@metacensus/api 0.3.0 → 0.4.0

package/dist/src/metacensus/v1/common.d.ts

@@ -14,78 +14,93 @@ export interface HealthcheckResponse {
     status: string;
 }
 /**
- * One participant's signature over one content message. Not verified at the
- * API edge — see README.md, "The signing chain".
+ * How to read a stored record: which signing scheme produced it and which
+ * message its `content` holds. A stored record is append-only — it can be
+ * neither re-signed nor allowed to assume the schema around it stays put — so
+ * it self-describes how to verify it rather than deriving that from the current
+ * envelope. Two independent axes of one concern, so one object; it is a
+ * record-level property, identical for both signatures, sealed by both digests.
+ * See README.md, "The signing chain".
  */
-export interface UserSignature {
+export interface Interpretation {
     /**
-     * Empty only on the sign-up that enrolls the key; public_key carries it
-     * inline there instead.
-     */
-    signerId: string;
-    /** base64url SHA-256 of public_key's SPKI DER. */
-    keyId: string;
-    alg: UserSignature_Alg;
-    /** base64url SPKI DER; set only on the sign-up that enrolls the key. */
-    publicKey: string;
-    /**
-     * The signer's claimed time, not the server's — see `recorded` on signed
-     * records for what the pair does and does not bound.
-     */
-    signingTime?: string | undefined;
-    /**
-     * Exactly how this signature is computed and checked; changing the
-     * canonicalization, digest, or encoding changes this string.
+     * The signing scheme as one atom: canonicalization, digest, curve and
+     * encoding together. Changing any of them changes this string, and a verifier
+     * that does not recognize it refuses rather than guesses.
      */
     spec: string;
     /**
-     * Full proto name of the message `content` holds, e.g.
-     * "metacensus.v1.Prop". Stops a signature over one type being
-     * replayed as another.
+     * Full proto name of the message `content` holds, e.g. "metacensus.v1.Prop".
+     * Read from the record, never inferred from the surrounding envelope: the
+     * envelope's schema may drift, the sealed name does not. Stops a signature
+     * over one type being replayed as another.
      */
     contentType: string;
-    /** Excluded from its own digest by being emptied, not dropped. */
-    value: string;
 }
 /**
- * Closed vocabulary: an unrecognized value fails to decode rather than
- * reaching a verifier. See README.md, "The signing chain", before adding one.
+ * One signature in the chain, in one format for every layer. The participant
+ * signs with a passkey (WebAuthn); the institution countersigns headless
+ * (server/HSM). Both are the same object — a WebAuthn-shaped assertion whose
+ * challenge is the record's digest — so there is one decoder and one crypto
+ * primitive (ECDSA P-256 / ES256) the whole chain down. The only honest
+ * difference between the layers is the assertion's own metadata (`type`,
+ * `origin`, the user-verified flag), which each layer's acceptance policy
+ * checks; it is never a second code path. Not verified at the API edge — see
+ * README.md, "The signing chain".
  */
-export declare enum UserSignature_Alg {
-    Unspecified = "Unspecified",
-    /** Es384 - JOSE fixed-width r||s, never DER. */
-    Es384 = "Es384"
+export interface Signature {
+    /**
+     * Selects the signer's enrolled key from persistence's key history; that
+     * enrolled key is the trust anchor. Deliberately not a key carried on the
+     * record: resolving against persistence is what stops a forged {content, key,
+     * signature} triple verifying against itself. The signer's id is not carried
+     * either — it is this key_id's resolved owner, persistence's to determine,
+     * never a client claim. The one exception is sign-up, where no key is
+     * enrolled yet; see auth.proto's SignUpRequest.
+     */
+    keyId: string;
+    /**
+     * This signer's own time: a participant's claim, an institution's
+     * observation. Inside the digest, so it cannot be re-dated after the fact.
+     * Record ordering still uses the record-level `recorded`, never this — see
+     * `recorded` on the signed records.
+     */
+    time?: string | undefined;
+    /**
+     * The WebAuthn assertion. Stored verbatim; the digest it commits to is
+     * recomputed from the record's own fields at verify time, never
+     * reverse-engineered from what is stored.
+     */
+    assertion?: Signature_Assertion | undefined;
 }
 /**
- * An institution's countersignature over a UserSignature.value — it endorses
- * the author (enrolled and in good standing when the record was written), not
- * the content. Server-minted and outside the user's signature, so it rides on
- * the stored envelope and never inside signed content. Computing and checking
- * it is the store's, below the persistence seam; this contract only carries
- * the shape so a later runtime needs no wire break. See README.md.
+ * What navigator.credentials.get() returns for a passkey, and what a headless
+ * signer emits in the identical shape. WebAuthn does not sign arbitrary bytes:
+ * it signs authenticator_data ‖ SHA-256(client_data_json), with the content
+ * digest carried inside client_data_json.challenge.
  */
-export interface InstitutionalSignature {
-    /** The institution that countersigned. */
-    signerId: string;
+export interface Signature_Assertion {
     /**
-     * base64url SHA-256 of the institution key's SPKI DER, resolved against the
-     * institution's key history the way a user's key_id is.
+     * base64url of authenticatorData: the rpId hash, and the UP/UV/BE/BS flags
+     * a verifier reads presence, user-verification and credential custody
+     * (synced vs device-bound) from. Signed over directly.
      */
-    keyId: string;
-    /** Reuses UserSignature's closed algorithm vocabulary. */
-    alg: UserSignature_Alg;
+    authenticatorData: string;
     /**
-     * The server's observation of when it countersigned; the institution makes
-     * no separately-claimed time.
+     * base64url of the UTF-8 clientDataJSON. Its `challenge` is this record's
+     * digest (base64url); its `type` and, for a passkey, `origin` are the
+     * honest per-layer metadata the acceptance policy checks. A headless signer
+     * uses an honest institutional `type` and no origin, and never forges a
+     * passkey's metadata — the flags and type are the custody signal a verifier
+     * reads.
      */
-    recorded?: string | undefined;
-    /** Versions the countersignature scheme, independently of UserSignature.spec. */
-    spec: string;
+    clientDataJson: string;
     /**
-     * base64url r||s over the countersigned UserSignature.value. Emptied from
-     * its own digest by the same rule as UserSignature.value.
+     * base64url of the ECDSA signature over authenticator_data ‖
+     * SHA-256(client_data_json). DER (ASN.1 SEQUENCE), as WebAuthn emits — not
+     * the fixed-width r‖s the prior scheme carried.
      */
-    value: string;
+    signature: string;
 }
 /**
  * The part of a user record its owner signs. Lives here, not user.proto,

