@interop/wallet-core 0.16.0 → 0.17.1

package/dist/keys/pukRoster.d.ts

@@ -18,7 +18,7 @@
  *
  * A resource-hosted descriptor gets NONE of the server-side epoch invariants a
  * Collection Description enforces (append-only epochs, monotone
- * `currentEpoch`), so three client-side compensations are load-bearing alone
+ * `currentEpoch`), so four client-side compensations are load-bearing alone
  * against a tampering host:
  *
  * - **`epochsMac`** -- the epoch configuration is authenticated under the
@@ -38,10 +38,22 @@
  *   verification method is dropped and never receives a wrap, so a
  *   server-injected entry sits ignored. Wraps are minted only by enrolled
  *   clients, against log-verified keys.
+ * - **`epochsSig`** -- the epoch configuration is additionally SIGNED by the
+ *   writing client's enrolled Ed25519 key (`pukRosterEpochsSigner`), and a
+ *   read that adopts an epoch this client has not vouched for itself (a
+ *   rotated read, or a freshly enrolled client's first read) verifies that
+ *   signature against the locally verified did:webvh document
+ *   (`verifyPukRosterEpochsSig`). This is the check the `epochsMac` alone
+ *   cannot make on those paths: the MAC is keyed by a secret unwrapped from
+ *   the served descriptor itself, so a host that mints its own epoch, wraps
+ *   it to this client's world-readable key-agreement key, and MACs the
+ *   fabricated configuration under the same minted secret passes the MAC --
+ *   but it cannot produce a signature by a key the document backs.
  */
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
-import { type EncryptionDescriptorStore, type RecipientPublicKey } from '@interop/was-client/edv';
+import { type EncryptionDescriptorStore, type EpochsSigner, type RecipientPublicKey } from '@interop/was-client/edv';
+import { type ICapabilityAgent } from '../webvh/zcap.js';
 import type { Puk } from './puk.js';
 /**
  * Thrown when a served roster fails its client-side authentication: a
@@ -89,6 +101,41 @@ export interface RosterRecipientDocument {
         publicKeyMultibase?: string;
     }>;
 }
+/**
+ * The roster's epoch-configuration signer: signs each roster write's epoch
+ * configuration with this client's own Ed25519 signing key, under a `kid`
+ * that is the key's public multibase -- exactly the string enrolled as this
+ * client's verification method in the did:webvh document, so a reader
+ * resolves the signature against the document rather than anything the
+ * roster (or the server) supplies.
+ *
+ * @param options {object}
+ * @param options.keyAgent {ICapabilityAgent}   this client's signing key
+ *   agent (the `keyAgent` of `agentsFromSeed`)
+ * @returns {EpochsSigner}   the `signEpochs` hook for roster writes
+ */
+export declare function pukRosterEpochsSigner({ keyAgent }: {
+    keyAgent: ICapabilityAgent;
+}): EpochsSigner;
+/**
+ * Verifies a served roster's `epochsSig` against the locally verified
+ * did:webvh document -- the root of trust the server cannot mint. The
+ * signature must be present and supported, its `kid` must be the public
+ * multibase of one of the document's verification methods (an enrolled
+ * client's signing key), and it must verify over the canonical
+ * epoch-configuration payload. Throws {@link PukRosterIntegrityError}
+ * otherwise: a configuration no enrolled client signed.
+ *
+ * @param options {object}
+ * @param options.descriptor {CollectionEncryption}   the served roster
+ * @param options.document {RosterRecipientDocument}   the locally verified
+ *   did:webvh document (never a server-supplied roster field)
+ * @returns {Promise<void>}
+ */
+export declare function verifyPukRosterEpochsSig({ descriptor, document }: {
+    descriptor: CollectionEncryption;
+    document: RosterRecipientDocument;
+}): Promise<void>;
 /**
  * A wallet client's roster kid: its key-agreement key's id exactly as
  * `agentsFromSeed` derives it at the client's own logins
@@ -139,12 +186,16 @@ export declare function pukRosterRecipientResolver({ document }: {
  * @param options.puk {Puk}   the account's per-user key
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key -- the roster recipient
+ * @param options.signEpochs {EpochsSigner}   this client's epoch-configuration
+ *   signer ({@link pukRosterEpochsSigner}), so the first configuration is
+ *   vouched for by an enrollable key rather than only its own MAC
  * @returns {Promise<CollectionEncryption>}   the roster descriptor
  */
-export declare function ensurePukRoster({ store, puk, clientKeyAgreementKey }: {
+export declare function ensurePukRoster({ store, puk, clientKeyAgreementKey, signEpochs }: {
     store: EncryptionDescriptorStore;
     puk: Puk;
     clientKeyAgreementKey: IKeyAgreementKey;
+    signEpochs: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
  * Wraps the PUK to a client being enrolled -- the roster half of the
