@metacensus/api 0.2.0 → 0.4.0

package/dist/src/signing.js

@@ -1,32 +1,53 @@
-// The TypeScript half of the MetaCensus signing chain; go/signing is the
-// other half, and ts/test/wire.test.mjs checks the two agree — neither may
-// be edited alone.
+// The TypeScript half of the MetaCensus signing chain; go/signing is the other
+// half, and ts/test/wire.test.mjs checks the two agree — neither may be edited
+// alone. See README.md, "The signing chain".
 //
-//     digest = SHA-384( JCS( {"content": C, "signature": S} ) )
+// One format serves both layers. A participant signs with a passkey (WebAuthn);
+// an institution countersigns headless. Both produce the same object — a
+// WebAuthn assertion whose challenge is the record's digest:
 //
-// C is the content message, S is the UserSignature with `value` cleared.
-// Canonical JSON (RFC 8785) rather than the wire bytes: protojson isn't
-// byte-stable, so only canonicalizing keeps a record verifiable after it's
-// relayed, re-encoded and stored.
+//     challenge = SHA-256( JCS( D ) )
 //
-// No runtime dependency: the canonicalizer below is hand-written, and
-// signing uses the WebCrypto `crypto` global rather than an import.
-// Identifies this scheme (JCS + SHA-384 + base64url r||s); a verifier that
-// doesn't recognize it should refuse rather than guess.
-export const SPEC = "metacensus.sig/1";
-// P-384/SHA-384 — `UserSignature.Alg`'s `Es384`. The enum is closed; adding
-// another algorithm is a contract release.
+// D is {content, interpretation, keyId, time} for the participant and
+// {signature, interpretation, keyId, time} for the institution. The assertion
+// carries that challenge inside clientDataJSON and signs authenticatorData ‖
+// SHA-256(clientDataJSON). Verification recomputes the challenge, confirms the
+// binding, applies the layer's acceptance policy, then verifies the signature
+// over the wrapper — it never re-serialises clientDataJSON, only hashes the
+// stored bytes and parses them for `challenge`/`type`.
+//
+// This module holds the format primitives: the digest, a headless signer, and
+// verification. The browser passkey ceremony — navigator.credentials.create /
+// get — belongs to the consumer (metacensus/ui#55), which passes its assertion
+// here to be verified. Canonical JSON (RFC 8785) rather than the wire bytes:
+// protojson isn't byte-stable, so only canonicalizing keeps a record verifiable
+// after it's relayed, re-encoded and stored.
+// Versions the whole scheme (JCS + SHA-256 + P-256/ES256 + base64url) as one
+// atom; a verifier that doesn't recognize it should refuse rather than guess.
+export const SPEC = "metacensus.sig/2";
+// clientDataJSON.type values: the participant's is WebAuthn's own, the
+// institution's is honestly its own — never a forged "webauthn.get".
+export const TYPE_GET = "webauthn.get";
+export const TYPE_COUNTERSIGN = "metacensus.countersign";
+// authenticatorData flag bits (WebAuthn §6.1). BE/BS record credential custody
+// (synced vs device-bound) and are read, not set by policy.
+export const FLAG_UP = 1 << 0; // user present
+export const FLAG_UV = 1 << 2; // user verified (a gesture, not mere presence)
+export const FLAG_BE = 1 << 3; // backup eligible (a syncable passkey)
+export const FLAG_BS = 1 << 5; // backed up (currently synced)
+// ES256: ECDSA on P-256 with SHA-256 — WebAuthn's default and this scheme's
+// only algorithm. The enum is gone; a different curve is a different SPEC.
 const ALG = {
     name: "ECDSA",
-    namedCurve: "P-384",
-    hash: "SHA-384",
+    namedCurve: "P-256",
+    hash: "SHA-256",
 };
 // ---------------------------------------------------------------------------
 // JCS (RFC 8785)
 // ---------------------------------------------------------------------------
 /**
- * `value` as RFC 8785 canonical JSON of a ts-proto message — shaped to
- * match what protojson emits on the Go side (see buf.gen.yaml, wire.test.mjs).