package/dist/src/metacensus/v1/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/common.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,oBAAoB;AAEpB,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,eAAe;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,iBAAiB,CAAC;IACvB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EACR,MAAM,GACN,SAAS,CAAC;IACd;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,oBAAY,iBAAiB;IAC3B,WAAW,gBAAgB;IAC3B,gDAAgD;IAChD,KAAK,UAAU;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,GAAG,EAAE,iBAAiB,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,EACL,MAAM,GACN,SAAS,CAAC;IACd,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/common.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,oBAAoB;AAEpB,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,eAAe;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EACD,MAAM,GACN,SAAS,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/dist/src/metacensus/v1/common.js

@@ -5,14 +5,4 @@
 // source: metacensus/v1/common.proto
 /* eslint-disable */
 export const protobufPackage = "metacensus.v1";
-/**
- * Closed vocabulary: an unrecognized value fails to decode rather than
- * reaching a verifier. See README.md, "The signing chain", before adding one.
- */
-export var UserSignature_Alg;
-(function (UserSignature_Alg) {
-    UserSignature_Alg["Unspecified"] = "Unspecified";
-    /** Es384 - JOSE fixed-width r||s, never DER. */
-    UserSignature_Alg["Es384"] = "Es384";
-})(UserSignature_Alg || (UserSignature_Alg = {}));
 //# sourceMappingURL=common.js.map

package/dist/src/metacensus/v1/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/metacensus/v1/common.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,YAAY;AACZ,gCAAgC;AAChC,iCAAiC;AACjC,qCAAqC;AAErC,oBAAoB;AAEpB,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAyD/C;;;GAGG;AACH,MAAM,CAAN,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,gDAA2B,CAAA;IAC3B,gDAAgD;IAChD,oCAAe,CAAA;AACjB,CAAC,EAJW,iBAAiB,KAAjB,iBAAiB,QAI5B"}
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../../src/metacensus/v1/common.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,YAAY;AACZ,gCAAgC;AAChC,iCAAiC;AACjC,qCAAqC;AAErC,oBAAoB;AAEpB,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC"}

