@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/shared-ts/src/passkey-custody/primitives.js

@@ -13,6 +13,10 @@ function requireCanonicalBase64Url(value, label) {
 	if (base64UrlEncode(decoded) !== value) throw new Error(`${label} must be canonical base64url`);
 	return decoded;
 }
+function requireParsed(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField(value, label) {
 	try {
 		return parseDigestB64u(value);
@@ -20,12 +24,14 @@ function parseDigestField(value, label) {
 		throw new Error(`${label} ${error instanceof Error ? error.message : "is not a digest"}`);
 	}
 }
+const PASSKEY_CUSTODY_WRAP_NONCE_LENGTH = 12;
+const PASSKEY_CUSTODY_WRAP_TAG_LENGTH = 16;
 function parseEnvelopeNonceB64u(value, label = "nonceB64u") {
-	if (requireCanonicalBase64Url(value, label).length !== 12) throw new Error(`${label} must decode to a 12-byte ChaCha20Poly1305 nonce`);
+	if (requireCanonicalBase64Url(value, label).length !== PASSKEY_CUSTODY_WRAP_NONCE_LENGTH) throw new Error(`${label} must decode to a 12-byte ChaCha20Poly1305 nonce`);
 	return value;
 }
 function parseEnvelopeCiphertextB64u(value, label = "ciphertextB64u") {
-	if (requireCanonicalBase64Url(value, label).length < 17) throw new Error(`${label} must decode to sealed ciphertext with an authentication tag`);
+	if (requireCanonicalBase64Url(value, label).length < PASSKEY_CUSTODY_WRAP_TAG_LENGTH + 1) throw new Error(`${label} must decode to sealed ciphertext with an authentication tag`);
 	return value;
 }
 function parseEd25519PublicKeyB64u(value, label = "registeredPublicKeyB64u") {
@@ -50,43 +56,7 @@ function parseUnixMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
 	return value;
 }
-function requireRecord(value, label) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-const SECRET_BEARING_FIELD_SUBSTRINGS = [
-	"prf",
-	"kek",
-	"seed",
-	"scalar",
-	"secretkey",
-	"privatekey",
-	"plaintext",
-	"recoverycode",
-	"clientroot",
-	"holdershare"
-];
-/**
-* Rejects every field outside this record's exact shape.
-*
-* `knownOnOtherBranches` names fields that are legitimate public bindings
-* somewhere else in the same union. Those are reported as the branch mismatch
-* they are; only genuinely unknown fields are classified as leaks, so a public
-* key like `clientRootPublicKey33B64u` on the wrong branch is never mistaken
-* for plaintext custody material.
-*/
-function rejectUnknownFields(record, allowed, label, knownOnOtherBranches = []) {
-	const allowedSet = new Set(allowed);
-	const knownSet = new Set(knownOnOtherBranches);
-	for (const field of Object.keys(record)) {
-		if (allowedSet.has(field)) continue;
-		if (knownSet.has(field)) throw new Error(`${label}.${field} is not part of ${label}`);
-		const normalized = field.toLowerCase().replace(/_/g, "");
-		if (!normalized.includes("publickey") && SECRET_BEARING_FIELD_SUBSTRINGS.some((substring) => normalized.includes(substring))) throw new Error(`${label}.${field} must never carry plaintext custody material`);
-		throw new Error(`${label}.${field} is not part of ${label}`);
-	}
-}
 //#endregion
-export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, rejectUnknownFields, requireRecord };
+export { parseDigestField, parseEd25519PublicKeyB64u, parseEnvelopeCiphertextB64u, parseEnvelopeNonceB64u, parseEnvelopeRevision, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u, parseUnixMs, requireParsed };
 