+ * A value as RFC 8785 canonical JSON of a ts-proto message — shaped to match
+ * what protojson emits on the Go side (see buf.gen.yaml, wire.test.mjs).
  */
 export function canonicalize(value) {
     if (value === null)
@@ -98,56 +119,147 @@ function stringToJCS(s) {
     return out + '"';
 }
 // ---------------------------------------------------------------------------
-// The chain
+// The digest
 // ---------------------------------------------------------------------------
+/** An Interpretation for content of the given full proto name, under this SPEC. */
+export function interpretation(contentType) {
+    return { spec: SPEC, contentType };
+}
 /**
- * The exact string the digest is taken over — exported so a mismatch between
- * implementations shows up as two strings, not two hashes.
+ * The exact string the participant digest is taken over: {content,
+ * interpretation, keyId, time}. Exported so a mismatch between implementations
+ * shows up as two strings, not two hashes.
  */
-export function signingInput(content, signature) {
-    if (!signature.signingTime) {
+export function userSigningInput(content, interp, keyId, time) {
+    return canonicalize(baseFields(interp, keyId, time, { content }));
+}
+/** The string the institutional digest is taken over: {signature, interpretation, keyId, time}. */
+export function countersignInput(userSignature, interp, keyId, time) {
+    return canonicalize(baseFields(interp, keyId, time, { signature: userSignature }));
+}
+function baseFields(interp, keyId, time, extra) {
+    if (!time) {
         // Message-typed, so canonicalization can't tell "absent" from a default;
         // it must be set explicitly.
-        throw new Error("signing: signingTime is unset; every signature carries the time its signer claims");
+        throw new Error("signing: time is unset; every signature carries the time its signer claims or observes");
     }
-    return canonicalize({ content, signature: { ...signature, value: "" } });
+    if (!keyId)
+        throw new Error("signing: keyId is unset; the signer's enrolled key must be named");
+    return { interpretation: interp, keyId, time, ...extra };
+}
+/** SHA-256 over userSigningInput — the participant assertion's challenge. */
+export async function userChallenge(content, interp, keyId, time) {
+    return challenge(userSigningInput(content, interp, keyId, time));
 }
-/** SHA-384 over `signingInput`. */
-export async function digest(content, signature) {
-    const bytes = new TextEncoder().encode(signingInput(content, signature));
-    return crypto.subtle.digest("SHA-384", bytes);
+/** SHA-256 over countersignInput — the institutional assertion's challenge. */
+export async function countersignChallenge(userSignature, interp, keyId, time) {
+    return challenge(countersignInput(userSignature, interp, keyId, time));
+}
+async function challenge(input) {
+    return new Uint8Array(await sha256(new TextEncoder().encode(input)));
+}
+/**
+ * authenticatorData for a headless signer: SHA-256(rpId) ‖ flags ‖ signCount(0).
+ * A participant's comes from the authenticator with the real UV/BE/BS flags.
+ */
+export async function authenticatorData(rpId, flags) {
+    const hash = new Uint8Array(await sha256(new TextEncoder().encode(rpId)));
+    const out = new Uint8Array(37);
+    out.set(hash, 0);
+    out[32] = flags & 0xff;
+    return out;
 }
 /**
- * Signs `content`, returning the `value` for the signature. Fills in
- * nothing else — the other fields are the signer's own claims and are
- * already inside the digest.
+ * Builds the assertion a headless signer emits: fills the challenge, serialises
+ * clientDataJSON, and signs authenticatorData ‖ SHA-256(clientDataJSON) with
+ * privateKey, DER-encoded as WebAuthn does. authData carries the honest flags
+ * (see authenticatorData). For a participant, the browser produces all of this
+ * and this module only verifies it.
  */
-export async function sign(privateKey, content, signature) {
-    checkAttributes(signature);
-    const raw = await crypto.subtle.sign(ALG, privateKey, new TextEncoder().encode(signingInput(content, signature)));
-    // WebCrypto returns fixed-width r||s directly, not a DER SEQUENCE — no
-    // re-encoding needed.
