@metacensus/api 0.3.0 → 0.5.0

package/README.md

@@ -29,6 +29,8 @@ client to reach for. Construct it with:
   (wrap the global to add retries, a 401 policy, or logging).
 - `signer?` — signs writes; see "Writes", below. Omit it for a read-only client.
 - `token?` — an initial bearer token, to resume a session without logging in.
+- `credentials?` — the fetch credentials mode; set `"include"` in a browser so
+  the `HttpOnly` refresh cookie rides `refresh()` and `logout`. See "Auth", below.
 
 A non-2xx response throws `ApiError` (`method`, `url`, `status`, and the raw
 `body` — parse it defensively, since a 404 or 405 comes from the router, not a
@@ -55,38 +57,58 @@ The envelope isn't uniform, so the record isn't either:
 | a member — already flat | `Member`, unchanged / `Member[]` |
 
 When you need the signature itself — verifying authorship, comparing `recorded`
-against the signer's `signingTime`, or re-hashing the document — each
-signed-envelope read has a **`getXSigned`** twin that returns the raw envelope:
+against the signer's `time`, or re-checking the assertion — each signed-envelope
+read has a **`getXSigned`** twin that returns the raw envelope:
 
 ```ts
-const signed = await client.getTopicSigned({ topicId }); // TopicSigned: { id, recorded, content, userSignature }
-await verify(pub, signed.content, signed.userSignature);
+import { verifyUser, participantPolicy } from "@metacensus/api/signing";
+
+const signed = await client.getTopicSigned({ topicId }); // { id, recorded, content, interpretation, userSignature }
+const pub = await resolveEnrolledKey(signed.userSignature.keyId); // your key directory
+await verifyUser(pub, signed.content, signed.interpretation, signed.userSignature, participantPolicy(origin));
 ```
 
 `getXSigned` exists only where there's a signature to see; `Member` has none.
 
 ## Writes and the signer
 
-A write takes **flat content** — never the envelope — and the `signer` assembles
-the rest. The signer is set once on the constructor, because the key it signs
-with is identical for a session:
+A write takes **flat content** — never the envelope — and the `signer` returns
+the record's `interpretation`, the `Signature` over it, and (sign-up only) the
+enrolling `publicKey`; the client assembles the body. The signer is set once on
+the constructor, because the key it signs with is identical for a session. The
+signing mechanism is a **passkey (WebAuthn)**: the signer runs the ceremony and
+packages its assertion — the private key never enters the client, and cannot,
+because a passkey's key is non-extractable in the authenticator.
 
 ```ts
-import { SPEC, sign, keyId } from "@metacensus/api/signing";
+import {
+  interpretation, userChallenge, keyId, participantPolicy,
+} from "@metacensus/api/signing";
 
 const signer: Signer = async (content, contentType) => {
-  const s = {
-    signerId,
-    keyId: await keyId(publicKey),
-    alg: "Es384",
-    publicKey: "",
-    signingTime: new Date().toISOString(),
-    spec: SPEC,
-    contentType, // the client names it — you don't
-    value: "",
+  const interp = interpretation(contentType); // { spec, contentType } — the client names contentType
+  const kid = await keyId(publicKey);
+  const time = new Date().toISOString();
+
+  // The digest the assertion must commit to, carried as the WebAuthn challenge.
+  const challenge = await userChallenge(content, interp, kid, time);
+  const cred = await navigator.credentials.get({
+    publicKey: { challenge, allowCredentials: [/* this device's passkey */] },
+  }); // ui#55 owns provisioning and RP-ID scoping
+
+  const r = cred.response as AuthenticatorAssertionResponse;
+  return {
+    interpretation: interp,
+    signature: {
+      keyId: kid,
+      time,
+      assertion: {
+        authenticatorData: toBase64Url(r.authenticatorData),
+        clientDataJson: toBase64Url(r.clientDataJSON), // its challenge === base64url(challenge)
+        signature: toBase64Url(r.signature),           // DER, verified as-is
+      },
+    },
   };
-  s.value = await sign(privateKey, content, s);
-  return s;
 };
 
 const client = new Client({ baseUrl, signer });
@@ -94,19 +116,40 @@ const created = await client.createTopic({ content: { name: "A review", descript
 // TopicRecord, flattened like a read
 ```
 
-The client supplies `content` and the exact `contentType` (the one thing
-`sign`/`verify` leave to the caller, and the easiest to get wrong); your closure
-holds the key and does the crypto — the key never enters the client. A write on
-a client built without a signer throws.
+The client supplies `content` and the exact `contentType` (the one thing left to
+the caller, and the easiest to get wrong); the signer builds the interpretation
+and the assertion. A headless signer (a server or a test) builds the same shape
+with `assert()` instead of a browser ceremony — one format, both layers. A write
+on a client built without a signer throws. **The browser ceremony above is
+sketch, not shipped: provisioning a passkey to a device, RP-ID scoping across
+environments, and recovery are [ui#55](https://github.com/metacensus/ui/issues/55).**
 
