@interop/wallet-core 0.62.0 → 0.65.0

package/dist/clients/policy.js

@@ -6,14 +6,20 @@
  * @param options.client {AccountClientView}   the row in question
  * @param options.clients {AccountClientView[]}   the whole listing (the
  *   last-client rule is a property of the account, not of the row)
+ * @param [options.signerKind] {string}   who would sign the removal entry:
+ *   `'client'` (the default, an enrolled client's update keys) or `'ladder'`
+ *   (a standing credential's rung), which lifts the self and last-client
+ *   refusals -- see the module doc
  * @returns {{ allowed: boolean, refusal?: DisconnectRefusal }}
  */
-export function disconnectEligibility({ client, clients }) {
-    if (client.isCurrent) {
-        return { allowed: false, refusal: 'self' };
-    }
-    if (clients.length <= 1) {
-        return { allowed: false, refusal: 'last-client' };
+export function disconnectEligibility({ client, clients, signerKind = 'client' }) {
+    if (signerKind === 'client') {
+        if (client.isCurrent) {
+            return { allowed: false, refusal: 'self' };
+        }
+        if (clients.length <= 1) {
+            return { allowed: false, refusal: 'last-client' };
+        }
     }
     if (!client.updateKeyMultibase) {
         return { allowed: false, refusal: 'unattributed-update-key' };

package/dist/clients/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAyCA;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EAIX;IACC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACP,UAAU,GAAG,QAAQ,EAKtB;IACC,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;QACnD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EAIX;IACC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}

package/dist/clients/revocation.d.ts

@@ -20,11 +20,11 @@
  *    from the document the edit itself just resolved to (no re-fetch of the
  *    log this call just extended). On a log-governed roster store the
  *    orchestrator itself guarantees post-edit anchoring: the controller view
- *    built from the edit's own post-edit log is set as the store's freshness
- *    floor (`setControllerFloor`) before anything roster-side runs, so the
- *    rotation and the seal backstop anchor at or past the edit even where the
- *    app's injected controller resolution still serves a cached pre-edit
- *    view. The roster delivers, never sources, so the
+ *    built from the edit's own post-edit log is set as the store's minimum
+ *    controller version (`setMinimumControllerVersion`) before anything
+ *    roster-side runs, so the rotation and the seal backstop anchor at or
+ *    past the edit even where the app's injected controller resolution still
+ *    serves a cached pre-edit view. The roster delivers, never sources, so the
  *    stage names no client at all: it converges the roster onto that document
  *    (the login sweep's own path), retiring every current-epoch recipient the
  *    document no longer keys in one rotation. Nothing here has to pair a
@@ -72,7 +72,7 @@
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
-import { type ClientWebvhUpdateKeys, type PublishedKeyDocument, type RevokedClientKeys, type WebvhIdStore } from '../webvh/index.js';
+import { type AccountLogSigner, type PublishedKeyDocument, type RevokedClientKeys, type WebvhIdStore } from '../webvh/index.js';
 import { type CascadeCollections, type RosterSealReport, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
 export type { CascadeCollections, RosterSealReport };
 /**
@@ -125,11 +125,18 @@ export interface ClientRevocationResult {
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
- * @param options.updateKeys {ClientWebvhUpdateKeys}   THIS client's did:webvh
- *   update-key seeds, which sign the document edit
+ * @param options.signer {AccountLogSigner}   who signs the document edit:
+ *   THIS client's did:webvh update-key seeds, or the acting credential's
+ *   ladder seed
  * @param options.revokedClient {RevokedClientKeys}   the revoked client's
  *   public halves (its two verification-method multibases and its active
  *   update key)
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through, passed straight to the document edit: the
+ *   post-removal `did:web` projection is PUT through it immediately before
+ *   that entry publishes, so a ladder-signed disconnect does not leave
+ *   `did.json` naming the revoked client. Best-effort, and omitted the
+ *   behavior is unchanged (see `revokeWebvhClient`)
  * @param [options.knownLatentHashes] {string[]}   the standing recovery codes'
  *   update-key hashes, so the document edit can tell the revoked client's
  *   staged commitment apart from a latent recovery commitment (the one
@@ -164,9 +171,10 @@ export interface ClientRevocationResult {
  *   keeps operating without a re-login
  * @returns {Promise<ClientRevocationResult>}
  */
-export declare function revokeAccountClient({ idStore, updateKeys, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }: {
+export declare function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
+    projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     revokedClient: RevokedClientKeys;
     knownLatentHashes?: string[];
     expectedDid?: string;

