@interop/wallet-core 0.6.0 → 0.8.0

package/README.md

@@ -23,7 +23,7 @@ identical bytes. It is isomorphic (browser, Node.js, React Native) and has no UI
 or storage dependencies -- side effects are injected, and the dep-heavier
 protocol subpaths are import-directly-only.
 
-Five subpaths:
+The subpaths:
 
 - **`@interop/wallet-core/sync`** -- the Wallet Attached Storage (WAS)
   replication engine core: the `SyncEngine` orchestration (single-flight,
@@ -61,6 +61,32 @@ Five subpaths:
   display helpers and credential input parsing. Raw values out (ISO strings,
   `Date`, booleans); date formatting, i18n, and UI concerns stay in the app.
 
+- **`@interop/wallet-core/webvh`** -- the account's did:webvh identity: the
+  hosted DID log, its per-client update-key rotation, the client enrollment
+  entries, and ZCap signing under the did:webvh verification-method id.
+
+- **`@interop/wallet-core/keys`** -- the per-user key (PUK) and its
+  `key-map/puk.json` wrap-set roster: minting, the roster's init/read/rotate
+  primitives with their client-side guards (`epochsMac`, the latest-seen epoch
+  pin, the document-backed recipient resolver), and the roster's
+  compare-and-swap descriptor store.
+
+- **`@interop/wallet-core/descriptors`** -- collection encryption-descriptor
+  acquisition (fetch / cache / offline fallback) and the unknown-epoch refresh
+  policy, including a self-refreshing EDV document cipher.
+
+- **`@interop/wallet-core/keyring`** -- the unlock layer: the unlock derivation,
+  the `{ version, wrapped }` account-pointer record codec, and the unlock Space
+  lifecycle.
+
+- **`@interop/wallet-core/enrollment`** -- the client enrollment ceremony
+  (connect code, approval, completion).
+
+- **`@interop/wallet-core/recovery`** -- recovery codes on the roster identity
+  model: a code as a minimal always-enrolled wallet client (format and
+  derivation, the recovery record, the document half of issuance / revocation /
+  recovery).
+
 ## Install
 
 - Node.js 24+ is recommended.
@@ -91,8 +117,10 @@ import {
 ```
 
 The `sync` and `space` subpaths are re-exported from the package root as well.
-`identity`, `request`, and `display` are import-directly-only, so consumers of
-the root never pull the signing / KMS / document-loader dependency graph.
+Every other subpath (`identity`, `request`, `display`, `webvh`, `keys`,
+`descriptors`, `keyring`, `enrollment`, `recovery`) is import-directly-only, so
+consumers of the root never pull the signing / KMS / document-loader dependency
+graph.
 
 ## Contribute
 

package/dist/descriptors/acquire.d.ts

@@ -0,0 +1,110 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Collection encryption-descriptor acquisition: reading a collection's
+ * `CollectionEncryption` descriptor (its key-epoch roster) from the Collection
+ * Description, caching each success, and falling back to the cached copy when
+ * the description cannot be fetched -- offline, a previously-shared collection
+ * must keep encrypting under its current epoch. A successful fetch that
+ * returns no descriptor (an unshared collection) yields `undefined`: the
+ * single-key path.
+ *
+ * The two seams are deliberately narrow, so a wallet app's own classes satisfy
+ * them structurally -- no adapter needed. An {@link EncryptionDescriptorSource}
+ * is one signed describe; an {@link EncryptionDescriptorCache} is a durable
+ * get/put the host has already scoped to one account's Space (a web wallet: a
+ * localStorage pair keyed by Space id; a mobile wallet: a per-(profile,
+ * collection) table column), so no scope key appears in the interface.
+ */
+import type { CollectionEncryption, WasClient } from '@interop/was-client';
+/**
+ * Where descriptors come from: one signed read of the collection's
+ * Description. Resolves `undefined` for a collection that is plaintext or has
+ * no descriptor; network errors throw through (callers treat the fetch as
+ * best-effort and fall back to a cached copy).
+ */
+export interface EncryptionDescriptorSource {
+    collectionEncryption(options: {
+        collectionId: string;
+    }): Promise<CollectionEncryption | undefined>;
+}
+/**
+ * Where fetched descriptors survive offline: a durable get/put pre-scoped by
+ * the host to one account's Space. `readDescriptor` resolves `undefined` when
+ * nothing is cached (never throws for absence).