-    return toBase64Url(new Uint8Array(raw));
-}
-/** Checks `signature` against `content` under `publicKey`. */
-export async function verify(publicKey, content, signature) {
-    checkAttributes(signature);
-    const value = fromBase64Url(signature.value);
-    return crypto.subtle.verify(ALG, publicKey, value, new TextEncoder().encode(signingInput(content, signature)));
-}
-// Checked by both sign and verify, so a signature this module would refuse
-// is one it will never produce. `contentType` is the caller's responsibility
-// to set correctly — nothing here knows a plain object's proto name.
-function checkAttributes(signature) {
-    if (signature.spec !== SPEC) {
-        throw new Error(`signing: spec is ${JSON.stringify(signature.spec)}, and this module implements ${JSON.stringify(SPEC)}`);
+export async function assert(privateKey, challenge, authData, clientData) {
+    const cdj = new TextEncoder().encode(JSON.stringify({ ...clientData, challenge: toBase64Url(challenge) }));
+    const raw = new Uint8Array(await crypto.subtle.sign(ALG, privateKey, await signedMessage(authData, cdj)));
+    return {
+        authenticatorData: toBase64Url(authData),
+        clientDataJson: toBase64Url(cdj),
+        signature: toBase64Url(rawToDer(raw)),
+    };
+}
+/** authenticatorData ‖ SHA-256(clientDataJSON) — what ES256 then hashes and signs. */
+async function signedMessage(authData, clientDataJSON) {
+    const cdh = new Uint8Array(await sha256(clientDataJSON));
+    const msg = new Uint8Array(authData.length + cdh.length);
+    msg.set(authData, 0);
+    msg.set(cdh, authData.length);
+    return msg;
+}
+/** Accepts a passkey assertion: webauthn.get from a known origin, user-verified. */
+export function participantPolicy(...origins) {
+    return { type: TYPE_GET, origins, requireUV: true };
+}
+/** Accepts the headless countersignature: the institutional type, no origin. */
+export function institutionPolicy() {
+    return { type: TYPE_COUNTERSIGN, origins: [], requireUV: false };
+}
+/**
+ * Checks one assertion against a challenge under publicKey and policy: the
+ * challenge binding, then the assertion's own metadata, then the signature over
+ * the wrapper. clientDataJSON is hashed as stored and only parsed to read
+ * `challenge`/`type`; it is never re-serialised.
+ */
+export async function verifyAssertion(publicKey, assertion, challenge, policy) {
+    const authData = fromBase64Url(assertion.authenticatorData);
+    const cdj = fromBase64Url(assertion.clientDataJson);
+    const sig = fromBase64Url(assertion.signature);
+    if (authData.length < 37)
+        return false;
+    let cd;
+    try {
+        cd = JSON.parse(new TextDecoder().decode(cdj));
+    }
+    catch {
+        return false;
     }
-    if (signature.alg !== "Es384") {
-        throw new Error(`signing: alg is ${JSON.stringify(signature.alg)}, and this module implements "Es384"`);
+    // Challenge binding: the assertion must commit to this record's digest.
+    if (cd.challenge !== toBase64Url(challenge))
+        return false;
+    // Acceptance policy — the honest per-layer difference.
+    if (cd.type !== policy.type)
+        return false;
+    if (policy.origins.length === 0) {
+        if (cd.origin)
+            return false;
     }
-    if (!signature.contentType) {
-        throw new Error("signing: contentType is empty; it names the message the signature covers");
+    else if (!policy.origins.includes(cd.origin ?? "")) {
+        return false;
     }
+    if (policy.requireUV && (authData[32] & FLAG_UV) === 0)
+        return false;
+    return crypto.subtle.verify(ALG, publicKey, derToRaw(sig), await signedMessage(authData, cdj));
+}
+/**
+ * Checks a participant signature over content: the interpretation is this
+ * scheme's and names content's type, the assertion binds to the record's
+ * digest, and it satisfies policy. Resolving publicKey — the enrolled key keyId
+ * names — is the caller's, except at sign-up (see enrolledKey).