@@ -196,12 +247,16 @@ export declare function addPukRosterRecipient({ store, recipient, ownerKeyAgreem
  *   did:webvh document, AFTER the removal edit
  * @param options.retireRecipientId {string}   the removed recipient's roster
  *   kid
+ * @param options.signEpochs {EpochsSigner}   the rotating client's
+ *   epoch-configuration signer ({@link pukRosterEpochsSigner}), vouching for
+ *   the fresh epoch so other clients' rotated reads accept it
  * @returns {Promise<CollectionEncryption>}   the rotated roster descriptor
  */
-export declare function rotatePukRoster({ store, document, retireRecipientId }: {
+export declare function rotatePukRoster({ store, document, retireRecipientId, signEpochs }: {
     store: EncryptionDescriptorStore;
     document: RosterRecipientDocument;
     retireRecipientId: string;
+    signEpochs: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
  * Converges the roster onto the account document: the standing detector for a
@@ -237,14 +292,18 @@ export declare function rotatePukRoster({ store, document, retireRecipientId }:
  * @param [options.descriptor] {CollectionEncryption}   a descriptor the caller
  *   has just read (a login-time roster read), to save a re-read; omitted, the
  *   roster is read fresh
+ * @param options.signEpochs {EpochsSigner}   the converging client's
+ *   epoch-configuration signer ({@link pukRosterEpochsSigner}), for the
+ *   rotation this call may perform
  * @returns {Promise<object>}   whether the roster rotated on this call, the
  *   stale recipient kids found, and the roster descriptor as it now stands
  *   (`null` when the account has no roster yet)
  */
-export declare function convergePukRosterToDocument({ store, document, descriptor }: {
+export declare function convergePukRosterToDocument({ store, document, descriptor, signEpochs }: {
     store: EncryptionDescriptorStore;
     document: RosterRecipientDocument;
     descriptor?: CollectionEncryption;
+    signEpochs: EpochsSigner;
 }): Promise<{
     rotated: boolean;
     staleRecipientIds: string[];
@@ -274,7 +333,15 @@ export interface PukRosterReadResult {
  *    current; otherwise the current epoch was rotated by another client and
  *    this client's wrap is unwrapped with its own key-agreement key
  *    (`PukRosterUnwrapError` when it holds none).
- * 3. **Authentication**: the descriptor's `epochsMac` is verified under the
+ * 3. **Provenance** (the rotated/first-read path only): the epoch
+ *    configuration's `epochsSig` is verified against the locally verified
+ *    did:webvh document ({@link verifyPukRosterEpochsSig}) BEFORE the epoch
+ *    it delivers is adopted. On this path the `epochsMac` alone proves
+ *    nothing against the host -- its key is unwrapped from the served
+ *    descriptor itself -- so an epoch no enrolled client signed is refused
+ *    (`PukRosterIntegrityError`). The cached-current path needs no signature:
+ *    there the MAC is keyed by a secret this client already trusts.
+ * 4. **Authentication**: the descriptor's `epochsMac` is verified under the
  *    current epoch's secret (`PukRosterIntegrityError` on any mismatch -- a
  *    fabricated configuration).
  *
@@ -285,6 +352,10 @@ export interface PukRosterReadResult {
  * A caller with no cached PUK at all -- a freshly enrolled client making its
  * first post-enrollment read -- omits `puk` and always takes the unwrap path;
  * the result's `rotated` is then true (the PUK was adopted from the roster).
+ * Every unwrap-path caller must therefore supply the account document (or a
+ * way to resolve it): `document` when it already holds a verified copy, or
+ * `resolveDocument` to fetch-and-verify lazily, only when the read actually
+ * rotates.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
@@ -294,12 +365,19 @@ export interface PukRosterReadResult {
  *   (identity) key-agreement key, unwrapping a rotated epoch
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
  *   roster epoch, when this client has seen the roster before
+ * @param [options.document] {RosterRecipientDocument}   the locally verified
+ *   did:webvh document, when the caller already holds one
+ * @param [options.resolveDocument] {function}   resolves the locally verified
+ *   did:webvh document on demand; called only when the read takes the
+ *   rotated/first-read path
  * @returns {Promise<PukRosterReadResult | null>}
  */
-export declare function readPukRoster({ store, puk, clientKeyAgreementKey, pinnedEpochId }: {
+export declare function readPukRoster({ store, puk, clientKeyAgreementKey, pinnedEpochId, document, resolveDocument }: {
     store: EncryptionDescriptorStore;
     puk?: Puk;
     clientKeyAgreementKey: IKeyAgreementKey;
     pinnedEpochId?: string | null;
+    document?: RosterRecipientDocument;
+    resolveDocument?: () => Promise<RosterRecipientDocument>;
 }): Promise<PukRosterReadResult | null>;
 //# sourceMappingURL=pukRoster.d.ts.map

