@interop/wallet-core 0.24.0 → 0.25.0

package/dist/descriptors/logSource.d.ts

@@ -0,0 +1,33 @@
+import { type ResourceLogStore } from '@interop/was-client/log';
+import { type ResourceLogController, type ResourceLogPinStore } from '../resourceLog/index.js';
+import type { EncryptionDescriptorSource } from './acquire.js';
+/**
+ * The state-document schema identifier an encryption descriptor carries in a
+ * governed log entry, per WAS-EC.
+ */
+export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
+/**
+ * Builds the {@link EncryptionDescriptorSource} over per-collection resource
+ * logs. An absent log resolves `undefined` exactly like an absent
+ * Collection Description `encryption` member (a plaintext collection, or one
+ * whose provisioning has not landed); verification failures throw through --
+ * {@link acquireDescriptor} rethrows the refusal classes rather than falling
+ * back to the cache.
+ *
+ * @param options {object}
+ * @param options.logFor {function}   `(collectionId) => ResourceLogStore` --
+ *   the collection's governing log's transport seam
+ * @param options.resolveController {function}
+ *   `() => Promise<ResourceLogController>` -- the caller's currently verified
+ *   controller view, resolved per operation
+ * @param options.pinStoreFor {function}   `(collectionId) =>
+ *   ResourceLogPinStore` -- this client's chain-head pin for the collection's
+ *   log
+ * @returns {EncryptionDescriptorSource}
+ */
+export declare function logGovernedDescriptorSource({ logFor, resolveController, pinStoreFor }: {
+    logFor: (collectionId: string) => ResourceLogStore;
+    resolveController: () => Promise<ResourceLogController>;
+    pinStoreFor: (collectionId: string) => ResourceLogPinStore;
+}): EncryptionDescriptorSource;
+//# sourceMappingURL=logSource.d.ts.map

package/dist/descriptors/logSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,WAAW,EACZ,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,mBAAmB,CAAA;CAC3D,GAAG,0BAA0B,CAuB7B"}

package/dist/descriptors/logSource.js

@@ -0,0 +1,49 @@
+import { WAS_RESOURCE_LOG_METHOD } from '@interop/was-client/log';
+import { readResourceLog, ResourceLogIntegrityError } from '../resourceLog/index.js';
+/**
+ * The state-document schema identifier an encryption descriptor carries in a
+ * governed log entry, per WAS-EC.
+ */
+export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
+/**
+ * Builds the {@link EncryptionDescriptorSource} over per-collection resource
+ * logs. An absent log resolves `undefined` exactly like an absent
+ * Collection Description `encryption` member (a plaintext collection, or one
+ * whose provisioning has not landed); verification failures throw through --
+ * {@link acquireDescriptor} rethrows the refusal classes rather than falling
+ * back to the cache.
+ *
+ * @param options {object}
+ * @param options.logFor {function}   `(collectionId) => ResourceLogStore` --
+ *   the collection's governing log's transport seam
+ * @param options.resolveController {function}
+ *   `() => Promise<ResourceLogController>` -- the caller's currently verified
+ *   controller view, resolved per operation
+ * @param options.pinStoreFor {function}   `(collectionId) =>
+ *   ResourceLogPinStore` -- this client's chain-head pin for the collection's
+ *   log
+ * @returns {EncryptionDescriptorSource}
+ */
+export function logGovernedDescriptorSource({ logFor, resolveController, pinStoreFor }) {
+    return {
+        async collectionEncryption({ collectionId }) {
+            const controller = await resolveController();
+            const current = await readResourceLog({
+                store: logFor(collectionId),
+                controller,
+                expectedMethod: WAS_RESOURCE_LOG_METHOD,
+                pinStore: pinStoreFor(collectionId)
+            });
+            if (current === null) {
+                return undefined;
+            }
+            const state = current.verified.state;
+            if (state.type !== EPOCH_CONFIGURATION_STATE_TYPE) {
+                throw new ResourceLogIntegrityError(`The governed descriptor log carries state of type ` +
+                    `"${state.type}", not "${EPOCH_CONFIGURATION_STATE_TYPE}".`);
+            }
+            return state;
+        }
+    };
+}
+//# sourceMappingURL=logSource.js.map

package/dist/descriptors/logSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,uBAAuB,EAExB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,eAAe,EACf,yBAAyB,EAG1B,MAAM,yBAAyB,CAAA;AAGhC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,WAAW,EAKZ;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;gBACpC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,UAAU;gBACV,cAAc,EAAE,uBAAuB;gBACvC,QAAQ,EAAE,WAAW,CAAC,YAAY,CAAC;aACpC,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;YACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;gBAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;oBAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;YACH,CAAC;YACD,OAAO,KAA6B,CAAA;QACtC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/keys/index.d.ts

@@ -21,7 +21,10 @@
  * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
  *   descriptor store: reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
- *   bare signing client for the login-time direct read.
+ *   bare signing client for the login-time direct read. Sealable
+ *   (`SealableEncryptionDescriptorStore` / `isSealableDescriptorStore`):
+ *   `seal()` appends the idempotent backstop entry when the log's head still
+ *   anchors before the account document's latest membership change.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap, the roster read, and the rotation that retires it.
  * - `convergeUserKeyRosterToDocument` -- the standing detector for a revocation
@@ -51,7 +54,8 @@ export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochs
 export type { CollectionUserKeyRotationOutcome, UserKeyCascadeResult } from './userKeyCascade.js';
 export type { UserKeyRosterReadResult, RosterRecipientDocument } from './userKeyRoster.js';
 export { userKeyRosterDescriptorStore } from './rosterStore.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorStore } from './rosterLogStore.js';
+export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
+export type { SealableEncryptionDescriptorStore } from './rosterLogStore.js';
 export { ensureWalletSpaceEpochs } from './spaceEpochs.js';
 export type { WalletSpaceEpochsResult } from './spaceEpochs.js';
 export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';

