@metacensus/api 0.2.0 → 0.4.0

package/README.md

@@ -4,61 +4,163 @@ TypeScript interfaces for the MetaCensus API contract — every request and
 response under `/metacensus/api/v1` and `/metacensus/public`, generated from the
 `.proto` sources that also generate the Go side.
 
-What ships is the generated interfaces, the route manifest, `protobufPackage`,
-a typed client per surface — over a transport you supply — and the signing
-chain. It reaches for nothing at runtime; `scripts/check-no-runtime.mjs` is
-what says so, and what fails the build. The signing module is inside that
-guard rather than an exception to it.
+What ships is the generated interfaces, the route manifest, `protobufPackage`, a
+batteries-included client per surface, and the signing chain. How dependencies
+are weighed is in the repository's AGENTS.md, under "Dependencies".
 
 ```bash
 npm install @metacensus/api
 ```
 
 ```ts
-import type { Topic, PropCreateRequest } from "@metacensus/api";
-import { routes, Client, ApiError, type Transport } from "@metacensus/api";
+import { Client, ApiError, type Signer } from "@metacensus/api";
 
-const transport: Transport = async ({ method, path, body }) => {
-  const r = await fetch(baseUrl + path, { method, body });
-  return { status: r.status, body: await r.text() };
-};
-const api = new Client(transport);
-const topic = await api.getTopic({ topicId });
+const client = new Client({ baseUrl: "https://api.example.com", signer });
+await client.login({ email, password });          // token stored internally
+const topic = await client.getTopic({ topicId }); // TopicRecord: { id, recorded, name, description }
+```
+
+`Client` is batteries-included: it owns its `fetch`, holds the session token
+across `login`/`logout`, and signs writes with the `signer` you inject. It is the
+client to reach for. Construct it with:
+
+- `baseUrl` — the origin; the client adds `/metacensus/api/v1` and the route.
+- `fetch?` — a `fetch` to use instead of the global, for tests or instrumentation
+  (wrap the global to add retries, a 401 policy, or logging).
+- `signer?` — signs writes; see "Writes", below. Omit it for a read-only client.
+- `token?` — an initial bearer token, to resume a session without logging in.
+- `credentials?` — the fetch credentials mode; set `"include"` in a browser so
+  the `HttpOnly` refresh cookie rides `refresh()` and `logout`. See "Auth", below.
+
+A non-2xx response throws `ApiError` (`method`, `url`, `status`, and the raw
+`body` — parse it defensively, since a 404 or 405 comes from the router, not a
+handler). Every scalar is required, which is what makes Go's `EmitDefaultValues`
+and these types describe the same document: `client.createTopic({ content: { name } })`
+does not type-check, `{ content: { name, description: "" } }` does.
+
+## Reads: flat record or signed envelope
+
+A read returns the **flat record** — the domain object with the server's `id`
+and `recorded` folded in, and the `{content, userSignature}` envelope gone:
+
+```ts
+const topic = await client.getTopic({ topicId }); // { id, recorded, name, description }
+topic.name; // not topic.content.name
+```
+
+The envelope isn't uniform, so the record isn't either:
+
+| Response shape | `getX` / `listX` returns |
+| --- | --- |
+| id-bearing envelope (topic, prop, user) | `TopicRecord` — `{ id, recorded, ...content }` — / `TopicRecord[]` |
+| a vote — envelope with **no `id`** | `VoteRecord` (no `id`) / `VoteRecord[]` |
+| a member — already flat | `Member`, unchanged / `Member[]` |
+
+When you need the signature itself — verifying authorship, comparing `recorded`
+against the signer's `time`, or re-checking the assertion — each signed-envelope
+read has a **`getXSigned`** twin that returns the raw envelope:
+
+```ts
+import { verifyUser, participantPolicy } from "@metacensus/api/signing";
+
+const signed = await client.getTopicSigned({ topicId }); // { id, recorded, content, interpretation, userSignature }
+const pub = await resolveEnrolledKey(signed.userSignature.keyId); // your key directory
+await verifyUser(pub, signed.content, signed.interpretation, signed.userSignature, participantPolicy(origin));
 ```
 