package/dist/keys/pukRoster.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pukRoster.d.ts","sourceRoot":"","sources":["../../src/keys/pukRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAOL,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAEnC;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,aAAa,EAAE,MAAM,CAAA;gBACT,EAAE,aAAa,EAAE,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;CAQzD;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EACzB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,uBAAuB,CAAA;CAClC,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAsCtD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,GAAG,EACH,qBAAqB,EACtB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,GAAG,EAAE,GAAG,CAAA;IACR,qBAAqB,EAAE,gBAAgB,CAAA;CACxC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAUhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,KAAK,EACL,SAAS,EACT,oBAAoB,EACrB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,oBAAoB,EAAE,gBAAgB,CAAA;CACvC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0BhC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,iBAAiB,EAClB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,KAAK,EACL,QAAQ,EACR,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,UAAU,CAAC,EAAE,oBAAoB,CAAA;CAClC,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAA;CACxC,CAAC,CAgDD;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,oBAAoB,CAAA;IAChC,GAAG,EAAE,GAAG,CAAA;IACR,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,aAAa,CAAC,EAClC,KAAK,EACL,GAAG,EACH,qBAAqB,EACrB,aAAa,EACd,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA0EtC"}
+{"version":3,"file":"pukRoster.d.ts","sourceRoot":"","sources":["../../src/keys/pukRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAQL,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAEnC;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,aAAa,EAAE,MAAM,CAAA;gBACT,EAAE,aAAa,EAAE,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;CAQzD;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E,kBAAkB,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACzE;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,YAAY,CAgBf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,UAAU,EACV,QAAQ,EACT,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EACzB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAgBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,uBAAuB,CAAA;CAClC,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAsCtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,GAAG,EACH,qBAAqB,EACrB,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,GAAG,EAAE,GAAG,CAAA;IACR,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,UAAU,EAAE,YAAY,CAAA;CACzB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,KAAK,EACL,SAAS,EACT,oBAAoB,EACrB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,oBAAoB,EAAE,gBAAgB,CAAA;CACvC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0BhC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,iBAAiB,EAAE,MAAM,CAAA;IACzB,UAAU,EAAE,YAAY,CAAA;CACzB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAQhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,QAAQ,EAAE,uBAAuB,CAAA;IACjC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,YAAY,CAAA;CACzB,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAAA;CACxC,CAAC,CAiDD;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,oBAAoB,CAAA;IAChC,GAAG,EAAE,GAAG,CAAA;IACR,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAsB,aAAa,CAAC,EAClC,KAAK,EACL,GAAG,EACH,qBAAqB,EACrB,aAAa,EACb,QAAQ,EACR,eAAe,EAChB,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACzD,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA2FtC"}

