@interop/wallet-core 0.99.0 → 0.101.0

package/dist/testing/accountBuilder.js

@@ -0,0 +1,510 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * TEST FIXTURES ONLY. The shared account builder: the named account shapes a
+ * test starts from, each made through this package's own ceremonies against
+ * a real WAS server, with no fake store anywhere. Both wallets use it from
+ * their test globs only, and this package's integration tier uses it too.
+ *
+ * Never import this subpath from production code. Each consumer keeps a lint
+ * restriction excluding `@interop/wallet-core/testing` from its non-test
+ * globs.
+ *
+ * The builder imports no server package. The caller boots the server (the
+ * integration tier boots `was-teaching-server` in process) and hands over
+ * its URL; every client built here targets that URL.
+ *
+ * Every shape starts as a credential-anchored signup
+ * (`establishCredentialAnchoredAccount`) and adds one thing in the order a
+ * wallet's ladder-kind session runs it, acting as the signup credential:
+ *
+ * - `buildPassphraseAccount`: nothing more.
+ * - `buildSecondCredentialAccount`: a second standing credential
+ *   (`addStandingCredential`), the standing establishment's ladder branch.
+ * - `buildRecoveryCodeAccount`: one issued, unspent recovery code
+ *   (`issueRecoveryCode`), the issuance's ladder branch.
+ * - `buildEnrolledClientAccount`: one enrolled client (`enrollClient`), the
+ *   credential's self-enrollment.
+ *
+ * A passphrase derives through `FAST_KDF`, an HKDF stand-in for the shipped
+ * Argon2id set, so a passphrase shape derives in microseconds. A passphrase
+ * credential is low-entropy, so its `keyAgreement` key publishes as a hash
+ * commitment.
+ *
+ * The unlock records every shape binds are held in memory and never written:
+ * their codec and their storage are the wallet's. What a shape returns in
+ * their place is what the bind carried, the bridge and sibling delegations
+ * and the ladder seed, so a test can act as the credential afterwards.
+ *
+ * No shape performs the other app-side writes either. No shape writes an
+ * unlock-methods registry record. No shape writes a `connections` directory
+ * entry for the enrolled client. Each ladder-context add
+ * (`addStandingCredential`, `issueRecoveryCode`) enrolls one transient VM
+ * into the pointed generation, and `buildPassphraseAccount` enrolls none. So
+ * a shape's annex VM count differs from a real signup's.
+ *
+ * Each builder run keeps its own in-memory chain-head pins, as a fresh tab
+ * would.
+ */
+import { WasClient } from '@interop/was-client';
+import { agentsFromSeed } from '@interop/was-client/identity';
+import { memoryResourceLogPinStore } from '@interop/vh-resource-log';
+import { clientAnnexDidParts, clientAnnexLogStore, commitClientAnnexRung, delegatedClientsPointer, embeddedGenerationDelegation, enrollTransientClient, establishCredentialAnchoredAccount, ladderVmAgent, ladderVmZcapClient, mintDelegatedClientsDelegation, selfEnrollClientCore } from '../clientAnnex/index.js';
+import { mintSpaceId } from '../genesis/index.js';
+import { deriveUnlockSeed, unlockIdentityFromSeed } from '../keyring/index.js';
+import { accountCollectionStores, addUserKeyRosterRecipient, userKeyRosterDescriptorStore, userKeyRosterLogSigner } from '../keys/index.js';
+import { delegateLogWrite, generateRecoveryCode, publishRecoveryKey, recoveryClientFromCode } from '../recovery/index.js';
+import { webvhResourceLogController } from '../resourceLog/index.js';
+import { ID_COLLECTION } from '../space/index.js';
+import { generateLadderSeed, publishUnlockKey, standingClientFromUnlockSeed } from '../unlock/index.js';
+import { clientSigningKeyMultibase, delegatedWebvhLogStore, didKeyZcapClient, keyAgreementCommitment, ladderRung, verifyAccountLog, wasWebvhIdStore, webvhZcapClient } from '../webvh/index.js';
+import { FAST_KDF } from './fastKdf.js';
+/**
+ * A passphrase no other account in the process uses.
+ *
+ * @returns {string}
+ */
+function uniquePassphrase() {
+    return `builder-account-${crypto.randomUUID()}-Zz9!`;
+}
+/**
+ * A fresh credential and the account Space id it will be carried under: a
+ * random ladder seed, and the standing client derived from the credential's
+ * unlock seed. Given a passphrase, the unlock seed derives under `FAST_KDF`
+ * and the credential is low-entropy; the unlock identity rides along so a
+ * test can name its unlock Space. Without one, the unlock seed is 32 random
+ * bytes and the credential is high-entropy.
+ *
+ * @param [options] {object}
+ * @param [options.passphrase] {string}
+ * @returns {Promise<object>}   `{ spaceId, ladderSeed, standing, lowEntropy,
+ *   unlock? }`
+ */
+export async function mintCredential({ passphrase } = {}) {
+    const unlockSeed = passphrase === undefined
+        ? crypto.getRandomValues(new Uint8Array(32))
+        : await deriveUnlockSeed({ secret: passphrase, kdf: FAST_KDF });
+    return {
+        spaceId: mintSpaceId(),
+        ladderSeed: generateLadderSeed(),
+        standing: await standingClientFromUnlockSeed({ unlockSeed }),
+        lowEntropy: passphrase !== undefined,
+        ...(passphrase === undefined
+            ? {}
+            : { unlock: await unlockIdentityFromSeed({ seed: unlockSeed }) })
+    };
+}
+/**
+ * Establishes a credential-anchored account on the server, through one run of
+ * the signup ceremony. Each call is one run with its own in-memory pins, as a
+ * fresh tab's would be, so a test re-running a torn establishment passes the
+ * same `credential` again.
+ *
+ * @param options {object}