+ */
+export interface EncryptionDescriptorCache {
+    readDescriptor(options: {
+        collectionId: string;
+    }): Promise<CollectionEncryption | undefined>;
+    writeDescriptor(options: {
+        collectionId: string;
+        descriptor: CollectionEncryption;
+    }): Promise<void>;
+}
+/**
+ * The {@link EncryptionDescriptorSource} over a was-client handle: reads the
+ * collection's Description in the given Space and returns its `encryption`
+ * descriptor.
+ *
+ * @param options {object}
+ * @param options.was {WasClient}   a client whose signer can read the Space
+ * @param options.spaceId {string}
+ * @returns {EncryptionDescriptorSource}
+ */
+export declare function wasDescriptorSource({ was, spaceId }: {
+    was: WasClient;
+    spaceId: string;
+}): EncryptionDescriptorSource;
+/**
+ * Acquires one collection's descriptor: fetches it from the source, caching a
+ * success; falls back to the cached copy when the fetch fails; and with no
+ * source at all (a purely local code path) reads the cache alone. A successful
+ * fetch that returns no descriptor resolves `undefined` -- an unshared
+ * collection stays on the single-key path -- and deliberately leaves any
+ * cached copy in place, mirroring the fetch-failure fallback.
+ *
+ * @param options {object}
+ * @param [options.source] {EncryptionDescriptorSource}   omit for cache-only
+ *   acquisition
+ * @param options.cache {EncryptionDescriptorCache}
+ * @param options.collectionId {string}
+ * @param [options.onFetchError] {function}   observes a swallowed fetch
+ *   failure (the cached-fallback branch); errors from the cache itself throw
+ *   through
+ * @returns {Promise<CollectionEncryption | undefined>}
+ */
+export declare function acquireDescriptor({ source, cache, collectionId, onFetchError }: {
+    source?: EncryptionDescriptorSource;
+    cache: EncryptionDescriptorCache;
+    collectionId: string;
+    onFetchError?: (err: unknown, info: {
+        collectionId: string;
+    }) => void;
+}): Promise<CollectionEncryption | undefined>;
+/**
+ * Acquires descriptors for a set of collections concurrently (each fetch is an
+ * independent signed round trip, so a session start is not gated on a serial
+ * chain of describes). Collections that resolve no descriptor are simply
+ * absent from the result.
+ *
+ * @param options {object}
+ * @param [options.source] {EncryptionDescriptorSource}   omit for cache-only
+ *   acquisition
+ * @param options.cache {EncryptionDescriptorCache}
+ * @param options.collectionIds {string[]}
+ * @param [options.onFetchError] {function}   observes each swallowed fetch
+ *   failure
+ * @returns {Promise<Record<string, CollectionEncryption>>}   keyed by
+ *   collection id
+ */
+export declare function acquireDescriptors({ source, cache, collectionIds, onFetchError }: {
+    source?: EncryptionDescriptorSource;
+    cache: EncryptionDescriptorCache;
+    collectionIds: string[];
+    onFetchError?: (err: unknown, info: {
+        collectionId: string;
+    }) => void;
+}): Promise<Record<string, CollectionEncryption>>;
+//# sourceMappingURL=acquire.d.ts.map

package/dist/descriptors/acquire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acquire.d.ts","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,oBAAoB,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,cAAc,CAAC,OAAO,EAAE;QACtB,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC7C,eAAe,CAAC,OAAO,EAAE;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,oBAAoB,CAAA;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAU7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAe5C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAiBhD"}

package/dist/descriptors/acquire.js

@@ -0,0 +1,86 @@
+/**
+ * The {@link EncryptionDescriptorSource} over a was-client handle: reads the
+ * collection's Description in the given Space and returns its `encryption`
+ * descriptor.
+ *
+ * @param options {object}
+ * @param options.was {WasClient}   a client whose signer can read the Space
+ * @param options.spaceId {string}
+ * @returns {EncryptionDescriptorSource}
+ */
+export function wasDescriptorSource({ was, spaceId }) {
+    return {
+        async collectionEncryption({ collectionId }) {
+            const description = await was
+                .space(spaceId)
+                .collection(collectionId)
+                .describe();
+            return description?.encryption ?? undefined;
+        }
+    };
+}
+/**
+ * Acquires one collection's descriptor: fetches it from the source, caching a
+ * success; falls back to the cached copy when the fetch fails; and with no
+ * source at all (a purely local code path) reads the cache alone. A successful
+ * fetch that returns no descriptor resolves `undefined` -- an unshared
+ * collection stays on the single-key path -- and deliberately leaves any
+ * cached copy in place, mirroring the fetch-failure fallback.
