@interop/wallet-core 0.39.0 → 0.41.0

package/dist/keyring/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAExE,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,YAAY,EACZ,YAAY,EACb,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/keyring/index.js

@@ -11,12 +11,19 @@
  *   unchanged where WebCrypto's `deriveBits` is unavailable) and the unlock
  *   Space addressing convention.
  * - `wrapKeyringRecord` / `unwrapKeyringRecord` -- the
- *   `{ version, encryption, wrapped }` account-pointer record codec.
- * - `mintRecordEncryption` / `recordCipher` / `parseRecordFrame` -- the
- *   record-own-epoch envelope construction the codec seals with plus the frame
- *   validation it opens with, exported so an app's own locally stored records
- *   seal and unseal the same way (under their own cipher context) rather than
- *   re-deriving the construction.
+ *   `{ version, encryption, wrapped, proof }` account-pointer record codec.
+ * - `recordSignerFromAgent` / `signRecordFrame` / `verifyRecordProof` /
+ *   `RecordProofError` -- the record's authenticity layer: the proof over the
+ *   frame members by the unlock identity's signing key, verified before any
+ *   decryption, so a storage host cannot substitute a record it sealed itself.
+ * - `mintRecordEncryption` / `recordSealCipher` / `recordCipher` /
+ *   `parseRecordFrame` / `parseRecordCreatedAt` / `recordCreatedAtStamp` --
+ *   the record-own-epoch envelope construction the codec seals with (the seal
+ *   cipher is encrypt-only, so sealing needs no key-agreement secret) plus
+ *   the frame and plaintext validation it opens with,
+ *   exported so an app's own locally stored records seal and unseal the same
+ *   way (under their own cipher context) rather than re-deriving the
+ *   construction.
  * - `ensureUnlockSpace` / `getUnlockKeyring` / `putUnlockKeyring` /
  *   `deleteUnlockSpace` / `deleteUnlockSpaceWithCapability` -- the unlock
  *   Space's lifecycle and its one resource.
@@ -27,7 +34,7 @@
  * was-client dependency graph (the same isolation pattern as `./identity`).
  */
 export { deriveUnlockIdentity, KEYRING_KDF, UNLOCK_HANDLE, UNLOCK_KEY_NAME, unlockSpaceIdFor } from './kdf.js';
-export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordFrame, parseRecordPointer, recordCipher, unwrapKeyringRecord, wrapKeyringRecord } from './record.js';
-export { deleteUnlockSpace, deleteUnlockSpaceWithCapability, ensureUnlockSpace, getUnlockKeyring, putUnlockKeyring, putUnlockKeyringWithCapability, UNLOCK_SPACE_NAME } from './unlockSpace.js';
+export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, RecordProofError, recordProofKeyMultibase, recordSealCipher, recordSignerFromAgent, signRecordFrame, unwrapKeyringRecord, verifyRecordProof, wrapKeyringRecord } from './record.js';
+export { deleteUnlockSpace, deleteUnlockSpaceWithCapability, ensureUnlockSpace, getUnlockKeyring, getUnlockKeyringWithCapability, putUnlockKeyring, putUnlockKeyringWithCapability, UNLOCK_SPACE_NAME } from './unlockSpace.js';
 export { fetchKeyringRecord } from './fetch.js';
 //# sourceMappingURL=index.js.map

package/dist/keyring/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAA;AAGjB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAA;AAGjB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AASpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/keyring/kdf.d.ts

@@ -64,7 +64,8 @@ export declare const KEYRING_KDF: UnlockKdf;
  * Derives the full unlock identity from an unlock secret: the unlock
  * CapabilityAgent, a ZcapClient that can both invoke and delegate (the
  * unlock agent delegates a management zcap on its own Space to the account
- * controller at bind time), the unlock KAK + resolver for wrap/unwrap, and the
+ * controller at bind time), the unlock KAK + resolver for wrap/unwrap, the
+ * record signer that signs and verifies the keyring record's proof, and the
  * unlock Space id. Performs no I/O -- the derivation seam for tests and future
  * unlock methods.