+ * @param options.serverUrl {string}   the booted server's URL
+ * @param [options.credential] {BuilderCredential}   from `mintCredential`; a
+ *   fresh high-entropy one when omitted
+ * @returns {Promise<object>}   the account's ids, the credential's ladder seed
+ *   and standing client, and the bridge and sibling delegations the re-bind
+ *   carried
+ */
+export async function establishAccount({ serverUrl, credential }) {
+    const { spaceId, ladderSeed, standing, lowEntropy, unlock } = credential ?? (await mintCredential());
+    const pinStore = memoryResourceLogPinStore();
+    const bootstrapAgent = await ladderVmAgent({ ladderSeed });
+    const bootstrapZcap = didKeyZcapClient({ keyAgent: bootstrapAgent });
+    const bootstrapWas = new WasClient({ serverUrl, zcapClient: bootstrapZcap });
+    const signer = userKeyRosterLogSigner({ keyAgent: bootstrapAgent });
+    // The unlock record, held in memory. The re-bind is the last call, and the
+    // one carrying the sibling delegation.
+    const binds = [];
+    const establishment = await establishCredentialAnchoredAccount({
+        wasServerUrl: serverUrl,
+        spaceId,
+        ladderSeed,
+        standing: {
+            clientDid: standing.clientDid,
+            keyAgreementKeyMultibase: standing.keyAgreementKeyMultibase,
+            recipientKid: standing.recipientKid,
+            keyAgreementKey: standing.agents.keyAgreementKey
+        },
+        lowEntropy,
+        bindRecord: async ({ delegation, delegatedClients }) => {
+            binds.push({
+                delegation,
+                ...(delegatedClients ? { delegatedClients } : {})
+            });
+            return {
+                createdAt: new Date(Date.now() + binds.length).toISOString(),
+                unlockSpaceId: unlock?.spaceId ?? 'unlock-space-held-in-memory'
+            };
+        },
+        rosterStoreFor: ({ did, log }) => userKeyRosterDescriptorStore({
+            storageServerUrl: serverUrl,
+            zcapClient: bootstrapZcap,
+            spaceId,
+            resolveController: async () => webvhResourceLogController({ did, log }),
+            pinStore,
+            signer
+        }),
+        collectionStoreFor: ({ did, log }) => accountCollectionStores({
+            storageServerUrl: serverUrl,
+            zcapClient: bootstrapZcap,
+            spaceId,
+            did,
+            pinStore,
+            signer,
+            log
+        }),
+        bootstrapWasFor: () => bootstrapWas,
+        idStore: wasWebvhIdStore({ was: bootstrapWas, spaceId, pinStore })
+    });
+    const record = binds.at(-1);
+    if (!record?.delegatedClients) {
+        throw new Error('fixture: the re-bind carried no sibling delegation');
+    }
+    const pointed = delegatedClientsPointer({ doc: establishment.accountLog.doc });
+    if (pointed === undefined) {
+        throw new Error('fixture: the establishment left no pointer');
+    }
+    return {
+        serverUrl,
+        spaceId,
+        accountDid: establishment.did,
+        annexSpaceId: clientAnnexDidParts({ did: pointed }).spaceId,
+        ladderSeed,
+        standing,
+        bridge: record.delegation,
+        sibling: record.delegatedClients
+    };
+}
+/**
+ * A credential-anchored account with one passphrase.
+ *
+ * @param options {object}
+ * @param options.serverUrl {string}
+ * @param [options.passphrase] {string}   a unique one by default
+ * @returns {Promise<object>}   the established account plus `passphrase`
+ */
+export async function buildPassphraseAccount({ serverUrl, passphrase = uniquePassphrase() }) {
+    const account = await establishAccount({
+        serverUrl,
+        credential: await mintCredential({ passphrase })
+    });
+    return { ...account, passphrase };
+}
+/**
+ * The account-ceremony context a transient session on the account's
+ * credential acts under (the ladder kind): the account log written through
+ * the record's bridge and signed by a ladder rung, and roster appends signed
+ * by the ladder VM and invoked by a per-visit annex VM under the generation
+ * delegation, the only authority such a session holds over the account
+ * Space once its controller is the did:webvh.
+ *
+ * @param options {object}
+ * @param options.account {EstablishedAccount}
+ * @param options.pinStore {ResourceLogPinStore}   the run's chain-head pins
+ * @returns {Promise<object>}   `{ idStore, rosterStore, signer }`
+ */
+async function ladderContext({ account, pinStore }) {
+    const { serverUrl, spaceId, accountDid, annexSpaceId, ladderSeed } = account;
+    const readAccountLog = async () => verifyAccountLog({ did: accountDid, spaceId, host: serverUrl, pinStore });
+    // The transient visit: a per-visit key enrolled into the pointed
+    // generation through the record's sibling delegation.
+    const { keyAgent } = await agentsFromSeed({
+        seed: crypto.getRandomValues(new Uint8Array(32))
+    });
+    const enrolled = await enrollTransientClient({
+        readAccountDocument: async () => (await readAccountLog()).doc,
+        storeForGenerationId: generationId => delegatedWebvhLogStore({
+            host: serverUrl,
+            spaceId: annexSpaceId,
+            collectionId: generationId,
+            delegation: account.sibling,
+            zcapClient: account.standing.agents.zcapClient,
+            pinStore
+        }),
+        ladderSeed,
+        transientKeyMultibase: clientSigningKeyMultibase({ keyAgent })
+    });
+    const capability = embeddedGenerationDelegation({ doc: enrolled.doc });
+    if (capability === undefined) {
