raz-encrypt 2.1.0 → 2.4.0

package/dist/store.js

@@ -4,7 +4,7 @@ import { hkdf } from "@noble/hashes/hkdf.js";
 import { hmac } from "@noble/hashes/hmac.js";
 import { sha384 } from "@noble/hashes/sha2.js";
 import { bytesToHex, concatBytes, hexToBytes, randomBytes, utf8ToBytes } from "@noble/hashes/utils.js";
-import { appendFile, mkdir, readFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, rm } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { canonicalize } from "./canonicalJson.js";
 import { writeFileAtomic } from "./fileCrypto.js";
@@ -27,6 +27,10 @@ function logFilePath(storageDir) {
 function headFilePath(storageDir) {
     return join(storageDir, "log.head.json");
 }
+/** Migration journal (ADR 0031): the head record the encrypted log WILL have, MACed like a head, written before the log is rewritten. */
+function journalFilePath(storageDir) {
+    return join(storageDir, "log.head.next.json");
+}
 /**
  * HKDF-derived from BOTH the classical and PQC signing secrets (concatenated,
  * same composition pattern as hybrid.ts's deriveHybridKey) — matching this
@@ -70,7 +74,7 @@ function decryptEntryContent(identity, entry) {
         return JSON.parse(new TextDecoder().decode(plaintext));
     }
     catch (err) {
-        throw new Error(`Audit log entry failed to decrypt: ${err instanceof Error ? err.message : String(err)}`);
+        throw new Error(`Audit log entry failed to decrypt: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
     }
 }
 /**
@@ -114,10 +118,10 @@ function computeHeadMac(identity, head) {
     const key = hkdf(sha384, concatBytes(identity.classical.secretKey, identity.pqcSign.secretKey), undefined, AUDIT_LOG_HEAD_INFO, 32);
     return bytesToHex(hmac(sha384, key, utf8ToBytes(canonicalize(head))));
 }
-async function readHead(identity) {
+async function readHead(identity, path = headFilePath(identity.storageDir)) {
     let raw;
     try {
-        raw = await readFile(headFilePath(identity.storageDir), "utf8");
+        raw = await readFile(path, "utf8");
     }
     catch (err) {
         if (err.code === "ENOENT")
@@ -160,12 +164,43 @@ function checkHeadAgainst(read, entries) {
         return { reason: "head-invalid", brokenAtIndex: entries.length };
     return undefined;
 }
+/**
+ * The head to judge `entries` by. Normally the head file. If a migration crashed after rewriting the
+ * log but before writing the head (ADR 0031), the head file is stale (or, for an empty log, absent); the journal holds the head the
+ * rewritten log should have. The journal is believed only if its MAC verifies AND it names exactly
+ * this log's tip, so it cannot launder a truncation or an edit. Read-only.
+ */
+async function effectiveHead(identity, entries) {
+    const head = await readHead(identity);
+    const headFine = checkHeadAgainst(head, entries) === undefined;
+    const headIsEncrypted = head.state === "ok" && head.head.encrypted === true;
+    if (headFine && headIsEncrypted)
+        return { head, fromJournal: false };
+    const journal = await readHead(identity, journalFilePath(identity.storageDir));
+    // Also taken when the head is "fine" but not marked encrypted: an empty log has no stale head to notice.
+    if (journal.state === "ok" && journal.head.encrypted === true && journal.head.count === entries.length && checkHeadAgainst(journal, entries) === undefined) {
+        return { head: journal, fromJournal: true };
+    }
+    return { head, fromJournal: false };
+}
 async function checkHead(identity, entries) {
-    return checkHeadAgainst(await readHead(identity), entries);
+    return checkHeadAgainst((await effectiveHead(identity, entries)).head, entries);
 }
-async function writeHead(identity, count, mac, encrypted) {
+/** Like effectiveHead, but also finishes an interrupted migration (writes the head, removes the journal) and removes a stale journal. Call only from the serialized append/migrate paths. */
+async function recoverHead(identity, entries) {
+    const { head, fromJournal } = await effectiveHead(identity, entries);
+    if (fromJournal && head.state === "ok") {
+        await writeHead(identity, head.head.count, head.head.mac, true);
+        await rm(journalFilePath(identity.storageDir), { force: true });
+    }
+    else if (head.state === "ok" && checkHeadAgainst(head, entries) === undefined) {
+        await rm(journalFilePath(identity.storageDir), { force: true }); // stale journal from a crash before the log was rewritten
+    }
+    return head;
+}
+async function writeHead(identity, count, mac, encrypted, path = headFilePath(identity.storageDir)) {
     const head = encrypted ? { version: 1, count, mac, encrypted: true } : { version: 1, count, mac };
-    await writeFileAtomic(headFilePath(identity.storageDir), JSON.stringify({ ...head, headMac: computeHeadMac(identity, head) }));
+    await writeFileAtomic(path, JSON.stringify({ ...head, headMac: computeHeadMac(identity, head) }));
 }
 const appendState = new Map();
 function stateFor(storageDir) {
@@ -181,10 +216,13 @@ async function doAppend(identity, entry, state) {
     const full = { ...entry, at: new Date().toISOString() };
     if (!state.tail) {
         const existing = await readStoredEntries(identity.storageDir);
-        const head = await readHead(identity);
+        const head = await recoverHead(identity, existing);
         state.tail = { mac: existing.length > 0 ? existing[existing.length - 1].mac : GENESIS_HASH, entryCount: existing.length };
         state.headTrusted = checkHeadAgainst(head, existing) === undefined;
-        state.encrypted = head.state === "ok" && head.head.encrypted === true;
+        // The mode also comes from the last stored entry, so deleting the head cannot make
+        // new entries land in plaintext inside an encrypted log (ADR 0031).