package/dist/keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/index.js

@@ -21,7 +21,10 @@
  * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
  *   descriptor store: reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
- *   bare signing client for the login-time direct read.
+ *   bare signing client for the login-time direct read. Sealable
+ *   (`SealableEncryptionDescriptorStore` / `isSealableDescriptorStore`):
+ *   `seal()` appends the idempotent backstop entry when the log's head still
+ *   anchors before the account document's latest membership change.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap, the roster read, and the rotation that retires it.
  * - `convergeUserKeyRosterToDocument` -- the standing detector for a revocation
@@ -47,7 +50,7 @@ export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRe
 export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from './userKeyRoster.js';
 export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
 export { userKeyRosterDescriptorStore } from './rosterStore.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorStore } from './rosterLogStore.js';
+export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
 export { ensureWalletSpaceEpochs } from './spaceEpochs.js';
 export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';
 export { wasClientLabelsStore } from './wasLabelsStore.js';

package/dist/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAU5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAG1D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAU5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAG1D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/rosterLogStore.d.ts

@@ -1,11 +1,30 @@
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import { type ResourceLogStore } from '@interop/was-client/log';
 import { type ResourceLogController, type ResourceLogPinStore, type ResourceLogSigner } from '../resourceLog/index.js';
+import { EPOCH_CONFIGURATION_STATE_TYPE } from '../descriptors/logSource.js';
+export { EPOCH_CONFIGURATION_STATE_TYPE };
 /**
- * The state-document schema identifier an encryption descriptor carries in a
- * governed log entry, per WAS-EC.
+ * An `EncryptionDescriptorStore` whose resource is governed by a resource
+ * log, and can therefore be SEALED: `seal()` runs the sealing sweep
+ * (`sealResourceLog`) against the caller's currently verified controller
+ * view, appending the idempotent no-op backstop entry when the log's head
+ * still anchors before the controller's latest membership change --
+ * `'sealed'` -- and writing nothing when the log is already sealed, absent,
+ * or has no membership change to seal against -- `'noop'`.
  */
-export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
+export interface SealableEncryptionDescriptorStore extends EncryptionDescriptorStore {
+    seal(): Promise<'sealed' | 'noop'>;
+}
+/**
+ * Whether a descriptor store is log-governed and sealable -- the guard the
+ * ceremonies and sweeps use to run the seal backstop only where a governing
+ * log exists (an ordinary Collection-Description-backed store has nothing to
+ * seal).
+ *
+ * @param store {EncryptionDescriptorStore}
+ * @returns {boolean}
+ */
+export declare function isSealableDescriptorStore(store: EncryptionDescriptorStore): store is SealableEncryptionDescriptorStore;
 /**
  * Builds the log-governed `EncryptionDescriptorStore`.
  *
@@ -23,12 +42,12 @@ export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
  *   for this log
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key, for the appends this store writes
- * @returns {EncryptionDescriptorStore}
+ * @returns {SealableEncryptionDescriptorStore}
  */
 export declare function logGovernedDescriptorStore({ log, resolveController, pinStore, signer }: {
     log: ResourceLogStore;
     resolveController: () => Promise<ResourceLogController>;
     pinStore: ResourceLogPinStore;
     signer: ResourceLogSigner;
-}): EncryptionDescriptorStore;
+}): SealableEncryptionDescriptorStore;
 //# sourceMappingURL=rosterLogStore.d.ts.map

package/dist/keys/rosterLogStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EAEvB,MAAM,yBAAyB,CAAA;AAEhC;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACP,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,yBAAyB,CAqG5B"}
+{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAQL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EAEvB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAA;AAE5E,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,yBAAyB,GAC/B,KAAK,IAAI,iCAAiC,CAK5C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACP,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CAoHpC"}

package/dist/keys/rosterLogStore.js

@@ -1,10 +1,20 @@
 import { confirmAppend, WAS_RESOURCE_LOG_METHOD } from '@interop/was-client/log';
-import { buildResourceLogEntry, buildResourceLogGenesis, readResourceLog, ResourceLogClosedError, ResourceLogIntegrityError, verifyResourceLog } from '../resourceLog/index.js';
+import { buildResourceLogEntry, buildResourceLogGenesis, readResourceLog, ResourceLogClosedError, ResourceLogIntegrityError, sealResourceLog, verifyResourceLog } from '../resourceLog/index.js';
+import { EPOCH_CONFIGURATION_STATE_TYPE } from '../descriptors/logSource.js';
+export { EPOCH_CONFIGURATION_STATE_TYPE };
 /**
- * The state-document schema identifier an encryption descriptor carries in a
- * governed log entry, per WAS-EC.
+ * Whether a descriptor store is log-governed and sealable -- the guard the
+ * ceremonies and sweeps use to run the seal backstop only where a governing
+ * log exists (an ordinary Collection-Description-backed store has nothing to
+ * seal).
+ *
+ * @param store {EncryptionDescriptorStore}
+ * @returns {boolean}
  */
-export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
+export function isSealableDescriptorStore(store) {
+    return (typeof store.seal ===
+        'function');
+}
 /**
  * Builds the log-governed `EncryptionDescriptorStore`.
  *
@@ -22,7 +32,7 @@ export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
  *   for this log
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key, for the appends this store writes
- * @returns {EncryptionDescriptorStore}
+ * @returns {SealableEncryptionDescriptorStore}
  */
 export function logGovernedDescriptorStore({ log, resolveController, pinStore, signer }) {
     // The verified log observed by the most recent read on this store instance;
@@ -104,6 +114,20 @@ export function logGovernedDescriptorStore({ log, resolveController, pinStore, s
             // edv machinery re-reads and adopts the winner's descriptor.
             await log.create(genesis);
             await settle({ entry: genesis, controller });
+        },
+        async seal() {
+            const controller = await resolveController();
+            const { sealed, verified } = await sealResourceLog({
+                store: log,
+                controller,
+                expectedMethod: WAS_RESOURCE_LOG_METHOD,
+                pinStore,
+                signer
+            });
+            if (verified !== null) {
+                lastVerified = verified;
+            }
+            return sealed ? 'sealed' : 'noop';
         }
     };
 }