+        throw new Error('fixture: the generation carries no delegation');
+    }
+    return {
+        // Public reads of the world-readable `did.jsonl`, and the bridge's
+        // delegated PUT, invoked by the credential's standing client. The two
+        // publishers declare the wide `WebvhIdStore` but only forward the store
+        // to `signAccountEntry`, which needs the three-member shape.
+        idStore: delegatedWebvhLogStore({
+            host: serverUrl,
+            spaceId,
+            collectionId: ID_COLLECTION.id,
+            delegation: account.bridge,
+            zcapClient: account.standing.agents.zcapClient,
+            pinStore
+        }),
+        // The controller view resolves per operation, so an append after an
+        // entry anchors at the post-entry head.
+        rosterStore: userKeyRosterDescriptorStore({
+            storageServerUrl: serverUrl,
+            zcapClient: webvhZcapClient({ keyAgent, did: enrolled.clientAnnexDid }),
+            spaceId,
+            resolveController: async () => webvhResourceLogController({
+                did: accountDid,
+                log: (await readAccountLog()).log
+            }),
+            pinStore,
+            signer: userKeyRosterLogSigner({
+                keyAgent: await ladderVmAgent({ ladderSeed })
+            }),
+            capability
+        }),
+        signer: { kind: 'ladder', ladderSeed },
+        standingKeyAgreementKey: account.standing.agents
+            .keyAgreementKey
+    };
+}
+/**
+ * Adds a second standing credential to the account, acting as the account's
+ * existing credential in a transient session: the standing establishment's
+ * ladder branch. The new credential's bridge and sibling delegations are
+ * signed by its OWN ladder VM; its record binds in memory; its ladder's rung
+ * 0 is committed into the pointed generation (blocking on this branch); the
+ * bind entry publishes, signed by the acting credential's ladder; and only
+ * then is the new credential escrowed into the roster, since a ladder-signed
+ * roster append is licensed at the inventory-changing version its own entry
+ * mints.
+ *
+ * A second call with the same passphrase is not a converging re-run: each
+ * call mints a fresh ladder seed, so the re-bind is refused at
+ * `publishUnlockKey`.
+ *
+ * @param options {object}
+ * @param options.account {EstablishedAccount}   the acting credential's
+ *   account
+ * @param [options.passphrase] {string}   the new credential's passphrase, a
+ *   unique one by default
+ * @returns {Promise<object>}   the new credential's passphrase, standing
+ *   client, ladder seed, bridge, and sibling
+ */
+export async function addStandingCredential({ account, passphrase = uniquePassphrase() }) {
+    const { serverUrl, spaceId, accountDid, annexSpaceId } = account;
+    const pinStore = memoryResourceLogPinStore();
+    const ctx = await ladderContext({ account, pinStore });
+    const pointer = { did: accountDid, spaceId, host: serverUrl };
+    const { standing, ladderSeed } = await mintCredential({ passphrase });
+    const rung0 = await ladderRung({ ladderSeed, index: 0 });
+    const boundZcapClient = await ladderVmZcapClient({ accountDid, ladderSeed });
+    // The bridge and sibling, held in memory as the bound record's members.
+    const bridge = await delegateLogWrite({
+        zcapClient: boundZcapClient,
+        pointer,
+        recoveryClientDid: standing.clientDid
+    });
+    const sibling = await mintDelegatedClientsDelegation({
+        zcapClient: boundZcapClient,
+        wasServerUrl: serverUrl,
+        clientAnnexSpaceId: annexSpaceId,
+        controller: standing.clientDid
+    });
+    // The bound credential's annex rung 0, committed under the acting
+    // credential's rung through the acting record's sibling.
+    const { doc } = await verifyAccountLog({
+        did: accountDid,
+        spaceId,
+        host: serverUrl,
+        pinStore
+    });
+    const clientAnnexDid = delegatedClientsPointer({ doc });
+    if (clientAnnexDid === undefined) {
+        throw new Error('fixture: the account points at no annex generation');
+    }
+    const { generationId } = clientAnnexDidParts({ did: clientAnnexDid });
+    await commitClientAnnexRung({
+        store: clientAnnexLogStore({
+            was: new WasClient({
+                serverUrl,
+                zcapClient: account.standing.agents.zcapClient
+            }),
+            spaceId: annexSpaceId,
+            generationId,
+            pinStore,
+            capability: account.sibling
+        }),
+        boundLadderSeed: ladderSeed,
+        actingLadderSeed: account.ladderSeed,
+        generationId,
+        expectedDid: clientAnnexDid
+    });
+    await publishUnlockKey({
+        idStore: ctx.idStore,
+        signer: ctx.signer,
+        unlockKeys: {
+            keyAgreement: {
+                commitment: await keyAgreementCommitment({
+                    keyAgreementKeyMultibase: standing.keyAgreementKeyMultibase
+                })
+            },
+            updateKeyMultibase: rung0.keyMultibase
+        },
+        ladderSeed,
+        expectedDid: accountDid
+    });
+    await addUserKeyRosterRecipient({
+        store: ctx.rosterStore,
+        recipient: {
+            id: standing.recipientKid,
+            publicKeyMultibase: standing.keyAgreementKeyMultibase
+        },
+        ownerKeyAgreementKey: ctx.standingKeyAgreementKey
+    });
+    return { passphrase, standing, ladderSeed, bridge, sibling };
+}
+/**
+ * Issues one recovery code, acting as the account's credential in a