-`path` is absolute and already carries `/metacensus/api/v1`, every segment
-percent-encoded; prepend only an origin. `body`, when present, is the exact
-string to send: the client serialises once, so what you log or hash is what
-went out.
+`getXSigned` exists only where there's a signature to see; `Member` has none.
+
+## Writes and the signer
+
+A write takes **flat content** — never the envelope — and the `signer` returns
+the record's `interpretation`, the `Signature` over it, and (sign-up only) the
+enrolling `publicKey`; the client assembles the body. The signer is set once on
+the constructor, because the key it signs with is identical for a session. The
+signing mechanism is a **passkey (WebAuthn)**: the signer runs the ceremony and
+packages its assertion — the private key never enters the client, and cannot,
+because a passkey's key is non-extractable in the authenticator.
 
-**The transport is where your own concerns go**: auth headers, a 401 policy,
-retries. The client calls no `fetch`, keeps no cache, and throws `ApiError` for
-any non-2xx the transport did not handle itself. `ApiError.body` is raw text —
-a 404 or 405 comes from the server's router rather than a handler, so parse it
-defensively rather than assuming JSON.
+```ts
+import {
+  interpretation, userChallenge, keyId, participantPolicy,
+} from "@metacensus/api/signing";
+
+const signer: Signer = async (content, contentType) => {
+  const interp = interpretation(contentType); // { spec, contentType } — the client names contentType
+  const kid = await keyId(publicKey);
+  const time = new Date().toISOString();
+
+  // The digest the assertion must commit to, carried as the WebAuthn challenge.
+  const challenge = await userChallenge(content, interp, kid, time);
+  const cred = await navigator.credentials.get({
+    publicKey: { challenge, allowCredentials: [/* this device's passkey */] },
+  }); // ui#55 owns provisioning and RP-ID scoping
+
+  const r = cred.response as AuthenticatorAssertionResponse;
+  return {
+    interpretation: interp,
+    signature: {
+      keyId: kid,
+      time,
+      assertion: {
+        authenticatorData: toBase64Url(r.authenticatorData),
+        clientDataJson: toBase64Url(r.clientDataJSON), // its challenge === base64url(challenge)
+        signature: toBase64Url(r.signature),           // DER, verified as-is
+      },
+    },
+  };
+};
 
-Signing is *not* a transport concern. A participant's signature is part of the
-request message and is made before the client is called; see "Signing", below.
+const client = new Client({ baseUrl, signer });
+const created = await client.createTopic({ content: { name: "A review", description: "" } });
+// TopicRecord, flattened like a read
+```
 
-Every scalar is required, which is what makes Go's `EmitDefaultValues` and
-these types describe the same document: `api.createTopic({ name })` does not
-type-check, `{ name, description: "" }` does. Message-typed fields are
-optional.
+The client supplies `content` and the exact `contentType` (the one thing left to
+the caller, and the easiest to get wrong); the signer builds the interpretation
+and the assertion. A headless signer (a server or a test) builds the same shape
+with `assert()` instead of a browser ceremony — one format, both layers. A write
+on a client built without a signer throws. **The browser ceremony above is
+sketch, not shipped: provisioning a passkey to a device, RP-ID scoping across
+environments, and recovery are [ui#55](https://github.com/metacensus/ui/issues/55).**
+
+## Auth and the session token
+
+There are two tokens. The **access token** is short-lived: `login` and `signUp`
+store the one they return, the client adds `Authorization: Bearer <token>` to
+every later request, and `session.expiresIn` (seconds) says how long it lasts.
+`token` (a getter) exposes the current one, to persist and restore a session via
+the `token` option. `signUp` signs its `User` content through the same signer;
+the signer returns the enrolling `publicKey`, which the client sends on the
+request (not on the signature — no record carries its own verification key) and
+the store binds under the signature's `keyId`. Keep the password out of
+`content`, since content is what gets stored.
+
+The **refresh token** is long-lived and never touches JavaScript. In a browser
+the server keeps it in an `HttpOnly` cookie, so `refresh()` sends an empty body
+and lets the cookie speak — construct the client with `credentials: "include"`
+so the browser attaches that cookie (and the deployment must answer credentialed
+CORS for your origin). `refresh()` returns a fresh `Session` and stores its new
+access token, exactly as `login` does; the refresh token is rotated on each use
+and `logout` revokes it. A non-browser caller with no cookie can instead pass the
+token in `RefreshRequest.refreshToken` (and `LogoutRequest.refreshToken`) — the
+contract is cookie-agnostic; the cookie is a transport the server adds.
+
+The client keeps no refresh policy of its own: a 401 on an expired access token
+is an ordinary `ApiError`, and the consumer decides when to call `refresh()` and
+retry (react-query, say). Refresh at or before `expiresIn` to avoid the round
+trip.
 