 ## Auth and the session token
 
-`login` and `signUp` store the returned token; the client adds
-`Authorization: Bearer <token>` to every later request, and `logout` clears it.
-`signUp` signs its `User` content through the same signer (that signature enrols
-the key — inline `publicKey`, empty `signerId`; keep the password out of
-`content`, since content is what gets stored). `token` (a getter) exposes the
-current token, to persist and later restore a session via the `token` option.
+There are two tokens. The **access token** is short-lived: `login` and `signUp`
+store the one they return, the client adds `Authorization: Bearer <token>` to
+every later request, and `session.expiresIn` (seconds) says how long it lasts.
+`token` (a getter) exposes the current one, to persist and restore a session via
+the `token` option. `signUp` signs its `User` content through the same signer;
+the signer returns the enrolling `publicKey`, which the client sends on the
+request (not on the signature — no record carries its own verification key) and
+the store binds under the signature's `keyId`. Keep the password out of
+`content`, since content is what gets stored.
+
+The **refresh token** is long-lived and never touches JavaScript. In a browser
+the server keeps it in an `HttpOnly` cookie, so `refresh()` sends an empty body
+and lets the cookie speak — construct the client with `credentials: "include"`
+so the browser attaches that cookie (and the deployment must answer credentialed
+CORS for your origin). `refresh()` returns a fresh `Session` and stores its new
+access token, exactly as `login` does; the refresh token is rotated on each use
+and `logout` revokes it. A non-browser caller with no cookie can instead pass the
+token in `RefreshRequest.refreshToken` (and `LogoutRequest.refreshToken`) — the
+contract is cookie-agnostic; the cookie is a transport the server adds.
+
+The client keeps no refresh policy of its own: a 401 on an expired access token
+is an ordinary `ApiError`, and the consumer decides when to call `refresh()` and
+retry (react-query, say). Refresh at or before `expiresIn` to avoid the round
+trip.
 
 ## The public surface
 
@@ -145,26 +188,32 @@ the enum's comment for why.
 
 ## Signing
 
-Every write on the authenticated surface carries a `content` message and a
-`userSignature` over it. A session token says who is connected; the signature
-says who authored the record, and the API server does not check it — it is
-verified by the persistence layer, behind the edge. `@metacensus/api/signing` is
-what your `Signer` uses to make one:
+Every write on the authenticated surface carries a `content` message, an
+`interpretation`, and a `userSignature` over both. A session token says who is
+connected; the signature says who authored the record, and the API server does
+not check it — it is verified by the persistence layer, behind the edge.
+`@metacensus/api/signing` is what your `Signer` uses, and what a verifier calls:
 
 ```ts
-import { SPEC, sign, verify, keyId, generateKeyPair, encodePublicKey } from "@metacensus/api/signing";
+import {
+  SPEC, interpretation, userChallenge, assert, verifyUser,
+  authenticatorData, participantPolicy, keyId, generateKeyPair, FLAG_UP, FLAG_UV,
+} from "@metacensus/api/signing";
 
-const { privateKey, publicKey } = await generateKeyPair(); // ECDSA P-384
+const { privateKey, publicKey } = await generateKeyPair(); // ECDSA P-256 (ES256)
 ```
 
-The digest is SHA-384 over RFC 8785 canonical JSON of `{content, signature}`,
-with `value` emptied. Every field but `value` is inside it, so a signature cannot
-be re-attributed or re-dated — which is why `contentType` has to name the content
-you actually signed and `signingTime` has to be set. `routes` carries a `signed`
-flag per route, so "which routes need a key?" is a lookup rather than a guess.
-
-The full account of the chain, and `go/signing`, the other half that has to
-compute the same digest, are in the repository README.
+The mechanism is **WebAuthn/passkeys**, one format for both the participant and
+the institution (ECDSA P-256 / ES256). This module is the toolkit: `interpretation`
+and `userChallenge` build the digest, `assert` makes a headless assertion,
+`verifyUser`/`verifyCountersign` check one under a `participantPolicy` or
+`institutionPolicy`. `routes` carries a `signed` flag per route, so "which routes
+need a key?" is a lookup rather than a guess.
+
+The scheme, the digest, and the verify procedure are the repository README's
+"The signing chain"; `go/signing` is the other half that computes the same digest
+and whose DER assertions this module verifies. The browser passkey ceremony
+itself is [ui#55](https://github.com/metacensus/ui/issues/55).
 