package/dist/keys/pukRoster.js

@@ -1,4 +1,7 @@
-import { addRecipient, initRecipients, ownerRecipient, removeRecipient, unwrapEpochSecret, verifyEpochsMac } from '@interop/was-client/edv';
+import { addRecipient, epochsSigPayload, initRecipients, ownerRecipient, removeRecipient, unwrapEpochSecret, verifyEpochsMac } from '@interop/was-client/edv';
+import { Ed25519VerificationKey } from '@interop/ed25519-verification-key';
+import { base64urlnopad } from '@scure/base';
+import { clientSigningKeyMultibase } from '../webvh/zcap.js';
 /**
  * Thrown when a served roster fails its client-side authentication: a
  * missing/unsupported/invalid `epochsMac`, or a descriptor whose `currentEpoch`
@@ -39,6 +42,86 @@ export class PukRosterUnwrapError extends Error {
         this.name = 'PukRosterUnwrapError';
     }
 }
+/**
+ * The `epochsSig` construction this module mints and accepts: version 1,
+ * Ed25519 (`EdDSA`), `kid` the signer's public-key multibase (`z6Mk...`) --
+ * the same string that names the client's verification method in the
+ * did:webvh document.
+ */
+const EPOCHS_SIG_V = 1;
+const EPOCHS_SIG_ALG = 'EdDSA';
+/**
+ * The roster's epoch-configuration signer: signs each roster write's epoch
+ * configuration with this client's own Ed25519 signing key, under a `kid`
+ * that is the key's public multibase -- exactly the string enrolled as this
+ * client's verification method in the did:webvh document, so a reader
+ * resolves the signature against the document rather than anything the
+ * roster (or the server) supplies.
+ *
+ * @param options {object}
+ * @param options.keyAgent {ICapabilityAgent}   this client's signing key
+ *   agent (the `keyAgent` of `agentsFromSeed`)
+ * @returns {EpochsSigner}   the `signEpochs` hook for roster writes
+ */
+export function pukRosterEpochsSigner({ keyAgent }) {
+    const kid = clientSigningKeyMultibase({ keyAgent });
+    const signer = keyAgent.getSigner();
+    return async function signEpochs({ payload }) {
+        const signature = await signer.sign({ data: payload });
+        return {
+            v: EPOCHS_SIG_V,
+            alg: EPOCHS_SIG_ALG,
+            kid,
+            sig: base64urlnopad.encode(signature)
+        };
+    };
+}
+/**
+ * Verifies a served roster's `epochsSig` against the locally verified
+ * did:webvh document -- the root of trust the server cannot mint. The
+ * signature must be present and supported, its `kid` must be the public
+ * multibase of one of the document's verification methods (an enrolled
+ * client's signing key), and it must verify over the canonical
+ * epoch-configuration payload. Throws {@link PukRosterIntegrityError}
+ * otherwise: a configuration no enrolled client signed.
+ *
+ * @param options {object}
+ * @param options.descriptor {CollectionEncryption}   the served roster
+ * @param options.document {RosterRecipientDocument}   the locally verified
+ *   did:webvh document (never a server-supplied roster field)
+ * @returns {Promise<void>}
+ */
+export async function verifyPukRosterEpochsSig({ descriptor, document }) {
+    const epochsSig = descriptor.epochsSig;
+    if (!epochsSig ||
+        epochsSig.v !== EPOCHS_SIG_V ||
+        epochsSig.alg !== EPOCHS_SIG_ALG) {
+        throw new PukRosterIntegrityError('The PUK roster carries no supported epoch-configuration signature.');
+    }
+    const backed = (document.verificationMethod ?? []).some(method => method.publicKeyMultibase === epochsSig.kid);
+    if (!backed) {
+        throw new PukRosterIntegrityError('The PUK roster epoch configuration is signed by a key the account ' +
+            'document does not back.');
+    }
+    let signature;
+    try {
+        signature = base64urlnopad.decode(epochsSig.sig);
+    }
+    catch {
+        throw new PukRosterIntegrityError('The PUK roster epoch-configuration signature is malformed.');
+    }
+    const verifier = new Ed25519VerificationKey({
+        controller: `did:key:${epochsSig.kid}`,
+        publicKeyMultibase: epochsSig.kid
+    }).verifier();
+    const verified = await verifier.verify({
+        data: epochsSigPayload(descriptor),
+        signature
+    });
+    if (!verified) {
+        throw new PukRosterIntegrityError('The PUK roster epoch-configuration signature failed verification.');
+    }
+}
 /**
  * A wallet client's roster kid: its key-agreement key's id exactly as
  * `agentsFromSeed` derives it at the client's own logins
@@ -129,9 +212,12 @@ export function pukRosterRecipientResolver({ document }) {
  * @param options.puk {Puk}   the account's per-user key
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key -- the roster recipient
+ * @param options.signEpochs {EpochsSigner}   this client's epoch-configuration
+ *   signer ({@link pukRosterEpochsSigner}), so the first configuration is
+ *   vouched for by an enrollable key rather than only its own MAC
  * @returns {Promise<CollectionEncryption>}   the roster descriptor
  */
-export async function ensurePukRoster({ store, puk, clientKeyAgreementKey }) {
+export async function ensurePukRoster({ store, puk, clientKeyAgreementKey, signEpochs }) {
     const current = await store.read();
     if (current !== null) {
         return current.descriptor;
@@ -139,7 +225,8 @@ export async function ensurePukRoster({ store, puk, clientKeyAgreementKey }) {
     return initRecipients({
         store,
         recipients: [ownerRecipient({ keyAgreementKey: clientKeyAgreementKey })],
-        epoch: { epochId: puk.id, secret: puk.secret }
+        epoch: { epochId: puk.id, secret: puk.secret },
+        signEpochs
     });
 }
 /**
@@ -208,14 +295,18 @@ export async function addPukRosterRecipient({ store, recipient, ownerKeyAgreemen
  *   did:webvh document, AFTER the removal edit
  * @param options.retireRecipientId {string}   the removed recipient's roster
  *   kid
+ * @param options.signEpochs {EpochsSigner}   the rotating client's
+ *   epoch-configuration signer ({@link pukRosterEpochsSigner}), vouching for
+ *   the fresh epoch so other clients' rotated reads accept it
  * @returns {Promise<CollectionEncryption>}   the rotated roster descriptor