  *
@@ -81,6 +82,7 @@ export declare function deriveUnlockIdentity({ secret, kdf }: {
     zcapClient: ZcapClient;
     keyAgreementKey: X25519KeyAgreementKey2020;
     keyResolver: IKeyResolver;
+    recordSigner: import("./record.js").RecordSigner;
     spaceId: string;
 }>;
 /**

package/dist/keyring/kdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAOhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAQ3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,QAAQ,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,SAMzB,CAAA;AA2DD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf;;;;;;GAyBA;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAQhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAQ3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,QAAQ,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,SAMzB,CAAA;AA2DD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf;;;;;;;GAsCA;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAA"}

package/dist/keyring/kdf.js

@@ -24,6 +24,7 @@ import { hkdf } from '@noble/hashes/hkdf.js';
 import { pbkdf2Async } from '@noble/hashes/pbkdf2.js';
 import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import { singleKeyResolver } from '../identity/keyResolver.js';
+import { recordSignerFromAgent } from './record.js';
 /**
  * The load-bearing `CapabilityAgent` derivation names for an unlock identity
  * (the counterpart of the data identity's bootstrap names): every unlock
@@ -101,7 +102,8 @@ async function deriveUnlockSeed({ secret, kdf }) {
  * Derives the full unlock identity from an unlock secret: the unlock
  * CapabilityAgent, a ZcapClient that can both invoke and delegate (the
  * unlock agent delegates a management zcap on its own Space to the account
- * controller at bind time), the unlock KAK + resolver for wrap/unwrap, and the
+ * controller at bind time), the unlock KAK + resolver for wrap/unwrap, the
+ * record signer that signs and verifies the keyring record's proof, and the
  * unlock Space id. Performs no I/O -- the derivation seam for tests and future
  * unlock methods.
  *
@@ -130,8 +132,20 @@ export async function deriveUnlockIdentity({ secret, kdf }) {
         keyPair: agent.getVerificationKeyPair()
     });
     const keyResolver = singleKeyResolver({ keyAgreementKey });
+    // The record signer is the unlock signing key itself, named by its public
+    // multibase: the keyring record's proof is made and checked against a key
+    // that derives from the secret, so the storage host never holds it and a
+    // fresh client holds the verification prior by construction.
+    const recordSigner = recordSignerFromAgent({ keyAgent: agent });
     const spaceId = unlockSpaceIdFor({ did: agent.id });
-    return { agent, zcapClient, keyAgreementKey, keyResolver, spaceId };
+    return {
+        agent,
+        zcapClient,
+        keyAgreementKey,
+        keyResolver,
+        recordSigner,
+        spaceId
+    };
 }
 /**
  * The unlock Space id an unlock identity addresses:

package/dist/keyring/kdf.js.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAE9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAA;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAA;AAE3C;;;GAGG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAA;AA0B5B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,OAAO;IACnB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,8BAA8B;CACrC,CAAA;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,IAAI,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,gBAAgB,CAAC,EAC9B,MAAM,EACN,GAAG,EAIJ;IACC,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,WAAW,GACf,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YAC1C,CAAC,EAAE,GAAG,CAAC,UAAU;YACjB,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CACT,IAAI,EACJ,WAAW,EACX,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAClC,iBAAiB,CAClB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EAIJ;IACC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,eAAe;KACzB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;IAChC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IAEF,8EAA8E;IAC9E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,sBAAsB,EAAE;KACxC,CAAC,CAAA;IACJ,MAAM,WAAW,GAAiB,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAExE,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,GAAG,EAAmB;IACvD,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACrE,CAAC"}