+        const lastIsEncrypted = existing.length > 0 && isV2Entry(existing[existing.length - 1]);
+        state.encrypted = (head.state === "ok" && head.head.encrypted === true) || lastIsEncrypted;
     }
     const content = state.encrypted ? { version: 2, ...encryptEntryContent(identity, full) } : { ...full };
     const withPrev = { ...content, prevMac: state.tail.mac };
@@ -266,7 +304,7 @@ export async function migrateAuditLogToEncrypted(identity) {
     await task;
 }
 async function doMigrateToEncrypted(identity, state) {
-    const head = await readHead(identity);
+    const head = await recoverHead(identity, await readStoredEntries(identity.storageDir)); // finish an interrupted earlier migration first
     if (head.state === "ok" && head.head.encrypted === true)
         return; // already encrypted — true no-op
     const integrity = await verifyLogIntegrity(identity);
@@ -285,8 +323,11 @@ async function doMigrateToEncrypted(identity, state) {
         prevMac = mac;
     }
     await mkdir(identity.storageDir, { recursive: true, mode: 0o700 });
+    // Crash-safe order (ADR 0031): journal the head the new log will have, then rewrite the log, then the head, then drop the journal.
+    await writeHead(identity, rewritten.length, prevMac, true, journalFilePath(identity.storageDir));
     await writeFileAtomic(logFilePath(identity.storageDir), rewritten.map((entry) => JSON.stringify(entry)).join("\n") + (rewritten.length > 0 ? "\n" : ""));
     await writeHead(identity, rewritten.length, prevMac, true);
+    await rm(journalFilePath(identity.storageDir), { force: true });
     state.tail = { mac: prevMac, entryCount: rewritten.length };
     state.headTrusted = true;
     state.encrypted = true;

package/dist/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAkClD,SAAS,SAAS,CAAC,KAAqB;IACtC,OAAQ,KAA+B,CAAC,OAAO,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAuB;IAC/C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,MAAM,mBAAmB,GAAG,WAAW,CAAC,mCAAmC,CAAC,CAAC;AAC7E,uGAAuG;AACvG,MAAM,mBAAmB,GAAG,WAAW,CAAC,wCAAwC,CAAC,CAAC;AAClF,oKAAoK;AACpK,MAAM,kBAAkB,GAAG,WAAW,CAAC,kCAAkC,CAAC,CAAC;AAE3E,SAAS,WAAW,CAAC,UAAkB;IACrC,OAAO,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,QAAkB;IAC3C,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACjI,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,QAAkB,EAAE,KAA8B;IACpE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,QAAkB;IAC9C,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAChI,CAAC;AAED,4JAA4J;AAC5J,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,WAAW,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,OAAiB;IAChE,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChI,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,iHAAiH;AACjH,SAAS,mBAAmB,CAAC,QAAkB,EAAE,KAAuB;IACtE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5I,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAa,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,SAAkB,EAAE,QAAgB;IAC5D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;aACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,gEAAgE;YAChE,mEAAmE;YACnE,+DAA+D;YAC/D,mEAAmE;YACnE,0BAA0B;YAC1B,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAmB,CAAC;QACzF,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAuBD,SAAS,cAAc,CAAC,QAAkB,EAAE,IAAgB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACpI,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAID,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAClF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACpC,IACE,IAAI,CAAC,OAAO,KAAK,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YACjC,IAAI,CAAC,KAAK,GAAG,CAAC;YACd,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,EACzD,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,IAAI,GAAe,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACxK,OAAO,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC3G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAID,gMAAgM;AAChM,SAAS,gBAAgB,CAAC,IAAc,EAAE,OAAyB;IACjE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAClI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAE/F,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IACjC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACrE,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAkB,EAAE,OAAyB;IACpE,OAAO,gBAAgB,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAkB,EAAE,KAAa,EAAE,GAAW,EAAE,SAAkB;IACzF,MAAM,IAAI,GAAe,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC9G,MAAM,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACjI,CAAC;AA2BD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;AAEnD,SAAS,QAAQ,CAAC,UAAkB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACtF,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,KAA2B,EAAE,KAAkB;IACzF,MAAM,IAAI,GAAa,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAElE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1H,KAAK,CAAC,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC;QACnE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAA4B,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;IAChI,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAoB,CAAC;IAEtD,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnG,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;IAC5D,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,WAAW;QAAE,MAAM,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,KAA2B;IAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5C,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,wBAAwB;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACtF,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,QAAkB;IAC9C,OAAO,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5J,CAAC;AAYD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,eAAe,GAAG,YAAY,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,eAAe,GAAG,GAAG,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IAElD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,QAAkB;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,CAAC;AACb,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,QAAkB,EAAE,KAAkB;IACxE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,iCAAiC;IAElG,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,OAAO,GAAG,YAAY,CAAC;IAC3B,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAa,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC5G,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACrC,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzJ,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAE3D,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC5D,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;AACzB,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAkClD,SAAS,SAAS,CAAC