package/dist/keys/rosterLogStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterLogStore.js","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAsBA,OAAO,EACL,aAAa,EACb,uBAAuB,EAExB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EAKlB,MAAM,yBAAyB,CAAA;AAEhC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,MAAM,EAMP;IACC,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,YAAY,GAA+B,IAAI,CAAA;IAEnD,SAAS,OAAO,CACd,UAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;QACjD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAA;IAC1D,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EACpB,KAAK,EACL,UAAU,EAIX;QACC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc,EAAE,uBAAuB;YACvC,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE;SAC3B,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACnC,YAAY,GAAG,SAAS,CAAA;IAC1B,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;gBACpC,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,cAAc,EAAE,uBAAuB;gBACvC,QAAQ;aACT,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,YAAY,GAAG,IAAI,CAAA;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;YACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;gBAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;oBAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;YACH,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAA;YAC/B,OAAO;gBACL,UAAU,EAAE,KAA6B;gBACzC,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,gEAAgE;oBAC9D,kCAAkC,CACrC,CAAA;YACH,CAAC;YACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,kEAAkE;oBAChE,4DAA4D,CAC/D,CAAA;YACH,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBACxC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,uEAAuE;YACvE,gDAAgD;YAChD,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACpC,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;gBAC5C,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,MAAM,EAAE,uBAAuB;gBAC/B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACzB,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;QAC9C,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"rosterLogStore.js","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,aAAa,EACb,uBAAuB,EAExB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,iBAAiB,EAKlB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAA;AAE5E,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAezC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAgC;IAEhC,OAAO,CACL,OAAQ,KAAoD,CAAC,IAAI;QACjE,UAAU,CACX,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,MAAM,EAMP;IACC,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,YAAY,GAA+B,IAAI,CAAA;IAEnD,SAAS,OAAO,CACd,UAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;QACjD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAA;IAC1D,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EACpB,KAAK,EACL,UAAU,EAIX;QACC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc,EAAE,uBAAuB;YACvC,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE;SAC3B,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACnC,YAAY,GAAG,SAAS,CAAA;IAC1B,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;gBACpC,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,cAAc,EAAE,uBAAuB;gBACvC,QAAQ;aACT,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,YAAY,GAAG,IAAI,CAAA;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;YACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;gBAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;oBAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;YACH,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAA;YAC/B,OAAO;gBACL,UAAU,EAAE,KAA6B;gBACzC,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,gEAAgE;oBAC9D,kCAAkC,CACrC,CAAA;YACH,CAAC;YACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,kEAAkE;oBAChE,4DAA4D,CAC/D,CAAA;YACH,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBACxC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,uEAAuE;YACvE,gDAAgD;YAChD,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACpC,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;gBAC5C,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,MAAM,EAAE,uBAAuB;gBAC/B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACzB,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;QAC9C,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;gBACjD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,cAAc,EAAE,uBAAuB;gBACvC,QAAQ;gBACR,MAAM;aACP,CAAC,CAAA;YACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,YAAY,GAAG,QAAQ,CAAA;YACzB,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QACnC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/keys/rosterStore.d.ts

@@ -1,6 +1,6 @@
 import type { ZcapClient } from '@interop/ezcap';
-import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import type { ResourceLogController, ResourceLogPinStore, ResourceLogSigner } from '../resourceLog/index.js';
+import { type SealableEncryptionDescriptorStore } from './rosterLogStore.js';
 /**
  * Builds the log-governed descriptor store over the user key roster in a
  * data Space: reads resolve to the verified head of
@@ -19,7 +19,7 @@ import type { ResourceLogController, ResourceLogPinStore, ResourceLogSigner } fr
  *   pin for the roster log
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key ({@link userKeyRosterLogSigner})
- * @returns {EncryptionDescriptorStore}
+ * @returns {SealableEncryptionDescriptorStore}
  */
 export declare function userKeyRosterDescriptorStore({ storageServerUrl, zcapClient, spaceId, resolveController, pinStore, signer }: {
     storageServerUrl: string;
@@ -28,5 +28,5 @@ export declare function userKeyRosterDescriptorStore({ storageServerUrl, zcapCli
     resolveController: () => Promise<ResourceLogController>;
     pinStore: ResourceLogPinStore;
     signer: ResourceLogSigner;
-}): EncryptionDescriptorStore;
+}): SealableEncryptionDescriptorStore;
 //# sourceMappingURL=rosterStore.d.ts.map

package/dist/keys/rosterStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterStore.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAExE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,yBAAyB,CAAA;AAOhC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACP,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,yBAAyB,CAa5B"}
+{"version":3,"file":"rosterStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterStore.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,yBAAyB,CAAA;AAKhC,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACP,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CAapC"}

package/dist/keys/rosterStore.js

@@ -38,7 +38,7 @@ import { logGovernedDescriptorStore } from './rosterLogStore.js';
  *   pin for the roster log
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key ({@link userKeyRosterLogSigner})
- * @returns {EncryptionDescriptorStore}
+ * @returns {SealableEncryptionDescriptorStore}
  */
 export function userKeyRosterDescriptorStore({ storageServerUrl, zcapClient, spaceId, resolveController, pinStore, signer }) {
     const was = new WasClient({ serverUrl: storageServerUrl, zcapClient });

package/dist/keys/rosterStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterStore.js","sourceRoot":"","sources":["../../src/keys/rosterStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAM1D,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC7B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,QAAQ,EACR,MAAM,EAQP;IACC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,GAAG;SACnB,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;IACjE,OAAO,0BAA0B,CAAC;QAChC,GAAG,EAAE,gBAAgB,CAAC;YACpB,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,4BAA4B,CAAC;SAC5D,CAAC;QACF,iBAAiB;QACjB,QAAQ;QACR,MAAM;KACP,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"rosterStore.js","sourceRoot":"","sources":["../../src/keys/rosterStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAM1D,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC7B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,0BAA0B,EAE3B,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,QAAQ,EACR,MAAM,EAQP;IACC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,GAAG;SACnB,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;IACjE,OAAO,0BAA0B,CAAC;QAChC,GAAG,EAAE,gBAAgB,CAAC;YACpB,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,4BAA4B,CAAC;SAC5D,CAAC;QACF,iBAAiB;QACjB,QAAQ;QACR,MAAM;KACP,CAAC,CAAA;AACJ,CAAC"}