+ */
+export async function verifyUser(publicKey, content, interp, signature, policy) {
+    if (interp.spec !== SPEC)
+        return false;
+    if (!signature.assertion)
+        return false;
+    const challenge = await userChallenge(content, interp, signature.keyId, signature.time ?? "");
+    return verifyAssertion(publicKey, signature.assertion, challenge, policy);
+}
+/**
+ * Checks an institutional signature nesting over userSignature: it binds to
+ * userSignature (plus the record's interpretation) and satisfies policy.
+ */
+export async function verifyCountersign(publicKey, userSignature, interp, institutional, policy) {
+    if (!institutional.assertion)
+        return false;
+    const challenge = await countersignChallenge(userSignature, interp, institutional.keyId, institutional.time ?? "");
+    return verifyAssertion(publicKey, institutional.assertion, challenge, policy);
 }
 // ---------------------------------------------------------------------------
 // Keys
@@ -168,26 +280,100 @@ export async function decodePublicKey(encoded) {
     return crypto.subtle.importKey("spki", fromBase64Url(encoded), ALG, true, ["verify"]);
 }
 /**
- * base64url of SHA-256 over the SPKI DER — `UserSignature.keyId`. Derived
- * rather than minted, so a client can compute it before it has an account.
+ * base64url of SHA-256 over the SPKI DER — `Signature.keyId`. Derived rather
+ * than minted, so a client can compute it before it has an account.
  */
 export async function keyId(publicKey) {
     const spki = await crypto.subtle.exportKey("spki", publicKey);
-    return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", spki)));
+    return toBase64Url(new Uint8Array(await sha256(new Uint8Array(spki))));
+}
+/**
+ * Resolves the key being enrolled at sign-up, the one write whose key is not
+ * yet in persistence: the key offered must thumbprint to the keyId claimed, or
+ * a key that is not the sender's could be enrolled under their account. Every
+ * other record resolves keyId against its owner's enrolled key.
+ */
+export async function enrolledKey(publicKey, claimedKeyId) {
+    if (!publicKey)
+        throw new Error("signing: sign-up carries no enrolling public key");
+    const key = await decodePublicKey(publicKey);
+    if ((await keyId(key)) !== claimedKeyId) {
+        throw new Error("signing: keyId does not thumbprint the key offered");
+    }
+    return key;
+}
+// ---------------------------------------------------------------------------
+// Bytes
+// ---------------------------------------------------------------------------
+function sha256(bytes) {
+    return crypto.subtle.digest("SHA-256", bytes);
 }
 function toBase64Url(bytes) {
-    let binary = "";
-    for (const b of bytes)
-        binary += String.fromCharCode(b);
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    return bytes.toBase64({ alphabet: "base64url", omitPadding: true });
 }
 // Uint8Array<ArrayBuffer>, not the default <ArrayBufferLike>: WebCrypto's
-// BufferSource excludes SharedArrayBuffer.
+// BufferSource excludes SharedArrayBuffer. fromBase64's loose chunk handling
+// accepts the unpadded input toBase64Url writes.
 function fromBase64Url(s) {
-    const binary = atob(s.replace(/-/g, "+").replace(/_/g, "/"));
-    const out = new Uint8Array(new ArrayBuffer(binary.length));
-    for (let i = 0; i < binary.length; i++)
-        out[i] = binary.charCodeAt(i);
+    return Uint8Array.fromBase64(s, { alphabet: "base64url" });
+}
+// WebCrypto signs and verifies fixed-width r‖s (IEEE P1363); WebAuthn stores an
+// ASN.1 DER SEQUENCE. These two bridge the formats for P-256 (32-byte coords),
+// so one stored format (DER) serves a passkey and a headless signer alike.
+function rawToDer(raw) {
+    const r = derInt(raw.subarray(0, 32));
+    const s = derInt(raw.subarray(32, 64));
+    const body = new Uint8Array(r.length + s.length);
+    body.set(r, 0);
+    body.set(s, r.length);
+    const out = new Uint8Array(2 + body.length);
+    out[0] = 0x30; // SEQUENCE
+    out[1] = body.length;
+    out.set(body, 2);
     return out;
 }
+// One ASN.1 INTEGER from a big-endian coordinate: strip leading zeros, prepend
+// a 0x00 when the high bit is set so the value stays positive.