 //# sourceMappingURL=primitives.js.map

package/dist/esm/shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js

@@ -28,10 +28,6 @@ function parseEvmFamilySigningKeySlotId(raw) {
 		value: String(parsed.value)
 	};
 }
-function parseEvmFamilySigningKeySlotIdOrNull(raw) {
-	const parsed = parseEvmFamilySigningKeySlotId(raw);
-	return parsed.ok ? parsed.value : null;
-}
 function requireEvmFamilySigningKeySlotId(value, label = "evmFamilySigningKeySlotId") {
 	const parsed = parseEvmFamilySigningKeySlotId(value);
 	if (parsed.ok) return parsed.value;
@@ -48,6 +44,6 @@ function deriveEvmFamilySigningKeySlotId(input) {
 	].join(":"));
 }
 //#endregion
-export { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotIdOrNull, requireEvmFamilySigningKeySlotId };
+export { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId, requireEvmFamilySigningKeySlotId };
 
 //# sourceMappingURL=evmFamilySigningKeySlotId.js.map

package/dist/esm/shared-ts/src/signing-lanes/index.js

@@ -1,11 +1,11 @@
 import "../utils/domainIds.js";
 import "./evmFamilySigningKeySlotId.js";
 import "./participants.js";
-import "./participantDigest.js";
-import "./ownerContinuity.js";
 import "./rotationParsers.js";
 import "./rotation.js";
+import "./participantDigest.js";
+import "./ownerContinuity.js";
 import "./rotationDigests.js";
+import "./rotationProtocolParsers.js";
 import "./rotationLifecycle.js";
 import "./execution.js";
-import "./linkedEcdsaScope.js";

package/dist/esm/shared-ts/src/signing-lanes/ownerContinuity.js

@@ -1,7 +1,10 @@
 import { hasWhitespaceOrControlCharacters, parseMpcSigningWorkerRef } from "../utils/domainIds.js";
 import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
-import { parseDigestField, rejectUnknownFields, requireRecord } from "../passkey-custody/primitives.js";
+import { requireRecord } from "../utils/validation.js";
+import { rejectUnknownFields } from "../utils/exactRecord.js";
+import { parseDigestField, requireParsed } from "../passkey-custody/primitives.js";
+import { concat } from "../utils/digestEncoding.js";
 import { parseLaneParticipantBindingDigestB64u } from "./participants.js";
 import { encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 } from "./participantDigest.js";
 //#region ../shared-ts/src/signing-lanes/ownerContinuity.ts
@@ -14,10 +17,6 @@ const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
 	"custodyKeyManifestDigestB64u",
 	"sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 /** Parse the owner signer identity without widening it into a generic string. */
 function parseWalletSignerId(raw, label = "walletSignerId") {
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -43,7 +42,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
 		kind: "owner_lane_participant_continuity_v1",
 		signerId: parseWalletSignerId(args.signerId),
 		participantIds,
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
 		custodyKeyManifestDigestB64u: parseDigestField(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
 		sourceIdentityDigestB64u: parseDigestField(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
 	};
@@ -55,21 +54,11 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
 	return buildOwnerLaneParticipantContinuityV1({
 		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
 		participantIds: parseParticipantIds(record.participantIds, `${label}.participantIds`),
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+		signingWorkerId: requireParsed(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
 		custodyKeyManifestDigestB64u: parseDigestField(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
 		sourceIdentityDigestB64u: parseDigestField(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
 	});
 }
-function concat(parts) {
-	const length = parts.reduce((total, part) => total + part.length, 0);
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
 function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
 	const record = parseOwnerLaneParticipantContinuityV1(input);
 	return concat([
@@ -83,9 +72,9 @@ function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
 	]);
 }
 async function computeOwnerLaneParticipantBindingDigestV1(input) {
-	return requireResult(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
+	return requireParsed(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
 //#endregion
-export { OWNER_LANE_PARTICIPANT_BINDING_DOMAIN_V1, buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, ownerLaneParticipantContinuityCanonicalBytesV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };
+export { buildOwnerLaneParticipantContinuityV1, computeOwnerLaneParticipantBindingDigestV1, ownerLaneParticipantContinuityCanonicalBytesV1, parseOwnerLaneParticipantContinuityV1, parseWalletSignerId };
 