 ## The public surface
 
 The public, unauthenticated surface is an entry point of its own in the same
-package, with a client to match:
+package, with a client to match — no signer, no token:
 
 ```ts
 import type { PartnerSubmission } from "@metacensus/api/public";
-import {
-  PartnerSubmission_Interest,
-  PublicClient,
-  publicPrefix,
-} from "@metacensus/api/public";
+import { PartnerSubmission_Interest, PublicClient } from "@metacensus/api/public";
 
-const pub = new PublicClient(transport);
+const pub = new PublicClient({ baseUrl });
 await pub.submitPartnerInterest({ name, email, interests, message, website: "" });
 ```
 
@@ -66,8 +168,6 @@ One package because the SPA calls both surfaces from one build; an entry point
 per surface because a consumer of only the public surface should not acquire the
 authenticated types. `@metacensus/api/signing` is a third, splitting by concern
 rather than by surface — nothing on the public surface is ever signed.
-`PublicClient` sends no credentials of its own; pass it a separate transport
-from the one you pass `Client`.
 
 `ApiError` is the same class from either entry point, so `instanceof ApiError`
 holds for a failure from either surface. Importing it twice is harmless.
@@ -88,47 +188,32 @@ the enum's comment for why.
 
 ## Signing
 
-Every write on the authenticated surface carries a `content` message and a
-`userSignature` over it. A session token says who is connected; the signature
-says who authored the record, and the API server does not check it — it is
-verified by the persistence layer, behind the edge.
+Every write on the authenticated surface carries a `content` message, an
+`interpretation`, and a `userSignature` over both. A session token says who is
+connected; the signature says who authored the record, and the API server does
+not check it — it is verified by the persistence layer, behind the edge.
+`@metacensus/api/signing` is what your `Signer` uses, and what a verifier calls:
 
 ```ts
-import { SPEC, sign, keyId, generateKeyPair, encodePublicKey } from "@metacensus/api/signing";
-
-const { privateKey, publicKey } = await generateKeyPair(); // ECDSA P-384
-
-const content = { name: "A review", description: "" };
-const userSignature = {
-  signerId,
-  keyId: await keyId(publicKey),
-  alg: "Es384",
-  publicKey: "", // inline only on sign-up, which is what enrols the key
-  signingTime: new Date().toISOString(),
-  spec: SPEC,
-  contentType: "metacensus.v1.TopicContent",
-  value: "",
-};
-userSignature.value = await sign(privateKey, content, userSignature);
+import {
+  SPEC, interpretation, userChallenge, assert, verifyUser,
+  authenticatorData, participantPolicy, keyId, generateKeyPair, FLAG_UP, FLAG_UV,
+} from "@metacensus/api/signing";
 
-await api.createTopic({ content, userSignature });
+const { privateKey, publicKey } = await generateKeyPair(); // ECDSA P-256 (ES256)
 ```
 