,KAAqB;IACtC,OAAQ,KAA+B,CAAC,OAAO,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAuB;IAC/C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,MAAM,mBAAmB,GAAG,WAAW,CAAC,mCAAmC,CAAC,CAAC;AAC7E,uGAAuG;AACvG,MAAM,mBAAmB,GAAG,WAAW,CAAC,wCAAwC,CAAC,CAAC;AAClF,oKAAoK;AACpK,MAAM,kBAAkB,GAAG,WAAW,CAAC,kCAAkC,CAAC,CAAC;AAE3E,SAAS,WAAW,CAAC,UAAkB;IACrC,OAAO,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;AAC3C,CAAC;AAED,yIAAyI;AACzI,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,QAAkB;IAC3C,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACjI,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,QAAkB,EAAE,KAA8B;IACpE,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,QAAkB;IAC9C,OAAO,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAChI,CAAC;AAED,4JAA4J;AAC5J,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,WAAW,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,OAAiB;IAChE,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChI,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,iHAAiH;AACjH,SAAS,mBAAmB,CAAC,QAAkB,EAAE,KAAuB;IACtE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,GAAG,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5I,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAa,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5H,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,SAAkB,EAAE,QAAgB;IAC5D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;aACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,gEAAgE;YAChE,mEAAmE;YACnE,+DAA+D;YAC/D,mEAAmE;YACnE,0BAA0B;YAC1B,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAmB,CAAC;QACzF,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAuBD,SAAS,cAAc,CAAC,QAAkB,EAAE,IAAgB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACpI,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAID,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,OAAe,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC1F,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAClF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACpC,IACE,IAAI,CAAC,OAAO,KAAK,CAAC;YAClB,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YACjC,IAAI,CAAC,KAAK,GAAG,CAAC;YACd,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;YAC5B,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,EACzD,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,IAAI,GAAe,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACxK,OAAO,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC3G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAID,gMAAgM;AAChM,SAAS,gBAAgB,CAAC,IAAc,EAAE,OAAyB;IACjE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAClI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAE/F,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IACjC,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACrE,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACvF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,QAAkB,EAAE,OAAyB;IACxE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC;IAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IAC5E,IAAI,QAAQ,IAAI,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/E,yGAAyG;IACzG,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3J,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAkB,EAAE,OAAyB;IACpE,OAAO,gBAAgB,CAAC,CAAC,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAClF,CAAC;AAED,6LAA6L;AAC7L,KAAK,UAAU,WAAW,CAAC,QAAkB,EAAE,OAAyB;IACtE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,WAAW,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAChF,MAAM,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,0DAA0D;IAC7H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAkB,EAAE,KAAa,EAAE,GAAW,EAAE,SAAkB,EAAE,OAAe,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC3I,MAAM,IAAI,GAAe,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC9G,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACpG,CAAC;AA2BD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;AAEnD,SAAS,QAAQ,CAAC,UAAkB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACtF,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,KAA2B,EAAE,KAAkB;IACzF,MAAM,IAAI,GAAa,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAElE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1H,KAAK,CAAC,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,SAAS,CAAC;QACnE,mFAAmF;QACnF,oEAAoE;QACpE,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACxF,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,eAAe,CAAC;IAC7F,CAAC;IAED,MAAM,OAAO,GAA4B,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;IAChI,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAoB,CAAC;IAEtD,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnG,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;IAC5D,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,KAAK,CAAC,WAAW;QAAE,MAAM,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,KAA2B;IAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5C,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,wBAAwB;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACtF,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,QAAkB;IAC9C,OAAO,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5J,CAAC;AAYD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,eAAe,GAAG,YAAY,CAAC;IAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC7C,CAAC;QACD,eAAe,GAAG,GAAG,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IAElD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,QAAkB;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,CAAC;AACb,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,QAAkB,EAAE,KAAkB;IACxE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,gDAAgD;IACxI,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,iCAAiC;IAElG,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACjH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,OAAO,GAAG,YAAY,CAAC;IAC3B,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAa,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC5G,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,CAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACrC,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,mIAAmI;IACnI,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACjG,MAAM,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzJ,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhE,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC5D,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;AACzB,CAAC"}

package/dist/trust.d.ts

@@ -30,7 +30,20 @@ export declare class TrustStoreIntegrityError extends Error {
  * Exported (ADR 0026) so the timing-safety test can exercise this exact
  * compare in isolation, without the file I/O its only internal callers do.