+{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAA;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAA;AAE3C;;;GAGG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAA;AA0B5B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,OAAO;IACnB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,8BAA8B;CACrC,CAAA;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,IAAI,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,gBAAgB,CAAC,EAC9B,MAAM,EACN,GAAG,EAIJ;IACC,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,WAAW,GACf,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YAC1C,CAAC,EAAE,GAAG,CAAC,UAAU;YACjB,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CACT,IAAI,EACJ,WAAW,EACX,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAClC,iBAAiB,CAClB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EAIJ;IACC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,eAAe;KACzB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;IAChC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IAEF,8EAA8E;IAC9E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,sBAAsB,EAAE;KACxC,CAAC,CAAA;IACJ,MAAM,WAAW,GAAiB,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAExE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAE/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO;QACL,KAAK;QACL,UAAU;QACV,eAAe;QACf,WAAW;QACX,YAAY;QACZ,OAAO;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,GAAG,EAAmB;IACvD,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACrE,CAAC"}

package/dist/keyring/record.d.ts

@@ -1,31 +1,120 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+import type { CollectionEncryption } from '@interop/was-client';
+import { type DocCipher } from '@interop/was-client/edv';
+/**
+ * The version stamped on the stored `{ version, encryption, wrapped, proof }`
+ * keyring envelope: the signed record, whose envelope seals under the record's
+ * own key epoch (the `encryption` member) and whose sibling members carry a
+ * Data Integrity proof by the unlock identity's signing key. Any other version
+ * is refused as unusable -- such accounts are re-provisioned, not migrated.
+ */
+export declare const KEYRING_RECORD_VERSION = 2;
+/**
+ * The record signer's seam: the signing key's public multibase (which names
+ * the key in the proof's `verificationMethod`) and a raw detached-signature
+ * hook over it. Structurally the resource log's `ResourceLogSigner`, so one
+ * adapter feeds both, deliberately restated here rather than imported -- a
+ * record is not a log, and the keyring module keeps its own vocabulary.
+ */
+export interface RecordSigner {
+    keyMultibase: string;
+    sign(input: {
+        data: Uint8Array;
+    }): Promise<Uint8Array>;
+}
+/**
+ * The fixed proof shape a signed record carries: an eddsa-jcs-2022 Data
+ * Integrity proof over the record's sibling members, `assertionMethod`
+ * purpose, with the signing key named by a `did:key:<multibase>#<multibase>`
+ * verification method.
+ */
+export interface RecordProof {
+    type: 'DataIntegrityProof';
+    cryptosuite: 'eddsa-jcs-2022';
+    verificationMethod: string;
+    proofPurpose: 'assertionMethod';
+    created?: string;
+    proofValue: string;
+}
+/**
+ * A stored signed record: the frame members the proof secures, plus the proof
+ * itself.
+ */
+export interface SignedRecord {
+    version: number;
+    encryption: CollectionEncryption;
+    wrapped: unknown;
+    proof: RecordProof;
+}
+/**
+ * A record's proof is absent, malformed, signed by a key this client does not
+ * accept, or does not verify over the record's own members. Its own class,
+ * distinct from a decrypt failure or an unusable-version refusal: this is the
+ * refusal that says the storage host forged or tampered with the record, which
+ * an app maps to its own login copy.
  */
+export declare class RecordProofError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
 /**
- * The keyring record codec: the `{ version, encryption, wrapped }` envelope
- * stored as the one resource of an account's unlock Space. Its plaintext
- * carries the account controller, the email captured at bind time, and the
- * account pointer -- and deliberately no key material of any kind, so the
- * record locates an account without authorizing anything against it.
+ * Adapts a signing key agent (the unlock identity's `CapabilityAgent`, or an
+ * enrolled client's own key agent) to the record signer seam: the agent's
+ * did:key id supplies the public multibase, its signer the raw signature.
  *
- * The wrap is an EDV document envelope sealed under the record's own key
- * epoch: every EDV envelope seals to an epoch key, so the record carries its
- * one-epoch descriptor in its `encryption` member, epoch[0] wrapped to the
- * unlock key-agreement key. The record stays self-contained -- unlock KAK in,
- * contents out. The cipher's `keyring` collection context labels errors only
- * (the codec is agnostic to it); what keeps a swapped-in foreign record from
- * being accepted is the contents validation on unwrap, not the cipher.