package/dist/src/metacensus/v1/prop.d.ts

@@ -1,26 +1,26 @@
-import type { InstitutionalSignature, UserSignature } from "./common.js";
+import type { Interpretation, Signature } from "./common.js";
 export declare const protobufPackage = "metacensus.v1";
 /** Propositions and votes: the consensus mechanism. */
 /**
  * A motion a topic's members vote on, as a signed record. `author_id` and
- * `created` were removed: they're `user_signature.signer_id` and
- * `.signing_time` now.
+ * `created` were removed: the author is `user_signature.key_id`'s resolved
+ * owner, and the claimed time is `user_signature.time`.
  */
 export interface PropSigned {
-    /** Minted by the server, outside the signature. */
+    /** Minted by the server, outside every signature. */
     id: string;
-    /**
-     * Server's observation; see UserSignature.signing_time for the author's
-     * claim.
-     */
+    /** Server's observation; see Signature.time for the author's claim. */
     recorded?: string | undefined;
     content?: Prop | undefined;
-    userSignature?: UserSignature | undefined;
+    /** How to read this record; sealed by both signatures below. */
+    interpretation?: Interpretation | undefined;
+    /** The participant vouches for `content`. */
+    userSignature?: Signature | undefined;
     /**
-     * The institution's countersignature over user_signature.value; see
-     * UserSigned.
+     * The institution vouches for `user_signature` (it nests over it); see
+     * UserSigned and README.md, "The signing chain".
      */
-    institutionalSignature?: InstitutionalSignature | undefined;
+    institutionalSignature?: Signature | undefined;
 }
 /**
  * What a prop's author signs; carries `topic_id` but not the prop's own
@@ -50,20 +50,20 @@ export declare enum Prop_Type {
 export interface VoteSigned {
     /**
      * Server's observation, and the only ordering a reader may use —
-     * `user_signature.signing_time` is the voter's own claim.
+     * `user_signature.time` is the voter's own claim.
      */
     recorded?: string | undefined;
     content?: Vote | undefined;
-    userSignature?: UserSignature | undefined;
-    /**
-     * The institution's countersignature over user_signature.value; see
-     * UserSigned. VoteSigned mints no id, so this is 4, not 5.
-     */
-    institutionalSignature?: InstitutionalSignature | undefined;
+    /** How to read this record; sealed by both signatures below. */
+    interpretation?: Interpretation | undefined;
+    /** The participant vouches for `content`. */
+    userSignature?: Signature | undefined;
+    /** The institution vouches for `user_signature`; see UserSigned. */
+    institutionalSignature?: Signature | undefined;
 }
 /**
- * What a voter signs. `user_id` duplicates `user_signature.signer_id` by
- * design; persistence owes refusing the two when they disagree (see
+ * What a voter signs. `user_id` duplicates the author `user_signature.key_id`
+ * resolves to; persistence owes refusing the two when they disagree (see
  * README.md, "Open questions").
  */
 export interface Vote {
@@ -100,13 +100,15 @@ export interface PropGetRequest {
     propId: string;
 }
 /**
- * No author field — that's `user_signature.signer_id`. `topic_id` is bound
- * by the path and re-signed inside `content`; the two must agree.
+ * No author field — the author is `user_signature.key_id`'s resolved owner.
+ * `topic_id` is bound by the path and re-signed inside `content`; the two must
+ * agree. `interpretation` is the client's, re-stamped onto the stored record.
  */
 export interface PropCreateRequest {
     topicId: string;
     content?: Prop | undefined;
-    userSignature?: UserSignature | undefined;
+    interpretation?: Interpretation | undefined;
+    userSignature?: Signature | undefined;
 }
 export interface VoteListRequest {
     topicId: string;
@@ -124,6 +126,7 @@ export interface VoteSetRequest {
     topicId: string;
     propId: string;
     content?: Vote | undefined;
-    userSignature?: UserSignature | undefined;
+    interpretation?: Interpretation | undefined;
+    userSignature?: Signature | undefined;
 }
 //# sourceMappingURL=prop.d.ts.map