  */
-export declare function macMatches(identity: Identity, entries: Entries, mac: unknown): boolean;
+export declare function macMatches(identity: Identity, entries: Entries, mac: unknown, seq?: number): boolean;
+/** What a caller can keep somewhere an attacker on this machine cannot write (a second device, a remote service) to catch a rollback of every local file at once. Not secret. */
+export interface TrustStoreAnchor {
+    seq: number;
+    mac: string;
+}
+/** The current `{ seq, mac }` of the trust store. Store it off-box after changes you care about. */
+export declare function getTrustStoreAnchor(identity: Identity): Promise<TrustStoreAnchor>;
+/**
+ * Throws TrustStoreIntegrityError if the local trust store is older than `anchor`, or has the
+ * same sequence number with different contents. Newer is fine. This is the only check that
+ * catches a rollback where trust.json and trust.seq.json were restored together (ADR 0030).
+ */
+export declare function verifyTrustStoreAnchor(identity: Identity, anchor: TrustStoreAnchor): Promise<void>;
 /**
  * One-time, explicit opt-in (issue #43/ADR 0027) to encrypt `trust.json`'s
  * entries, so filesystem access alone no longer reveals who this identity
@@ -119,7 +132,8 @@ export interface RotationStatement {
  * NEW identity, to get a complete, dual-signed RotationStatement — a single
  * signature from the old key alone is never enough to redirect a peer's
  * trust (see `applyRotation`), so this function's output is not yet usable
- * on its own.
+ * on its own. Even a dual-signed statement is only as trustworthy as the new
+ * fingerprint the receiver confirms out of band (`applyRotation`).
  */
 export declare function beginRotation(oldIdentity: Identity, newCard: PublicCard, options?: {
     rotatedAt?: string;
@@ -130,8 +144,11 @@ export declare function beginRotation(oldIdentity: Identity, newCard: PublicCard
 /**
  * Finishes a key rotation: the NEW identity signs the SAME document
  * `beginRotation` produced, proving the new key exists and agrees to be
- * named as successor — not just asserted unilaterally by whoever holds the
- * old key (which could be an attacker who compromised it alone).
+ * named as successor. This proves the statement's author controls the new
+ * key; it does NOT prove the new key belongs to the real owner — an attacker
+ * who stole the old key can mint their own "new" identity and complete the
+ * statement themselves. Receivers close that gap with `applyRotation`'s
+ * out-of-band `confirmNewFingerprint`.
  */
 export declare function completeRotation(newIdentity: Identity, draft: {
     document: RotationDocument;
@@ -145,8 +162,18 @@ export declare function completeRotation(newIdentity: Identity, draft: {
  * fingerprint). A statement for a card you never trusted is a no-op — this
  * is not a way to seed your trust store with a card you never decided to
  * trust in the first place.
+ *
+ * `options.confirmNewFingerprint` is REQUIRED: the new card's fingerprint as
+ * the real owner gave it to you over a channel the statement did not travel
+ * on (phone call, in person). Dual signatures alone only prove the author
+ * holds both keys; an attacker with a stolen old key supplies their own
+ * "new" key and signs both. Spacing and case are ignored when comparing.
+ * A mismatch returns `{ valid: false, reason: "fingerprint-mismatch" }` and
+ * changes nothing; a missing value throws (ADR 0029).
  */
-export declare function applyRotation(identity: Identity, statement: RotationStatement): Promise<VerifyResult>;
+export declare function applyRotation(identity: Identity, statement: RotationStatement, options: {
+    confirmNewFingerprint: string;
+}): Promise<VerifyResult>;
 export interface RevocationDocument {
     revokedCard: PublicCard;
     revokedAt: string;