 //# sourceMappingURL=ownerContinuity.js.map

package/dist/esm/shared-ts/src/signing-lanes/participantDigest.js

@@ -1,6 +1,7 @@
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { sha256Bytes } from "../utils/digests.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { concat } from "../utils/digestEncoding.js";
 import { buildSigningWorkerParticipantRecordV1, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantRecordV1 } from "./participants.js";
 //#region ../shared-ts/src/signing-lanes/participantDigest.ts
 /** Domain tags are part of the wire contract and must never be shortened. */
@@ -8,16 +9,6 @@ const LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes
 const SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/signing-worker-participant/v1";
 /** The lane digest binds the fixed holder-then-SigningWorker participant set. */
 const LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/lane-participant-set/v1";
-function concat(parts) {
-	const length = parts.reduce((total, part) => total + part.length, 0);
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
 function placeholderParticipantDigest() {
 	const parsed = parseLaneParticipantBindingDigestB64u(base64UrlEncode(new Uint8Array(32)));
 	if (!parsed.ok) throw new Error(parsed.error.message);
@@ -32,13 +23,13 @@ function u32(value) {
 		value & 255
 	]);
 }
-/** LP32(UTF8(value)) from the Refactor 102 canonical encoding. */
+/** LP32(UTF8(value)) from the canonical lane encoding. */
 function encodeLaneCanonicalTextV1(value) {
 	if (typeof value !== "string") throw new Error("canonical text must be a string");
 	const bytes = new TextEncoder().encode(value);
 	return concat([u32(bytes.length), bytes]);
 }
-/** LP32(BASE64URL_DECODE_CANONICAL_32(value)) from the Refactor 102 encoding. */
+/** LP32(BASE64URL_DECODE_CANONICAL_32(value)) from the canonical lane encoding. */
 function encodeLaneCanonicalDigestV1(value) {
 	const parsed = parseDigestB64u(value);
 	return concat([u32(32), base64UrlDecode(parsed)]);
@@ -119,6 +110,6 @@ async function buildSigningWorkerParticipantRecordWithDigestV1(input) {
 	});
 }
 //#endregion
-export { LANE_HOLDER_PARTICIPANT_BINDING_DOMAIN_V1, LANE_PARTICIPANT_SET_BINDING_DOMAIN_V1, SIGNING_WORKER_PARTICIPANT_BINDING_DOMAIN_V1, buildSigningWorkerParticipantRecordWithDigestV1, computeLaneParticipantSetBindingDigestV1, encodeLaneCanonicalDigestV1, encodeLaneCanonicalNonEmptyCountV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1, laneHolderParticipantCanonicalBytesV1, laneParticipantSetCanonicalBytesV1, signingWorkerParticipantCanonicalBytesV1 };
+export { buildSigningWorkerParticipantRecordWithDigestV1, computeLaneParticipantSetBindingDigestV1, encodeLaneCanonicalDigestV1, encodeLaneCanonicalTextV1, encodeLaneCanonicalU64V1 };
 
 //# sourceMappingURL=participantDigest.js.map

package/dist/esm/shared-ts/src/signing-lanes/participants.js

@@ -1,6 +1,7 @@
 import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
+import { requireRecord } from "../utils/validation.js";
 //#region ../shared-ts/src/signing-lanes/participants.ts
 function missing(field) {
 	return {
@@ -89,10 +90,6 @@ function brandRecipientDigest(value) {
 function brandParticipantDigest(value) {
 	return value;
 }
-function requireRecord(raw, label) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${label} must be an object`);
-	return raw;
-}
 function rejectUnknownFields(record, fields, label) {
 	const allowed = new Set(fields);
 	for (const field of Object.keys(record)) if (!allowed.has(field)) throw new Error(`${label}.${field} is not supported`);
@@ -257,6 +254,6 @@ function parseSigningWorkerParticipantRecordV1(raw, label = "signingWorkerPartic
 	});
 }
 //#endregion
-export { buildLaneHolderCustodyIdentityV1, buildLaneHolderParticipantRecordV1, buildSigningWorkerParticipantRecordV1, buildSigningWorkerRecipientIdentityV1, parseHpkePublicKeyB64u, parseLaneCustodyBindingDigestB64u, parseLaneHolderCustodyBindingId, parseLaneHolderCustodyIdentityV1, parseLaneHolderParticipantId, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantId, parseSigningWorkerParticipantRecordV1, parseSigningWorkerRecipientIdentityV1, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId };
+export { buildLaneHolderParticipantRecordV1, buildSigningWorkerParticipantRecordV1, parseHpkePublicKeyB64u, parseLaneCustodyBindingDigestB64u, parseLaneHolderCustodyBindingId, parseLaneHolderParticipantId, parseLaneHolderParticipantRecordV1, parseLaneParticipantBindingDigestB64u, parseSigningWorkerParticipantId, parseSigningWorkerParticipantRecordV1, parseSigningWorkerRecipientKeyDigestB64u, parseSigningWorkerRecipientKeyId };
 