 ## Both surfaces
 

package/dist/signing.d.ts

@@ -1,2 +1,3 @@
-export { SPEC, canonicalize, signingInput, digest, sign, verify, generateKeyPair, encodePublicKey, decodePublicKey, keyId, } from "./src/signing.js";
+export { SPEC, TYPE_GET, TYPE_COUNTERSIGN, FLAG_UP, FLAG_UV, FLAG_BE, FLAG_BS, canonicalize, interpretation, userSigningInput, countersignInput, userChallenge, countersignChallenge, authenticatorData, assert, verifyAssertion, verifyUser, verifyCountersign, participantPolicy, institutionPolicy, generateKeyPair, encodePublicKey, decodePublicKey, keyId, enrolledKey, } from "./src/signing.js";
+export type { ClientData, Policy } from "./src/signing.js";
 //# sourceMappingURL=signing.d.ts.map

package/dist/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../signing.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,IAAI,EACJ,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,IAAI,EACJ,MAAM,EACN,eAAe,EACf,eAAe,EACf,eAAe,EACf,KAAK,GACN,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../signing.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,MAAM,EACN,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,KAAK,EACL,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/signing.js

@@ -1,5 +1,5 @@
 // The MetaCensus signing chain, producing the same digest as go/signing. A
 // third entry point splitting by concern, not surface. See ts/README.md,
 // "Signing". The runtime half is src/signing.ts.
-export { SPEC, canonicalize, signingInput, digest, sign, verify, generateKeyPair, encodePublicKey, decodePublicKey, keyId, } from "./src/signing.js";
+export { SPEC, TYPE_GET, TYPE_COUNTERSIGN, FLAG_UP, FLAG_UV, FLAG_BE, FLAG_BS, canonicalize, interpretation, userSigningInput, countersignInput, userChallenge, countersignChallenge, authenticatorData, assert, verifyAssertion, verifyUser, verifyCountersign, participantPolicy, institutionPolicy, generateKeyPair, encodePublicKey, decodePublicKey, keyId, enrolledKey, } from "./src/signing.js";
 //# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing.js","sourceRoot":"","sources":["../signing.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AAEjD,OAAO,EACL,IAAI,EACJ,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,IAAI,EACJ,MAAM,EACN,eAAe,EACf,eAAe,EACf,eAAe,EACf,KAAK,GACN,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../signing.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AAEjD,OAAO,EACL,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,MAAM,EACN,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,eAAe,EACf,KAAK,EACL,WAAW,GACZ,MAAM,kBAAkB,CAAC"}