+function derInt(coord) {
+    let i = 0;
+    while (i < coord.length - 1 && coord[i] === 0)
+        i++;
+    let v = coord.subarray(i);
+    if (v[0] & 0x80) {
+        const pad = new Uint8Array(v.length + 1);
+        pad.set(v, 1);
+        v = pad;
+    }
+    const out = new Uint8Array(2 + v.length);
+    out[0] = 0x02; // INTEGER
+    out[1] = v.length;
+    out.set(v, 2);
+    return out;
+}
+function derToRaw(der) {
+    // SEQUENCE header, then two INTEGERs; left-pad each coordinate to 32 bytes.
+    let p = 2; // skip 0x30, length
+    if (der[p] !== 0x02)
+        throw new Error("signing: malformed DER signature");
+    const rLen = der[p + 1];
+    const r = der.subarray(p + 2, p + 2 + rLen);
+    p = p + 2 + rLen;
+    if (der[p] !== 0x02)
+        throw new Error("signing: malformed DER signature");
+    const sLen = der[p + 1];
+    const s = der.subarray(p + 2, p + 2 + sLen);
+    const out = new Uint8Array(64);
+    coordInto(out, 0, r);
+    coordInto(out, 32, s);
+    return out;
+}
+// Right-align a DER INTEGER (which may carry a leading 0x00 or be short) into a
+// 32-byte coordinate slot.
+function coordInto(out, at, v) {
+    let i = 0;
+    while (i < v.length - 32)
+        i++; // drop a leading 0x00 pad if present
+    const src = v.subarray(i);
+    out.set(src, at + (32 - src.length));
+}
 //# sourceMappingURL=signing.js.map

package/dist/src/signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/signing.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,mBAAmB;AACnB,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,kCAAkC;AAClC,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AAIpE,2EAA2E;AAC3E,wDAAwD;AACxD,MAAM,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAEvC,4EAA4E;AAC5E,2CAA2C;AAC3C,MAAM,GAAG,GAAqD;IAC5D,IAAI,EAAE,OAAO;IACb,UAAU,EAAE,OAAO;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,MAAM;QACR;YACE,MAAM,IAAI,SAAS,CAAC,YAAY,OAAO,KAAK,wCAAwC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,MAAM;IACrE,+EAA+E;IAC/E,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAC3B,CAAC;IACF,2EAA2E;IAC3E,iCAAiC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAClB,YAAY,CAAC,gEAAgE;YAC3E,0EAA0E;YAC1E,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,KAAK,GAA2B;IACpC,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,IAAI,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;YACpB,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,SAAwB;IACrE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC3B,yEAAyE;QACzE,6BAA6B;QAC7B,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,mCAAmC;AACnC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,SAAwB;IACrE,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,UAAqB,EACrB,OAAgB,EAChB,SAAwB;IAExB,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAClH,uEAAuE;IACvE,sBAAsB;IACtB,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,SAAoB,EACpB,OAAgB,EAChB,SAAwB;IAExB,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,qEAAqE;AACrE,SAAS,eAAe,CAAC,SAAwB;IAC/C,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAA2B,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAoB;IACxD,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,SAAoB;IAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9D,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,0EAA0E;AAC1E,2CAA2C;AAC3C,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/signing.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,6CAA6C;AAC7C,EAAE;AACF,gFAAgF;AAChF,yEAAyE;AACzE,6DAA6D;AAC7D,EAAE;AACF,sCAAsC;AACtC,EAAE;AACF,sEAAsE;AACtE,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,uDAAuD;AACvD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,6CAA6C;AAQ7C,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAC;AAEvC,uEAAuE;AACvE,qEAAqE;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,CAAC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAEzD,+EAA+E;AAC/E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe;AAC9C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,+CAA+C;AAC9E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,uCAAuC;AACtE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,+BAA+B;AAE9D,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,GAAG,GAAqD;IAC5D,IAAI,EAAE,OAAO;IACb,UAAU,EAAE,OAAO;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,KAAK,QAAQ;YACX,MAAM;QACR;YACE,MAAM,IAAI,SAAS,CAAC,YAAY,OAAO,KAAK,wCAAwC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,MAAM;IACrE,+EAA+E;IAC/E,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAC3B,CAAC;IACF,2EAA2E;IAC3E,iCAAiC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAClB,YAAY,CAAC,gEAAgE;YAC3E,0EAA0E;YAC1E,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,KAAK,GAA2B;IACpC,