+ *
+ * @param options {object}
+ * @param [options.source] {EncryptionDescriptorSource}   omit for cache-only
+ *   acquisition
+ * @param options.cache {EncryptionDescriptorCache}
+ * @param options.collectionId {string}
+ * @param [options.onFetchError] {function}   observes a swallowed fetch
+ *   failure (the cached-fallback branch); errors from the cache itself throw
+ *   through
+ * @returns {Promise<CollectionEncryption | undefined>}
+ */
+export async function acquireDescriptor({ source, cache, collectionId, onFetchError }) {
+    if (!source) {
+        return cache.readDescriptor({ collectionId });
+    }
+    try {
+        const fetched = await source.collectionEncryption({ collectionId });
+        if (fetched) {
+            await cache.writeDescriptor({ collectionId, descriptor: fetched });
+            return fetched;
+        }
+        return undefined;
+    }
+    catch (err) {
+        onFetchError?.(err, { collectionId });
+        return cache.readDescriptor({ collectionId });
+    }
+}
+/**
+ * Acquires descriptors for a set of collections concurrently (each fetch is an
+ * independent signed round trip, so a session start is not gated on a serial
+ * chain of describes). Collections that resolve no descriptor are simply
+ * absent from the result.
+ *
+ * @param options {object}
+ * @param [options.source] {EncryptionDescriptorSource}   omit for cache-only
+ *   acquisition
+ * @param options.cache {EncryptionDescriptorCache}
+ * @param options.collectionIds {string[]}
+ * @param [options.onFetchError] {function}   observes each swallowed fetch
+ *   failure
+ * @returns {Promise<Record<string, CollectionEncryption>>}   keyed by
+ *   collection id
+ */
+export async function acquireDescriptors({ source, cache, collectionIds, onFetchError }) {
+    const resolved = await Promise.all(collectionIds.map(async (collectionId) => [
+        collectionId,
+        await acquireDescriptor({ source, cache, collectionId, onFetchError })
+    ]));
+    const descriptors = {};
+    for (const [collectionId, descriptor] of resolved) {
+        if (descriptor) {
+            descriptors[collectionId] = descriptor;
+        }
+    }
+    return descriptors;
+}
+//# sourceMappingURL=acquire.js.map

package/dist/descriptors/acquire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AAgDA;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EAIR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,WAAW,GAAG,MAAM,GAAG;iBAC1B,KAAK,CAAC,OAAO,CAAC;iBACd,UAAU,CAAC,YAAY,CAAC;iBACxB,QAAQ,EAAE,CAAA;YACb,OAAO,WAAW,EAAE,UAAU,IAAI,SAAS,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EAMb;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;YAClE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QACrC,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EAMb;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,aAAa,CAAC,GAAG,CACf,KAAK,EAAC,YAAY,EAAC,EAAE,CACnB;QACE,YAAY;QACZ,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;KAC9D,CACb,CACF,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/descriptors/cipher.d.ts

@@ -0,0 +1,56 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * A self-refreshing EDV document cipher: `createEdvDocCipher` bound to
+ * descriptor acquisition and the once-per-session refresh rule, for a host
+ * whose decrypt seam is the cipher itself (a sync engine's `decryptDoc`, a
+ * conflict resolver) rather than a row-scanning store.
+ *
+ * Built, the cipher acquires the collection's descriptor (fetch, cache the
+ * success, cached fallback on failure -- see `acquire.ts`) and constructs the
+ * underlying EDV cipher from it; with no descriptor, or a descriptor with no
+ * epochs, that is the single-key path, unchanged. When a decrypt throws
+ * `UnknownEpochError`, the cipher re-acquires the descriptor, rebuilds itself,
+ * and retries that decrypt exactly once -- and only once per cipher instance,
+ * which the host scopes to one `(profile, collection)` session by dropping
+ * its cipher cache when the session ends. A second failure (or any unknown
+ * epoch after the one refresh is spent) propagates.