+ * transient session: the issuance's ladder branch. The code's bridge is
+ * signed by the code's own ladder VM and binds in memory; then the code's
+ * `keyAgreement` key publishes, its wrap is escrowed into the roster, and the
+ * authority half (its ladder VM and rung-0 commitment) publishes last. The
+ * code is not spent.
+ *
+ * @param options {object}
+ * @param options.account {EstablishedAccount}
+ * @returns {Promise<object>}   `{ code, client, recoveryKid, bridge }`
+ */
+export async function issueRecoveryCode({ account }) {
+    const { serverUrl, spaceId, accountDid } = account;
+    const pinStore = memoryResourceLogPinStore();
+    const ctx = await ladderContext({ account, pinStore });
+    const pointer = { did: accountDid, spaceId, host: serverUrl };
+    const code = generateRecoveryCode();
+    const client = await recoveryClientFromCode({ code });
+    const recovery = {
+        keyAgreementKeyMultibase: client.keyAgreementKeyMultibase,
+        updateKeyMultibase: client.updateKeyMultibase
+    };
+    const bridge = await delegateLogWrite({
+        zcapClient: await ladderVmZcapClient({
+            accountDid,
+            ladderSeed: client.ladderSeed
+        }),
+        pointer,
+        recoveryClientDid: client.clientDid
+    });
+    const publishPart = async (part) => publishRecoveryKey({
+        idStore: ctx.idStore,
+        signer: ctx.signer,
+        recovery,
+        ladderSeed: client.ladderSeed,
+        part,
+        expectedDid: accountDid
+    });
+    await publishPart('key');
+    await addUserKeyRosterRecipient({
+        store: ctx.rosterStore,
+        recipient: {
+            id: client.recipientKid,
+            publicKeyMultibase: client.keyAgreementKeyMultibase
+        },
+        ownerKeyAgreementKey: ctx.standingKeyAgreementKey
+    });
+    await publishPart('authority');
+    return { code, client, recoveryKid: client.recipientKid, bridge };
+}
+/**
+ * Self-enrolls one enrolled client with the account's credential
+ * (`selfEnrollClientCore`), writing the account log through the record's
+ * bridge. The `onCommitted` seam is an in-memory no-op: a wallet persists
+ * the pending client-key record there, and here the seeds the core hands
+ * back are returned to the caller, which is this fixture's persist. A torn
+ * run is not this fixture's subject.
+ *
+ * @param options {object}
+ * @param options.account {EstablishedAccount}
+ * @returns {Promise<object>}   the new client's seed, agents, signing key
+ *   multibase, did:webvh update keys, did:key, the user key it read, and a
+ *   zcap client signing as `<accountDid>#<signing key>`
+ */
+export async function enrollClient({ account }) {
+    const { serverUrl, spaceId, accountDid, ladderSeed, standing } = account;
+    const pinStore = memoryResourceLogPinStore();
+    const enrolled = await selfEnrollClientCore({
+        pointer: { did: accountDid, spaceId, host: serverUrl },
+        ladderSeed,
+        credentialKeyAgreementKey: standing.agents
+            .keyAgreementKey,
+        logStore: delegatedWebvhLogStore({
+            host: serverUrl,
+            spaceId,
+            collectionId: ID_COLLECTION.id,
+            delegation: account.bridge,
+            zcapClient: standing.agents.zcapClient,
+            pinStore
+        }),
+        onCommitted: async () => { }
+    });
+    const agents = await agentsFromSeed({ seed: enrolled.clientSeed });
+    const zcapClient = webvhZcapClient({
+        keyAgent: agents.keyAgent,
+        did: accountDid
+    });
+    return {
+        clientSeed: enrolled.clientSeed,
+        agents,
+        signingKeyMultibase: clientSigningKeyMultibase({
+            keyAgent: agents.keyAgent
+        }),
+        webvhUpdateKeys: enrolled.webvhUpdateKeys,
+        clientDid: enrolled.clientDid,
+        userKey: enrolled.userKey,
+        zcapClient
+    };
+}
+/**
+ * The passphrase shape plus a second standing credential.
+ *
+ * @param options {object}
+ * @param options.serverUrl {string}
+ * @param [options.passphrase] {string}   a unique one by default
+ * @returns {Promise<object>}   the passphrase account plus `second`
+ */
+export async function buildSecondCredentialAccount({ serverUrl, passphrase }) {
+    const account = await buildPassphraseAccount({
+        serverUrl,
+        ...(passphrase === undefined ? {} : { passphrase })
+    });
+    return { ...account, second: await addStandingCredential({ account }) };
+}
+/**
+ * The passphrase shape plus one issued, unspent recovery code.
+ *
+ * @param options {object}
+ * @param options.serverUrl {string}
+ * @param [options.passphrase] {string}   a unique one by default
+ * @returns {Promise<object>}   the passphrase account plus `recovery`
+ */
+export async function buildRecoveryCodeAccount({ serverUrl, passphrase }) {
+    const account = await buildPassphraseAccount({
+        serverUrl,
+        ...(passphrase === undefined ? {} : { passphrase })
+    });
+    return { ...account, recovery: await issueRecoveryCode({ account }) };
+}
+/**
+ * The passphrase shape plus one enrolled client.
+ *
+ * @param options {object}
+ * @param options.serverUrl {string}
+ * @param [options.passphrase] {string}   a unique one by default
+ * @returns {Promise<object>}   the passphrase account plus `client`
+ */
+export async function buildEnrolledClientAccount({ serverUrl, passphrase }) {
+    const account = await buildPassphraseAccount({
+        serverUrl,
+        ...(passphrase === undefined ? {} : { passphrase })
+    });
+    return { ...account, client: await enrollClient({ account }) };
+}
+//# sourceMappingURL=accountBuilder.js.map