package/dist/clients/revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACrD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,UAAU,CAAC,EAAE,0BAA0B,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACzC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA8ElC"}
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACrD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,UAAU,CAAC,EAAE,0BAA0B,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACzC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA+ElC"}

package/dist/clients/revocation.js

@@ -17,11 +17,18 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
- * @param options.updateKeys {ClientWebvhUpdateKeys}   THIS client's did:webvh
- *   update-key seeds, which sign the document edit
+ * @param options.signer {AccountLogSigner}   who signs the document edit:
+ *   THIS client's did:webvh update-key seeds, or the acting credential's
+ *   ladder seed
  * @param options.revokedClient {RevokedClientKeys}   the revoked client's
  *   public halves (its two verification-method multibases and its active
  *   update key)
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through, passed straight to the document edit: the
+ *   post-removal `did:web` projection is PUT through it immediately before
+ *   that entry publishes, so a ladder-signed disconnect does not leave
+ *   `did.json` naming the revoked client. Best-effort, and omitted the
+ *   behavior is unchanged (see `revokeWebvhClient`)
  * @param [options.knownLatentHashes] {string[]}   the standing recovery codes'
  *   update-key hashes, so the document edit can tell the revoked client's
  *   staged commitment apart from a latent recovery commitment (the one
@@ -56,7 +63,7 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
  *   keeps operating without a re-login
  * @returns {Promise<ClientRevocationResult>}
  */
-export async function revokeAccountClient({ idStore, updateKeys, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }) {
+export async function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }) {
     if (ownSigningKeyMultibase &&
         ownSigningKeyMultibase === revokedClient.signingKeyMultibase) {
         throw new Error('This wallet cannot disconnect itself; use another enrolled wallet ' +
@@ -71,13 +78,14 @@ export async function revokeAccountClient({ idStore, updateKeys, revokedClient,
     // recipients from.
     const { did, doc, log } = await revokeWebvhClient({
         idStore,
-        updateKeys,
+        signer,
+        ...(projectionStore ? { projectionStore } : {}),
         revokedClient,
         ...(knownLatentHashes ? { knownLatentHashes } : {}),
         ...(expectedDid !== undefined ? { expectedDid } : {})
     });
     // 2-3. The shared roster-and-cascade tail: the roster rotation onto the
-    // post-edit document (with its post-edit controller floor and its seal
+    // post-edit document (with its post-edit minimum controller version and its seal
     // backstop), then the collection fan-out onto the fresh key.
     const tail = await rotateRosterToDocumentAndCascade({
         rosterStore,

package/dist/clients/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AA0EA,OAAO,EACL,iBAAiB,EAKlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAoCzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EAyBlB;IACC,IACE,sBAAsB;QACtB,sBAAsB,KAAK,aAAa,CAAC,mBAAmB,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,sCAAsC,CACzC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAChD,OAAO;QACP,UAAU;QACV,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,sEAAsE;QACtE,gEAAgE;QAChE,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,mEAAmE;IACnE,YAAY;IACZ,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAExE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AA0EA,OAAO,EACL,iBAAiB,EAKlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAoCzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EA0BlB;IACC,IACE,sBAAsB;QACtB,sBAAsB,KAAK,aAAa,CAAC,mBAAmB,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,sCAAsC,CACzC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAChD,OAAO;QACP,MAAM;QACN,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,sEAAsE;QACtE,gEAAgE;QAChE,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,mEAAmE;IACnE,YAAY;IACZ,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAExE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC"}