+ */
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+import { type DocCipher } from '@interop/was-client/edv';
+import { type EncryptionDescriptorCache, type EncryptionDescriptorSource } from './acquire.js';
+/**
+ * Builds a {@link DocCipher} whose descriptor is acquired through the
+ * source/cache seams and refreshed (once per instance) on an unknown-epoch
+ * decrypt.
+ *
+ * With no `source` the descriptor is served from the cache alone and the
+ * refresh path is inert (an unknown-epoch decrypt propagates immediately) --
+ * the shape for a purely local code path that must never touch the network.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the vault key pair this
+ *   collection's envelopes are sealed to
+ * @param options.keyResolver {IKeyResolver}
+ * @param options.collectionId {string}
+ * @param [options.idDerivation] {'content' | 'random'}   defaults to
+ *   `'content'`
+ * @param [options.source] {EncryptionDescriptorSource}
+ * @param options.cache {EncryptionDescriptorCache}
+ * @param [options.onFetchError] {function}   observes swallowed
+ *   descriptor-fetch failures
+ * @returns {Promise<DocCipher>}
+ */
+export declare function createRefreshingEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, idDerivation, source, cache, onFetchError }: {
+    keyAgreementKey: IKeyAgreementKey;
+    keyResolver: IKeyResolver;
+    collectionId: string;
+    idDerivation?: 'content' | 'random';
+    source?: EncryptionDescriptorSource;
+    cache: EncryptionDescriptorCache;
+    onFetchError?: (err: unknown, info: {
+        collectionId: string;
+    }) => void;
+}): Promise<DocCipher>;
+//# sourceMappingURL=cipher.d.ts.map

package/dist/descriptors/cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../src/descriptors/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAChC,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EACb,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACnC,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,SAAS,CAAC,CAqDrB"}

package/dist/descriptors/cipher.js

@@ -0,0 +1,73 @@
+import { createEdvDocCipher, UnknownEpochError } from '@interop/was-client/edv';
+import { acquireDescriptor } from './acquire.js';
+/**
+ * Builds a {@link DocCipher} whose descriptor is acquired through the
+ * source/cache seams and refreshed (once per instance) on an unknown-epoch
+ * decrypt.
+ *
+ * With no `source` the descriptor is served from the cache alone and the
+ * refresh path is inert (an unknown-epoch decrypt propagates immediately) --
+ * the shape for a purely local code path that must never touch the network.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the vault key pair this
+ *   collection's envelopes are sealed to
+ * @param options.keyResolver {IKeyResolver}
+ * @param options.collectionId {string}
+ * @param [options.idDerivation] {'content' | 'random'}   defaults to
+ *   `'content'`
+ * @param [options.source] {EncryptionDescriptorSource}
+ * @param options.cache {EncryptionDescriptorCache}
+ * @param [options.onFetchError] {function}   observes swallowed
+ *   descriptor-fetch failures
+ * @returns {Promise<DocCipher>}
+ */
+export async function createRefreshingEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, idDerivation, source, cache, onFetchError }) {
+    const build = async () => createEdvDocCipher({
+        keyAgreementKey,
+        keyResolver,
+        collectionId,
+        idDerivation,
+        encryption: await acquireDescriptor({
+            source,
+            cache,
+            collectionId,
+            onFetchError
+        })
+    });
+    let inner = await build();
+    // The one descriptor refresh this cipher instance (= this collection this
+    // session) may spend, shared so concurrent unknown-epoch decrypts ride a
+    // single re-read instead of each spending one.
+    let refreshed = null;
+    return {
+        encrypt: options => inner.encrypt(options),
+        encryptUpdate: options => {
+            if (!inner.encryptUpdate) {
+                throw new Error(`Collection "${collectionId}" cipher has no in-place update.`);
+            }
+            return inner.encryptUpdate(options);
+        },
+        async decrypt({ envelope }) {
+            try {
+                return await inner.decrypt({ envelope });
+            }
+            catch (err) {
+                if (!(err instanceof UnknownEpochError) || !source) {
+                    throw err;
+                }
+                refreshed ??= build().then(cipher => {
+                    inner = cipher;
+                });
+                await refreshed;
+                // One retry under the swapped cipher. If the refresh was already
+                // spent before this decrypt began, this re-attempt is a local
+                // no-network decrypt that fails the same way -- so a genuinely
+                // foreign envelope still surfaces UnknownEpochError, and never a
+                // second description read.