package/dist/src/client.d.ts

@@ -1,6 +1,6 @@
 import type { PartnerReceipt, PartnerSubmission } from "./metacensus/public/v1/partner.js";
-import type { LoginRequest, LogoutRequest, LogoutResponse, Session, SignUpRequest } from "./metacensus/v1/auth.js";
-import type { HealthcheckRequest, HealthcheckResponse, User, UserSignature } from "./metacensus/v1/common.js";
+import type { LoginRequest, LogoutRequest, LogoutResponse, RefreshRequest, Session, SignUpRequest } from "./metacensus/v1/auth.js";
+import type { HealthcheckRequest, HealthcheckResponse, Interpretation, Signature, User } from "./metacensus/v1/common.js";
 import type { Prop, PropCreateRequest, PropGetRequest, PropListRequest, PropSigned, Vote, VoteListRequest, VoteSetRequest, VoteSigned } from "./metacensus/v1/prop.js";
 import type { Member, MemberGetRequest, MemberListRequest, Topic, TopicCreateRequest, TopicGetRequest, TopicListRequest, TopicSigned } from "./metacensus/v1/topic.js";
 import type { SelfGetRequest, UserGetRequest, UserListRequest, UserSigned } from "./metacensus/v1/user.js";
@@ -11,7 +11,12 @@ export declare class ApiError extends Error {
     readonly body: string;
     constructor(method: string, url: string, status: number, body: string);
 }
-export type Signer = (content: unknown, contentType: string) => Promise<UserSignature>;
+export interface SignResult {
+    interpretation: Interpretation;
+    signature: Signature;
+    publicKey?: string;
+}
+export type Signer = (content: unknown, contentType: string) => Promise<SignResult>;
 export type PropRecord = Pick<PropSigned, "id" | "recorded"> & Prop;
 export type TopicRecord = Pick<TopicSigned, "id" | "recorded"> & Topic;
 export type UserRecord = Pick<UserSigned, "id" | "recorded"> & User;
@@ -22,28 +27,30 @@ export interface ClientOptions {
     readonly signer?: Signer;
     readonly token?: string;
     readonly prefix?: string;
+    readonly credentials?: RequestCredentials;
 }
 export declare class Client {
     #private;
     constructor(options: ClientOptions);
     get token(): string | undefined;
     login(req: LoginRequest): Promise<Session>;
-    signUp(req: Omit<SignUpRequest, "userSignature">): Promise<Session>;
+    signUp(req: Omit<SignUpRequest, "userSignature" | "interpretation" | "publicKey">): Promise<Session>;
+    refresh(req: RefreshRequest): Promise<Session>;
     logout(req: LogoutRequest): Promise<LogoutResponse>;
     healthcheck(req: HealthcheckRequest): Promise<HealthcheckResponse>;
     listProps(req: PropListRequest): Promise<PropRecord[]>;
     listPropsSigned(req: PropListRequest): Promise<PropSigned[]>;
     getProp(req: PropGetRequest): Promise<PropRecord>;
     getPropSigned(req: PropGetRequest): Promise<PropSigned>;
-    createProp(req: Omit<PropCreateRequest, "userSignature">): Promise<PropRecord>;
+    createProp(req: Omit<PropCreateRequest, "userSignature" | "interpretation" | "publicKey">): Promise<PropRecord>;
     listVotes(req: VoteListRequest): Promise<VoteRecord[]>;
     listVotesSigned(req: VoteListRequest): Promise<VoteSigned[]>;
-    setVote(req: Omit<VoteSetRequest, "userSignature">): Promise<VoteRecord>;
+    setVote(req: Omit<VoteSetRequest, "userSignature" | "interpretation" | "publicKey">): Promise<VoteRecord>;
     listTopics(req: TopicListRequest): Promise<TopicRecord[]>;
     listTopicsSigned(req: TopicListRequest): Promise<TopicSigned[]>;
     getTopic(req: TopicGetRequest): Promise<TopicRecord>;
     getTopicSigned(req: TopicGetRequest): Promise<TopicSigned>;
-    createTopic(req: Omit<TopicCreateRequest, "userSignature">): Promise<TopicRecord>;
+    createTopic(req: Omit<TopicCreateRequest, "userSignature" | "interpretation" | "publicKey">): Promise<TopicRecord>;
     listMembers(req: MemberListRequest): Promise<Member[]>;
     getMember(req: MemberGetRequest): Promise<Member>;
     listUsers(req: UserListRequest): Promise<UserRecord[]>;

package/dist/src/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnH,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC9G,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAY,eAAe,EAAE,UAAU,EAAE,IAAI,EAAY,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC3L,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAc,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAa,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC9L,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAY,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAKrH,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJvB,YACW,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAItB;CACF;AAID,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAwBvF,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC;AACpE,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC;AACvE,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC;AACpE,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;AAkB7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAGD,qBAAa,MAAM;;IAOjB,YAAY,OAAO,EAAE,aAAa,EAMjC;IAGD,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAcK,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/C;IAGK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAKxE;IAGK,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAIxD;IAGD,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEjE;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAErD;IAGD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3D;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhD;IAGD,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtD;IAGK,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAInF;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAErD;IAGD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3D;IAGK,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAI7E;IAGD,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAExD;IAGD,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAE9D;IAGD,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAEnD;IAGD,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAEzD;IAGK,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAGtF;IAGD,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAErD;IAGD,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhD;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAErD;IAGD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3D;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhD;IAGD,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtD;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhD;IAGD,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtD;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAGD,qBAAa,YAAY;;IAKvB,YAAY,OAAO,EAAE,mBAAmB,EAIvC;IAOD,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAErE;CACF"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnI,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AAC1H,OAAO,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAY,eAAe,EAAE,UAAU,EAAE,IAAI,EAAY,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC3L,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAc,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAa,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC9L,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAY,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAKrH,qBAAa,QAAS,SAAQ,KAAK;IAE/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJvB,YACW,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAItB;CACF;AAKD,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAyBpF,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC;AACpE,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC;AACvE,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC;AACpE,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;AAkB7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAGzB,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAC3C;AAGD,qBAAa,MAAM;;IAQjB,YAAY,OAAO,EAAE,aAAa,EAOjC;IAGD,IAAI,KAAK,IAAI,MAAM,GAAG,SAAS,CAE9B;IAcK,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/C;IAGK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAKzG;IAGK,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAInD;IAGK,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAIxD;IAGD,WAAW,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAEjE;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAErD;IAGD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3D;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhD;IAGD,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtD;IAGK,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAIpH;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAErD;IAGD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3D;IAGK,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAI9G;IAGD,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAExD;IAGD,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAE9D;IAGD,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAEnD;IAGD,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAEzD;IAGK,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,GAAG,gBAAgB,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAGvH;IAGD,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAErD;IAGD,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhD;IAGD,SAAS,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAErD;IAGD,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAE3D;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhD;IAGD,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtD;IAGD,OAAO,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEhD;IAGD,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtD;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAGD,qBAAa,YAAY;;IAKvB,YAAY,OAAO,EAAE,mBAAmB,EAIvC;IAOD,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAErE;CACF"}