+ * @param options {object}
+ * @param options.keyAgent {object}   a did:key `CapabilityAgent`-shaped agent
+ * @returns {RecordSigner}
  */
-import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
-import type { CollectionEncryption } from '@interop/was-client';
-import { type DocCipher } from '@interop/was-client/edv';
+export declare function recordSignerFromAgent({ keyAgent }: {
+    keyAgent: {
+        id: string;
+        getSigner: () => {
+            sign: (input: {
+                data: Uint8Array;
+            }) => Promise<Uint8Array>;
+        };
+    };
+}): RecordSigner;
 /**
- * The version stamped on the stored `{ version, encryption, wrapped }` keyring
- * envelope: the record whose envelope seals under the record's own key epoch
- * (the `encryption` member). Any other version is refused as unusable -- such
- * accounts are re-provisioned, not migrated.
+ * Signs a record's frame members and returns the stored signed record. Shared
+ * by the keyring and recovery wrap paths (and available to an app's own record
+ * kinds), so one construction produces every signed record: the proof covers
+ * `{ version, encryption, wrapped }` plus any record-kind members under JCS
+ * canonicalization.
+ *
+ * @param options {object}
+ * @param options.version {number}   the frame version to stamp
+ * @param options.encryption {CollectionEncryption}   the record's descriptor
+ * @param options.wrapped {unknown}   the sealed envelope
+ * @param options.signer {RecordSigner}   the signing key
+ * @param [options.members] {object}   additional record-kind frame members the
+ *   proof must cover (e.g. the recovery record's `binding`)
+ * @returns {Promise<SignedRecord>}
  */
-export declare const KEYRING_RECORD_VERSION = 1;
+export declare function signRecordFrame({ version, encryption, wrapped, signer, members }: {
+    version: number;
+    encryption: CollectionEncryption;
+    wrapped: unknown;
+    signer: RecordSigner;
+    members?: Record<string, unknown>;
+}): Promise<SignedRecord>;
+/**
+ * The signing key's public multibase named by a proof's `verificationMethod`:
+ * its fragment. The signer emits `did:key:<multibase>#<multibase>`; the DID
+ * half is not what authorizes anything -- the multibase IS the key, and the
+ * caller's allowlist decides whether it may sign this record.
+ *
+ * @param options {object}
+ * @param options.verificationMethod {string}
+ * @param options.label {string}   names the record kind in the refusal
+ * @returns {string}
+ */
+export declare function recordProofKeyMultibase({ verificationMethod, label }: {
+    verificationMethod: string;
+    label: string;
+}): string;
 /**
  * Mints the one-epoch descriptor a fresh record is sealed under: epoch[0]
  * wrapped to the given KAK alone, built through `initRecipients` against a
@@ -44,12 +133,14 @@ export declare function mintRecordEncryption({ keyAgreementKey }: {
     keyAgreementKey: IKeyAgreementKey;
 }): Promise<CollectionEncryption>;
 /**
- * Builds the record cipher: an EDV cipher over the record's own descriptor.
- * Shared by the wrap and unwrap paths (and by the recovery record, which
- * reuses the keyring cipher context verbatim); an app's own record kind
- * passes its own `collectionId` so its failures name the record kind. The
- * context labels errors only -- the codec is agnostic to it, so a record
- * kind's real swap protection is its contents validation on unwrap.
+ * Builds the record's reading cipher: an EDV cipher over the record's own
+ * descriptor, from the reader's key-agreement key. The unwrap paths' cipher
+ * (and the recovery record's, which reuses the keyring cipher context
+ * verbatim); the wrap paths seal through {@link recordSealCipher} instead. An
+ * app's own record kind passes its own `collectionId` so its failures name
+ * the record kind. The context labels errors only -- the codec is agnostic to
+ * it, so a record kind's real swap protection is its contents validation on
+ * unwrap.