+                return inner.decrypt({ envelope });
+            }
+        }
+    };
+}
+//# sourceMappingURL=cipher.js.map

package/dist/descriptors/cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/descriptors/cipher.ts"],"names":[],"mappings":"AAuBA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,iBAAiB,EAGlB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EASb;IACC,MAAM,KAAK,GAAG,KAAK,IAAwB,EAAE,CAC3C,kBAAkB,CAAC;QACjB,eAAe;QACf,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,UAAU,EAAE,MAAM,iBAAiB,CAAC;YAClC,MAAM;YACN,KAAK;YACL,YAAY;YACZ,YAAY;SACb,CAAC;KACH,CAAC,CAAA;IAEJ,IAAI,KAAK,GAAG,MAAM,KAAK,EAAE,CAAA;IACzB,0EAA0E;IAC1E,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,SAAS,GAAyB,IAAI,CAAA;IAE1C,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAE1C,aAAa,EAAE,OAAO,CAAC,EAAE;YACvB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,kCAAkC,CAC9D,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACnD,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,SAAS,KAAK,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;oBAClC,KAAK,GAAG,MAAM,CAAA;gBAChB,CAAC,CAAC,CAAA;gBACF,MAAM,SAAS,CAAA;gBACf,iEAAiE;gBACjE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iEAAiE;gBACjE,2BAA2B;gBAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/descriptors/index.d.ts

@@ -0,0 +1,32 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/descriptors` subpath: collection
+ * encryption-descriptor acquisition and the unknown-epoch refresh policy --
+ * the one implementation of "which key epoch does this collection encrypt
+ * under, and when do we ask again" that every wallet replica must share (a
+ * drift here does not fail loudly; it fails as a resource one replica cannot
+ * decrypt).
+ *
+ * - `EncryptionDescriptorSource` / `EncryptionDescriptorCache` -- the narrow
+ *   seams a host implements: one signed Collection Description read, and a
+ *   durable get/put pre-scoped to one account's Space.
+ * - `wasDescriptorSource` -- the `EncryptionDescriptorSource` over a
+ *   was-client handle.
+ * - `acquireDescriptor` / `acquireDescriptors` -- fetch + cache with the
+ *   cached fallback (offline, a previously-shared collection keeps encrypting
+ *   under its current epoch; no descriptor at all is the single-key path).
+ * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
+ *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
+ *   for hosts whose reads scan rows and count unknown-epoch skips.
+ * - `createRefreshingEdvDocCipher` -- `createEdvDocCipher` bound to both: a
+ *   cipher that acquires its own descriptor and, on an unknown-epoch decrypt,
+ *   re-reads the description, swaps itself, and retries exactly once per
+ *   instance.
+ */
+export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
+export type { EncryptionDescriptorCache, EncryptionDescriptorSource } from './acquire.js';
+export { DescriptorRefreshPolicy } from './refresh.js';
+export { createRefreshingEdvDocCipher } from './cipher.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/descriptors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}

package/dist/descriptors/index.js

@@ -0,0 +1,31 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/descriptors` subpath: collection
+ * encryption-descriptor acquisition and the unknown-epoch refresh policy --
+ * the one implementation of "which key epoch does this collection encrypt
+ * under, and when do we ask again" that every wallet replica must share (a
+ * drift here does not fail loudly; it fails as a resource one replica cannot
+ * decrypt).
+ *
+ * - `EncryptionDescriptorSource` / `EncryptionDescriptorCache` -- the narrow
+ *   seams a host implements: one signed Collection Description read, and a
+ *   durable get/put pre-scoped to one account's Space.
+ * - `wasDescriptorSource` -- the `EncryptionDescriptorSource` over a
+ *   was-client handle.
+ * - `acquireDescriptor` / `acquireDescriptors` -- fetch + cache with the
+ *   cached fallback (offline, a previously-shared collection keeps encrypting
+ *   under its current epoch; no descriptor at all is the single-key path).
+ * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
+ *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
+ *   for hosts whose reads scan rows and count unknown-epoch skips.