package/dist/src/client.js

@@ -19,13 +19,13 @@ export class ApiError extends Error {
 function param(v) {
     return encodeURIComponent(String(v));
 }
-async function request(f, url, method, body, token) {
+async function request(f, url, method, body, token, credentials) {
     const headers = {};
     if (body !== undefined)
         headers["Content-Type"] = "application/json";
     if (token !== undefined)
         headers["Authorization"] = `Bearer ${token}`;
-    const res = await f(url, { method, headers, body });
+    const res = await f(url, { method, headers, body, credentials });
     if (res.status < 200 || res.status >= 300) {
         throw new ApiError(method, url, res.status, await res.text());
     }
@@ -50,12 +50,14 @@ export class Client {
     #fetch;
     #prefix;
     #signer;
+    #credentials;
     #token;
     constructor(options) {
         this.#baseUrl = options.baseUrl;
         this.#fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
         this.#prefix = options.prefix ?? apiPrefix;
         this.#signer = options.signer;
+        this.#credentials = options.credentials;
         this.#token = options.token;
     }
     // The session token from the last login/signUp, for persisting a session.
@@ -63,7 +65,7 @@ export class Client {
         return this.#token;
     }
     #request(method, path, body) {
-        return request(this.#fetch, this.#baseUrl + this.#prefix + path, method, body, this.#token);
+        return request(this.#fetch, this.#baseUrl + this.#prefix + path, method, body, this.#token, this.#credentials);
     }
     #sign(content, contentType) {
         if (this.#signer === undefined) {
@@ -79,14 +81,20 @@ export class Client {
     }
     // AuthRoutes.SignUp: POST /signup
     async signUp(req) {
-        const userSignature = await this.#sign(req.content, "metacensus.v1.User");
-        const session = await this.#request("POST", "/signup", JSON.stringify({ ...req, userSignature }));
+        const { interpretation, signature, publicKey } = await this.#sign(req.content, "metacensus.v1.User");
+        const session = await this.#request("POST", "/signup", JSON.stringify({ ...req, interpretation, publicKey, userSignature: signature }));
+        this.#token = session.token;
+        return session;
+    }
+    // AuthRoutes.Refresh: POST /refresh
+    async refresh(req) {
+        const session = await this.#request("POST", "/refresh", JSON.stringify(req));
         this.#token = session.token;
         return session;
     }
     // AuthRoutes.Logout: POST /logout
     async logout(req) {
-        const res = await this.#request("POST", "/logout", undefined);
+        const res = await this.#request("POST", "/logout", JSON.stringify(req));
         this.#token = undefined;
         return res;
     }
@@ -113,8 +121,8 @@ export class Client {
     // PropRoutes.CreateProp: POST /topic/{topicId}/prop
     async createProp(req) {
         const { topicId, ...rest } = req;
-        const userSignature = await this.#sign(rest.content, "metacensus.v1.Prop");
-        return flattenProp(await this.#request("POST", `/topic/${param(topicId)}/prop`, JSON.stringify({ ...rest, userSignature })));
+        const { interpretation, signature } = await this.#sign(rest.content, "metacensus.v1.Prop");
+        return flattenProp(await this.#request("POST", `/topic/${param(topicId)}/prop`, JSON.stringify({ ...rest, interpretation, userSignature: signature })));
     }
     // PropRoutes.ListVotes: GET /topic/{topicId}/prop/{propId}/vote
     listVotes(req) {
@@ -127,8 +135,8 @@ export class Client {
     // PropRoutes.SetVote: POST /topic/{topicId}/prop/{propId}/vote
     async setVote(req) {
         const { topicId, propId, ...rest } = req;
-        const userSignature = await this.#sign(rest.content, "metacensus.v1.Vote");
-        return flattenVote(await this.#request("POST", `/topic/${param(topicId)}/prop/${param(propId)}/vote`, JSON.stringify({ ...rest, userSignature })));
+        const { interpretation, signature } = await this.#sign(rest.content, "metacensus.v1.Vote");
+        return flattenVote(await this.#request("POST", `/topic/${param(topicId)}/prop/${param(propId)}/vote`, JSON.stringify({ ...rest, interpretation, userSignature: signature })));
     }
     // TopicRoutes.ListTopics: GET /topic
     listTopics(req) {
@@ -148,8 +156,8 @@ export class Client {
     }
     // TopicRoutes.CreateTopic: POST /topic
     async createTopic(req) {
-        const userSignature = await this.#sign(req.content, "metacensus.v1.Topic");
-        return flattenTopic(await this.#request("POST", "/topic", JSON.stringify({ ...req, userSignature })));
+        const { interpretation, signature } = await this.#sign(req.content, "metacensus.v1.Topic");
+        return flattenTopic(await this.#request("POST", "/topic", JSON.stringify({ ...req, interpretation, userSignature: signature })));
     }
     // TopicRoutes.ListMembers: GET /topic/{topicId}/member
     listMembers(req) {