package/dist/testing/accountBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountBuilder.js","sourceRoot":"","sources":["../../src/testing/accountBuilder.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AAGpE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,kCAAkC,EAClC,aAAa,EACb,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC9E,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,4BAA4B,EAC7B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,eAAe,EAChB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAEvC;;;;GAIG;AACH,SAAS,gBAAgB;IACvB,OAAO,mBAAmB,MAAM,CAAC,UAAU,EAAE,OAAO,CAAA;AACtD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,UAAU,KACiB,EAAE;IAC7B,MAAM,UAAU,GACd,UAAU,KAAK,SAAS;QACtB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnE,OAAO;QACL,OAAO,EAAE,WAAW,EAAE;QACtB,UAAU,EAAE,kBAAkB,EAAE;QAChC,QAAQ,EAAE,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5D,UAAU,EAAE,UAAU,KAAK,SAAS;QACpC,GAAG,CAAC,UAAU,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;KACpE,CAAA;AACH,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,SAAS,EACT,UAAU,EAIX;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GACzD,UAAU,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1D,MAAM,aAAa,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IAC5E,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IAEnE,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,KAAK,GAA2D,EAAE,CAAA;IACxE,MAAM,aAAa,GAAG,MAAM,kCAAkC,CAAC;QAC7D,YAAY,EAAE,SAAS;QACvB,OAAO;QACP,UAAU;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;YAC3D,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe;SACjD;QACD,UAAU;QACV,UAAU,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,EAAE;YACrD,KAAK,CAAC,IAAI,CAAC;gBACT,UAAU;gBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD,CAAC,CAAA;YACF,OAAO;gBACL,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;gBAC5D,aAAa,EAAE,MAAM,EAAE,OAAO,IAAI,6BAA6B;aAChE,CAAA;QACH,CAAC;QACD,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAC/B,4BAA4B,CAAC;YAC3B,gBAAgB,EAAE,SAAS;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;YACvE,QAAQ;YACR,MAAM;SACP,CAAC;QACJ,kBAAkB,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CACnC,uBAAuB,CAAC;YACtB,gBAAgB,EAAE,SAAS;YAC3B,UAAU,EAAE,aAAa;YACzB,OAAO;YACP,GAAG;YACH,QAAQ;YACR,MAAM;YACN,GAAG;SACJ,CAAC;QACJ,eAAe,EAAE,GAAG,EAAE,CAAC,YAAY;QACnC,OAAO,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;KACnE,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3B,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO;QACP,UAAU,EAAE,aAAa,CAAC,GAAG;QAC7B,YAAY,EAAE,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;QAC3D,UAAU;QACV,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,OAAO,EAAE,MAAM,CAAC,gBAAgB;KACjC,CAAA;AACH,CAAC;AAID;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,SAAS,EACT,UAAU,GAAG,gBAAgB,EAAE,EAIhC;IACC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;QACrC,SAAS;QACT,UAAU,EAAE,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC;KACjD,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,aAAa,CAAC,EAC3B,OAAO,EACP,QAAQ,EAIT;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAC5E,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAChC,gBAAgB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;IAE3E,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC;QACxC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;KACjD,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,GAAG;QAC7D,oBAAoB,EAAE,YAAY,CAAC,EAAE,CACnC,sBAAsB,CAAC;YACrB,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,YAAY;YACrB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,OAAO,CAAC,OAAO;YAC3B,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU;YAC9C,QAAQ;SACT,CAAC;QACJ,UAAU;QACV,qBAAqB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC/D,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,4BAA4B,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAA;IACtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IAED,OAAO;QACL,mEAAmE;QACnE,sEAAsE;QACtE,wEAAwE;QACxE,6DAA6D;QAC7D,OAAO,EAAE,sBAAsB,CAAC;YAC9B,IAAI,EAAE,SAAS;YACf,OAAO;YACP,YAAY,EAAE,aAAa,CAAC,EAAE;YAC9B,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU;YAC9C,QAAQ;SACT,CAAiB;QAClB,oEAAoE;QACpE,wCAAwC;QACxC,WAAW,EAAE,4BAA4B,CAAC;YACxC,gBAAgB,EAAE,SAAS;YAC3B,UAAU,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;YACvE,OAAO;YACP,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC;gBACzB,GAAG,EAAE,UAAU;gBACf,GAAG,EAAE,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,GAAG;aAClC,CAAC;YACJ,QAAQ;YACR,