package/dist/keys/userKeyCascade.d.ts

@@ -65,11 +65,13 @@ export declare function unwrapUserKeyGenerations({ descriptor, clientKeyAgreemen
 }): Promise<UserKey[]>;
 /**
  * What one collection's cascade step did: `noop` (already on the current user
- * key), `escrowed` (the current user key's wrap was completed into history
- * with no stale epoch to rotate), or `rotated` (a fresh epoch sealed to the
- * current user key, the stale generations retired).
+ * key), `sealed` (already on the current user key, but the collection's
+ * governing log still anchored before the membership change -- the backstop
+ * append landed), `escrowed` (the current user key's wrap was completed into
+ * history with no stale epoch to rotate), or `rotated` (a fresh epoch sealed
+ * to the current user key, the stale generations retired).
  */
-export type CollectionUserKeyRotationOutcome = 'noop' | 'escrowed' | 'rotated';
+export type CollectionUserKeyRotationOutcome = 'noop' | 'sealed' | 'escrowed' | 'rotated';
 /**
  * Brings ONE encrypted collection's epoch roster onto the current user key --
  * the per-collection op of the revocation cascade and of the completion sweep:
@@ -79,8 +81,13 @@ export type CollectionUserKeyRotationOutcome = 'noop' | 'escrowed' | 'rotated';
  *   a fresh epoch minted without the stale generations. Two requests per
  *   collection; app recipients and other readers ride through untouched (the
  *   default did:key resolver re-wraps them).
- * - **Current already** and fully escrowed: no write at all, so a naive
- *   re-run after a mid-cascade crash converges with zero redundant epochs.
+ * - **Current already** and fully escrowed: no epoch write at all, so a naive
+ *   re-run after a mid-cascade crash converges with zero redundant epochs. On
+ *   a log-governed (sealable) store this is exactly where an unsealed log can
+ *   hide -- the rotation that should have re-anchored the log never wrote --
+ *   so the store's seal backstop runs here (`sealed` when it appended);
+ *   rotated and escrowed writes seal by construction, anchored at the
+ *   caller's current controller head.
  * - **No epochs**: refused fail-closed (see the module doc) -- provisioning
  *   installs every encrypted collection's epoch[0], so the cascade never
  *   mints a first epoch.

package/dist/keys/userKeyCascade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"userKeyCascade.d.ts","sourceRoot":"","sources":["../../src/keys/userKeyCascade.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAKL,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAoB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAA;AAE7D;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;CACjB,GAAG,kBAAkB,CAKrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,UAAU,EACV,qBAAqB,EACtB,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;CACxC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAkBrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gCAAgC,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,KAAK,EACL,OAAO,EACP,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,OAAO,EAAE,CAAA;CACvB,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAgG5C;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAA;IAC1D,MAAM,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,aAAa,EACb,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,OAAO,EACR,EAAE;IACD,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACxD,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;CACjB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAwBhC"}
+{"version":3,"file":"userKeyCascade.d.ts","sourceRoot":"","sources":["../../src/keys/userKeyCascade.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAKL,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAoB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAA;AAE7D;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,OAAO,CAAA;CACjB,GAAG,kBAAkB,CAKrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,UAAU,EACV,qBAAqB,EACtB,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;CACxC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAkBrB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gCAAgC,GAC1C,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAA;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,KAAK,EACL,OAAO,EACP,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,OAAO,EAAE,CAAA;CACvB,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAmG5C;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAA;IAC1D,MAAM,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,aAAa,EACb,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,OAAO,EACR,EAAE;IACD,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACxD,gBAAgB,EAAE,oBAAoB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;CACjB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAwBhC"}

package/dist/keys/userKeyCascade.js

@@ -1,4 +1,5 @@
 import { addRecipient, epochKeyIdFor, replaceRecipient, unwrapEpochSecret } from '@interop/was-client/edv';
+import { isSealableDescriptorStore } from './rosterLogStore.js';
 import { userKeyVaultKeys } from './userKey.js';
 /**
  * A user key presented as an epoch-roster recipient: the kid is the
@@ -57,8 +58,13 @@ export async function unwrapUserKeyGenerations({ descriptor, clientKeyAgreementK
  *   a fresh epoch minted without the stale generations. Two requests per
  *   collection; app recipients and other readers ride through untouched (the
  *   default did:key resolver re-wraps them).
- * - **Current already** and fully escrowed: no write at all, so a naive
- *   re-run after a mid-cascade crash converges with zero redundant epochs.
+ * - **Current already** and fully escrowed: no epoch write at all, so a naive
+ *   re-run after a mid-cascade crash converges with zero redundant epochs. On
+ *   a log-governed (sealable) store this is exactly where an unsealed log can
+ *   hide -- the rotation that should have re-anchored the log never wrote --
+ *   so the store's seal backstop runs here (`sealed` when it appended);
+ *   rotated and escrowed writes seal by construction, anchored at the
+ *   caller's current controller head.
  * - **No epochs**: refused fail-closed (see the module doc) -- provisioning
  *   installs every encrypted collection's epoch[0], so the cascade never
  *   mints a first epoch.
@@ -99,6 +105,9 @@ export async function rotateCollectionEpochsToUserKey({ store, userKey, generati
     if (staleKids.length === 0) {
         const escrowComplete = (descriptor.epochs ?? []).every(epoch => epoch.recipients.some(entry => entry.header.kid === userKeyKid));
         if (currentKids.has(userKeyKid) && escrowComplete) {
+            if (isSealableDescriptorStore(store)) {
+                return (await store.seal()) === 'sealed' ? 'sealed' : 'noop';
+            }
             return 'noop';
         }
     }