  *
  * @param options {object}
  * @param options.keyAgreementKey {IKeyAgreementKey}   the wrapping KAK (for
@@ -66,12 +157,37 @@ export declare function recordCipher({ keyAgreementKey, keyResolver, encryption,
     encryption: CollectionEncryption;
     collectionId?: string;
 }): Promise<DocCipher>;
+/**
+ * Builds the record's sealing cipher: an encrypt-only EDV cipher over the
+ * record's own descriptor, needing no key-agreement secret -- a write seals to
+ * the descriptor's epoch public key, reconstructed from the epoch id. This is
+ * what lets the recovery re-mint, which holds only the code's unlock KAK
+ * public half, re-seal a record it can never open; the issuance wraps go
+ * through the same construction and produce the same envelope shape. Decrypt
+ * on it refuses with was-client's typed `EncryptOnlyCipherError`.
+ *
+ * @param options {object}
+ * @param options.encryption {CollectionEncryption}   the record's descriptor
+ * @param [options.collectionId] {string}   the cipher context failures are
+ *   labeled with; defaults to the keyring context
+ * @returns {Promise<DocCipher>}
+ */
+export declare function recordSealCipher({ encryption, collectionId }: {
+    encryption: CollectionEncryption;
+    collectionId?: string;
+}): Promise<DocCipher>;
 /**
  * Validates the common `{ version, encryption, wrapped }` frame of a stored
  * record (keyring or recovery -- `label` names the refusals) and returns its
- * members. Exported so an app's own record kinds open their records through
- * the same frame validation the codec here seals with, rather than re-deriving
- * the version and shape checks.
+ * members, the `proof` among them for the signed frame. Exported so an app's
+ * own record kinds open their records through the same frame validation the
+ * codec here seals with, rather than re-deriving the version and shape checks.
+ *
+ * A frame at the keyring record version is the signed frame, so it must carry
+ * a fixed-shape proof; a record kind stamping its own version is unaffected
+ * (its authenticity story is its own). Validating the shape here does not
+ * verify it -- {@link verifyRecordProof} does, and every unwrap path in this
+ * module runs it before decrypting.
  *
  * @param options {object}
  * @param options.record {unknown}
@@ -79,7 +195,8 @@ export declare function recordCipher({ keyAgreementKey, keyResolver, encryption,
  *   kind's own label
  * @param [options.version] {number}   the version the frame must carry;
  *   defaults to the keyring record version
- * @returns {{ encryption: CollectionEncryption, wrapped: unknown }}
+ * @returns {{ encryption: CollectionEncryption, wrapped: unknown,
+ *   proof?: RecordProof }}
  */
 export declare function parseRecordFrame({ record, label, version }: {
     record: unknown;
@@ -88,7 +205,34 @@ export declare function parseRecordFrame({ record, label, version }: {
 }): {
     encryption: CollectionEncryption;
     wrapped: unknown;
+    proof?: RecordProof;
 };
+/**
+ * Verifies a stored record's proof: the fixed proof shape, the signing key
+ * against the caller's allowlist, and the signature over the record's sibling
+ * members (everything except `proof`, JCS-canonicalized). Refuses with
+ * {@link RecordProofError} in every failing case -- a class of its own, so an
+ * app tells "the host forged or tampered with this record" apart from a wrong
+ * unlock secret or an unusable version.
+ *
+ * Standalone as well as internal, because the recovery record's re-minted
+ * signer is only knowable after the record is decrypted (see
+ * `unwrapRecoveryRecord`).