-The digest is SHA-384 over RFC 8785 canonical JSON of
-`{content, signature}`, with `value` emptied. Every field but `value` is inside
-it, so a signature cannot be re-attributed or re-dated — which also means
-`contentType` has to name the content you actually signed, and `signingTime`
-has to be set.
-
-Sign-up is the one request whose signature carries its own public key: there is
-no id yet to look one up by. Set `publicKey` there, leave `signerId` empty, and
-keep the password out of `content` — content is what gets stored.
-
-`routes` carries a `signed` flag per route, so "which routes need a key?" is a
-lookup rather than a guess.
-
-The full account of the chain, and `go/signing`, the other half that has to
-compute the same digest, are in the repository README.
+The mechanism is **WebAuthn/passkeys**, one format for both the participant and
+the institution (ECDSA P-256 / ES256). This module is the toolkit: `interpretation`
+and `userChallenge` build the digest, `assert` makes a headless assertion,
+`verifyUser`/`verifyCountersign` check one under a `participantPolicy` or
+`institutionPolicy`. `routes` carries a `signed` flag per route, so "which routes
+need a key?" is a lookup rather than a guess.
+
+The scheme, the digest, and the verify procedure are the repository README's
+"The signing chain"; `go/signing` is the other half that computes the same digest
+and whose DER assertions this module verifies. The browser passkey ceremony
+itself is [ui#55](https://github.com/metacensus/ui/issues/55).
 
 ## Both surfaces
 

package/dist/index.d.ts

@@ -5,5 +5,5 @@ export * from "./src/metacensus/v1/topic.js";
 export * from "./src/metacensus/v1/user.js";
 export * from "./src/route-manifest.js";
 export { protobufPackage } from "./src/metacensus/v1/common.js";
-export { Client, ApiError, type ClientRequest, type ClientResponse, type Transport, } from "./src/client.js";
+export { Client, ApiError, type ClientOptions, type Signer, type TopicRecord, type PropRecord, type VoteRecord, type UserRecord, } from "./src/client.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAOA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAIhE,OAAO,EACL,MAAM,EACN,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAOA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAMhE,OAAO,EACL,MAAM,EACN,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -13,6 +13,8 @@ export * from "./src/route-manifest.js";
 // `export *` can't pick one file's `protobufPackage` over another's.
 export { protobufPackage } from "./src/metacensus/v1/common.js";
 // Named, not `export *`: src/client.ts has one class per surface, and this
-// entry point wants only the authenticated one.
+// entry point wants only the authenticated one. `Client` is batteries-included;
+// the `…Record` types are its flat reads and `Signer` its write seam. See
+// ts/README.md, "The generated client".
 export { Client, ApiError, } from "./src/client.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,qEAAqE;AACrE,kDAAkD;AAClD,EAAE;AACF,0EAA0E;AAC1E,0CAA0C;AAE1C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AAExC,qEAAqE;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,2EAA2E;AAC3E,gDAAgD;AAChD,OAAO,EACL,MAAM,EACN,QAAQ,GAIT,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,qEAAqE;AACrE,kDAAkD;AAClD,EAAE;AACF,0EAA0E;AAC1E,0CAA0C;AAE1C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AAExC,qEAAqE;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,2EAA2E;AAC3E,gFAAgF;AAChF,0EAA0E;AAC1E,wCAAwC;AACxC,OAAO,EACL,MAAM,EACN,QAAQ,GAOT,MAAM,iBAAiB,CAAC"}

package/dist/public.d.ts

@@ -2,5 +2,5 @@ export * from "./src/metacensus/public/v1/common.js";
 export * from "./src/metacensus/public/v1/partner.js";
 export * from "./src/route-manifest.js";
 export { protobufPackage } from "./src/metacensus/public/v1/common.js";
-export { PublicClient, ApiError, type ClientRequest, type ClientResponse, type Transport, } from "./src/client.js";
+export { PublicClient, ApiError, type PublicClientOptions, } from "./src/client.js";
 //# sourceMappingURL=public.d.ts.map

package/dist/public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../public.ts"],"names":[],"mappings":"AAIA,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAMvE,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../public.ts"],"names":[],"mappings":"AAIA,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAMvE,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,KAAK,mBAAmB,GACzB,MAAM,iBAAiB,CAAC"}

package/dist/public.js

@@ -7,8 +7,8 @@ export * from "./src/route-manifest.js";
 // `export *` can't pick one file's `protobufPackage` over another's.
 export { protobufPackage } from "./src/metacensus/public/v1/common.js";
 // Named, not `export *`: src/client.ts has one class per surface, and this
-// entry point wants only PublicClient. A public-only consumer still carries
-// the authenticated Client as dead code (a bundler drops it), but not the
+// entry point wants only PublicClient. A public-only consumer still carries the
+// authenticated Client as dead code (a bundler drops it), but not the
 // authenticated types, which is what the split is for.
 export { PublicClient, ApiError, } from "./src/client.js";
 //# sourceMappingURL=public.js.map