  */
-export async function rotatePukRoster({ store, document, retireRecipientId }) {
+export async function rotatePukRoster({ store, document, retireRecipientId, signEpochs }) {
     return removeRecipient({
         store,
         recipientId: retireRecipientId,
         resolveRecipientKey: pukRosterRecipientResolver({ document }),
-        pull: async () => { }
+        pull: async () => { },
+        signEpochs
     });
 }
 /**
@@ -252,11 +343,14 @@ export async function rotatePukRoster({ store, document, retireRecipientId }) {
  * @param [options.descriptor] {CollectionEncryption}   a descriptor the caller
  *   has just read (a login-time roster read), to save a re-read; omitted, the
  *   roster is read fresh
+ * @param options.signEpochs {EpochsSigner}   the converging client's
+ *   epoch-configuration signer ({@link pukRosterEpochsSigner}), for the
+ *   rotation this call may perform
  * @returns {Promise<object>}   whether the roster rotated on this call, the
  *   stale recipient kids found, and the roster descriptor as it now stands
  *   (`null` when the account has no roster yet)
  */
-export async function convergePukRosterToDocument({ store, document, descriptor }) {
+export async function convergePukRosterToDocument({ store, document, descriptor, signEpochs }) {
     let roster = descriptor;
     if (!roster) {
         const read = await store.read();
@@ -294,7 +388,8 @@ export async function convergePukRosterToDocument({ store, document, descriptor
     const rotated = await rotatePukRoster({
         store,
         document,
-        retireRecipientId: staleRecipientIds[0]
+        retireRecipientId: staleRecipientIds[0],
+        signEpochs
     });
     return { rotated: true, staleRecipientIds, descriptor: rotated };
 }
@@ -310,7 +405,15 @@ export async function convergePukRosterToDocument({ store, document, descriptor
  *    current; otherwise the current epoch was rotated by another client and
  *    this client's wrap is unwrapped with its own key-agreement key
  *    (`PukRosterUnwrapError` when it holds none).
- * 3. **Authentication**: the descriptor's `epochsMac` is verified under the
+ * 3. **Provenance** (the rotated/first-read path only): the epoch
+ *    configuration's `epochsSig` is verified against the locally verified
+ *    did:webvh document ({@link verifyPukRosterEpochsSig}) BEFORE the epoch
+ *    it delivers is adopted. On this path the `epochsMac` alone proves
+ *    nothing against the host -- its key is unwrapped from the served
+ *    descriptor itself -- so an epoch no enrolled client signed is refused
+ *    (`PukRosterIntegrityError`). The cached-current path needs no signature:
+ *    there the MAC is keyed by a secret this client already trusts.
+ * 4. **Authentication**: the descriptor's `epochsMac` is verified under the
  *    current epoch's secret (`PukRosterIntegrityError` on any mismatch -- a
  *    fabricated configuration).
  *
@@ -321,6 +424,10 @@ export async function convergePukRosterToDocument({ store, document, descriptor
  * A caller with no cached PUK at all -- a freshly enrolled client making its
  * first post-enrollment read -- omits `puk` and always takes the unwrap path;
  * the result's `rotated` is then true (the PUK was adopted from the roster).
+ * Every unwrap-path caller must therefore supply the account document (or a
+ * way to resolve it): `document` when it already holds a verified copy, or
+ * `resolveDocument` to fetch-and-verify lazily, only when the read actually
+ * rotates.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
@@ -330,9 +437,14 @@ export async function convergePukRosterToDocument({ store, document, descriptor
  *   (identity) key-agreement key, unwrapping a rotated epoch
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
  *   roster epoch, when this client has seen the roster before
+ * @param [options.document] {RosterRecipientDocument}   the locally verified
+ *   did:webvh document, when the caller already holds one
+ * @param [options.resolveDocument] {function}   resolves the locally verified
+ *   did:webvh document on demand; called only when the read takes the
+ *   rotated/first-read path
  * @returns {Promise<PukRosterReadResult | null>}
  */
-export async function readPukRoster({ store, puk, clientKeyAgreementKey, pinnedEpochId }) {
+export async function readPukRoster({ store, puk, clientKeyAgreementKey, pinnedEpochId, document, resolveDocument }) {
     const current = await store.read();
     if (current === null) {
         return null;
@@ -363,8 +475,21 @@ export async function readPukRoster({ store, puk, clientKeyAgreementKey, pinnedE
         rotated = false;
     }
     else {
-        // Rotated by another client: unwrap this client's entry in the current
-        // epoch with its own key-agreement key (rotation delivery).
+        // Rotated by another client (or this client's first read): before
+        // adopting the delivered epoch, trace it to a root of trust the server
+        // cannot mint -- the epoch configuration must be signed by a key the
+        // locally verified account document backs. The epochsMac below cannot
+        // carry this: on this path its key comes out of the served descriptor
+        // itself.
+        const accountDocument = document ?? (resolveDocument ? await resolveDocument() : undefined);
+        if (!accountDocument) {
+            throw new Error('A PUK roster read that adopts an epoch from the roster needs the ' +
+                'account document (pass `document` or `resolveDocument`) to verify ' +
+                'the epoch configuration signature.');
+        }
+        await verifyPukRosterEpochsSig({ descriptor, document: accountDocument });
+        // Unwrap this client's entry in the current epoch with its own
+        // key-agreement key (rotation delivery).
         const entry = descriptor.epochs[currentIndex].recipients.find(recipient => recipient.header.kid === clientKeyAgreementKey.id);
         if (!entry) {
             throw new PukRosterUnwrapError('The PUK roster current epoch carries no wrap for this client.');