 //# sourceMappingURL=participants.js.map

package/dist/esm/shared-ts/src/signing-lanes/recordParsers.js

@@ -1,5 +1,9 @@
 import { hasWhitespaceOrControlCharacters } from "../utils/domainIds.js";
-import "../utils/registrationIntent.js";
+import "../utils/validation.js";
+import "../utils/exactRecord.js";
+import "../utils/registrationIds.js";
+import "./participants.js";
+import "./ownerContinuity.js";
 //#region ../shared-ts/src/signing-lanes/recordParsers.ts
 const WALLET_KEY_COMMON_FIELDS = [
 	"kind",
@@ -22,7 +26,7 @@ const EVM_WALLET_KEY_FIELDS = [
 	"evmAddress"
 ];
 Array.from(new Set([...ED25519_WALLET_KEY_FIELDS, ...EVM_WALLET_KEY_FIELDS]));
-const SIGNING_LANE_REFERENCE_FIELDS = [
+const SIGNING_LANE_RECORD_BASE_FIELDS = [...[
 	"kind",
 	"walletId",
 	"walletKeyId",
@@ -30,9 +34,7 @@ const SIGNING_LANE_REFERENCE_FIELDS = [
 	"laneKind",
 	"laneShareEpoch",
 	"participantBindingDigestB64u"
-];
-[...SIGNING_LANE_REFERENCE_FIELDS];
-const SIGNING_LANE_RECORD_BASE_FIELDS = [...SIGNING_LANE_REFERENCE_FIELDS, "lifecycle"];
+], "lifecycle"];
 const OWNER_AUTH_SIGNING_LANE_FIELDS = [
 	...SIGNING_LANE_RECORD_BASE_FIELDS,
 	"walletAuthMethodId",

