@interop/wallet-core 0.40.0 → 0.42.0

package/dist/descriptors/logSource.js

@@ -5,6 +5,52 @@ import { readResourceLog, ResourceLogIntegrityError } from '../resourceLog/index
  * governed log entry, per WAS-EC.
  */
 export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
+/**
+ * The one governed epoch-configuration read: the fail-closed boundary that
+ * decides whether a served log state may be treated as an encryption
+ * descriptor. Resolves the controller view, reads and fully verifies the log
+ * (chain, proofs, external authorization, and the chain-head pin, via
+ * `readResourceLog`), and refuses a verified head whose state is not a
+ * `WasEpochConfiguration` rather than handing it out as a descriptor.
+ * Resolves `null` for an absent log (the pre-genesis state). Both governed
+ * descriptor consumers -- the log-governed descriptor source below and the
+ * roster's log-governed descriptor store -- read through this helper, so a
+ * hardening applied here reaches every trusted descriptor read.
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}   the log's transport seam
+ * @param options.resolveController {function}
+ *   `() => Promise<ResourceLogController>` -- the caller's currently verified
+ *   controller view, resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pin for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
+ * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; etag?: string } | null>}
+ */
+export async function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }) {
+    const controller = await resolveController();
+    const current = await readResourceLog({
+        store,
+        controller,
+        expectedMethod: RESOURCE_LOG_METHOD,
+        pinStore,
+        logId
+    });
+    if (current === null) {
+        return null;
+    }
+    const state = current.verified.state;
+    if (state.type !== EPOCH_CONFIGURATION_STATE_TYPE) {
+        throw new ResourceLogIntegrityError(`The governed descriptor log carries state of type ` +
+            `"${state.type}", not "${EPOCH_CONFIGURATION_STATE_TYPE}".`);
+    }
+    return {
+        verified: current.verified,
+        descriptor: state,
+        etag: current.etag
+    };
+}
 /**
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
  * logs. An absent log resolves `undefined` exactly like an absent
@@ -19,30 +65,26 @@ export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
  * @param options.resolveController {function}
  *   `() => Promise<ResourceLogController>` -- the caller's currently verified
  *   controller view, resolved per operation
- * @param options.pinStoreFor {function}   `(collectionId) =>
- *   ResourceLogPinStore` -- this client's chain-head pin for the collection's
- *   log
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pins, keyed per log
+ * @param options.logIdFor {function}   `(collectionId) => string` -- the
+ *   collection's descriptor log's pin-slot key, typically built with
+ *   `resourceLogPinId`
  * @returns {EncryptionDescriptorSource}
  */
-export function logGovernedDescriptorSource({ logFor, resolveController, pinStoreFor }) {
+export function logGovernedDescriptorSource({ logFor, resolveController, pinStore, logIdFor }) {
     return {
         async collectionEncryption({ collectionId }) {
-            const controller = await resolveController();
-            const current = await readResourceLog({
+            const current = await readGovernedEpochConfiguration({
                 store: logFor(collectionId),
-                controller,
-                expectedMethod: RESOURCE_LOG_METHOD,
-                pinStore: pinStoreFor(collectionId)
+                resolveController,
+                pinStore,
+                logId: logIdFor(collectionId)
             });
             if (current === null) {
                 return undefined;
             }
-            const state = current.verified.state;
-            if (state.type !== EPOCH_CONFIGURATION_STATE_TYPE) {
-                throw new ResourceLogIntegrityError(`The governed descriptor log carries state of type ` +
-                    `"${state.type}", not "${EPOCH_CONFIGURATION_STATE_TYPE}".`);
-            }
-            return state;
+            return current.descriptor;
         }
     };
 }

package/dist/descriptors/logSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,mBAAmB,EAEpB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,eAAe,EACf,yBAAyB,EAG1B,MAAM,yBAAyB,CAAA;AAGhC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,WAAW,EAKZ;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;gBACpC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,UAAU;gBACV,cAAc,EAAE,mBAAmB;gBACnC,QAAQ,EAAE,WAAW,CAAC,YAAY,CAAC;aACpC,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;YACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;gBAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;oBAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;YACH,CAAC;YACD,OAAO,KAA6B,CAAA;QACtC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,mBAAmB,EAEpB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,eAAe,EACf,yBAAyB,EAI1B,MAAM,yBAAyB,CAAA;AAGhC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAKC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EAMT;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB;gBACjB,QAAQ;gBACR,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;aAC9B,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/enrollment/enrollment.d.ts