package/dist/keys/pukRoster.js.map

@@ -1 +1 @@
-{"version":3,"file":"pukRoster.js","sourceRoot":"","sources":["../../src/keys/pukRoster.ts"],"names":[],"mappings":"AA2CA,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,eAAe,EAGhB,MAAM,yBAAyB,CAAA;AAGhC;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,aAAa,CAAQ;IACrB,YAAY,EAAE,aAAa,EAA6B;QACtD,KAAK,CACH,uEAAuE;YACrE,mCAAmC,CACtC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QACtC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAYD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EAIzB;IACC,OAAO,WAAW,mBAAmB,IAAI,wBAAwB,EAAE,CAAA;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,EAAU;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,QAAQ,EAGT;IACC,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwD,CAAA;IAC5E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACvD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,mBAAmB,GAGpB,EAAE,CAAA;IACP,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAW;QAEX,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CACpC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,kBAAkB,KAAK,QAAQ;YACtC,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC5B,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,CACjD,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oEAAoE;YACpE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAmB,EAAE,CAAA;IACnE,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,GAAG,EACH,qBAAqB,EAKtB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,UAAU,CAAA;IAC3B,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;KAC/C,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,KAAK,EACL,SAAS,EACT,oBAAoB,EAKrB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,+CAA+C,CAClD,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;IACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAC3C,CAAA;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,wEAAwE;QACxE,mEAAmE;QACnE,6CAA6C;QAC7C,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,KAAK;QACL,SAAS;QACT,KAAK,EAAE,EAAE,eAAe,EAAE,oBAAoB,EAAE;KACjD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,iBAAiB,EAKlB;IACC,OAAO,eAAe,CAAC;QACrB,KAAK;QACL,WAAW,EAAE,iBAAiB;QAC9B,mBAAmB,EAAE,0BAA0B,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC7D,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KACrB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,KAAK,EACL,QAAQ,EACR,UAAU,EAKX;IAKC,IAAI,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACpE,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAA;IAC1B,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAA;IAC1C,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,cAAc,CACrC,CAAA;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D,CAC/D,CAAA;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpE,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAC5B,IAAI,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,qEAAqE;YACnE,mCAAmC,CACtC,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAE;KACzC,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAClE,CAAC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,KAAK,EACL,GAAG,EACH,qBAAqB,EACrB,aAAa,EAMd;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IAErC,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACjE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY;QAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,CAAA;IACN,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;YACrD,MAAM,IAAI,wBAAwB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D,CAC/D,CAAA;IACH,CAAC;IAED,IAAI,UAAe,CAAA;IACnB,IAAI,OAAgB,CAAA;IACpB,IAAI,GAAG,IAAI,UAAU,CAAC,YAAY,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;QAC9C,UAAU,GAAG,GAAG,CAAA;QAChB,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAO,CAAC,YAAY,CAAE,CAAC,UAAU,CAAC,IAAI,CAC7D,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,CAC/D,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oBAAoB,CAC5B,+DAA+D,CAChE,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,KAAK;YACL,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,oBAAoB,CAC5B,kDAAkD,CACnD,CAAA;QACH,CAAC;QACD,UAAU,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,YAAa,EAAE,MAAM,EAAE,CAAA;QACrD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,IACE,CAAC,CAAC,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,2DAA2D,CAC5D,CAAA;IACH,CAAC;IAED,OAAO;QACL,UAAU;QACV,GAAG,EAAE,UAAU;QACf,OAAO;QACP,aAAa,EAAE,UAAU,CAAC,YAAa;KACxC,CAAA;AACH,CAAC"}
+{"version":3,"file":"pukRoster.js","sourceRoot":"","sources":["../../src/keys/pukRoster.ts"],"names":[],"mappings":"AAyDA,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,eAAe,EAIhB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EACL,yBAAyB,EAE1B,MAAM,kBAAkB,CAAA;AAGzB;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,aAAa,CAAQ;IACrB,YAAY,EAAE,aAAa,EAA6B;QACtD,KAAK,CACH,uEAAuE;YACrE,mCAAmC,CACtC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;QACtC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAYD;;;;;GAKG;AACH,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,cAAc,GAAG,OAAO,CAAA;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EAGT;IACC,MAAM,GAAG,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,OAAO,KAAK,UAAU,UAAU,CAAC,EAC/B,OAAO,EAGR;QACC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QACtD,OAAO;YACL,CAAC,EAAE,YAAY;YACf,GAAG,EAAE,cAAc;YACnB,GAAG;YACH,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;SACtC,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,UAAU,EACV,QAAQ,EAIT;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IACE,CAAC,SAAS;QACV,SAAS,CAAC,CAAC,KAAK,YAAY;QAC5B,SAAS,CAAC,GAAG,KAAK,cAAc,EAChC,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,oEAAoE,CACrE,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC,GAAG,CACtD,CAAA;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,uBAAuB,CAC/B,oEAAoE;YAClE,yBAAyB,CAC5B,CAAA;IACH,CAAC;IACD,IAAI,SAAqB,CAAA;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAC/B,4DAA4D,CAC7D,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,sBAAsB,CAAC;QAC1C,UAAU,EAAE,WAAW,SAAS,CAAC,GAAG,EAAE;QACtC,kBAAkB,EAAE,SAAS,CAAC,GAAG;KAClC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACb,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACrC,IAAI,EAAE,gBAAgB,CAAC,UAAU,CAAC;QAClC,SAAS;KACV,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE,CACpE,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EAIzB;IACC,OAAO,WAAW,mBAAmB,IAAI,wBAAwB,EAAE,CAAA;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,EAAU;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,QAAQ,EAGT;IACC,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwD,CAAA;IAC5E,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QACvD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,mBAAmB,GAGpB,EAAE,CAAA;IACP,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAW;QAEX,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CACpC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,kBAAkB,KAAK,QAAQ;YACtC,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBAC5B,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,CACjD,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oEAAoE;YACpE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAmB,EAAE,CAAA;IACnE,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,GAAG,EACH,qBAAqB,EACrB,UAAU,EAMX;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,UAAU,CAAA;IAC3B,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;QAC9C,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,KAAK,EACL,SAAS,EACT,oBAAoB,EAKrB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,+CAA+C,CAClD,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;IACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAC3C,CAAA;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,wEAAwE;QACxE,mEAAmE;QACnE,6CAA6C;QAC7C,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,KAAK;QACL,SAAS;QACT,KAAK,EAAE,EAAE,eAAe,EAAE,oBAAoB,EAAE;KACjD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,UAAU,EAMX;IACC,OAAO,eAAe,CAAC;QACrB,KAAK;QACL,WAAW,EAAE,iBAAiB;QAC9B,mBAAmB,EAAE,0BAA0B,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC7D,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACpB,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,KAAK,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EAMX;IAKC,IAAI,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACpE,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAA;IAC1B,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAA;IAC1C,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,cAAc,CACrC,CAAA;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D,CAC/D,CAAA;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpE,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAC5B,IAAI,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,uBAAuB,CAC/B,qEAAqE;YACnE,mCAAmC,CACtC,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAE;QACxC,UAAU;KACX,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAClE,CAAC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,KAAK,EACL,GAAG,EACH,qBAAqB,EACrB,aAAa,EACb,QAAQ,EACR,eAAe,EAQhB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IAErC,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACjE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY;QAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,CAAA;IACN,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;YACrD,MAAM,IAAI,wBAAwB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D,CAC/D,CAAA;IACH,CAAC;IAED,IAAI,UAAe,CAAA;IACnB,IAAI,OAAgB,CAAA;IACpB,IAAI,GAAG,IAAI,UAAU,CAAC,YAAY,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;QAC9C,UAAU,GAAG,GAAG,CAAA;QAChB,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,kEAAkE;QAClE,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,UAAU;QACV,MAAM,eAAe,GACnB,QAAQ,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACrE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,mEAAmE;gBACjE,oEAAoE;gBACpE,oCAAoC,CACvC,CAAA;QACH,CAAC;QACD,MAAM,wBAAwB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAA;QAEzE,+DAA+D;QAC/D,yCAAyC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAO,CAAC,YAAY,CAAE,CAAC,UAAU,CAAC,IAAI,CAC7D,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,CAC/D,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oBAAoB,CAC5B,+DAA+D,CAChE,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,KAAK;YACL,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,oBAAoB,CAC5B,kDAAkD,CACnD,CAAA;QACH,CAAC;QACD,UAAU,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,YAAa,EAAE,MAAM,EAAE,CAAA;QACrD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,IACE,CAAC,CAAC,MAAM,eAAe,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,2DAA2D,CAC5D,CAAA;IACH,CAAC;IAED,OAAO;QACL,UAAU;QACV,GAAG,EAAE,UAAU;QACf,OAAO;QACP,aAAa,EAAE,UAAU,CAAC,YAAa;KACxC,CAAA;AACH,CAAC"}