+ * - `createRefreshingEdvDocCipher` -- `createEdvDocCipher` bound to both: a
+ *   cipher that acquires its own descriptor and, on an unknown-epoch decrypt,
+ *   re-reads the description, swaps itself, and retries exactly once per
+ *   instance.
+ */
+export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
+export { DescriptorRefreshPolicy } from './refresh.js';
+export { createRefreshingEdvDocCipher } from './cipher.js';
+//# sourceMappingURL=index.js.map

package/dist/descriptors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}

package/dist/descriptors/refresh.d.ts

@@ -0,0 +1,60 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The unknown-epoch refresh policy: an epoch rotation emits no change-feed
+ * entry, so a cipher built from a cached descriptor can meet envelopes stamped
+ * with an epoch it has never seen. The remedy is one re-read of the
+ * Collection Description plus a cipher rebuild and a single retry -- and the
+ * policy guards that remedy to ONCE per collection per session, so a
+ * genuinely foreign envelope (one no descriptor will ever route) cannot drive
+ * a refetch loop, let alone a refetch per resource.
+ */
+/**
+ * Tracks which collections have already spent their one refresh this session,
+ * and runs reads under the refresh-and-retry-once rule. One instance per
+ * session (it IS the session scope of the guard); the injected `refresh` does
+ * the host's whole swap -- re-acquire the descriptor(s), rebuild the
+ * cipher(s), and install them wherever the host keeps them.
+ */
+export declare class DescriptorRefreshPolicy {
+    #private;
+    constructor({ refresh }: {
+        refresh: (options: {
+            collectionId: string;
+        }) => Promise<void>;
+    });
+    /** Whether a collection still has its one refresh this session. */
+    shouldRefresh({ collectionId }: {
+        collectionId: string;
+    }): boolean;
+    /**
+     * Runs a read that reports whether it skipped unknown-epoch rows; on the
+     * first such report for a collection this session, spends the collection's
+     * refresh (descriptor re-read + cipher swap, via the injected `refresh`) and
+     * re-reads once. A later unknown-epoch report for the same collection
+     * returns the read's value as-is.
+     *
+     * @param options {object}
+     * @param options.collectionId {string}
+     * @param options.read {function}   the read, reporting `unknownEpoch`
+     * @returns {Promise<T>}   the (possibly re-read) value
+     */
+    readWithRefresh<T>({ collectionId, read }: {
+        collectionId: string;
+        read: () => Promise<{
+            value: T;
+            unknownEpoch: boolean;
+        }>;
+    }): Promise<T>;
+    /**
+     * Re-arms the guard -- for one collection, or (with no argument) for all.
+     * Call when a fresh descriptor is installed by some other path (a share,
+     * unshare, or recipient rotation this session performed itself), since the
+     * next unknown-epoch read is then evidence of a NEW rotation elsewhere.
+     */
+    reset(options?: {
+        collectionId?: string;
+    }): void;
+}
+//# sourceMappingURL=refresh.d.ts.map

package/dist/descriptors/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/descriptors/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAEH;;;;;;GAMG;AACH,qBAAa,uBAAuB;;gBAKtB,EACV,OAAO,EACR,EAAE;QACD,OAAO,EAAE,CAAC,OAAO,EAAE;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAC9D;IAID,mEAAmE;IACnE,aAAa,CAAC,EAAE,YAAY,EAAE,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;IAIlE;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,CAAC,EAAE,EACvB,YAAY,EACZ,IAAI,EACL,EAAE;QACD,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,MAAM,OAAO,CAAC;YAAE,KAAK,EAAE,CAAC,CAAC;YAAC,YAAY,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KACzD,GAAG,OAAO,CAAC,CAAC,CAAC;IAUd;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CAOjD"}

package/dist/descriptors/refresh.js

@@ -0,0 +1,67 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The unknown-epoch refresh policy: an epoch rotation emits no change-feed
+ * entry, so a cipher built from a cached descriptor can meet envelopes stamped
+ * with an epoch it has never seen. The remedy is one re-read of the
+ * Collection Description plus a cipher rebuild and a single retry -- and the
+ * policy guards that remedy to ONCE per collection per session, so a
+ * genuinely foreign envelope (one no descriptor will ever route) cannot drive
+ * a refetch loop, let alone a refetch per resource.