@@ -60,7 +60,10 @@ export declare function encodeEnrollmentRequest({ request }: {
 /**
  * Parses and validates a connect code: the prefix, the payload version, and
  * each key decoded to its bytes (Ed25519 multibase for the signing and update
- * keys, X25519 for the key-agreement key). Throws on anything malformed -- a
+ * keys, X25519 for the key-agreement key), plus the canonicality of the
+ * key-agreement key ({@link assertCanonicalEnrollmentKeys}), so the refusal
+ * reaches the approver's consent screen rather than the ceremony. Throws on
+ * anything malformed -- a
  * code is typed or scanned, so a clear refusal beats a half-parsed ceremony,
  * and the approving client signs these keys into an append-only log where a
  * corrupted one would be published permanently.
@@ -72,6 +75,29 @@ export declare function encodeEnrollmentRequest({ request }: {
 export declare function parseEnrollmentRequest({ code }: {
     code: string;
 }): EnrollmentRequest;
+/**
+ * Refuses a connect code whose key-agreement key is not the canonical X25519
+ * twin of its signing key.
+ *
+ * The document publishes a client's key-agreement method under the controller
+ * marker `did:key:<signing multibase>` -- a claim that the key belongs to
+ * that signing key -- and every reader (the client listing, the revocation
+ * removal, the roster's recipient resolver) trusts it. This check is what
+ * makes the claim true: without it an enrollee could supply a key-agreement
+ * key nobody else can pair with its signing key, and publishing it under the
+ * marker would state something the account cannot back.
+ *
+ * It runs here so the refusal reaches the approver's consent screen before
+ * anything is published; the write sites enforce the same rule as a backstop,
+ * through `markedVerificationMethodPair`.
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}
+ * @returns {void}
+ */
+export declare function assertCanonicalEnrollmentKeys({ request }: {
+    request: EnrollmentRequest;
+}): void;
 /**
  * The did:key a connect code's signing key derives -- shown on BOTH screens
  * so the person running the ceremony can compare them before approving (the
@@ -118,7 +144,9 @@ export declare function mintEnrollmentRequest(): Promise<{
  * wrapped into the roster first (escrow: every epoch, so the new client reads
  * pre-enrollment history), then the two log entries. Quorum-of-one: this
  * client's own update key signs both entries. Idempotent at every stage, so
- * re-approving the same code after any tear converges.
+ * re-approving the same code after any tear converges. A request whose
+ * key-agreement key is not its signing key's canonical twin is refused before
+ * anything is written ({@link assertCanonicalEnrollmentKeys}).
  *
  * @param options {object}
  * @param options.request {EnrollmentRequest}   the parsed connect code

package/dist/enrollment/enrollment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAYxE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAc7B,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AA+DD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAsDpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,kBAAkB,EAAE,yBAAyB,CAAA;IAC7C,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB3E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EACnB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAyEvD"}
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAaxE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAc7B,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AAiDD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,IAAI,CAYP;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,kBAAkB,EAAE,yBAAyB,CAAA;IAC7C,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B3E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EACnB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAyEvD"}