package/dist/keys/userKeyCascade.js.map

@@ -1 +1 @@
-{"version":3,"file":"userKeyCascade.js","sourceRoot":"","sources":["../../src/keys/userKeyCascade.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EAGlB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAgB,MAAM,cAAc,CAAA;AAE7D;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,OAAO;QACL,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,kBAAkB,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE;KAC9C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,UAAU,EACV,qBAAqB,EAItB;IACC,MAAM,WAAW,GAAc,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACjC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,CAC/D,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,KAAK;YACL,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;QACF,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,KAAK,EACL,OAAO,EACP,WAAW,EAKZ;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CACzC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAC3C,CAAA;IAED,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,4DAA4D;YAC5D,0DAA0D;YAC1D,+CAA+C,CAClD,CAAA;IACH,CAAC;IAED,MAAM,YAAY,GAChB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAAC;QACrE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IAClD,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CACvD,CAAA;IACD,MAAM,SAAS,GAAG,gBAAgB;SAC/B,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;SAC/C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAE5C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAC7D,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAChE,CAAA;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,EAAE,CAAC;YAClD,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,mEAAmE;QACnE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,eAAe,GAAG,CAAC,GAAG,gBAAgB,CAAC;aAC1C,OAAO,EAAE;aACT,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;QACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;QAC5D,MAAM,gBAAgB,CAAC;YACrB,KAAK;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;YAC1C,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;YACjD,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;SACrB,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,6EAA6E;QAC7E,yEAAyE;QACzE,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,IAAI,KAAK,CACb,wEAAwE;YACtE,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,gFAAgF;IAChF,uEAAuE;IACvE,0EAA0E;IAC1E,SAAS;IACT,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CACjD,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAC1E,CAAA;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,WAAW,CAAC;SACjC,OAAO,EAAE;SACT,IAAI,CAAC,UAAU,CAAC,EAAE,CACjB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAC3D,CACF,CACF,CAAA;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,uEAAuE,CAC1E,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;IACxD,MAAM,YAAY,CAAC;QACjB,KAAK;QACL,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;KAClD,CAAC,CAAA;IACF,OAAO,UAAU,CAAA;AACnB,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,aAAa,EACb,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,OAAO,EAQR;IACC,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC;QACjD,UAAU,EAAE,gBAAgB;QAC5B,qBAAqB;KACtB,CAAC,CAAA;IACF,MAAM,QAAQ,GAAqD,EAAE,CAAA;IACrE,MAAM,MAAM,GAAoD,EAAE,CAAA;IAClE,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QACrC,IAAI,CAAC;YACH,IAAI,WAAW,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAM;YACR,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,MAAM,+BAA+B,CAAC;gBAC7D,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;gBAC7B,OAAO;gBACP,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC"}
+{"version":3,"file":"userKeyCascade.js","sourceRoot":"","sources":["../../src/keys/userKeyCascade.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EAGlB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAgB,MAAM,cAAc,CAAA;AAE7D;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,OAAO;QACL,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,kBAAkB,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE;KAC9C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,UAAU,EACV,qBAAqB,EAItB;IACC,MAAM,WAAW,GAAc,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACjC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,CAC/D,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,KAAK;YACL,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;QACF,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,KAAK,EACL,OAAO,EACP,WAAW,EAKZ;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,gBAAgB,GAAG,WAAW,CAAC,MAAM,CACzC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAC3C,CAAA;IAED,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,4DAA4D;YAC5D,0DAA0D;YAC1D,+CAA+C,CAClD,CAAA;IACH,CAAC;IAED,MAAM,YAAY,GAChB,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAAC;QACrE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IAClD,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CACvD,CAAA;IACD,MAAM,SAAS,GAAG,gBAAgB;SAC/B,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;SAC/C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAE5C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAC7D,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAChE,CAAA;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,EAAE,CAAC;YAClD,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;YAC9D,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,mEAAmE;QACnE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,eAAe,GAAG,CAAC,GAAG,gBAAgB,CAAC;aAC1C,OAAO,EAAE;aACT,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;QACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;QAC5D,MAAM,gBAAgB,CAAC;YACrB,KAAK;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;YAC1C,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;YACjD,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;SACrB,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,6EAA6E;QAC7E,yEAAyE;QACzE,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,IAAI,KAAK,CACb,wEAAwE;YACtE,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,gFAAgF;IAChF,uEAAuE;IACvE,0EAA0E;IAC1E,SAAS;IACT,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CACjD,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAC1E,CAAA;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,WAAW,CAAC;SACjC,OAAO,EAAE;SACT,IAAI,CAAC,UAAU,CAAC,EAAE,CACjB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAC3D,CACF,CACF,CAAA;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,uEAAuE,CAC1E,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;IACxD,MAAM,YAAY,CAAC;QACjB,KAAK;QACL,SAAS,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,KAAK,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;KAClD,CAAC,CAAA;IACF,OAAO,UAAU,CAAA;AACnB,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,aAAa,EACb,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,OAAO,EAQR;IACC,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC;QACjD,UAAU,EAAE,gBAAgB;QAC5B,qBAAqB;KACtB,CAAC,CAAA;IACF,MAAM,QAAQ,GAAqD,EAAE,CAAA;IACrE,MAAM,MAAM,GAAoD,EAAE,CAAA;IAClE,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QACrC,IAAI,CAAC;YACH,IAAI,WAAW,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACtD,OAAM;YACR,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,GAAG,MAAM,+BAA+B,CAAC;gBAC7D,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;gBAC7B,OAAO;gBACP,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC"}