package/dist/src/metacensus/v1/prop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prop.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/prop.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEzE,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,uDAAuD;AAEvD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EACV,aAAa,GACb,SAAS,CAAC;IACd;;;OAGG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAC7D;AAED;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,kDAAkD;AAClD,oBAAY,SAAS;IACnB,WAAW,gBAAgB;IAC3B,SAAS,cAAc;IACvB,aAAa,kBAAkB;IAC/B,WAAW,gBAAgB;IAC3B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,uBAAuB,4BAA4B;IACnD,wBAAwB,6BAA6B;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EACV,aAAa,GACb,SAAS,CAAC;IACd;;;OAGG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAC7D;AAED;;;;GAIG;AACH,MAAM,WAAW,IAAI;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,oBAAY,aAAa;IACvB,WAAW,gBAAgB;IAC3B,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC3C"}
+{"version":3,"file":"prop.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/prop.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7D,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,uDAAuD;AAEvD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EACJ,IAAI,GACJ,SAAS,CAAC;IACd,gEAAgE;IAChE,cAAc,CAAC,EACX,cAAc,GACd,SAAS,CAAC;IACd,6CAA6C;IAC7C,aAAa,CAAC,EACV,SAAS,GACT,SAAS,CAAC;IACd;;;OAGG;IACH,sBAAsB,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,kDAAkD;AAClD,oBAAY,SAAS;IACnB,WAAW,gBAAgB;IAC3B,SAAS,cAAc;IACvB,aAAa,kBAAkB;IAC/B,WAAW,gBAAgB;IAC3B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,uBAAuB,4BAA4B;IACnD,wBAAwB,6BAA6B;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EACJ,IAAI,GACJ,SAAS,CAAC;IACd,gEAAgE;IAChE,cAAc,CAAC,EACX,cAAc,GACd,SAAS,CAAC;IACd,6CAA6C;IAC7C,aAAa,CAAC,EACV,SAAS,GACT,SAAS,CAAC;IACd,oEAAoE;IACpE,sBAAsB,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,WAAW,IAAI;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAED,oBAAY,aAAa;IACvB,WAAW,gBAAgB;IAC3B,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3B,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,aAAa,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3B,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,aAAa,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACvC"}

package/dist/src/metacensus/v1/prop.js.map

@@ -1 +1 @@
-{"version":3,"file":"prop.js","sourceRoot":"","sources":["../../../../src/metacensus/v1/prop.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,YAAY;AACZ,gCAAgC;AAChC,iCAAiC;AACjC,mCAAmC;AAKnC,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAuC/C,kDAAkD;AAClD,MAAM,CAAN,IAAY,SASX;AATD,WAAY,SAAS;IACnB,wCAA2B,CAAA;IAC3B,oCAAuB,CAAA;IACvB,4CAA+B,CAAA;IAC/B,wCAA2B,CAAA;IAC3B,oCAAuB,CAAA;IACvB,wCAA2B,CAAA;IAC3B,gEAAmD,CAAA;IACnD,kEAAqD,CAAA;AACvD,CAAC,EATW,SAAS,KAAT,SAAS,QASpB;AAyCD,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,4CAA2B,CAAA;IAC3B,4BAAW,CAAA;IACX,oCAAmB,CAAA;IACnB,oCAAmB,CAAA;AACrB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB"}
+{"version":3,"file":"prop.js","sourceRoot":"","sources":["../../../../src/metacensus/v1/prop.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,YAAY;AACZ,gCAAgC;AAChC,iCAAiC;AACjC,mCAAmC;AAKnC,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AA2C/C,kDAAkD;AAClD,MAAM,CAAN,IAAY,SASX;AATD,WAAY,SAAS;IACnB,wCAA2B,CAAA;IAC3B,oCAAuB,CAAA;IACvB,4CAA+B,CAAA;IAC/B,wCAA2B,CAAA;IAC3B,oCAAuB,CAAA;IACvB,wCAA2B,CAAA;IAC3B,gEAAmD,CAAA;IACnD,kEAAqD,CAAA;AACvD,CAAC,EATW,SAAS,KAAT,SAAS,QASpB;AA6CD,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,4CAA2B,CAAA;IAC3B,4BAAW,CAAA;IACX,oCAAmB,CAAA;IACnB,oCAAmB,CAAA;AACrB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB"}