package/dist/public.js.map

@@ -1 +1 @@
-{"version":3,"file":"public.js","sourceRoot":"","sources":["../public.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,0EAA0E;AAC1E,iEAAiE;AAEjE,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AAExC,qEAAqE;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAEvE,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,uDAAuD;AACvD,OAAO,EACL,YAAY,EACZ,QAAQ,GAIT,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"public.js","sourceRoot":"","sources":["../public.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,0EAA0E;AAC1E,iEAAiE;AAEjE,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AAExC,qEAAqE;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAEvE,2EAA2E;AAC3E,gFAAgF;AAChF,sEAAsE;AACtE,uDAAuD;AACvD,OAAO,EACL,YAAY,EACZ,QAAQ,GAET,MAAM,iBAAiB,CAAC"}

package/dist/signing.d.ts

@@ -1,2 +1,3 @@
-export { SPEC, canonicalize, signingInput, digest, sign, verify, generateKeyPair, encodePublicKey, decodePublicKey, keyId, } from "./src/signing.js";
+export { SPEC, TYPE_GET, TYPE_COUNTERSIGN, FLAG_UP, FLAG_UV, FLAG_BE, FLAG_BS, canonicalize, interpretation, userSigningInput, countersignInput, userChallenge, countersignChallenge, authenticatorData, assert, verifyAssertion, verifyUser, verifyCountersign, participantPolicy, institutionPolicy, generateKeyPair, encodePublicKey, decodePublicKey, keyId, enrolledKey, } from "./src/signing.js";
+export type { ClientData, Policy } from "./src/signing.js";
 //# sourceMappingURL=signing.d.ts.map

package/dist/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../signing.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,IAAI,EACJ,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,IAAI,EACJ,MAAM,EACN,eAAe,EACf,eAAe,EACf,eAAe,EACf,KAAK,GACN,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../signing.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,MAAM,EACN,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,KAAK,EACL,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/signing.js

@@ -1,5 +1,5 @@
 // The MetaCensus signing chain, producing the same digest as go/signing. A
 // third entry point splitting by concern, not surface. See ts/README.md,
 // "Signing". The runtime half is src/signing.ts.
-export { SPEC, canonicalize, signingInput, digest, sign, verify, generateKeyPair, encodePublicKey, decodePublicKey, keyId, } from "./src/signing.js";
+export { SPEC, TYPE_GET, TYPE_COUNTERSIGN, FLAG_UP, FLAG_UV, FLAG_BE, FLAG_BS, canonicalize, interpretation, userSigningInput, countersignInput, userChallenge, countersignChallenge, authenticatorData, assert, verifyAssertion, verifyUser, verifyCountersign, participantPolicy, institutionPolicy, generateKeyPair, encodePublicKey, decodePublicKey, keyId, enrolledKey, } from "./src/signing.js";
 //# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing.js","sourceRoot":"","sources":["../signing.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AAEjD,OAAO,EACL,IAAI,EACJ,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,IAAI,EACJ,MAAM,EACN,eAAe,EACf,eAAe,EACf,eAAe,EACf,KAAK,GACN,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../signing.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AAEjD,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,MAAM,EACN,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,KAAK,EACL,WAAW,GACZ,MAAM,kBAAkB,CAAC"}