package/dist/enrollment/enrollment.js

@@ -1,7 +1,7 @@
+import { decodeMultikey, MultikeyCodec } from '@interop/data-integrity-core/multihash';
 import { base64urlnopad } from '@scure/base';
-import { multibaseDecode, MULTICODEC_X25519_PUB_HEADER } from '@interop/x25519-key-agreement-key';
 import { agentsFromSeed } from '../identity/agents.js';
-import { enrollWebvhClient, mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
+import { enrollWebvhClient, keyAgreementTwinMultibase, mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
 import { clientSigningKeyMultibase, isWebvhDid, webvhZcapClient } from '../webvh/zcap.js';
 import { AccountLogMissingError, verifyAccountLog } from '../webvh/verifyLog.js';
 import { addUserKeyRosterRecipient } from '../keys/userKeyRoster.js';
@@ -31,46 +31,34 @@ export class EnrollmentPendingError extends Error {
  */
 const ED25519_MULTIBASE_PREFIX = 'z6Mk';
 const X25519_MULTIBASE_PREFIX = 'z6LS';
-/**
- * The multicodec varint header of an `ed25519-pub` value, the registry
- * constant the `z6Mk` prefix renders. The X25519 counterpart is imported from
- * the key suite that owns it; there is no exported Ed25519 equivalent.
- */
-const MULTICODEC_ED25519_PUB_HEADER = new Uint8Array([0xed, 0x01]);
-/**
- * The byte length of both public key types a connect code carries.
- */
-const PUBLIC_KEY_BYTES = 32;
 /**
  * Validates one connect-code key all the way down to its bytes: the multibase
- * prefix, a real base58btc decode, the multicodec header, and the key length.
- * The prefix alone is worth nothing here -- these keys are signed into an
- * append-only did:webvh log, where a key that only LOOKS like a multibase is
- * published forever.
+ * prefix, then a real base58btc decode with the multicodec header and key
+ * length enforced by `decodeMultikey`. The prefix alone is worth nothing here
+ * -- these keys are signed into an append-only did:webvh log, where a key
+ * that only LOOKS like a multibase is published forever. The prefix check
+ * stays alongside the decode: it is a stricter, deliberate spelling
+ * constraint (`z6Mk` / `z6LS` exactly) the codec-level decode does not cover.
  *
  * @param options {object}
  * @param options.value {unknown}   the payload member
  * @param options.prefix {string}   the expected multibase prefix
- * @param options.header {Uint8Array}   the expected multicodec header bytes
+ * @param options.expectedCodec {MultikeyCodec}   the expected multicodec
  * @param options.name {string}   the key's name, for the error message
  * @returns {string}   the key, verbatim
  */
-function requireConnectCodeKey({ value, prefix, header, name }) {
+function requireConnectCodeKey({ value, prefix, expectedCodec, name }) {
     if (typeof value !== 'string' || !value.startsWith(prefix)) {
         throw new Error(`The connect code carries a malformed ${name}.`);
     }
-    let bytes;
     try {
-        bytes = multibaseDecode(header, value);
+        decodeMultikey({ multikey: value, expectedCodec });
     }
     catch (err) {
         throw new Error(`The connect code carries a malformed ${name}.`, {
             cause: err
         });
     }
-    if (bytes.length !== PUBLIC_KEY_BYTES) {
-        throw new Error(`The connect code carries a malformed ${name}.`);
-    }
     return value;
 }
 /**
@@ -87,7 +75,10 @@ export function encodeEnrollmentRequest({ request }) {
 /**
  * Parses and validates a connect code: the prefix, the payload version, and
  * each key decoded to its bytes (Ed25519 multibase for the signing and update
- * keys, X25519 for the key-agreement key). Throws on anything malformed -- a
+ * keys, X25519 for the key-agreement key), plus the canonicality of the
+ * key-agreement key ({@link assertCanonicalEnrollmentKeys}), so the refusal
+ * reaches the approver's consent screen rather than the ceremony. Throws on
+ * anything malformed -- a
  * code is typed or scanned, so a clear refusal beats a half-parsed ceremony,
  * and the approving client signs these keys into an append-only log where a
  * corrupted one would be published permanently.
@@ -115,32 +106,63 @@ export function parseEnrollmentRequest({ code }) {
     if (v !== CONNECT_CODE_VERSION) {
         throw new Error(`Unsupported connect code version "${String(v)}".`);
     }
-    return {
+    const request = {
         signingKeyMultibase: requireConnectCodeKey({
             value: signingKeyMultibase,
             prefix: ED25519_MULTIBASE_PREFIX,
-            header: MULTICODEC_ED25519_PUB_HEADER,
+            expectedCodec: MultikeyCodec.ED25519_PUB,
             name: 'signing key'
         }),
         keyAgreementKeyMultibase: requireConnectCodeKey({
             value: keyAgreementKeyMultibase,
             prefix: X25519_MULTIBASE_PREFIX,
-            header: MULTICODEC_X25519_PUB_HEADER,
+            expectedCodec: MultikeyCodec.X25519_PUB,
             name: 'key-agreement key'
         }),
         updateKeyMultibase: requireConnectCodeKey({
             value: updateKey,
             prefix: ED25519_MULTIBASE_PREFIX,
-            header: MULTICODEC_ED25519_PUB_HEADER,
+            expectedCodec: MultikeyCodec.ED25519_PUB,
             name: 'update key'
         }),
         stagedUpdateKeyMultibase: requireConnectCodeKey({
             value: stagedUpdateKeyMultibase,
             prefix: ED25519_MULTIBASE_PREFIX,
-            header: MULTICODEC_ED25519_PUB_HEADER,
+            expectedCodec: MultikeyCodec.ED25519_PUB,
             name: 'staged update key'
         })
     };
+    assertCanonicalEnrollmentKeys({ request });
+    return request;
+}
+/**
+ * Refuses a connect code whose key-agreement key is not the canonical X25519
+ * twin of its signing key.
+ *
+ * The document publishes a client's key-agreement method under the controller
+ * marker `did:key:<signing multibase>` -- a claim that the key belongs to
+ * that signing key -- and every reader (the client listing, the revocation
+ * removal, the roster's recipient resolver) trusts it. This check is what
+ * makes the claim true: without it an enrollee could supply a key-agreement
+ * key nobody else can pair with its signing key, and publishing it under the
+ * marker would state something the account cannot back.
+ *
+ * It runs here so the refusal reaches the approver's consent screen before
+ * anything is published; the write sites enforce the same rule as a backstop,
+ * through `markedVerificationMethodPair`.
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}
+ * @returns {void}
+ */
+export function assertCanonicalEnrollmentKeys({ request }) {
+    const { signingKeyMultibase, keyAgreementKeyMultibase } = request;
+    if (keyAgreementKeyMultibase !==
+        keyAgreementTwinMultibase({ signingKeyMultibase })) {
+        throw new Error("The connect code's key-agreement key is not the canonical X25519 " +
+            'twin of its signing key; this wallet cannot be connected. Generate ' +
+            'a fresh connect code on the other wallet and try again.');
+    }
 }
 /**
  * The did:key a connect code's signing key derives -- shown on BOTH screens
@@ -212,7 +234,9 @@ export async function mintEnrollmentRequest() {
  * wrapped into the roster first (escrow: every epoch, so the new client reads
  * pre-enrollment history), then the two log entries. Quorum-of-one: this
  * client's own update key signs both entries. Idempotent at every stage, so
- * re-approving the same code after any tear converges.
+ * re-approving the same code after any tear converges. A request whose
+ * key-agreement key is not its signing key's canonical twin is refused before
+ * anything is written ({@link assertCanonicalEnrollmentKeys}).
  *
  * @param options {object}
  * @param options.request {EnrollmentRequest}   the parsed connect code
@@ -230,6 +254,10 @@ export async function mintEnrollmentRequest() {
  *   needs no second parse of the connect code
  */
 export async function approveEnrollment({ request, clientWebvhKeys, clientKeyAgreementKey, userKeyRosterStore, idStore }) {
+    // Re-checked here rather than trusted from the parse: this is the one seam
+    // every approval path runs through, and it is what publishes the key under
+    // the controller marker.
+    assertCanonicalEnrollmentKeys({ request });
     // Decryption material before authorization: the wrap lands first, so no
     // enrolled client is ever authorized but blind.
     await addUserKeyRosterRecipient({