package/dist/src/metacensus/v1/topic.d.ts

@@ -1,22 +1,19 @@
-import type { InstitutionalSignature, UserSignature } from "./common.js";
+import type { Interpretation, Signature } from "./common.js";
 export declare const protobufPackage = "metacensus.v1";
 /** Topics and their membership. */
 /** A systematic review in progress, as a signed record. */
 export interface TopicSigned {
-    /** Minted by the server, outside the signature. */
+    /** Minted by the server, outside every signature. */
     id: string;
-    /**
-     * Server's observation; see UserSignature.signing_time for the author's
-     * claim.
-     */
+    /** Server's observation; see Signature.time for the author's claim. */
     recorded?: string | undefined;
     content?: Topic | undefined;
-    userSignature?: UserSignature | undefined;
-    /**
-     * The institution's countersignature over user_signature.value; see
-     * UserSigned.
-     */
-    institutionalSignature?: InstitutionalSignature | undefined;
+    /** How to read this record; sealed by both signatures below. */
+    interpretation?: Interpretation | undefined;
+    /** The participant vouches for `content`. */
+    userSignature?: Signature | undefined;
+    /** The institution vouches for `user_signature`; see UserSigned. */
+    institutionalSignature?: Signature | undefined;
 }
 /**
  * What a topic's author signs; carries no id — the server mints the
@@ -36,7 +33,8 @@ export interface TopicGetRequest {
 }
 export interface TopicCreateRequest {
     content?: Topic | undefined;
-    userSignature?: UserSignature | undefined;
+    interpretation?: Interpretation | undefined;
+    userSignature?: Signature | undefined;
 }
 /**
  * A user's membership of a topic. No backend implements the member routes

package/dist/src/metacensus/v1/topic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"topic.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/topic.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEzE,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,mCAAmC;AAEnC,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAC5B,aAAa,CAAC,EACV,aAAa,GACb,SAAS,CAAC;IACd;;;OAGG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAC7D;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAC5B,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC3C;AAED;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"topic.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/topic.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7D,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,mCAAmC;AAEnC,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EACJ,KAAK,GACL,SAAS,CAAC;IACd,gEAAgE;IAChE,cAAc,CAAC,EACX,cAAc,GACd,SAAS,CAAC;IACd,6CAA6C;IAC7C,aAAa,CAAC,EACV,SAAS,GACT,SAAS,CAAC;IACd,oEAAoE;IACpE,sBAAsB,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAC5B,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,aAAa,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,gEAAgE;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/src/metacensus/v1/user.d.ts

@@ -1,25 +1,23 @@
-import type { InstitutionalSignature, User, UserSignature } from "./common.js";
+import type { Interpretation, Signature, User } from "./common.js";
 export declare const protobufPackage = "metacensus.v1";
 /** Users. Sign-up and login live in auth.proto. */
 /**
- * A signed record. Also the key directory: reading a user's enrolling
- * `user_signature.public_key` is how a verifier resolves a `key_id`.
+ * A signed record. Also the key directory: a user's enrolling key (carried on
+ * the SignUpRequest that created them) is how a verifier resolves a `key_id` to
+ * its trust anchor.
  */
 export interface UserSigned {
-    /** Minted by the server, outside the signature. */
+    /** Minted by the server, outside every signature. */
     id: string;
-    /**
-     * Server's observation; see UserSignature.signing_time for the author's
-     * claim.
-     */
+    /** Server's observation; see Signature.time for the author's claim. */
     recorded?: string | undefined;
     content?: User | undefined;
-    userSignature?: UserSignature | undefined;
-    /**
-     * The institution's countersignature over `user_signature.value`; see the
-     * InstitutionalSignature type.
-     */
-    institutionalSignature?: InstitutionalSignature | undefined;
+    /** How to read this record; sealed by both signatures below. */
+    interpretation?: Interpretation | undefined;
+    /** The participant vouches for `content`. */
+    userSignature?: Signature | undefined;
+    /** The institution vouches for `user_signature`; see the Signature type. */
+    institutionalSignature?: Signature | undefined;
 }
 export interface UserListRequest {
 }

package/dist/src/metacensus/v1/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/user.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE/E,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,mDAAmD;AAEnD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3B,aAAa,CAAC,EACV,aAAa,GACb,SAAS,CAAC;IACd;;;OAGG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;CAC9B"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/user.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnE,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,mDAAmD;AAEnD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EACJ,IAAI,GACJ,SAAS,CAAC;IACd,gEAAgE;IAChE,cAAc,CAAC,EACX,cAAc,GACd,SAAS,CAAC;IACd,6CAA6C;IAC7C,aAAa,CAAC,EACV,SAAS,GACT,SAAS,CAAC;IACd,4EAA4E;IAC5E,sBAAsB,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;CAC9B"}

package/dist/src/route-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-manifest.d.ts","sourceRoot":"","sources":["../../src/route-manifest.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,SAAS,uBAAuB,CAAC;AAK9C,eAAO,MAAM,YAAY,uBAAuB,CAAC;AAMjD,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,MAAM,EAAE,SAAS,KAAK,EAmBlC,CAAC"}
+{"version":3,"file":"route-manifest.d.ts","sourceRoot":"","sources":["../../src/route-manifest.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,SAAS,uBAAuB,CAAC;AAK9C,eAAO,MAAM,YAAY,uBAAuB,CAAC;AAMjD,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,MAAM,EAAE,SAAS,KAAK,EAoBlC,CAAC"}