package/dist/request/classify.d.ts

@@ -14,6 +14,17 @@
  */
 import type { CHAPIStoreEvent, ICapabilityQueryDetail, ICredentialQuery, IQueryByExample, IVPOffer, IVPRequest, IVPRDetails, IVPRQuery, IVerifiableCredential, IVerifiablePresentation, WalletRequestProfile } from './types.js';
 import type { CHAPIGetEvent } from './types.js';
+/**
+ * The VC data model version a presentation carrying the given credentials must
+ * use, so its `@context` stays coherent with what it carries: `2.0` when any
+ * credential is a VC 2.0 one, else `1.0`. Shared by the bare-credential
+ * wrapping below and by the unsigned branch of `composeVp` (the signed branch
+ * takes its version from the negotiated cryptosuite instead).
+ *
+ * @param credentials {IVerifiableCredential[]}
+ * @returns {number}
+ */
+export declare function presentationVersionFor(credentials: IVerifiableCredential[]): number;
 /**
  * The Verifiable Credentials carried by a presentation, normalized to an array.
  *
@@ -103,7 +114,10 @@ export declare function isDidAuthOnly(profile: WalletRequestProfile): boolean;
 /**
  * Returns true if the wallet can satisfy the DID method a `DIDAuthentication`
  * query constrains to. A wallet holding only `did:key` can satisfy a request
- * that lists `key` among `acceptedMethods` or omits the constraint entirely.
+ * that lists `key` among `acceptedMethods` or omits the constraint entirely. A
+ * malformed `acceptedMethods` (not an array, or holding non-object entries) is
+ * read for the entries it does have rather than dereferenced blindly: an
+ * `acceptedMethods` that is not a list of constraints at all imposes none.
  *
  * @param queries {IVPRQuery[]}
  * @returns {boolean}

package/dist/request/classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAEhB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,uBAAuB,EAEvB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA4D/C;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,uBAAuB,GACpC,qBAAqB,EAAE,CAQzB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAYtE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;CACrB,GAAG,OAAO,CAMV;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,EAAE,CAS3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,GACrB,gBAAgB,EAAE,CAMpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAoB5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAS1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAMpE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAQpE"}
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAEhB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,uBAAuB,EAEvB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO/C;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,qBAAqB,EAAE,GACnC,MAAM,CAOR;AA0DD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,uBAAuB,GACpC,qBAAqB,EAAE,CAQzB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAYtE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;CACrB,GAAG,OAAO,CAQV;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,EAAE,CAS3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,GACrB,gBAAgB,EAAE,CAMpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAoB5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAS1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAMpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAQpE"}

package/dist/request/classify.js

@@ -1,6 +1,25 @@
 import { typeArray } from '@interop/data-integrity-core/guards';
+import { asRecord } from '../display/text.js';
 const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
 const VC_2_CONTEXT_URL = 'https://www.w3.org/ns/credentials/v2';
+/**
+ * The VC data model version a presentation carrying the given credentials must
+ * use, so its `@context` stays coherent with what it carries: `2.0` when any
+ * credential is a VC 2.0 one, else `1.0`. Shared by the bare-credential
+ * wrapping below and by the unsigned branch of `composeVp` (the signed branch
+ * takes its version from the negotiated cryptosuite instead).
+ *
+ * @param credentials {IVerifiableCredential[]}
+ * @returns {number}
+ */
+export function presentationVersionFor(credentials) {
+    const isV2 = credentials.some(credential => {
+        const contexts = credential?.['@context'];
+        const contextArray = Array.isArray(contexts) ? contexts : [contexts];
+        return contextArray.includes(VC_2_CONTEXT_URL);
+    });
+    return isV2 ? 2.0 : 1.0;
+}
 /**
  * Wraps a bare Verifiable Credential in an unsigned Verifiable Presentation,
  * matching the credential's VC data model version so the presentation's
@@ -10,9 +29,7 @@ const VC_2_CONTEXT_URL = 'https://www.w3.org/ns/credentials/v2';
  * @returns {IVerifiablePresentation}
  */
 function presentationWrapping(credential) {
-    const contexts = credential['@context'];
-    const contextArray = Array.isArray(contexts) ? contexts : [contexts];
-    const isV2 = contextArray.includes(VC_2_CONTEXT_URL);
+    const isV2 = presentationVersionFor([credential]) === 2.0;
     return {
         '@context': [isV2 ? VC_2_CONTEXT_URL : VC_1_CONTEXT_URL],
         type: ['VerifiablePresentation'],
@@ -22,21 +39,25 @@ function presentationWrapping(credential) {
 /**
  * The offered payload as a Verifiable Presentation: passed through when the
  * issuer already offered one, and wrapped when it offered a bare Verifiable
- * Credential.
+ * Credential. A `data` payload that is not an object at all is unrecognized,
+ * and reported with the same descriptive error as an unrecognized object.
  *
  * @param credential {CHAPIStoreEvent['credential']}
  * @returns {IVerifiablePresentation}
  */
 function offeredPresentation({ dataType, data }) {
-    const types = typeArray(data?.type);
-    const isPresentation = dataType === 'VerifiablePresentation' ||
-        types.includes('VerifiablePresentation') ||
-        'verifiableCredential' in (data ?? {});
+    const payload = asRecord(data);
+    const types = typeArray(payload?.type);
+    const isPresentation = !!payload &&
+        (dataType === 'VerifiablePresentation' ||
+            types.includes('VerifiablePresentation') ||
+            'verifiableCredential' in payload);
     if (isPresentation) {
         return data;
     }
-    if (dataType === 'VerifiableCredential' ||
-        types.includes('VerifiableCredential')) {
+    if (payload &&
+        (dataType === 'VerifiableCredential' ||
+            types.includes('VerifiableCredential'))) {
         return presentationWrapping(data);
     }
     throw new Error(`CHAPI store event offered an unrecognized payload (dataType: ${dataType ?? 'undefined'}, type: ${JSON.stringify(types)}).`);
@@ -94,7 +115,7 @@ export function classifyCHAPIStoreEvent(event) {
  * @returns {boolean}
  */
 export function isDIDAuthRequested({ queries }) {
-    const didAuthRequests = queries.filter(q => q.type === 'DIDAuthentication');
+    const didAuthRequests = queries.filter(query => query.type === 'DIDAuthentication');
     if (didAuthRequests.length > 1) {
         throw new Error('More than one DIDAuthentication request found, exiting.');
     }
@@ -194,7 +215,10 @@ export function isDidAuthOnly(profile) {
 /**
  * Returns true if the wallet can satisfy the DID method a `DIDAuthentication`
  * query constrains to. A wallet holding only `did:key` can satisfy a request
- * that lists `key` among `acceptedMethods` or omits the constraint entirely.
+ * that lists `key` among `acceptedMethods` or omits the constraint entirely. A
+ * malformed `acceptedMethods` (not an array, or holding non-object entries) is
+ * read for the entries it does have rather than dereferenced blindly: an
+ * `acceptedMethods` that is not a list of constraints at all imposes none.
  *
  * @param queries {IVPRQuery[]}
  * @returns {boolean}
@@ -202,9 +226,9 @@ export function isDidAuthOnly(profile) {
 export function didAuthMethodSupported(queries) {
     const didAuth = queries.find(query => query.type === 'DIDAuthentication');
     const acceptedMethods = didAuth?.acceptedMethods;
-    if (!acceptedMethods || acceptedMethods.length === 0) {
+    if (!Array.isArray(acceptedMethods) || acceptedMethods.length === 0) {
         return true;
     }
-    return acceptedMethods.some(({ method }) => method === 'key');
+    return acceptedMethods.some(entry => asRecord(entry)?.method === 'key');
 }
 //# sourceMappingURL=classify.js.map