package/dist/enrollment/enrollment.js.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EACL,eAAe,EACf,4BAA4B,EAC7B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AACrE,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAE3B,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAS9B;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YACE,OAAO,GAAG,6DAA6D;QACrE,oDAAoD;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC;;;;GAIG;AACH,MAAM,6BAA6B,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AAElE;;GAEG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAE3B;;;;;;;;;;;;;GAaG;AACH,SAAS,qBAAqB,CAAC,EAC7B,KAAK,EACL,MAAM,EACN,MAAM,EACN,IAAI,EAML;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,EAAE;YAC/D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EAGR;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACvE,OAAO,GAAG,mBAAmB,GAAG,cAAc,CAAC,MAAM,CACnD,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,EAAE,CAAA;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,IAAI,EAGL;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACjE,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EACJ,CAAC,EACD,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAAE,SAAS,EAC7B,wBAAwB,EACzB,GAAG,MAAiC,CAAA;IACrC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,qBAAqB,CAAC;YACzC,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE,aAAa;SACpB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,4BAA4B;YACpC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;QACF,kBAAkB,EAAE,qBAAqB,CAAC;YACxC,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE,YAAY;SACnB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EAGR;IACC,OAAO,WAAW,OAAO,CAAC,mBAAmB,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EAGR;IACC,OAAO,kBAAkB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAMzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,yBAAyB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IACD,OAAO;QACL,UAAU;QACV,eAAe;QACf,IAAI,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,SAAS,EAAE,QAAQ,CAAC,EAAE;KACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EAOR;IACC,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,yBAAyB,CAAC;QAC9B,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE;YACT,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC;YACvC,kBAAkB,EAAE,OAAO,CAAC,wBAAwB;SACrD;QACD,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACtC,OAAO;QACP,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,OAAO;KACnB,CAAC,CAAA;IACF,OAAO;QACL,GAAG;QACH,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC3C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EAMnB;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,4BAA4B,CAC/B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YAChC,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,UAAU;KACjC,CAAC,CAAA;IACF,MAAM,QAAQ,GACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB,CACzD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,oEAAoE;IACpE,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACxD,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,eAAe;KACvC,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAA;AACrE,CAAC"}
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,cAAc,EACd,aAAa,EACd,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AACrE,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAE3B,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAS9B;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YACE,OAAO,GAAG,6DAA6D;QACrE,oDAAoD;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB,CAAC,EAC7B,KAAK,EACL,MAAM,EACN,aAAa,EACb,IAAI,EAML;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,CAAC;QACH,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,EAAE;YAC/D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EAGR;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACvE,OAAO,GAAG,mBAAmB,GAAG,cAAc,CAAC,MAAM,CACnD,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,EAAE,CAAA;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,IAAI,EAGL;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACjE,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EACJ,CAAC,EACD,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAAE,SAAS,EAC7B,wBAAwB,EACzB,GAAG,MAAiC,CAAA;IACrC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,qBAAqB,CAAC;YACzC,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,aAAa;SACpB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,aAAa,CAAC,UAAU;YACvC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;QACF,kBAAkB,EAAE,qBAAqB,CAAC;YACxC,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,YAAY;SACnB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;KACH,CAAA;IACD,6BAA6B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1C,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,OAAO,EAGR;IACC,MAAM,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAA;IACjE,IACE,wBAAwB;QACxB,yBAAyB,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,qEAAqE;YACrE,yDAAyD,CAC5D,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EAGR;IACC,OAAO,WAAW,OAAO,CAAC,mBAAmB,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EAGR;IACC,OAAO,kBAAkB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAMzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,yBAAyB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IACD,OAAO;QACL,UAAU;QACV,eAAe;QACf,IAAI,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,SAAS,EAAE,QAAQ,CAAC,EAAE;KACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EAOR;IACC,2EAA2E;IAC3E,2EAA2E;IAC3E,yBAAyB;IACzB,6BAA6B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE1C,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,yBAAyB,CAAC;QAC9B,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE;YACT,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC;YACvC,kBAAkB,EAAE,OAAO,CAAC,wBAAwB;SACrD;QACD,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACtC,OAAO;QACP,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,OAAO;KACnB,CAAC,CAAA;IACF,OAAO;QACL,GAAG;QACH,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC3C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EAMnB;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,4BAA4B,CAC/B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YAChC,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,UAAU;KACjC,CAAC,CAAA;IACF,MAAM,QAAQ,GACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB,CACzD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,oEAAoE;IACpE,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACxD,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,eAAe;KACvC,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAA;AACrE,CAAC"}