package/dist/src/route-manifest.js

@@ -16,7 +16,8 @@ export const publicPrefix = "/metacensus/public";
 export const routes = [
     { prefix: apiPrefix, service: "AuthRoutes", rpc: "Login", method: "POST", path: "/login", params: [], query: [], body: "*", signed: false, request: "LoginRequest", response: "Session" },
     { prefix: apiPrefix, service: "AuthRoutes", rpc: "SignUp", method: "POST", path: "/signup", params: [], query: [], body: "*", signed: true, request: "SignUpRequest", response: "Session" },
-    { prefix: apiPrefix, service: "AuthRoutes", rpc: "Logout", method: "POST", path: "/logout", params: [], query: [], body: "", signed: false, request: "LogoutRequest", response: "LogoutResponse" },
+    { prefix: apiPrefix, service: "AuthRoutes", rpc: "Refresh", method: "POST", path: "/refresh", params: [], query: [], body: "*", signed: false, request: "RefreshRequest", response: "Session" },
+    { prefix: apiPrefix, service: "AuthRoutes", rpc: "Logout", method: "POST", path: "/logout", params: [], query: [], body: "*", signed: false, request: "LogoutRequest", response: "LogoutResponse" },
     { prefix: apiPrefix, service: "HealthRoutes", rpc: "Healthcheck", method: "GET", path: "/healthcheck", params: [], query: [], body: "", signed: false, request: "HealthcheckRequest", response: "HealthcheckResponse" },
     { prefix: apiPrefix, service: "PropRoutes", rpc: "ListProps", method: "GET", path: "/topic/{topicId}/prop", params: ["topicId"], query: [], body: "", signed: false, request: "PropListRequest", response: "PropList" },
     { prefix: apiPrefix, service: "PropRoutes", rpc: "GetProp", method: "GET", path: "/topic/{topicId}/prop/{propId}", params: ["topicId", "propId"], query: [], body: "", signed: false, request: "PropGetRequest", response: "PropSigned" },

package/dist/src/route-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-manifest.js","sourceRoot":"","sources":["../../src/route-manifest.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C,2EAA2E;AAC3E,uEAAuE;AACvE,gEAAgE;AAChE,EAAE;AACF,4DAA4D;AAC5D,0EAA0E;AAE1E,yFAAyF;AACzF,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAE9C,8GAA8G;AAC9G,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAoBjD,MAAM,CAAC,MAAM,MAAM,GAAqB;IACtC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE;IACzL,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE;IAC3L,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IAClM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IACvN,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE;IACvN,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE;IACzO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC7N,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qCAAqC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE;IAC/O,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC/O,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE;IACnM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE;IACrN,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,aAAa,EAAE;IACzM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAChO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC5O,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE;IAC9L,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC9M,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC7L,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;CAC9N,CAAC"}
+{"version":3,"file":"route-manifest.js","sourceRoot":"","sources":["../../src/route-manifest.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C,2EAA2E;AAC3E,uEAAuE;AACvE,gEAAgE;AAChE,EAAE;AACF,4DAA4D;AAC5D,0EAA0E;AAE1E,yFAAyF;AACzF,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAE9C,8GAA8G;AAC9G,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAoBjD,MAAM,CAAC,MAAM,MAAM,GAAqB;IACtC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE;IACzL,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE;IAC3L,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE;IAC/L,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACnM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,qBAAqB,EAAE;IACvN,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE;IACvN,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE;IACzO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC7N,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qCAAqC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE;IAC/O,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC/O,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE;IACnM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,aAAa,EAAE;IACrN,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,aAAa,EAAE;IACzM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAChO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC5O,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE;IAC9L,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC9M,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC7L,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;CAC9N,CAAC"}