package/dist/clients/rosterPolicy.d.ts

@@ -112,7 +112,13 @@ export declare function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgr
 /**
  * Converges the roster onto the account's locally verified did:webvh document,
  * adopting a rotation the ordinary way (a roster re-read) and handing back the
- * key and descriptor the collection fan-out should run against.
+ * key and descriptor the collection fan-out should run against. Both
+ * directions run: a current-epoch recipient the document no longer keys is
+ * rotated away, and an enrolled client the document DOES key that holds no
+ * wrap is escrowed into every epoch. The escrow direction is what the login
+ * sweep contributes to a ceremony torn between the entry that published a
+ * client and the append that was to wrap the user key to it; it appends
+ * without rotating, so it leaves `rotated` false.
  *
  * Best-effort UP TO the rotation: a log that cannot be fetched or verified, or
  * a roster that turns out to need nothing, resolves to the unchanged input,
@@ -143,7 +149,8 @@ export declare function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgr
  *   {@link AdoptedUserKey} of a rotation, before the fan-out runs
  * @returns {Promise<object>}   whether the roster rotated on this call,
  *   whether the seal backstop had to append (`sealed`), the stale recipient
- *   kids found, and the key + descriptor to fan out with
+ *   kids found, the kids escrowed by the mirror direction, and the key +
+ *   descriptor to fan out with
  */
 export declare function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, clientKeyAgreementKey, pinnedEpochId, accountLogPinStore, onUserKeyAdopted }: {
     pointer: AccountLogPointer;
@@ -158,6 +165,7 @@ export declare function convergeUserKeyRosterToAccount({ pointer, store, userKey
     rotated: boolean;
     sealed: boolean;
     staleRecipientIds: string[];
+    escrowedRecipientIds: string[];
     userKey: UserKey;
     descriptor: CollectionEncryption;
 }>;

package/dist/clients/rosterPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAGnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AA2CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAqC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CA0GD"}
+{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAInE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AAuCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAqC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CA0HD"}