package/dist/src/client.d.ts

@@ -1,54 +1,73 @@
 import type { PartnerReceipt, PartnerSubmission } from "./metacensus/public/v1/partner.js";
-import type { LoginRequest, LogoutRequest, LogoutResponse, Session, SignUpRequest } from "./metacensus/v1/auth.js";
-import type { HealthcheckRequest, HealthcheckResponse } from "./metacensus/v1/common.js";
-import type { Prop, PropCreateRequest, PropGetRequest, PropList, PropListRequest, Vote, VoteList, VoteListRequest, VoteSetRequest } from "./metacensus/v1/prop.js";
-import type { Member, MemberGetRequest, MemberList, MemberListRequest, Topic, TopicCreateRequest, TopicGetRequest, TopicList, TopicListRequest } from "./metacensus/v1/topic.js";
-import type { SelfGetRequest, User, UserGetRequest, UserList, UserListRequest } from "./metacensus/v1/user.js";
-export interface ClientRequest {
-    readonly method: string;
-    readonly path: string;
-    readonly body?: string;
-}
-export interface ClientResponse {
-    readonly status: number;
-    readonly body: string;
-}
-export type Transport = (req: ClientRequest) => Promise<ClientResponse>;
+import type { LoginRequest, LogoutRequest, LogoutResponse, RefreshRequest, Session, SignUpRequest } from "./metacensus/v1/auth.js";
+import type { HealthcheckRequest, HealthcheckResponse, Interpretation, Signature, User } from "./metacensus/v1/common.js";
+import type { Prop, PropCreateRequest, PropGetRequest, PropListRequest, PropSigned, Vote, VoteListRequest, VoteSetRequest, VoteSigned } from "./metacensus/v1/prop.js";
+import type { Member, MemberGetRequest, MemberListRequest, Topic, TopicCreateRequest, TopicGetRequest, TopicListRequest, TopicSigned } from "./metacensus/v1/topic.js";
+import type { SelfGetRequest, UserGetRequest, UserListRequest, UserSigned } from "./metacensus/v1/user.js";
 export declare class ApiError extends Error {
     readonly method: string;
-    readonly path: string;
+    readonly url: string;
     readonly status: number;
     readonly body: string;
-    constructor(method: string, path: string, status: number, body: string);
+    constructor(method: string, url: string, status: number, body: string);
+}
+export interface SignResult {
+    interpretation: Interpretation;
+    signature: Signature;
+    publicKey?: string;
+}
+export type Signer = (content: unknown, contentType: string) => Promise<SignResult>;
+export type PropRecord = Pick<PropSigned, "id" | "recorded"> & Prop;
+export type TopicRecord = Pick<TopicSigned, "id" | "recorded"> & Topic;
+export type UserRecord = Pick<UserSigned, "id" | "recorded"> & User;
+export type VoteRecord = Pick<VoteSigned, "recorded"> & Vote;
+export interface ClientOptions {
+    readonly baseUrl: string;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly signer?: Signer;
+    readonly token?: string;
+    readonly prefix?: string;
+    readonly credentials?: RequestCredentials;
 }
 export declare class Client {
-    private readonly transport;
-    private readonly prefix;
-    constructor(transport: Transport, prefix?: string);
-    private call;
+    #private;
+    constructor(options: ClientOptions);
+    get token(): string | undefined;
     login(req: LoginRequest): Promise<Session>;
-    signUp(req: SignUpRequest): Promise<Session>;
+    signUp(req: Omit<SignUpRequest, "userSignature" | "interpretation" | "publicKey">): Promise<Session>;
+    refresh(req: RefreshRequest): Promise<Session>;
     logout(req: LogoutRequest): Promise<LogoutResponse>;
     healthcheck(req: HealthcheckRequest): Promise<HealthcheckResponse>;
-    listProps(req: PropListRequest): Promise<PropList>;
-    getProp(req: PropGetRequest): Promise<Prop>;
-    createProp(req: PropCreateRequest): Promise<Prop>;
-    listVotes(req: VoteListRequest): Promise<VoteList>;
-    setVote(req: VoteSetRequest): Promise<Vote>;
-    listTopics(req: TopicListRequest): Promise<TopicList>;
-    getTopic(req: TopicGetRequest): Promise<Topic>;
-    createTopic(req: TopicCreateRequest): Promise<Topic>;
-    listMembers(req: MemberListRequest): Promise<MemberList>;
+    listProps(req: PropListRequest): Promise<PropRecord[]>;
+    listPropsSigned(req: PropListRequest): Promise<PropSigned[]>;
+    getProp(req: PropGetRequest): Promise<PropRecord>;
+    getPropSigned(req: PropGetRequest): Promise<PropSigned>;
+    createProp(req: Omit<PropCreateRequest, "userSignature" | "interpretation" | "publicKey">): Promise<PropRecord>;
+    listVotes(req: VoteListRequest): Promise<VoteRecord[]>;
+    listVotesSigned(req: VoteListRequest): Promise<VoteSigned[]>;
+    setVote(req: Omit<VoteSetRequest, "userSignature" | "interpretation" | "publicKey">): Promise<VoteRecord>;
+    listTopics(req: TopicListRequest): Promise<TopicRecord[]>;
+    listTopicsSigned(req: TopicListRequest): Promise<TopicSigned[]>;
+    getTopic(req: TopicGetRequest): Promise<TopicRecord>;
+    getTopicSigned(req: TopicGetRequest): Promise<TopicSigned>;
+    createTopic(req: Omit<TopicCreateRequest, "userSignature" | "interpretation" | "publicKey">): Promise<TopicRecord>;
+    listMembers(req: MemberListRequest): Promise<Member[]>;
     getMember(req: MemberGetRequest): Promise<Member>;
-    listUsers(req: UserListRequest): Promise<UserList>;
-    getUser(req: UserGetRequest): Promise<User>;
-    getSelf(req: SelfGetRequest): Promise<User>;
+    listUsers(req: UserListRequest): Promise<UserRecord[]>;
+    listUsersSigned(req: UserListRequest): Promise<UserSigned[]>;