MAAM,EAAE,sBAAsB,CAAC;gBAC7B,QAAQ,EAAE,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;aAC9C,CAAC;YACF,UAAU;SACX,CAAC;QACF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,UAAU,EAAE;QAC/C,uBAAuB,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;aAC7C,eAAmC;KACvC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,OAAO,EACP,UAAU,GAAG,gBAAgB,EAAE,EAIhC;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;IAChE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtD,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACrE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IAE5E,wEAAwE;IACxE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,eAAe;QAC3B,OAAO;QACP,iBAAiB,EAAE,QAAQ,CAAC,SAAS;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,UAAU,EAAE,eAAe;QAC3B,YAAY,EAAE,SAAS;QACvB,kBAAkB,EAAE,YAAY;QAChC,UAAU,EAAE,QAAQ,CAAC,SAAS;KAC/B,CAAC,CAAA;IAEF,kEAAkE;IAClE,yDAAyD;IACzD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC;QACrC,GAAG,EAAE,UAAU;QACf,OAAO;QACP,IAAI,EAAE,SAAS;QACf,QAAQ;KACT,CAAC,CAAA;IACF,MAAM,cAAc,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACvD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAA;IACrE,MAAM,qBAAqB,CAAC;QAC1B,KAAK,EAAE,mBAAmB,CAAC;YACzB,GAAG,EAAE,IAAI,SAAS,CAAC;gBACjB,SAAS;gBACT,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU;aAC/C,CAAC;YACF,OAAO,EAAE,YAAY;YACrB,YAAY;YACZ,QAAQ;YACR,UAAU,EAAE,OAAO,CAAC,OAAO;SAC5B,CAAC;QACF,eAAe,EAAE,UAAU;QAC3B,gBAAgB,EAAE,OAAO,CAAC,UAAU;QACpC,YAAY;QACZ,WAAW,EAAE,cAAc;KAC5B,CAAC,CAAA;IAEF,MAAM,gBAAgB,CAAC;QACrB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,UAAU,EAAE,MAAM,sBAAsB,CAAC;oBACvC,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;iBAC5D,CAAC;aACH;YACD,kBAAkB,EAAE,KAAK,CAAC,YAAY;SACvC;QACD,UAAU;QACV,WAAW,EAAE,UAAU;KACxB,CAAC,CAAA;IACF,MAAM,yBAAyB,CAAC;QAC9B,KAAK,EAAE,GAAG,CAAC,WAAW;QACtB,SAAS,EAAE;YACT,EAAE,EAAE,QAAQ,CAAC,YAAY;YACzB,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;SACtD;QACD,oBAAoB,EAAE,GAAG,CAAC,uBAAuB;KAClD,CAAC,CAAA;IACF,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EAGR;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAClD,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IACtD,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC7D,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAA;IACnC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG;QACf,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,UAAU,EAAE,MAAM,kBAAkB,CAAC;YACnC,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QACF,OAAO;QACP,iBAAiB,EAAE,MAAM,CAAC,SAAS;KACpC,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,KAAK,EAAE,IAAyB,EAAE,EAAE,CACtD,kBAAkB,CAAC;QACjB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ;QACR,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI;QACJ,WAAW,EAAE,UAAU;KACxB,CAAC,CAAA;IACJ,MAAM,WAAW,CAAC,KAAK,CAAC,CAAA;IACxB,MAAM,yBAAyB,CAAC;QAC9B,KAAK,EAAE,GAAG,CAAC,WAAW;QACtB,SAAS,EAAE;YACT,EAAE,EAAE,MAAM,CAAC,YAAY;YACvB,kBAAkB,EAAE,MAAM,CAAC,wBAAwB;SACpD;QACD,oBAAoB,EAAE,GAAG,CAAC,uBAAuB;KAClD,CAAC,CAAA;IACF,MAAM,WAAW,CAAC,WAAW,CAAC,CAAA;IAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAA;AACnE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,OAAO,EAGR;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IACxE,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;QAC1C,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QACtD,UAAU;QACV,yBAAyB,EAAE,QAAQ,CAAC,MAAM;aACvC,eAAmC;QACtC,QAAQ,EAAE,sBAAsB,CAAC;YAC/B,IAAI,EAAE,SAAS;YACf,OAAO;YACP,YAAY,EAAE,aAAa,CAAC,EAAE;YAC9B,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;YACtC,QAAQ;SACT,CAAC;QACF,WAAW,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KAC5B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;IAClE,MAAM,UAAU,GAAe,eAAe,CAAC;QAC7C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,UAAU;KAChB,CAAC,CAAA;IACF,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,MAAM;QACN,mBAAmB,EAAE,yBAAyB,CAAC;YAC7C,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;QACF,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU;KACX,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,SAAS,EACT,UAAU,EAIX;IACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;QAC3C,SAAS;QACT,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,SAAS,EACT,UAAU,EAIX;IACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;QAC3C,SAAS;QACT,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,SAAS,EACT,UAAU,EAIX;IACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;QAC3C,SAAS;QACT,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;AAChE,CAAC"}