package/dist/src/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAW3C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE9D,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEtB,MAAM;IACN,GAAG;IACH,MAAM;IACN,IAAI;IAJf,YACW,MAAc,EACd,GAAW,EACX,MAAc,EACd,IAAY;QAErB,KAAK,CAAC,GAAG,MAAM,IAAI,GAAG,UAAU,MAAM,EAAE,CAAC,CAAC;sBALjC,MAAM;mBACN,GAAG;sBACH,MAAM;oBACN,IAAI;QAGb,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAMD,SAAS,KAAK,CAAC,CAA4B;IACzC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,CAA0B,EAC1B,GAAW,EACX,MAAc,EACd,IAAwB,EACxB,KAAyB;IAEzB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAM,CAAC;AACpD,CAAC;AAOD,SAAS,WAAW,CAAC,CAAa;IAChC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,OAAgB,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,CAAc;IAClC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,OAAiB,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAAC,CAAa;IAChC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,OAAgB,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,CAAa;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,OAAgB,EAAE,CAAC;AAC1D,CAAC;AAUD,sCAAsC;AACtC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAS;IACjB,MAAM,CAA0B;IAChC,OAAO,CAAS;IAChB,OAAO,CAAU;IAC1B,MAAM,CAAU;IAEhB,YAAY,OAAsB;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,0EAA0E;IAC1E,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,QAAQ,CAAI,MAAc,EAAE,IAAY,EAAE,IAAa;QACrD,OAAO,OAAO,CAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,OAAgB,EAAE,WAAmB;QACzC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,KAAK,CAAC,GAAiB;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAU,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,MAAM,CAAC,GAAyC;QACpD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAU,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,MAAM,CAAC,GAAkB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAiB,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,6CAA6C;IAC7C,WAAW,CAAC,GAAuB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAsB,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAC9E,CAAC;IAED,kDAAkD;IAClD,SAAS,CAAC,GAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9H,CAAC;IAED,kDAAkD;IAClD,eAAe,CAAC,GAAoB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7G,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,GAAmB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjI,CAAC;IAED,yDAAyD;IACzD,aAAa,CAAC,GAAmB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/G,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,UAAU,CAAC,GAA6C;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACjC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAa,MAAM,EAAE,UAAU,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3I,CAAC;IAED,gEAAgE;IAChE,SAAS,CAAC,GAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACxJ,CAAC;IAED,gEAAgE;IAChE,eAAe,CAAC,GAAoB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvI,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,OAAO,CAAC,GAA0C;QACtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACzC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAa,MAAM,EAAE,UAAU,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IACjK,CAAC;IAED,qCAAqC;IACrC,UAAU,CAAC,GAAqB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAY,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,qCAAqC;IACrC,gBAAgB,CAAC,GAAqB;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAY,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,6CAA6C;IAC7C,QAAQ,CAAC,GAAoB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAc,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzG,CAAC;IAED,6CAA6C;IAC7C,cAAc,CAAC,GAAoB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAc,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtF,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,WAAW,CAAC,GAA8C;QAC9D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC3E,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAc,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC;IAED,uDAAuD;IACvD,WAAW,CAAC,GAAsB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjH,CAAC;IAED,8DAA8D;IAC9D,SAAS,CAAC,GAAqB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAS,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC7G,CAAC;IAED,kCAAkC;IAClC,SAAS,CAAC,GAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,kCAAkC;IAClC,eAAe,CAAC,GAAoB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjF,CAAC;IAED,yCAAyC;IACzC,OAAO,CAAC,GAAmB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrG,CAAC;IAED,yCAAyC;IACzC,aAAa,CAAC,GAAmB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACnF,CAAC;IAED,gCAAgC;IAChC,OAAO,CAAC,GAAmB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChF,CAAC;IAED,gCAAgC;IAChC,aAAa,CAAC,GAAmB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF;AAQD,0DAA0D;AAC1D,MAAM,OAAO,YAAY;IACd,QAAQ,CAAS;IACjB,MAAM,CAA0B;IAChC,OAAO,CAAS;IAEzB,YAAY,OAA4B;QACtC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAChD,CAAC;IAED,QAAQ,CAAI,MAAc,EAAE,IAAY,EAAE,IAAa;QACrD,OAAO,OAAO,CAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/F,CAAC;IAED,qDAAqD;IACrD,qBAAqB,CAAC,GAAsB;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAiB,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAW3C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE9D,+EAA+E;AAC/E,wEAAwE;AACxE,MAAM,OAAO,QAAS,SAAQ,KAAK;IAEtB,MAAM;IACN,GAAG;IACH,MAAM;IACN,IAAI;IAJf,YACW,MAAc,EACd,GAAW,EACX,MAAc,EACd,IAAY;QAErB,KAAK,CAAC,GAAG,MAAM,IAAI,GAAG,UAAU,MAAM,EAAE,CAAC,CAAC;sBALjC,MAAM;mBACN,GAAG;sBACH,MAAM;oBACN,IAAI;QAGb,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAiBD,SAAS,KAAK,CAAC,CAA4B;IACzC,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,CAA0B,EAC1B,GAAW,EACX,MAAc,EACd,IAAwB,EACxB,KAAyB,EACzB,WAAgC;IAEhC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IACrE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACjE,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAM,CAAC;AACpD,CAAC;AAOD,SAAS,WAAW,CAAC,CAAa;IAChC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,OAAgB,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,CAAc;IAClC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,OAAiB,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAAC,CAAa;IAChC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,OAAgB,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,CAAa;IAChC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAI,CAAC,CAAC,OAAgB,EAAE,CAAC;AAC1D,CAAC;AAaD,sCAAsC;AACtC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAS;IACjB,MAAM,CAA0B;IAChC,OAAO,CAAS;IAChB,OAAO,CAAU;IACjB,YAAY,CAAsB;IAC3C,MAAM,CAAU;IAEhB,YAAY,OAAsB;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,0EAA0E;IAC1E,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,QAAQ,CAAI,MAAc,EAAE,IAAY,EAAE,IAAa;QACrD,OAAO,OAAO,CAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACpH,CAAC;IAED,KAAK,CAAC,OAAgB,EAAE,WAAmB;QACzC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,KAAK,CAAC,GAAiB;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAU,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,MAAM,CAAC,GAA0E;QACrF,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACrG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAU,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACjJ,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,oCAAoC;IACpC,KAAK,CAAC,OAAO,CAAC,GAAmB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAU,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,MAAM,CAAC,GAAkB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAiB,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,6CAA6C;IAC7C,WAAW,CAAC,GAAuB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAsB,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IAC9E,CAAC;IAED,kDAAkD;IAClD,SAAS,CAAC,GAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9H,CAAC;IAED,kDAAkD;IAClD,eAAe,CAAC,GAAoB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7G,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,GAAmB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjI,CAAC;IAED,yDAAyD;IACzD,aAAa,CAAC,GAAmB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/G,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,UAAU,CAAC,GAA8E;QAC7F,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACjC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC3F,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAa,MAAM,EAAE,UAAU,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACtK,CAAC;IAED,gEAAgE;IAChE,SAAS,CAAC,GAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACxJ,CAAC;IAED,gEAAgE;IAChE,eAAe,CAAC,GAAoB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvI,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,OAAO,CAAC,GAA2E;QACvF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACzC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC3F,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAa,MAAM,EAAE,UAAU,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5L,CAAC;IAED,qCAAqC;IACrC,UAAU,CAAC,GAAqB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAY,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,qCAAqC;IACrC,gBAAgB,CAAC,GAAqB;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAY,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,6CAA6C;IAC7C,QAAQ,CAAC,GAAoB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAc,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzG,CAAC;IAED,6CAA6C;IAC7C,cAAc,CAAC,GAAoB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAc,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtF,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,WAAW,CAAC,GAA+E;QAC/F,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC3F,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAc,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IAChJ,CAAC;IAED,uDAAuD;IACvD,WAAW,CAAC,GAAsB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjH,CAAC;IAED,8DAA8D;IAC9D,SAAS,CAAC,GAAqB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAS,KAAK,EAAE,UAAU,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC7G,CAAC;IAED,kCAAkC;IAClC,SAAS,CAAC,GAAoB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,kCAAkC;IAClC,eAAe,CAAC,GAAoB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAW,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjF,CAAC;IAED,yCAAyC;IACzC,OAAO,CAAC,GAAmB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrG,CAAC;IAED,yCAAyC;IACzC,aAAa,CAAC,GAAmB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACnF,CAAC;IAED,gCAAgC;IAChC,OAAO,CAAC,GAAmB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChF,CAAC;IAED,gCAAgC;IAChC,aAAa,CAAC,GAAmB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAa,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF;AAQD,0DAA0D;AAC1D,MAAM,OAAO,YAAY;IACd,QAAQ,CAAS;IACjB,MAAM,CAA0B;IAChC,OAAO,CAAS;IAEzB,YAAY,OAA4B;QACtC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAChD,CAAC;IAED,QAAQ,CAAI,MAAc,EAAE,IAAY,EAAE,IAAa;QACrD,OAAO,OAAO,CAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/F,CAAC;IAED,qDAAqD;IACrD,qBAAqB,CAAC,GAAsB;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAiB,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/src/metacensus/v1/auth.d.ts