+    getUser(req: UserGetRequest): Promise<UserRecord>;
+    getUserSigned(req: UserGetRequest): Promise<UserSigned>;
+    getSelf(req: SelfGetRequest): Promise<UserRecord>;
+    getSelfSigned(req: SelfGetRequest): Promise<UserSigned>;
+}
+export interface PublicClientOptions {
+    readonly baseUrl: string;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly prefix?: string;
 }
 export declare class PublicClient {
-    private readonly transport;
-    private readonly prefix;
-    constructor(transport: Transport, prefix?: string);
-    private call;
+    #private;
+    constructor(options: PublicClientOptions);
     submitPartnerInterest(req: PartnerSubmission): Promise<PartnerReceipt>;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/src/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnH,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnK,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjL,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAiB/G,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAKD,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAKxE,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJvB,YACW,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAItB;CACF;AAGD,qBAAa,MAAM;IAIf,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFzB,YACmB,SAAS,EAAE,SAAS,EACpB,MAAM,GAAE,MAAyB,EAChD;YAEU,IAAI;IAWlB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAGzC;IAGD,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAG3C;IAGD,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAElD;IAGD,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEjE;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEjD;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAGD,UAAU,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhD;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEjD;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1C;IAGD,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAEpD;IAGD,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,CAE7C;IAGD,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,CAGnD;IAGD,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAEvD;IAGD,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhD;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEjD;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;CACF;AAGD,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFzB,YACmB,SAAS,EAAE,SAAS,EACpB,MAAM,GAAE,MAA4B,EACnD;YAEU,IAAI;IAWlB,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAGrE;CACF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnI,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AAC1H,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAY,eAAe,EAAE,UAAU,EAAE,IAAI,EAAY,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC3L,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAc,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAa,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC9L,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAY,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAKrH,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJvB,YACW,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAItB;CACF;AAKD,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAyBpF,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC;AACpE,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC;AACvE,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC;AACpE,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;AAkB7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAGzB,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAC3C;AAGD,qBAAa,MAAM;;IAQjB,YAAY,OAAO,EAAE,aAAa,EAOjC;IAGD,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAcK,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/C;IAGK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAKzG;IAGK,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAInD;IAGK,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAIxD;IAGD,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEjE;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAErD;IAGD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3D;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhD;IAGD,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtD;IAGK,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAIpH;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAErD;IAGD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3D;IAGK,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAI9G;IAGD,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAExD;IAGD,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAE9D;IAGD,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAEnD;IAGD,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAEzD;IAGK,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAGvH;IAGD,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAErD;IAGD,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhD;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAErD;IAGD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3D;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhD;IAGD,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtD;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhD;IAGD,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtD;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAGD,qBAAa,YAAY;;IAKvB,YAAY,OAAO,EAAE,mBAAmB,EAIvC;IAOD,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAErE;CACF"}