package/dist/request/appKey.d.ts

@@ -1,4 +1,5 @@
 import type { IVerifiableCredential } from '@interop/data-integrity-core';
+import { CONTEXT_URL_V1 as APP_CONNECT_CONTEXT_URL } from 'byoe-context';
 import type { IAppConnectApp } from './types.js';
 /**
  * The key name mixed into seed derivation. Unlike the handle this is
@@ -29,13 +30,13 @@ export declare const APP_KEY_CREDENTIAL_TYPE = "AppKeyCredential";
  */
 export declare const APP_KEY_TYPE_ARRAY: readonly string[];
 /**
- * The static inline `@context` object every app-key credential carries as the
+ * The hosted App Connect context URL every app-key credential carries as the
  * second entry of its `@context` array (after the VC 1.1 context URL). The
- * shape is normative and byte-identical for every application and every
- * credential: carrying the terms inline keeps the credential verifiable with
- * no remote vocabulary fetch on either side.
+ * context document defines the profile's BYOE terms; document loaders resolve
+ * it from the bundled `byoe-context` document, so no fetch happens at sign or
+ * verification time.
  */
-export declare const APP_KEY_CONTEXT: Readonly<Record<string, unknown>>;
+export { APP_CONNECT_CONTEXT_URL };
 /**
  * Whether a credential presents as an app key -- that is, carries the
  * {@link APP_KEY_CREDENTIAL_TYPE} marker in its `type` array. Says nothing
@@ -201,8 +202,8 @@ export declare function findLegacyAppKeyCredential({ credentials, origin }: {
  * Re-issues a legacy app-key credential in place under the `appUrl` model:
  * the same seed (so the same derived DID -- the app's identity and its
  * encrypted-data access are preserved), the fixed two-entry type array, the
- * static inline context, and the `credentialSubject.appUrl` claim set from
- * the validated request value. A fresh mint would roll the seed and orphan
+ * hosted App Connect context URL, and the `credentialSubject.appUrl` claim set
+ * from the validated request value. A fresh mint would roll the seed and orphan
  * the identity, and must never be the migration path. The fresh
  * `issuanceDate` ranks the re-issued credential ahead of the legacy one, so
  * subsequent connects match it directly.

package/dist/request/appKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"appKey.d.ts","sourceRoot":"","sources":["../../src/request/appKey.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAOzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAShD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,YAAY,CAAA;AAIzC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAA;AAEzD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAG9C,CAAA;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAU7D,CAAA;AAOD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;;CAQ5C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAI5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;;CAQlD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,IAAI,CAAC,CAOf;AAgDD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,qBAAqB,EAAE,CAU1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,WAAW,EACX,MAAM,EACN,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAU7C;AAmDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,MAAM,EACP,EAAE;IACD,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,WAAW,EACX,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAwB7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,UAAU,EACV,GAAG,EACH,MAAM,EACP,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBrE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAEpB;AA4BD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAMpB"}
+{"version":3,"file":"appKey.d.ts","sourceRoot":"","sources":["../../src/request/appKey.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAMzE,OAAO,EAAE,cAAc,IAAI,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAShD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,YAAY,CAAA;AAIzC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAA;AAEzD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAG9C,CAAA;AAEF;;;;;;GAMG;AACH,OAAO,EAAE,uBAAuB,EAAE,CAAA;AAOlC;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;;CAQ5C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAI5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;;CAQlD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,IAAI,CAAC,CAOf;AAgDD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,qBAAqB,EAAE,CAU1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,WAAW,EACX,MAAM,EACN,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAU7C;AAmDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,MAAM,EACP,EAAE;IACD,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,WAAW,EACX,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAwB7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,UAAU,EACV,GAAG,EACH,MAAM,EACP,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBrE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAEpB;AA4BD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAMpB"}

package/dist/request/appKey.js

@@ -17,17 +17,19 @@
  *
  * Ported from Freewallet's `src/lib/appKey.ts`, migrated from the
  * `credentialType` / `vocabBase` model to the App Connect spec's `appUrl`
- * model: the type array is a fixed two-entry list, the inline `@context` is
- * one static object identical for every application, and which application a
- * credential belongs to is a claim (`credentialSubject.appUrl`), not a type.
- * See the App Connect spec's App Key Credential section for the normative
- * shape, matching, and minting rules this module implements.
+ * model: the type array is a fixed two-entry list, the `@context` is the VC
+ * 1.1 context URL followed by the hosted App Connect context URL (identical
+ * for every application), and which application a credential belongs to is a
+ * claim (`credentialSubject.appUrl`), not a type. See the App Connect spec's
+ * App Key Credential section for the normative shape, matching, and minting
+ * rules this module implements.
  */
 import * as vc from '@interop/vc';
 import { base64urlnopad } from '@scure/base';
 import { CapabilityAgent } from '@interop/webkms-client';
 import { Ed25519Signature2020 } from '@interop/ed25519-signature';
 import { issuerId, subjectId, typeArray } from '@interop/data-integrity-core/guards';
+import { CONTEXT_URL_V1 as APP_CONNECT_CONTEXT_URL } from 'byoe-context';
 import { documentLoader } from './composeVp.js';
 /**
  * The semantic `handle` mixed into seed derivation. It identifies the agent
@@ -68,21 +70,13 @@ export const APP_KEY_TYPE_ARRAY = Object.freeze([
     APP_KEY_CREDENTIAL_TYPE
 ]);
 /**
- * The static inline `@context` object every app-key credential carries as the
+ * The hosted App Connect context URL every app-key credential carries as the
  * second entry of its `@context` array (after the VC 1.1 context URL). The
- * shape is normative and byte-identical for every application and every
- * credential: carrying the terms inline keeps the credential verifiable with
- * no remote vocabulary fetch on either side.
+ * context document defines the profile's BYOE terms; document loaders resolve
+ * it from the bundled `byoe-context` document, so no fetch happens at sign or
+ * verification time.
  */
-export const APP_KEY_CONTEXT = Object.freeze({
-    '@protected': true,
-    AppKeyCredential: 'https://w3id.org/byoe#AppKeyCredential',
-    appUrl: 'https://w3id.org/byoe#appUrl',
-    seed: 'https://w3id.org/byoe#seed',
-    origin: 'https://w3id.org/byoe#origin',
-    name: 'https://schema.org/name',
-    description: 'https://schema.org/description'
-});
+export { APP_CONNECT_CONTEXT_URL };
 /**
  * The number of random bytes in an app-key seed.
  */
@@ -291,8 +285,8 @@ export async function findAppKeyCredential({ credentials, appUrl, origin }) {
 }
 /**
  * Assembles and signs an app-key credential for a seed the caller supplies:
- * the fixed two-entry type array, the static inline context, issuer and
- * subject both the seed-derived DID, and the `seed` / `appUrl` / `origin`
+ * the fixed two-entry type array, the hosted App Connect context URL, issuer
+ * and subject both the seed-derived DID, and the `seed` / `appUrl` / `origin`
  * claims. `vc.issue` auto-fills `issuanceDate` in the canonical UTC form the
  * ranking expects. Shared by the fresh mint and the legacy re-issue.
  */
@@ -304,7 +298,7 @@ async function issueAppKeyCredential({ seedBytes, appName, appUrl, origin, descr
     });
     const controllerDid = agent.id;
     const credential = {
-        '@context': [VC_1_CONTEXT_URL, { ...APP_KEY_CONTEXT }],
+        '@context': [VC_1_CONTEXT_URL, APP_CONNECT_CONTEXT_URL],
         id: `urn:uuid:${crypto.randomUUID()}`,
         type: [...APP_KEY_TYPE_ARRAY],
         name: `${appName} app key`,
@@ -395,8 +389,8 @@ export async function findLegacyAppKeyCredential({ credentials, origin }) {
  * Re-issues a legacy app-key credential in place under the `appUrl` model:
  * the same seed (so the same derived DID -- the app's identity and its
  * encrypted-data access are preserved), the fixed two-entry type array, the
- * static inline context, and the `credentialSubject.appUrl` claim set from
- * the validated request value. A fresh mint would roll the seed and orphan
+ * hosted App Connect context URL, and the `credentialSubject.appUrl` claim set
+ * from the validated request value. A fresh mint would roll the seed and orphan
  * the identity, and must never be the migration path. The fresh
  * `issuanceDate` ranks the re-issued credential ahead of the legacy one, so
  * subsequent connects match it directly.