package/dist/enrollment/index.d.ts

@@ -11,6 +11,9 @@
  * - `mintEnrollmentRequest` / `encodeEnrollmentRequest` /
  *   `parseEnrollmentRequest` / `enrollmentClientDid` /
  *   `enrollmentRecipientKid` -- the connect-code channel layer.
+ * - `assertCanonicalEnrollmentKeys` -- the refusal of a code whose
+ *   key-agreement key is not its signing key's canonical X25519 twin, run by
+ *   both the parse and the approval.
  * - `approveEnrollment` -- the enrolling client's half, in the push order
  *   (roster wrap, then the two did:webvh log entries).
  * - `encodeOnboardingResponse` / `parseOnboardingResponse` -- the onboarding-
@@ -24,7 +27,7 @@
  *   log, read the roster, hand back the user key and the epoch to pin. Persisting
  *   the key set stays with the caller's own unlock layer.
  */
-export { approveEnrollment, completeEnrollmentCore, encodeEnrollmentRequest, EnrollmentPendingError, enrollmentClientDid, enrollmentRecipientKid, mintEnrollmentRequest, parseEnrollmentRequest } from './enrollment.js';
+export { approveEnrollment, assertCanonicalEnrollmentKeys, completeEnrollmentCore, encodeEnrollmentRequest, EnrollmentPendingError, enrollmentClientDid, enrollmentRecipientKid, mintEnrollmentRequest, parseEnrollmentRequest } from './enrollment.js';
 export type { EnrollmentRequest } from './enrollment.js';
 export { CONNECT_CODE_PREFIX, isConnectCode } from './connectCode.js';
 export { encodeOnboardingResponse, ONBOARDING_LABEL_MAX_LENGTH, ONBOARDING_RESPONSE_VERSION, parseOnboardingResponse } from './onboardingResponse.js';