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,IAAI,KAAK,CAAC;QACf,CAAC;aAAM,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;YACpB,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgB,EAChB,MAAsB,EACtB,KAAa,EACb,IAAY;IAEZ,OAAO,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAC9B,aAAwB,EACxB,MAAsB,EACtB,KAAa,EACb,IAAY;IAEZ,OAAO,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,UAAU,CACjB,MAAsB,EACtB,KAAa,EACb,IAAY,EACZ,KAA8B;IAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,yEAAyE;QACzE,6BAA6B;QAC7B,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAChG,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,MAAsB,EACtB,KAAa,EACb,IAAY;IAEZ,OAAO,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAwB,EACxB,MAAsB,EACtB,KAAa,EACb,IAAY;IAEZ,OAAO,SAAS,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAYD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACjE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,UAAqB,EACrB,SAAgB,EAChB,QAAe,EACf,UAAsB;IAEtB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAClC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CACrE,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO;QACL,iBAAiB,EAAE,WAAW,CAAC,QAAQ,CAAC;QACxC,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC;QAChC,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,aAAa,CAAC,QAAe,EAAE,cAAqB;IACjE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAmBD,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,GAAG,OAAiB;IACpD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAoB,EACpB,SAA8B,EAC9B,SAAgB,EAChB,MAAc;IAEd,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAEvC,IAAI,EAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IACxE,IAAI,EAAE,CAAC,SAAS,KAAK,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1D,uDAAuD;IACvD,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,EAAE,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;IAC9B,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAoB,EACpB,OAAgB,EAChB,MAAsB,EACtB,SAAoB,EACpB,MAAc;IAEd,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC,SAAS,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9F,OAAO,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAoB,EACpB,aAAwB,EACxB,MAAsB,EACtB,aAAwB,EACxB,MAAc;IAEd,IAAI,CAAC,aAAa,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnH,OAAO,eAAe,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAA2B,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAoB;IACxD,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,SAAoB;IAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9D,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,YAAoB;IACvE,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,SAAS,MAAM,CAAC,KAAmB;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,0EAA0E;AAC1E,6EAA6E;AAC7E,iDAAiD;AACjD,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAE3E,SAAS,QAAQ,CAAC,GAA4B;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW;IAC1B,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACrB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,+DAA+D;AAC/D,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,GAAG,GAAG,CAAC;IACV,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,UAAU;IACzB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAClB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe;IAC/B,4EAA4E;IAC5E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB;IAC/B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACjB,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrB,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,SAAS,SAAS,CAAC,GAAe,EAAE,EAAU,EAAE,CAAa;IAC3D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,CAAC,EAAE,CAAC,CAAC,qCAAqC;IACpE,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@metacensus/api",
-  "version": "0.2.0",
-  "description": "TypeScript for the MetaCensus API contract (/metacensus/api/v1 and /metacensus/public): generated types, a route manifest, a typed transport-agnostic client per surface, and the signing chain. No runtime dependencies.",
+  "version": "0.4.0",
+  "description": "TypeScript for the MetaCensus API contract (/metacensus/api/v1 and /metacensus/public): generated types, a route manifest, a typed transport-agnostic client per surface, and the signing chain.",
   "type": "module",
   "engines": {
-    "node": ">=22"
+    "node": ">=25"
   },
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -42,7 +42,7 @@
   },
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
-    "check": "tsc --noEmit && node scripts/check-no-runtime.mjs && node scripts/check-entry-points.mjs",
+    "check": "tsc --noEmit && node scripts/check-entry-points.mjs",
     "test": "npm run build && node --test \"test/**/*.test.mjs\"",
     "prepack": "npm run build"
   },