+ */
+/**
+ * Tracks which collections have already spent their one refresh this session,
+ * and runs reads under the refresh-and-retry-once rule. One instance per
+ * session (it IS the session scope of the guard); the injected `refresh` does
+ * the host's whole swap -- re-acquire the descriptor(s), rebuild the
+ * cipher(s), and install them wherever the host keeps them.
+ */
+export class DescriptorRefreshPolicy {
+    #refresh;
+    // Collection ids whose one refresh this session is already spent.
+    #refreshed = new Set();
+    constructor({ refresh }) {
+        this.#refresh = refresh;
+    }
+    /** Whether a collection still has its one refresh this session. */
+    shouldRefresh({ collectionId }) {
+        return !this.#refreshed.has(collectionId);
+    }
+    /**
+     * Runs a read that reports whether it skipped unknown-epoch rows; on the
+     * first such report for a collection this session, spends the collection's
+     * refresh (descriptor re-read + cipher swap, via the injected `refresh`) and
+     * re-reads once. A later unknown-epoch report for the same collection
+     * returns the read's value as-is.
+     *
+     * @param options {object}
+     * @param options.collectionId {string}
+     * @param options.read {function}   the read, reporting `unknownEpoch`
+     * @returns {Promise<T>}   the (possibly re-read) value
+     */
+    async readWithRefresh({ collectionId, read }) {
+        const first = await read();
+        if (first.unknownEpoch && this.shouldRefresh({ collectionId })) {
+            this.#refreshed.add(collectionId);
+            await this.#refresh({ collectionId });
+            return (await read()).value;
+        }
+        return first.value;
+    }
+    /**
+     * Re-arms the guard -- for one collection, or (with no argument) for all.
+     * Call when a fresh descriptor is installed by some other path (a share,
+     * unshare, or recipient rotation this session performed itself), since the
+     * next unknown-epoch read is then evidence of a NEW rotation elsewhere.
+     */
+    reset(options) {
+        if (options?.collectionId === undefined) {
+            this.#refreshed.clear();
+        }
+        else {
+            this.#refreshed.delete(options.collectionId);
+        }
+    }
+}
+//# sourceMappingURL=refresh.js.map

package/dist/descriptors/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/descriptors/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IACzB,QAAQ,CAAsD;IACvE,kEAAkE;IACzD,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IAEvC,YAAY,EACV,OAAO,EAGR;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAED,mEAAmE;IACnE,aAAa,CAAC,EAAE,YAAY,EAA4B;QACtD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAI,EACvB,YAAY,EACZ,IAAI,EAIL;QACC,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAA;QAC1B,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;YACrC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAA;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAmC;QACvC,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;CACF"}

package/dist/enrollment/enrollment.d.ts

@@ -1,5 +1,5 @@
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
-import type { MarkerStore } from '@interop/was-client/edv';
+import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
 import type { Puk } from '../keys/puk.js';
 import type { AccountPointer } from '../keyring/record.js';
@@ -95,8 +95,8 @@ export declare function mintEnrollmentRequest(): Promise<{
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   the approving
  *   client's own (identity) key-agreement key, unwrapping each epoch for
  *   re-wrapping
- * @param options.pukRosterStore {MarkerStore}   the account's
- *   `key-map/puk.json` marker store
+ * @param options.pukRosterStore {EncryptionDescriptorStore}   the account's
+ *   `key-map/puk.json` descriptor store
  * @param options.idStore {WebvhIdStore}   the account's `id` collection
  * @returns {Promise<{ did: string }>}   the account's did:webvh
  */
@@ -104,7 +104,7 @@ export declare function approveEnrollment({ request, clientWebvhKeys, clientKeyA
     request: EnrollmentRequest;
     clientWebvhKeys: ClientWebvhUpdateKeys;
     clientKeyAgreementKey: IKeyAgreementKey;
-    pukRosterStore: MarkerStore;
+    pukRosterStore: EncryptionDescriptorStore;
     idStore: WebvhIdStore;
 }): Promise<{
     did: string;

package/dist/enrollment/enrollment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAS1D,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAS7B,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAa1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AASD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,cAAc,EAAE,WAAW,CAAA;IAC3B,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB3B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACR,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;CACxB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CA2E/C"}
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AASxE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAS7B,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAa1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AASD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,cAAc,EAAE,yBAAyB,CAAA;IACzC,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB3B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACR,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;CACxB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CA2E/C"}