package/dist/enrollment/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AACvE,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AACvE,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,uBAAuB,CAAA"}

package/dist/enrollment/index.js

@@ -11,6 +11,9 @@
  * - `mintEnrollmentRequest` / `encodeEnrollmentRequest` /
  *   `parseEnrollmentRequest` / `enrollmentClientDid` /
  *   `enrollmentRecipientKid` -- the connect-code channel layer.
+ * - `assertCanonicalEnrollmentKeys` -- the refusal of a code whose
+ *   key-agreement key is not its signing key's canonical X25519 twin, run by
+ *   both the parse and the approval.
  * - `approveEnrollment` -- the enrolling client's half, in the push order
  *   (roster wrap, then the two did:webvh log entries).
  * - `encodeOnboardingResponse` / `parseOnboardingResponse` -- the onboarding-
@@ -24,7 +27,7 @@
  *   log, read the roster, hand back the user key and the epoch to pin. Persisting
  *   the key set stays with the caller's own unlock layer.
  */
-export { approveEnrollment, completeEnrollmentCore, encodeEnrollmentRequest, EnrollmentPendingError, enrollmentClientDid, enrollmentRecipientKid, mintEnrollmentRequest, parseEnrollmentRequest } from './enrollment.js';
+export { approveEnrollment, assertCanonicalEnrollmentKeys, completeEnrollmentCore, encodeEnrollmentRequest, EnrollmentPendingError, enrollmentClientDid, enrollmentRecipientKid, mintEnrollmentRequest, parseEnrollmentRequest } from './enrollment.js';
 export { CONNECT_CODE_PREFIX, isConnectCode } from './connectCode.js';
 export { encodeOnboardingResponse, ONBOARDING_LABEL_MAX_LENGTH, ONBOARDING_RESPONSE_VERSION, parseOnboardingResponse } from './onboardingResponse.js';
 export { createOnboardingExchange, ONBOARDING_INTERACTION_PATH, ONBOARDING_INVITE_TTL_MS, ONBOARDING_POLL_INTERVAL_MS, OnboardingExchangeGoneError, pollOnboardingExchange } from './onboardingInvite.js';

package/dist/enrollment/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,uBAAuB,CAAA"}

package/dist/keyring/fetch.d.ts

@@ -1,3 +1,15 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The portable keyring lookup: an unlock secret to the account it locates.
+ * One derivation, one read of the unlock Space's single resource, one unwrap.
+ *
+ * Deliberately I/O-only over the remote copy, which is the source of truth: an
+ * app's local caching, account-pointer pinning, and client-key-record handling
+ * wrap around this rather than living inside it, because those are per-app
+ * storage concerns with per-app durability rules.
+ */
 import type { UnlockKdf } from './kdf.js';
 import type { KeyringRecordContents } from './record.js';
 /**

package/dist/keyring/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/keyring/fetch.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAIzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAExD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,GAAiB,EACjB,gBAAgB,EACjB,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,CAAC,EAAE,SAAS,CAAA;IACf,gBAAgB,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC,CAAC,qBAAqB,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAsBtE"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/keyring/fetch.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAIzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAExD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,GAAiB,EACjB,gBAAgB,EACjB,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,CAAC,EAAE,SAAS,CAAA;IACf,gBAAgB,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC,CAAC,qBAAqB,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAoBtE"}

package/dist/keyring/fetch.js

@@ -26,8 +26,6 @@ export async function fetchKeyringRecord({ secret, kdf = KEYRING_KDF, storageSer
     }
     const contents = await unwrapKeyringRecord({
         record,
-        // `id` is always set on the unlock KAK (a controller was supplied at
-        // derivation), so it satisfies IKeyAgreementKey's required `id`.
         keyAgreementKey: unlock.keyAgreementKey,
         keyResolver: unlock.keyResolver,
         // The unlock identity's own signing key: derived from the secret the