package/dist/request/classify.js.map

@@ -1 +1 @@
-{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAE/D,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AACjE,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAE/D;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,UAAiC;IAEjC,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IACvC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACpE,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IACpD,OAAO;QACL,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,CAAC,UAAU,CAAC;KACR,CAAA;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,IAAI,EAC0B;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAE,IAA2B,EAAE,IAAI,CAAC,CAAA;IAC3D,MAAM,cAAc,GAClB,QAAQ,KAAK,wBAAwB;QACrC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACxC,sBAAsB,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IACxC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAA+B,CAAA;IACxC,CAAC;IACD,IACE,QAAQ,KAAK,sBAAsB;QACnC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EACtC,CAAC;QACD,OAAO,oBAAoB,CAAC,IAA6B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gEACE,QAAQ,IAAI,WACd,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAqC;IAErC,MAAM,EAAE,oBAAoB,EAAE,GAAG,YAAY,CAAA;IAC7C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACxC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,MAAM,6BAA6B,GACjC,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,CAAA;IAC7D,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,6BAA6B;QAC7B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,OAAO;QACL,sBAAsB,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAA;IAC3E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAsB,EAAE,CAC5B,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACzD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsB;IAEtB,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;IACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO;SACX,MAAM,CACL,CAAC,KAAK,EAAuB,EAAE,CAC7B,KAAK,CAAC,IAAI,KAAK,8BAA8B;QAC7C,KAAK,CAAC,IAAI,KAAK,WAAW,CAC7B;SACA,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;QACrB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,gDAAgD,CAC3D,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,MAAM,CACvB,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CACrE;QACD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC;KACrC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,OAAO,CACL,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAClC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CACnC,CAAA;IACrC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;IAChD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AACjE,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAoC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACzC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACpE,OAAO,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,UAAiC;IAEjC,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,CAAC,UAAU,CAAC;KACR,CAAA;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,IAAI,EAC0B;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,cAAc,GAClB,CAAC,CAAC,OAAO;QACT,CAAC,QAAQ,KAAK,wBAAwB;YACpC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACxC,sBAAsB,IAAI,OAAO,CAAC,CAAA;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAA+B,CAAA;IACxC,CAAC;IACD,IACE,OAAO;QACP,CAAC,QAAQ,KAAK,sBAAsB;YAClC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,oBAAoB,CAAC,IAA6B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gEACE,QAAQ,IAAI,WACd,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAqC;IAErC,MAAM,EAAE,oBAAoB,EAAE,GAAG,YAAY,CAAA;IAC7C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACxC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,MAAM,6BAA6B,GACjC,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,CAAA;IAC7D,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,6BAA6B;QAC7B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,OAAO;QACL,sBAAsB,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAC5C,CAAA;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAsB,EAAE,CAC5B,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACzD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsB;IAEtB,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;IACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO;SACX,MAAM,CACL,CAAC,KAAK,EAAuB,EAAE,CAC7B,KAAK,CAAC,IAAI,KAAK,8BAA8B;QAC7C,KAAK,CAAC,IAAI,KAAK,WAAW,CAC7B;SACA,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;QACrB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,gDAAgD,CAC3D,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,MAAM,CACvB,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CACrE;QACD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC;KACrC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,OAAO,CACL,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAClC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CACnC,CAAA;IACrC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,KAAK,CAAC,CAAA;AACzE,CAAC"}

package/dist/request/composeVp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composeVp.d.ts","sourceRoot":"","sources":["../../src/request/composeVp.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAEnE,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,EACL,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAEnB;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,eAEnB,CAAA;AAwGV;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,kBAAkB,EAClB,WAAgB,EAChB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,KAAU,EACV,UAAU,EACV,YAAqC,EACrC,cAAc,EAAE,MAAuB,EACxC,EAAE;IACD,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;IACf,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAuDnC;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,kBAAY,CAAA"}
+{"version":3,"file":"composeVp.d.ts","sourceRoot":"","sources":["../../src/request/composeVp.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAGnE,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,EACL,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAEnB;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,eAEnB,CAAA;AA4GV;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,kBAAkB,EAClB,WAAgB,EAChB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,KAAU,EACV,UAAU,EACV,YAAqC,EACrC,cAAc,EAAE,MAAuB,EACxC,EAAE;IACD,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;IACf,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAyDnC;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,kBAAY,CAAA"}