package/dist/request/appKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"appKey.js","sourceRoot":"","sources":["../../src/request/appKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EACL,QAAQ,EACR,SAAS,EACT,SAAS,EACV,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAG/C;;;;GAIG;AACH,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAEzC,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAA;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACjE,sBAAsB;IACtB,uBAAuB;CACxB,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsC,MAAM,CAAC,MAAM,CAC7E;IACE,YAAY,EAAE,IAAI;IAClB,gBAAgB,EAAE,wCAAwC;IAC1D,MAAM,EAAE,8BAA8B;IACtC,IAAI,EAAE,4BAA4B;IAClC,MAAM,EAAE,8BAA8B;IACtC,IAAI,EAAE,yBAAyB;IAC/B,WAAW,EAAE,gCAAgC;CAC9C,CACF,CAAA;AAED;;GAEG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAE3B;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAiC;IAChE,OAAO,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAA;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C;QACE,KAAK,CACH,uEAAuE;YACrE,uEAAuE,CAC1E,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAiC;IACpE,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAiC;IAEjC,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IACxC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;YAC3C,IAAI;YACJ,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,EAAE,KAAK,UAAU,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CACH,wEAAwE;YACtE,qEAAqE,CACxE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAiC;IAEjC,IACE,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAC7B,CAAC,CAAC,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,UAAiC;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC,UAAU,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,UAAiC;IACxD,MAAM,GAAG,GAAI,UAAyC,CAAC,YAAY,CAAA;IACnE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,KAA4B,EAC5B,MAA6B;IAE7B,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC,CAAA;IACX,CAAC;IACD,OAAO,aAAa,GAAG,YAAY,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,MAAM,EAKP;IACC,OAAO,WAAW;SACf,MAAM,CACL,UAAU,CAAC,EAAE,CACX,gBAAgB,CAAC,UAAU,CAAC;QAC5B,YAAY,CAAC,UAAU,CAAC,KAAK,MAAM;QACnC,YAAY,CAAC,UAAU,CAAC;QACxB,YAAY,CAAC,UAAU,CAAC,KAAK,MAAM,CACtC;SACA,IAAI,CAAC,qBAAqB,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,WAAW,EACX,MAAM,EACN,MAAM,EAKP;IACC,4EAA4E;IAC5E,4EAA4E;IAC5E,kCAAkC;IAClC,KAAK,MAAM,SAAS,IAAI,gBAAgB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,MAAM,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAAC,EACnC,SAAS,EACT,OAAO,EACP,MAAM,EACN,MAAM,EACN,WAAW,EAOZ;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAA;IACF,MAAM,aAAa,GAAG,KAAK,CAAC,EAAE,CAAA;IAC9B,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,CAAC,gBAAgB,EAAE,EAAE,GAAG,eAAe,EAAE,CAAC;QACtD,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;QACrC,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC;QAC7B,IAAI,EAAE,GAAG,OAAO,UAAU;QAC1B,WAAW;QACX,MAAM,EAAE,aAAa;QACrB,iBAAiB,EAAE;YACjB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;YACtC,MAAM;YACN,MAAM;SACP;KACF,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;QAC7B,UAAU;QACV,KAAK;QACL,cAAc;KACf,CAAC,CAA0B,CAAA;IAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,MAAM,EAIP;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC1E,OAAO,qBAAqB,CAAC;QAC3B,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM;QACN,WAAW,EACT,OAAO,GAAG,CAAC,IAAI,oDAAoD;YACnE,gDAAgD;KACnD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,WAAW,EACX,MAAM,EAIP;IACC,MAAM,UAAU,GAAG,WAAW;SAC3B,MAAM,CACL,UAAU,CAAC,EAAE,CACX,gBAAgB,CAAC,UAAU,CAAC;QAC5B,YAAY,CAAC,UAAU,CAAC,KAAK,SAAS;QACtC,YAAY,CAAC,UAAU,CAAC;QACxB,YAAY,CAAC,UAAU,CAAC,KAAK,MAAM,CACtC;SACA,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAC9B,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,UAAU,EACV,GAAG,EACH,MAAM,EAKP;IACC,IACE,CAAC,CAAC,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAC3C,YAAY,CAAC,UAAU,CAAC,KAAK,MAAM,EACnC,CAAC;QACD,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,MAAM,iBAAiB,GAAI,UAAwC;SAChE,WAAW,CAAA;IACd,OAAO,qBAAqB,CAAC;QAC3B,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM;QACN,WAAW,EACT,OAAO,iBAAiB,KAAK,QAAQ;YACnC,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,+CAA+C;gBAC9D,qDAAqD;KAC5D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAiC;IAEjC,OAAO,SAAS,CAAC,UAAU,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACtB,UAAiC;IAEjC,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAmD,CAAA;IAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAEjC,MAAM,OAAO,GAAG,UAAU,CAAC,iBACO,CAAA;IAClC,OAAO,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClD,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAEjC,MAAM,OAAO,GAAG,UAAU,CAAC,iBACO,CAAA;IAClC,OAAO,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClD,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,SAAS,CAAA;AACf,CAAC"}