package/dist/keyring/fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/keyring/fetch.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAGjD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,GAAG,GAAG,WAAW,EACjB,gBAAgB,EAKjB;IACC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,gBAAgB;QAChB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QACzC,MAAM;QACN,qEAAqE;QACrE,iEAAiE;QACjE,eAAe,EAAE,MAAM,CAAC,eAAmC;QAC3D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,oBAAoB,EAAE,MAAM,CAAC,YAAY,CAAC,YAAY;KACvD,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;AACvD,CAAC"}
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/keyring/fetch.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAGjD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,GAAG,GAAG,WAAW,EACjB,gBAAgB,EAKjB;IACC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,gBAAgB;QAChB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;QACzC,MAAM;QACN,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,oBAAoB,EAAE,MAAM,CAAC,YAAY,CAAC,YAAY;KACvD,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;AACvD,CAAC"}

package/dist/keyring/index.d.ts

@@ -16,10 +16,11 @@
  *   `RecordProofError` -- the record's authenticity layer: the proof over the
  *   frame members by the unlock identity's signing key, verified before any
  *   decryption, so a storage host cannot substitute a record it sealed itself.
- * - `mintRecordEncryption` / `recordCipher` / `parseRecordFrame` /
- *   `parseRecordCreatedAt` / `recordCreatedAtStamp` -- the record-own-epoch
- *   envelope construction the
- *   codec seals with plus the frame and plaintext validation it opens with,
+ * - `mintRecordEncryption` / `recordSealCipher` / `recordCipher` /
+ *   `parseRecordFrame` / `parseRecordCreatedAt` / `recordCreatedAtStamp` --
+ *   the record-own-epoch envelope construction the codec seals with (the seal
+ *   cipher is encrypt-only, so sealing needs no key-agreement secret) plus
+ *   the frame and plaintext validation it opens with,
  *   exported so an app's own locally stored records seal and unseal the same
  *   way (under their own cipher context) rather than re-deriving the
  *   construction.
@@ -32,9 +33,9 @@
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * was-client dependency graph (the same isolation pattern as `./identity`).
  */
-export { deriveUnlockIdentity, KEYRING_KDF, UNLOCK_HANDLE, UNLOCK_KEY_NAME, unlockSpaceIdFor } from './kdf.js';
+export { deriveUnlockIdentity, deriveUnlockSeed, KEYRING_KDF, UNLOCK_HANDLE, UNLOCK_KEY_NAME, unlockSpaceIdFor } from './kdf.js';
 export type { UnlockIdentity, UnlockKdf } from './kdf.js';
-export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, RecordProofError, recordProofKeyMultibase, recordSignerFromAgent, signRecordFrame, unwrapKeyringRecord, verifyRecordProof, wrapKeyringRecord } from './record.js';
+export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, RecordProofError, recordProofKeyMultibase, recordSealCipher, recordSignerFromAgent, signRecordFrame, unwrapKeyringRecord, verifyRecordProof, wrapKeyringRecord } from './record.js';
 export type { AccountPointer, KeyringRecordContents, RecordProof, RecordSigner, SignedRecord } from './record.js';
 export { deleteUnlockSpace, deleteUnlockSpaceWithCapability, ensureUnlockSpace, getUnlockKeyring, getUnlockKeyringWithCapability, putUnlockKeyring, putUnlockKeyringWithCapability, UNLOCK_SPACE_NAME } from './unlockSpace.js';
 export { fetchKeyringRecord } from './fetch.js';

package/dist/keyring/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,YAAY,EACZ,YAAY,EACb,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,YAAY,EACZ,YAAY,EACb,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/keyring/index.js