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record, proof included
+ * @param options.allowedKeyMultibases {string | string[]}   the signing keys
+ *   this caller accepts, as public multibases or as verification-method ids
+ *   whose fragment is one
+ * @param [options.label] {string}   names the record kind in refusals;
+ *   defaults to the keyring record
+ * @returns {Promise<string>}   the verified signing key's public multibase
+ */
+export declare function verifyRecordProof({ record, allowedKeyMultibases, label }: {
+    record: unknown;
+    allowedKeyMultibases: string | string[];
+    label?: string;
+}): Promise<string>;
 /**
  * The account pointer a keyring record carries in place of the retired data
  * seed: where the account lives (`spaceId` + `host`, the WAS server origin)
@@ -111,51 +255,93 @@ export interface KeyringRecordContents {
     controller: string;
     email?: string;
     pointer?: AccountPointer;
+    createdAt: string;
 }
 /**
  * Wraps the account-pointer contents into a keyring record: the controller,
  * email, and pointer (+ timestamp) sealed under a freshly minted record epoch
- * whose key is wrapped to the unlock KAK. Deliberately carries no key material
- * of any kind.
+ * whose key is wrapped to the unlock KAK, then signed by the unlock identity's
+ * signing key. Deliberately carries no key material of any kind.
+ *
+ * The timestamp stays inside the plaintext (the signature covers the
+ * ciphertext, so it is covered transitively), so bind times do not leak to a
+ * reader of the unlock Space.
  *
  * @param options {object}
  * @param options.controller {string}   the account did:key
  * @param [options.email] {string}   the account email, when known
  * @param [options.pointer] {AccountPointer}   the account pointer (absent on
  *   no-WAS deployments)
- * @param options.keyAgreementKey {IKeyAgreementKey}   the unlock KAK
- * @param options.keyResolver {IKeyResolver}
- * @returns {Promise<{ version: number, encryption: CollectionEncryption,
- *   wrapped: unknown }>}
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the unlock KAK (its
+ *   public half is all the wrap uses: sealing needs no key-agreement secret)
+ * @param options.signer {RecordSigner}   the unlock identity's signing key
+ *   (`recordSignerFromAgent` over the unlock agent)
+ * @param [options.createdAt] {string}   the bind timestamp to stamp, as an ISO
+ *   string; defaults to now. Supplied by a caller that pins record freshness,
+ *   so it knows the stamp without unwrapping the record it just wrote.
+ * @returns {Promise<SignedRecord>}
  */
-export declare function wrapKeyringRecord({ controller, email, pointer, keyAgreementKey, keyResolver }: {
+export declare function wrapKeyringRecord({ controller, email, pointer, keyAgreementKey, signer, createdAt }: {
     controller: string;
     email?: string;
     pointer?: AccountPointer;
     keyAgreementKey: IKeyAgreementKey;
-    keyResolver: IKeyResolver;
-}): Promise<{
-    version: number;
-    encryption: CollectionEncryption;
-    wrapped: unknown;
-}>;
+    signer: RecordSigner;
+    createdAt?: string;
+}): Promise<SignedRecord>;
 /**
- * Unwraps and validates a keyring record. Rejects a record whose `version` is
- * not the current one (accounts are re-provisioned, not migrated), and
- * sanity-checks the decrypted plaintext (non-empty controller, well-formed
- * pointer when present).
+ * Unwraps and validates a keyring record. Verifies the record's proof against
+ * the unlock identity's own signing key BEFORE decrypting -- there is no
+ * unwrap path that skips it, so a record the storage host substituted is
+ * refused ({@link RecordProofError}) rather than decrypted and inspected.
+ * Rejects a record whose `version` is not the current one (accounts are
+ * re-provisioned, not migrated), and sanity-checks the decrypted plaintext
+ * (non-empty controller, well-formed pointer when present, a parseable
+ * `createdAt`).
  *
  * @param options {object}
  * @param options.record {unknown}
  * @param options.keyAgreementKey {IKeyAgreementKey}   the unlock KAK
  * @param options.keyResolver {IKeyResolver}
+ * @param options.expectedKeyMultibase {string}   the unlock identity's signing
+ *   key multibase, derived from the typed secret -- the only key that may have
+ *   signed this record
  * @returns {Promise<KeyringRecordContents>}
  */
-export declare function unwrapKeyringRecord({ record, keyAgreementKey, keyResolver }: {
+export declare function unwrapKeyringRecord({ record, keyAgreementKey, keyResolver, expectedKeyMultibase }: {
     record: unknown;
     keyAgreementKey: IKeyAgreementKey;
     keyResolver: IKeyResolver;
+    expectedKeyMultibase: string;
 }): Promise<KeyringRecordContents>;
+/**
+ * The bind timestamp a wrap path stamps into a record's plaintext: the
+ * caller's, validated as a parseable ISO timestamp, or now. A caller supplies
+ * one when it pins record freshness, so it knows the stamp of the record it is
+ * writing without reading it back.