@@ -1,4 +1,4 @@
-import type { User, UserSignature } from "./common.js";
+import type { Interpretation, Signature, User } from "./common.js";
 export declare const protobufPackage = "metacensus.v1";
 /** Sign-up, login and logout. */
 export interface LoginRequest {
@@ -8,8 +8,9 @@ export interface LoginRequest {
 /**
  * Creates an account and enrolls the signing key every later write is
  * signed with: trust on first use — nobody vouches for the key, the service
- * binds whatever it's handed, and the signature proves possession of the
- * matching private key at enrollment.
+ * binds whatever it's handed, and the assertion proves possession of the
+ * matching private key at enrollment. This is the one write whose key is not
+ * resolved from persistence: no account, and so no key history, exists yet.
  */
 export interface SignUpRequest {
     content?: User | undefined;
@@ -18,17 +19,60 @@ export interface SignUpRequest {
      * signed, stored document.
      */
     password: string;
+    /** How the enrolling assertion is to be read; re-stamped onto the UserSigned. */
+    interpretation?: Interpretation | undefined;
     /**
-     * Over `content`, made with the key being enrolled. `signer_id` is empty
-     * (no id exists yet) and `public_key` carries the key inline.
+     * The public half of the key being enrolled: base64url SPKI DER. Carried
+     * here, on the one enrollment write, rather than on every Signature — a
+     * usually-empty key field on every record is a footgun (forge content, key
+     * and signature and it "verifies"). The store checks `user_signature.key_id`
+     * thumbprints this key before binding it. For a passkey this is the public
+     * key the navigator.credentials.create() ceremony yielded.
      */
-    userSignature?: UserSignature | undefined;
+    publicKey: string;
+    /**
+     * Over `content`, made with the key being enrolled; verified at sign-up
+     * against `public_key` (bound by key_id), not against a resolved key.
+     */
+    userSignature?: Signature | undefined;
 }
 export interface Session {
-    /** Bearer token, sent back as `Authorization: Bearer <token>`. */
+    /**
+     * Short-lived access token, sent back as `Authorization: Bearer <token>`.
+     * Opaque; the client cannot read an expiry out of it, which is what
+     * `expires_in` is for.
+     */
     token: string;
+    /**
+     * Seconds until `token` expires, measured from when this response was
+     * issued. The client refreshes at or before that horizon (see `/refresh`);
+     * it is the only expiry signal, since the token is opaque.
+     */
+    expiresIn: number;
+    /**
+     * Long-lived credential that mints a fresh access token at `/refresh`,
+     * rotated on every use and revoked at logout. In the browser posture it
+     * never travels here: the server lifts it into an `HttpOnly` cookie and
+     * blanks this field, so JavaScript never holds it. A non-browser caller (a
+     * proxy or another server) reads it here instead. See ts/README.md, "Auth
+     * and the session token".
+     */
+    refreshToken: string;
+}
+/**
+ * Exchanges a refresh token for a fresh session. Cookie or body delivery is as
+ * on `Session.refresh_token`; a request that carries neither is rejected.
+ */
+export interface RefreshRequest {
+    refreshToken: string;
 }
 export interface LogoutRequest {
+    /**
+     * The refresh token whose session to end — its rotation lineage and its
+     * access tokens with it. Cookie or body delivery is as on
+     * `Session.refresh_token`.
+     */
+    refreshToken: string;
 }
 export interface LogoutResponse {
 }

package/dist/src/metacensus/v1/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEvD,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,iCAAiC;AAEjC,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EACJ,IAAI,GACJ,SAAS,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,OAAO;IACtB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;CAC7B;AAED,MAAM,WAAW,cAAc;CAC9B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/metacensus/v1/auth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnE,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C,iCAAiC;AAEjC,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EACJ,IAAI,GACJ,SAAS,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,cAAc,CAAC,EACX,cAAc,GACd,SAAS,CAAC;IACd;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,OAAO;IACtB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;CAC9B"}