package/dist/testing/fastKdf.d.ts

@@ -0,0 +1,16 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * TEST FIXTURES ONLY. A cheap stand-in for the passphrase parameter set, for
+ * tests whose subject is a record codec or a ceremony rather than the KDF
+ * itself (`keyring-kdf.test.ts` pins that one): an HKDF expansion in place of
+ * the shipped memory-hard Argon2id stretch, which costs a 64 MiB allocation
+ * and a visible fraction of a second per derivation.
+ *
+ * Never import this subpath from production code: an unlock identity derived
+ * under it is not the one the shipped `KEYRING_KDF` derives.
+ */
+import type { UnlockKdf } from '../keyring/index.js';
+export declare const FAST_KDF: UnlockKdf;
+//# sourceMappingURL=fastKdf.d.ts.map

package/dist/testing/fastKdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastKdf.d.ts","sourceRoot":"","sources":["../../src/testing/fastKdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAEpD,eAAO,MAAM,QAAQ,EAAE,SAMtB,CAAA"}

package/dist/testing/fastKdf.js

@@ -0,0 +1,8 @@
+export const FAST_KDF = {
+    version: 1,
+    algorithm: 'HKDF',
+    hash: 'SHA-256',
+    salt: 'wallet-core/test/keyring-record',
+    info: 'unlock-seed'
+};
+//# sourceMappingURL=fastKdf.js.map