package/dist/esm/shared-ts/src/signing-lanes/rotationDigests.js

@@ -1,8 +1,9 @@
 import { base64UrlDecode, base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { sha256Bytes } from "../utils/digests.js";
-import { ownerLaneParticipantContinuityCanonicalBytesV1 } from "./ownerContinuity.js";
+import { parseDigestB64u, sha256DigestB64u } from "../utils/canonicalPrimitives.js";
+import { concat, lp32, text, u32, u64 } from "../utils/digestEncoding.js";
 import { isProvisionedLaneProtocolSourceV1 } from "./rotation.js";
+import { ownerLaneParticipantContinuityCanonicalBytesV1 } from "./ownerContinuity.js";
 //#region ../shared-ts/src/signing-lanes/rotationDigests.ts
 const ENROLLMENT_MANIFEST_DOMAIN = "seams/rotatable-signing-lanes/enrollment-manifest/v1";
 const AGGREGATE_ACTIVATION_DOMAIN = "seams/rotatable-signing-lanes/aggregate-activation-receipt/v1";
@@ -15,46 +16,6 @@ const SERVER_ACTIVATION_RECEIPT_DOMAIN = "seams/rotatable-signing-lanes/server-a
 const ECDSA_RETIREMENT_RECEIPT_DOMAIN = "seams/rotatable-signing-lanes/ecdsa-retirement-receipt/v1";
 const ED25519_RETIREMENT_RECEIPT_DOMAIN = "seams/rotatable-signing-lanes/ed25519-retirement-receipt/v1";
 const TEXT_ENCODER = new TextEncoder();
-function bytes(value) {
-	return Uint8Array.from(value);
-}
-function concat(parts) {
-	let length = 0;
-	for (const part of parts) length += part.length;
-	const output = new Uint8Array(length);
-	let offset = 0;
-	for (const part of parts) {
-		output.set(part, offset);
-		offset += part.length;
-	}
-	return output;
-}
-function u32(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0 || value > 4294967295) throw new Error(`${label} must be a non-negative u32`);
-	return bytes([
-		value >>> 24 & 255,
-		value >>> 16 & 255,
-		value >>> 8 & 255,
-		value & 255
-	]);
-}
-function u64(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	let remaining = BigInt(value);
-	const output = new Uint8Array(8);
-	for (let index = 7; index >= 0; index -= 1) {
-		output[index] = Number(remaining & 255n);
-		remaining >>= 8n;
-	}
-	return output;
-}
-function lp32(value, label) {
-	return concat([u32(value.length, `${label}.length`), value]);
-}
-function text(value, label) {
-	if (typeof value !== "string") throw new Error(`${label} must be a string`);
-	return lp32(TEXT_ENCODER.encode(value), label);
-}
 function digest(value, label) {
 	try {
 		return lp32(base64UrlDecode(parseDigestB64u(value)), label);
@@ -356,7 +317,7 @@ function encodeEcdsaServerRetirementReceiptCanonicalPayloadV1(value) {
 	]);
 }
 async function computeEcdsaServerRetirementReceiptDigestV1(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeEcdsaServerRetirementReceiptCanonicalPayloadV1(value))));
+	return sha256DigestB64u(encodeEcdsaServerRetirementReceiptCanonicalPayloadV1(value));
 }
 function encodeSigningWorkerLaneMaterialIdentityV1(value) {
 	return concat([
@@ -389,9 +350,9 @@ function encodeEd25519ServerRetirementReceiptCanonicalPayloadV1(value) {
 	]);
 }
 async function computeEd25519ServerRetirementReceiptDigestV1(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeEd25519ServerRetirementReceiptCanonicalPayloadV1(value))));
+	return sha256DigestB64u(encodeEd25519ServerRetirementReceiptCanonicalPayloadV1(value));
 }
 //#endregion
-export { computeAggregateLaneActivationReceiptDigestV1, computeAggregateLaneRevocationReceiptDigestV1, computeEcdsaServerRetirementReceiptDigestV1, computeEd25519ServerRetirementReceiptDigestV1, computeEd25519YaoLaneSessionDigestV1, computeLaneEnrollmentManifestDigestV1, computeRevokeSigningLaneDigestV1, encodeAggregateLaneActivationReceiptV1, encodeAggregateLaneRevocationReceiptV1, encodeEcdsaServerRetirementReceiptCanonicalPayloadV1, encodeEd25519ServerRetirementReceiptCanonicalPayloadV1, encodeEd25519YaoLaneJobTranscriptV1, encodeLaneEnrollmentManifestV1, encodeLaneHolderDeliveryReceiptV1, encodeLaneProtocolCommitReceiptV1, encodeLaneServerActivationReceiptV1, encodeRevokeSigningLaneV1, encodeSigningWorkerLaneMaterialIdentityV1 };
+export { computeAggregateLaneActivationReceiptDigestV1, computeAggregateLaneRevocationReceiptDigestV1, computeEcdsaServerRetirementReceiptDigestV1, computeEd25519ServerRetirementReceiptDigestV1, computeEd25519YaoLaneSessionDigestV1, computeLaneEnrollmentManifestDigestV1, computeRevokeSigningLaneDigestV1, encodeLaneHolderDeliveryReceiptV1, encodeLaneProtocolCommitReceiptV1, encodeLaneServerActivationReceiptV1 };
 
 //# sourceMappingURL=rotationDigests.js.map