+{"version":3,"file":"appKey.js","sourceRoot":"","sources":["../../src/request/appKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EACL,QAAQ,EACR,SAAS,EACT,SAAS,EACV,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,cAAc,IAAI,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAG/C;;;;GAIG;AACH,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAEzC,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAA;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACjE,sBAAsB;IACtB,uBAAuB;CACxB,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,OAAO,EAAE,uBAAuB,EAAE,CAAA;AAElC;;GAEG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAE3B;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAiC;IAChE,OAAO,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAA;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C;QACE,KAAK,CACH,uEAAuE;YACrE,uEAAuE,CAC1E,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAiC;IACpE,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAiC;IAEjC,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IACxC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;YAC3C,IAAI;YACJ,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,EAAE,KAAK,UAAU,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CACH,wEAAwE;YACtE,qEAAqE,CACxE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAiC;IAEjC,IACE,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAC7B,CAAC,CAAC,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,UAAiC;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,CAAC,UAAU,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,UAAiC;IACxD,MAAM,GAAG,GAAI,UAAyC,CAAC,YAAY,CAAA;IACnE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,KAA4B,EAC5B,MAA6B;IAE7B,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC,CAAA;IACX,CAAC;IACD,OAAO,aAAa,GAAG,YAAY,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,MAAM,EAKP;IACC,OAAO,WAAW;SACf,MAAM,CACL,UAAU,CAAC,EAAE,CACX,gBAAgB,CAAC,UAAU,CAAC;QAC5B,YAAY,CAAC,UAAU,CAAC,KAAK,MAAM;QACnC,YAAY,CAAC,UAAU,CAAC;QACxB,YAAY,CAAC,UAAU,CAAC,KAAK,MAAM,CACtC;SACA,IAAI,CAAC,qBAAqB,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,WAAW,EACX,MAAM,EACN,MAAM,EAKP;IACC,4EAA4E;IAC5E,4EAA4E;IAC5E,kCAAkC;IAClC,KAAK,MAAM,SAAS,IAAI,gBAAgB,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,MAAM,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAAC,EACnC,SAAS,EACT,OAAO,EACP,MAAM,EACN,MAAM,EACN,WAAW,EAOZ;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAA;IACF,MAAM,aAAa,GAAG,KAAK,CAAC,EAAE,CAAA;IAC9B,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;QACvD,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;QACrC,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC;QAC7B,IAAI,EAAE,GAAG,OAAO,UAAU;QAC1B,WAAW;QACX,MAAM,EAAE,aAAa;QACrB,iBAAiB,EAAE;YACjB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;YACtC,MAAM;YACN,MAAM;SACP;KACF,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;QAC7B,UAAU;QACV,KAAK;QACL,cAAc;KACf,CAAC,CAA0B,CAAA;IAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,MAAM,EAIP;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC1E,OAAO,qBAAqB,CAAC;QAC3B,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM;QACN,WAAW,EACT,OAAO,GAAG,CAAC,IAAI,oDAAoD;YACnE,gDAAgD;KACnD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,WAAW,EACX,MAAM,EAIP;IACC,MAAM,UAAU,GAAG,WAAW;SAC3B,MAAM,CACL,UAAU,CAAC,EAAE,CACX,gBAAgB,CAAC,UAAU,CAAC;QAC5B,YAAY,CAAC,UAAU,CAAC,KAAK,SAAS;QACtC,YAAY,CAAC,UAAU,CAAC;QACxB,YAAY,CAAC,UAAU,CAAC,KAAK,MAAM,CACtC;SACA,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAC9B,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACxE,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,UAAU,EACV,GAAG,EACH,MAAM,EAKP;IACC,IACE,CAAC,CAAC,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAC3C,YAAY,CAAC,UAAU,CAAC,KAAK,MAAM,EACnC,CAAC;QACD,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,MAAM,iBAAiB,GAAI,UAAwC;SAChE,WAAW,CAAA;IACd,OAAO,qBAAqB,CAAC;QAC3B,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM;QACN,WAAW,EACT,OAAO,iBAAiB,KAAK,QAAQ;YACnC,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,+CAA+C;gBAC9D,qDAAqD;KAC5D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAiC;IAEjC,OAAO,SAAS,CAAC,UAAU,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACtB,UAAiC;IAEjC,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAmD,CAAA;IAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAEjC,MAAM,OAAO,GAAG,UAAU,CAAC,iBACO,CAAA;IAClC,OAAO,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClD,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAEjC,MAAM,OAAO,GAAG,UAAU,CAAC,iBACO,CAAA;IAClC,OAAO,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAClD,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,SAAS,CAAA;AACf,CAAC"}