package/dist/testing/fastKdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastKdf.js","sourceRoot":"","sources":["../../src/testing/fastKdf.ts"],"names":[],"mappings":"AAeA,MAAM,CAAC,MAAM,QAAQ,GAAc;IACjC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,iCAAiC;IACvC,IAAI,EAAE,aAAa;CACpB,CAAA"}

package/dist/testing/index.d.ts

@@ -0,0 +1,13 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * TEST FIXTURES ONLY: the `./testing` subpath. The recorded-grant signer
+ * fixture, the fast passphrase KDF, and the account builder that makes real
+ * accounts against a caller-booted WAS server. Never import it from
+ * production code.
+ */
+export * from './signerFixture.js';
+export * from './fastKdf.js';
+export * from './accountBuilder.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAA"}

package/dist/testing/index.js

@@ -0,0 +1,13 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * TEST FIXTURES ONLY: the `./testing` subpath. The recorded-grant signer
+ * fixture, the fast passphrase KDF, and the account builder that makes real
+ * accounts against a caller-booted WAS server. Never import it from
+ * production code.
+ */
+export * from './signerFixture.js';
+export * from './fastKdf.js';
+export * from './accountBuilder.js';
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAA"}

package/dist/{testing.d.ts → testing/signerFixture.d.ts}

@@ -13,7 +13,7 @@
  * globs.
  */
 import type { IZcap } from '@interop/data-integrity-core';
-import type { AccountSignerCheck } from './clientAnnex/grantRevocation.js';
+import type { AccountSignerCheck } from '../clientAnnex/grantRevocation.js';
 /**
  * The account the signer-check fixture describes: one enrolled client and
  * one standing credential's ladder VM under `capabilityDelegation`, the
@@ -75,4 +75,4 @@ export declare function recordedGrant({ id, controller, invocationTarget, expire
         signerKeyId?: string;
     };
 }): IZcap;
-//# sourceMappingURL=testing.d.ts.map
+//# sourceMappingURL=signerFixture.d.ts.map

package/dist/testing/signerFixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signerFixture.d.ts","sourceRoot":"","sources":["../../src/testing/signerFixture.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;CAQjB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,eAAe,QAA+D,CAAA;AAC3F,eAAO,MAAM,aAAa,QAA4D,CAAA;AACtF,eAAO,MAAM,WAAW,QAA0C,CAAA;AAElE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,kBAAkB,CAcvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,EAC5B,EAAmB,EACnB,UAAkC,EAClC,gBAAoE,EACpE,OAAgC,EAChC,WAAW,EACX,MAAM,EACP,GAAE;IACD,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD,GAAG,KAAK,CAuBb"}

package/dist/{testing.js → testing/signerFixture.js}

@@ -86,4 +86,4 @@ export function recordedGrant({ id = 'urn:zcap:one', controller = SIGNER_FIXTURE
         }
     };
 }
-//# sourceMappingURL=testing.js.map
+//# sourceMappingURL=signerFixture.js.map

package/dist/testing/signerFixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signerFixture.js","sourceRoot":"","sources":["../../src/testing/signerFixture.ts"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,oBAAoB;IACjC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,yDAAyD;IACnE,WAAW,EAAE,yDAAyD;IACtE,IAAI,EAAE,qDAAqD;IAC3D,MAAM,EAAE,wBAAwB;CACxB,CAAA;AAEV;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,WAAW,EAAE,CAAA;AAC3F,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAA;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,cAAc,CAAC,UAAU,WAAW,CAAA;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAA;IACtE,OAAO;QACL,UAAU;QACV,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1C,GAAG,EAAE;YACH,kBAAkB,EAAE;gBAClB,EAAE,EAAE,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE;gBACxD,EAAE,EAAE,EAAE,aAAa,EAAE,kBAAkB,EAAE,QAAQ,EAAE;aACpD;YACD,oBAAoB,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC;SACvD;QACD,cAAc,EAAE,QAAQ;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,EAAE,GAAG,cAAc,EACnB,UAAU,GAAG,cAAc,CAAC,MAAM,EAClC,gBAAgB,GAAG,iDAAiD,EACpE,OAAO,GAAG,sBAAsB,EAChC,WAAW,EACX,MAAM,KAQJ,EAAE;IACJ,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAA;IAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI;QACzB,EAAE,EAAE,+BAA+B;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,gBAAgB,EAAE,IAAI;QACtB,GAAG,CAAC,MAAM,CAAC,WAAW;YACpB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,OAAO;QACL,UAAU,EAAE,CAAC,0BAA0B,CAAC;QACxC,EAAE;QACF,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC/C,UAAU;QACV,gBAAgB;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QAC9B,OAAO;QACP,KAAK,EAAE;YACL,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D;KACkB,CAAA;AACvB,CAAC"}