@@ -16,10 +16,11 @@
  *   `RecordProofError` -- the record's authenticity layer: the proof over the
  *   frame members by the unlock identity's signing key, verified before any
  *   decryption, so a storage host cannot substitute a record it sealed itself.
- * - `mintRecordEncryption` / `recordCipher` / `parseRecordFrame` /
- *   `parseRecordCreatedAt` / `recordCreatedAtStamp` -- the record-own-epoch
- *   envelope construction the
- *   codec seals with plus the frame and plaintext validation it opens with,
+ * - `mintRecordEncryption` / `recordSealCipher` / `recordCipher` /
+ *   `parseRecordFrame` / `parseRecordCreatedAt` / `recordCreatedAtStamp` --
+ *   the record-own-epoch envelope construction the codec seals with (the seal
+ *   cipher is encrypt-only, so sealing needs no key-agreement secret) plus
+ *   the frame and plaintext validation it opens with,
  *   exported so an app's own locally stored records seal and unseal the same
  *   way (under their own cipher context) rather than re-deriving the
  *   construction.
@@ -32,8 +33,8 @@
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * was-client dependency graph (the same isolation pattern as `./identity`).
  */
-export { deriveUnlockIdentity, KEYRING_KDF, UNLOCK_HANDLE, UNLOCK_KEY_NAME, unlockSpaceIdFor } from './kdf.js';
-export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, RecordProofError, recordProofKeyMultibase, recordSignerFromAgent, signRecordFrame, unwrapKeyringRecord, verifyRecordProof, wrapKeyringRecord } from './record.js';
+export { deriveUnlockIdentity, deriveUnlockSeed, KEYRING_KDF, UNLOCK_HANDLE, UNLOCK_KEY_NAME, unlockSpaceIdFor } from './kdf.js';
+export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, RecordProofError, recordProofKeyMultibase, recordSealCipher, recordSignerFromAgent, signRecordFrame, unwrapKeyringRecord, verifyRecordProof, wrapKeyringRecord } from './record.js';
 export { deleteUnlockSpace, deleteUnlockSpaceWithCapability, ensureUnlockSpace, getUnlockKeyring, getUnlockKeyringWithCapability, putUnlockKeyring, putUnlockKeyringWithCapability, UNLOCK_SPACE_NAME } from './unlockSpace.js';
 export { fetchKeyringRecord } from './fetch.js';
 //# sourceMappingURL=index.js.map

package/dist/keyring/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAA;AAGjB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AASpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAA;AAGjB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AASpB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/keyring/kdf.d.ts

@@ -16,9 +16,6 @@
  * (RFC 8018 / RFC 5869), so the two implementations agree bit for bit.
  */
 import { CapabilityAgent } from '@interop/webkms-client';
-import { ZcapClient } from '@interop/ezcap';
-import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
-import type { IKeyResolver } from '@interop/data-integrity-core';
 /**
  * The load-bearing `CapabilityAgent` derivation names for an unlock identity
  * (the counterpart of the data identity's bootstrap names): every unlock
@@ -60,6 +57,25 @@ export type UnlockKdf = {
  * unlock Space.
  */
 export declare const KEYRING_KDF: UnlockKdf;
+/**
+ * Derives the 32-byte unlock seed from an unlock secret, branching on the KDF
+ * family: PBKDF2 stretches a passphrase, HKDF expands already-uniform key
+ * material such as a passkey PRF output.
+ *
+ * Exported for the standing-credential derivation (`unlock/standingClient`):
+ * a standing unlock method expands its client identity and binding MAC key
+ * from this same seed under distinct HKDF salts, so the expensive stretch
+ * runs once per typed secret.
+ *
+ * @param options {object}
+ * @param options.secret {string | Uint8Array}
+ * @param options.kdf {UnlockKdf}
+ * @returns {Promise<Uint8Array>}
+ */
+export declare function deriveUnlockSeed({ secret, kdf }: {
+    secret: string | Uint8Array;
+    kdf: UnlockKdf;
+}): Promise<Uint8Array>;
 /**
  * Derives the full unlock identity from an unlock secret: the unlock
  * CapabilityAgent, a ZcapClient that can both invoke and delegate (the
@@ -79,9 +95,9 @@ export declare function deriveUnlockIdentity({ secret, kdf }: {
     kdf: UnlockKdf;
 }): Promise<{
     agent: CapabilityAgent;
-    zcapClient: ZcapClient;
-    keyAgreementKey: X25519KeyAgreementKey2020;
-    keyResolver: IKeyResolver;
+    zcapClient: import("@interop/ezcap").ZcapClient;
+    keyAgreementKey: import("@interop/data-integrity-core").IKeyAgreementKey;
+    keyResolver: import("@interop/data-integrity-core").IKeyResolver;
     recordSigner: import("./record.js").RecordSigner;
     spaceId: string;
 }>;

package/dist/keyring/kdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAQhE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAQ3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,QAAQ,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,SAMzB,CAAA;AA2DD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf;;;;;;;GAsCA;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAQxD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAQ3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,QAAQ,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,SAMzB,CAAA;AAmBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf;;;;;;;GA6BA;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAA"}