package/dist/src/signing.d.ts

@@ -1,25 +1,84 @@
-import type { UserSignature } from "./metacensus/v1/common.js";
-export declare const SPEC = "metacensus.sig/1";
+import type { Interpretation, Signature, Signature_Assertion } from "./metacensus/v1/common.js";
+type Bytes = Uint8Array<ArrayBuffer>;
+export declare const SPEC = "metacensus.sig/2";
+export declare const TYPE_GET = "webauthn.get";
+export declare const TYPE_COUNTERSIGN = "metacensus.countersign";
+export declare const FLAG_UP: number;
+export declare const FLAG_UV: number;
+export declare const FLAG_BE: number;
+export declare const FLAG_BS: number;
 /**
- * `value` as RFC 8785 canonical JSON of a ts-proto message — shaped to
- * match what protojson emits on the Go side (see buf.gen.yaml, wire.test.mjs).
+ * A value as RFC 8785 canonical JSON of a ts-proto message — shaped to match
+ * what protojson emits on the Go side (see buf.gen.yaml, wire.test.mjs).
  */
 export declare function canonicalize(value: unknown): string;
+/** An Interpretation for content of the given full proto name, under this SPEC. */
+export declare function interpretation(contentType: string): Interpretation;
 /**
- * The exact string the digest is taken over — exported so a mismatch between
- * implementations shows up as two strings, not two hashes.
+ * The exact string the participant digest is taken over: {content,
+ * interpretation, keyId, time}. Exported so a mismatch between implementations
+ * shows up as two strings, not two hashes.
  */
-export declare function signingInput(content: unknown, signature: UserSignature): string;
-/** SHA-384 over `signingInput`. */
-export declare function digest(content: unknown, signature: UserSignature): Promise<ArrayBuffer>;
+export declare function userSigningInput(content: unknown, interp: Interpretation, keyId: string, time: string): string;
+/** The string the institutional digest is taken over: {signature, interpretation, keyId, time}. */
+export declare function countersignInput(userSignature: Signature, interp: Interpretation, keyId: string, time: string): string;
+/** SHA-256 over userSigningInput — the participant assertion's challenge. */
+export declare function userChallenge(content: unknown, interp: Interpretation, keyId: string, time: string): Promise<Bytes>;
+/** SHA-256 over countersignInput — the institutional assertion's challenge. */
+export declare function countersignChallenge(userSignature: Signature, interp: Interpretation, keyId: string, time: string): Promise<Bytes>;
+/** The clientDataJSON fields a headless signer sets; a passkey's carries more. */
+export interface ClientData {
+    type: string;
+    origin?: string;
+}
 /**
- * Signs `content`, returning the `value` for the signature. Fills in
- * nothing else — the other fields are the signer's own claims and are
- * already inside the digest.
+ * authenticatorData for a headless signer: SHA-256(rpId) ‖ flags ‖ signCount(0).
+ * A participant's comes from the authenticator with the real UV/BE/BS flags.
  */
-export declare function sign(privateKey: CryptoKey, content: unknown, signature: UserSignature): Promise<string>;
-/** Checks `signature` against `content` under `publicKey`. */
-export declare function verify(publicKey: CryptoKey, content: unknown, signature: UserSignature): Promise<boolean>;
+export declare function authenticatorData(rpId: string, flags: number): Promise<Bytes>;
+/**
+ * Builds the assertion a headless signer emits: fills the challenge, serialises
+ * clientDataJSON, and signs authenticatorData ‖ SHA-256(clientDataJSON) with
+ * privateKey, DER-encoded as WebAuthn does. authData carries the honest flags
+ * (see authenticatorData). For a participant, the browser produces all of this
+ * and this module only verifies it.
+ */
+export declare function assert(privateKey: CryptoKey, challenge: Bytes, authData: Bytes, clientData: ClientData): Promise<Signature_Assertion>;
+/**
+ * What a verifier requires of an assertion's own metadata — the one honest
+ * difference between the layers, and a check here rather than a second verify
+ * path. `type` is the required clientDataJSON.type; `origins`, when non-empty,
+ * is the closed set a participant assertion must name, and when empty requires
+ * no origin (a headless signer); `requireUV` demands the user-verified flag.
+ */
+export interface Policy {
+    type: string;
+    origins: string[];
+    requireUV: boolean;
+}
+/** Accepts a passkey assertion: webauthn.get from a known origin, user-verified. */
+export declare function participantPolicy(...origins: string[]): Policy;
+/** Accepts the headless countersignature: the institutional type, no origin. */
+export declare function institutionPolicy(): Policy;
+/**
+ * Checks one assertion against a challenge under publicKey and policy: the
+ * challenge binding, then the assertion's own metadata, then the signature over
+ * the wrapper. clientDataJSON is hashed as stored and only parsed to read
+ * `challenge`/`type`; it is never re-serialised.
+ */
+export declare function verifyAssertion(publicKey: CryptoKey, assertion: Signature_Assertion, challenge: Bytes, policy: Policy): Promise<boolean>;
+/**
+ * Checks a participant signature over content: the interpretation is this
+ * scheme's and names content's type, the assertion binds to the record's
+ * digest, and it satisfies policy. Resolving publicKey — the enrolled key keyId
+ * names — is the caller's, except at sign-up (see enrolledKey).
+ */
+export declare function verifyUser(publicKey: CryptoKey, content: unknown, interp: Interpretation, signature: Signature, policy: Policy): Promise<boolean>;
+/**
+ * Checks an institutional signature nesting over userSignature: it binds to
+ * userSignature (plus the record's interpretation) and satisfies policy.
+ */
+export declare function verifyCountersign(publicKey: CryptoKey, userSignature: Signature, interp: Interpretation, institutional: Signature, policy: Policy): Promise<boolean>;
 /** Generates a signing keypair. The private key is non-extractable. */
 export declare function generateKeyPair(): Promise<CryptoKeyPair>;
 /**
@@ -30,8 +89,16 @@ export declare function encodePublicKey(publicKey: CryptoKey): Promise<string>;
 /** Reads what `encodePublicKey` wrote. */
 export declare function decodePublicKey(encoded: string): Promise<CryptoKey>;
 /**
- * base64url of SHA-256 over the SPKI DER — `UserSignature.keyId`. Derived
- * rather than minted, so a client can compute it before it has an account.
+ * base64url of SHA-256 over the SPKI DER — `Signature.keyId`. Derived rather
+ * than minted, so a client can compute it before it has an account.
  */
 export declare function keyId(publicKey: CryptoKey): Promise<string>;
+/**
+ * Resolves the key being enrolled at sign-up, the one write whose key is not
+ * yet in persistence: the key offered must thumbprint to the keyId claimed, or
+ * a key that is not the sender's could be enrolled under their account. Every
+ * other record resolves keyId against its owner's enrolled key.
+ */
+export declare function enrolledKey(publicKey: string, claimedKeyId: string): Promise<CryptoKey>;
+export {};
 //# sourceMappingURL=signing.d.ts.map