+ *
+ * @param options {object}
+ * @param [options.createdAt] {string}   the caller's timestamp
+ * @returns {string}
+ */
+export declare function recordCreatedAtStamp({ createdAt }: {
+    createdAt?: string;
+}): string;
+/**
+ * Parses and validates the required `createdAt` member of a record plaintext:
+ * the moment the record was bound, as an ISO timestamp that must parse. Apps
+ * pin freshness on it, so a record that cannot state its own bind time is
+ * refused rather than defaulted.
+ *
+ * @param options {object}
+ * @param options.value {unknown}   the plaintext's `createdAt` member
+ * @param options.label {string}   names the record kind in the refusal
+ * @returns {string}
+ */
+export declare function parseRecordCreatedAt({ value, label }: {
+    value: unknown;
+    label: string;
+}): string;
 /**
  * Parses and validates the optional `pointer` member of a keyring record
  * plaintext. An absent member is a no-WAS record (returns undefined); a

package/dist/keyring/record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/keyring/record.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,yBAAyB,CAAA;AAGhC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiBhC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,YAAY,CAAC,EACjC,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAoC,EACrC,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,UAAU,EAAE,oBAAoB,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,SAAS,CAAC,CAOrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,KAAK,EACL,OAAgC,EACjC,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG;IAAE,UAAU,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAoCzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,cAAc,CAAA;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,UAAU,EACV,KAAK,EACL,OAAO,EACP,eAAe,EACf,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,CAAC,CAwBD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,MAAM,EACN,eAAe,EACf,WAAW,EACZ,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgCjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAsB7E"}
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/keyring/record.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAKL,KAAK,SAAS,EAEf,MAAM,yBAAyB,CAAA;AAGhC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACvD;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,oBAAoB,CAAA;IAC1B,WAAW,EAAE,gBAAgB,CAAA;IAC7B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,iBAAiB,CAAA;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,WAAW,CAAA;CACnB;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,MAAM,CAAA;QACV,SAAS,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,KAAK,EAAE;gBAAE,IAAI,EAAE,UAAU,CAAA;aAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;SAC3D,CAAA;KACF,CAAA;CACF,GAAG,YAAY,CAmBf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAAC,EACpC,OAAO,EACP,UAAU,EACV,OAAO,EACP,MAAM,EACN,OAAO,EACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBxB;AAoCD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,kBAAkB,EAClB,KAAK,EACN,EAAE;IACD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,MAAM,CAWT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiBhC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,YAAY,CAAC,EACjC,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAoC,EACrC,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,UAAU,EAAE,oBAAoB,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,SAAS,CAAC,CAOrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,YAAoC,EACrC,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,SAAS,CAAC,CAErB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,KAAK,EACL,OAAgC,EACjC,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG;IACF,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,CAmDA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,oBAAoB,EACpB,KAAiB,EAClB,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,oBAAoB,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CA4ClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,UAAU,EACV,KAAK,EACL,OAAO,EACP,eAAe,EACf,MAAM,EACN,SAAS,EACV,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,eAAe,EAAE,gBAAgB,CAAA;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,YAAY,CAAC,CAyBxB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,MAAM,EACN,eAAe,EACf,WAAW,EACX,oBAAoB,EACrB,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,oBAAoB,EAAE,MAAM,CAAA;CAC7B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA2CjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,SAAS,EACV,EAAE;IACD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,MAAM,CAQT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,KAAK,EACL,KAAK,EACN,EAAE;IACD,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,MAAM,CAKT;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAsB7E"}