package/dist/src/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/signing.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAI/D,eAAO,MAAM,IAAI,qBAAqB,CAAC;AAcvC;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAyBnD;AAoDD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,GAAG,MAAM,CAO/E;AAED,mCAAmC;AACnC,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAG7F;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CACxB,UAAU,EAAE,SAAS,EACrB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,aAAa,GACvB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,8DAA8D;AAC9D,wBAAsB,MAAM,CAC1B,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,aAAa,GACvB,OAAO,CAAC,OAAO,CAAC,CAIlB;AAqBD,uEAAuE;AACvE,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAE9D;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E;AAED,0CAA0C;AAC1C,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzE;AAED;;;GAGG;AACH,wBAAsB,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGjE"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/signing.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIhG,KAAK,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;AAIrC,eAAO,MAAM,IAAI,qBAAqB,CAAC;AAIvC,eAAO,MAAM,QAAQ,iBAAiB,CAAC;AACvC,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AAIzD,eAAO,MAAM,OAAO,QAAS,CAAC;AAC9B,eAAO,MAAM,OAAO,QAAS,CAAC;AAC9B,eAAO,MAAM,OAAO,QAAS,CAAC;AAC9B,eAAO,MAAM,OAAO,QAAS,CAAC;AAc9B;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAyBnD;AAoDD,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAElE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,MAAM,CAER;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,SAAS,EACxB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,MAAM,CAER;AAiBD,6EAA6E;AAC7E,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC,CAEhB;AAED,+EAA+E;AAC/E,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,SAAS,EACxB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,KAAK,CAAC,CAEhB;AAUD,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAMnF;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAC1B,UAAU,EAAE,SAAS,EACrB,SAAS,EAAE,KAAK,EAChB,QAAQ,EAAE,KAAK,EACf,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,mBAAmB,CAAC,CAU9B;AAeD;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE9D;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,mBAAmB,EAC9B,SAAS,EAAE,KAAK,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,SAAS,EACxB,MAAM,EAAE,cAAc,EACtB,aAAa,EAAE,SAAS,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAIlB;AAMD,uEAAuE;AACvE,wBAAsB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAE9D;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E;AAED,0CAA0C;AAC1C,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEzE;AAED;;;GAGG;AACH,wBAAsB,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGjE;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAO7F"}