package/dist/clients/rosterPolicy.js

@@ -1,5 +1,6 @@
 import { convergeUserKeyRosterToDocument, isSealableDescriptorStore, readUserKeyRoster } from '../keys/index.js';
 import { log } from '../log.js';
+import { isResourceLogRefusal } from '../resourceLog/errors.js';
 import { verifyAccountLog } from '../webvh/index.js';
 /**
  * Whether a thrown error is one of the roster refusals -- a fabricated or
@@ -9,33 +10,29 @@ import { verifyAccountLog } from '../webvh/index.js';
  * rather than degrading it, so both entry points rethrow them instead of
  * warning and carrying on.
  *
- * The one carve-out is the chain-head pin's continuity reason `rollback` --
- * reconcilable divergence (possibly replication lag, retryable per the
- * profile's log-pin rules), the same carve-out `descriptors/acquire.ts` makes
- * on the collection-descriptor path and the account-log pin makes for the
- * account document: nothing rolled back is adopted and the pin never
- * regresses, so a lagging replica degrades the start to the cached user key
- * instead of hard-refusing a healthy account's login. The epoch pin's own
- * `UserKeyRosterContinuityError` stays a refusal: with no chain to compare it
- * cannot tell a rollback from a fork, and it is the guard that remains when
- * the chain-head pin was lost with a reinstall.
+ * The log half is {@link isResourceLogRefusal}, which carries the chain-head
+ * pin's `rollback` carve-out for every reader of a governed log; what this
+ * adds is the three names the generic taxonomy does not have. Among them the
+ * epoch pin's own `UserKeyRosterContinuityError` stays a refusal with no
+ * carve-out of its own: with no chain to compare it cannot tell a rollback
+ * from a fork, and it is the guard that remains when the chain-head pin was
+ * lost with a reinstall.
  *
- * Matched on `err.name` rather than `instanceof`: the errors are raised inside
- * the app-injected descriptor store, which can resolve to a different copy of
- * this package (linked, or duplicated through a dependency tree), and a
- * refusal from that copy must not fall into the warn-and-proceed transport
- * branch.
+ * Matched on `err.name` rather than `instanceof`, for the reason the shared
+ * predicate is: the errors are raised inside the app-injected descriptor
+ * store, which can resolve to a different copy of this package (linked, or
+ * duplicated through a dependency tree), and a refusal from that copy must
+ * not fall into the warn-and-proceed transport branch.
  *
  * @param err {unknown}
  * @returns {boolean}
  */
 function isRosterRefusal(err) {
-    const name = err?.name;
-    if (name === 'ResourceLogContinuityError') {
-        return err.reason !== 'rollback';
+    if (isResourceLogRefusal(err)) {
+        return true;
     }
-    return (name === 'ResourceLogIntegrityError' ||
-        name === 'UserKeyRosterContinuityError' ||
+    const name = err?.name;
+    return (name === 'UserKeyRosterContinuityError' ||
         name === 'UserKeyRosterIntegrityError' ||
         name === 'UserKeyRosterUnwrapError');
 }
@@ -110,7 +107,13 @@ export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgree
 /**
  * Converges the roster onto the account's locally verified did:webvh document,
  * adopting a rotation the ordinary way (a roster re-read) and handing back the
- * key and descriptor the collection fan-out should run against.
+ * key and descriptor the collection fan-out should run against. Both
+ * directions run: a current-epoch recipient the document no longer keys is
+ * rotated away, and an enrolled client the document DOES key that holds no
+ * wrap is escrowed into every epoch. The escrow direction is what the login
+ * sweep contributes to a ceremony torn between the entry that published a
+ * client and the append that was to wrap the user key to it; it appends
+ * without rotating, so it leaves `rotated` false.
  *
  * Best-effort UP TO the rotation: a log that cannot be fetched or verified, or
  * a roster that turns out to need nothing, resolves to the unchanged input,
@@ -141,18 +144,21 @@ export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgree
  *   {@link AdoptedUserKey} of a rotation, before the fan-out runs
  * @returns {Promise<object>}   whether the roster rotated on this call,
  *   whether the seal backstop had to append (`sealed`), the stale recipient
- *   kids found, and the key + descriptor to fan out with
+ *   kids found, the kids escrowed by the mirror direction, and the key +
+ *   descriptor to fan out with
  */
 export async function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, clientKeyAgreementKey, pinnedEpochId, accountLogPinStore, onUserKeyAdopted }) {
     const unchanged = {
         rotated: false,
         sealed: false,
         staleRecipientIds: [],
+        escrowedRecipientIds: [],
         userKey,
         descriptor
     };
     let rotated;
     let staleRecipientIds;
+    let escrowedRecipientIds;
     try {
         const { doc } = await verifyAccountLog({
             ...pointer,
@@ -161,10 +167,16 @@ export async function convergeUserKeyRosterToAccount({ pointer, store, userKey,
         const converged = await convergeUserKeyRosterToDocument({
             store,
             document: doc,
-            descriptor
+            descriptor,
+            // The escrow direction needs a key that unwraps every epoch, and the
+            // login sweep is the standing mender for a ceremony torn between the
+            // entry that published a client and the append that was to wrap the
+            // user key to it. Without it only the retire direction would run here.
+            ownerKeyAgreementKey: clientKeyAgreementKey
         });
         rotated = converged.rotated;
         staleRecipientIds = converged.staleRecipientIds;
+        escrowedRecipientIds = converged.escrowedRecipientIds;
     }
     catch (err) {
         if (isRosterRefusal(err)) {
@@ -196,8 +208,12 @@ export async function convergeUserKeyRosterToAccount({ pointer, store, userKey,
             log.warn('Could not seal the wrap-set roster log', { err });
         }
     }
+    if (escrowedRecipientIds.length > 0) {
+        log.warn('The wrap-set roster held no wrap for client(s) the account document ' +
+            'keys; the escrow has been completed', { escrowedRecipientCount: escrowedRecipientIds.length });
+    }
     if (!rotated) {
-        return { ...unchanged, sealed };
+        return { ...unchanged, sealed, escrowedRecipientIds };
     }
     log.warn('The wrap-set roster still wrapped the current key to recipient(s) ' +
         'the account document no longer keys; the rotation has been completed', { staleRecipientCount: staleRecipientIds.length });
@@ -235,6 +251,7 @@ export async function convergeUserKeyRosterToAccount({ pointer, store, userKey,
         rotated: true,
         sealed,
         staleRecipientIds,
+        escrowedRecipientIds,
         userKey: read.userKey,
         descriptor: read.descriptor
     };

package/dist/clients/rosterPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AA4DA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAC1C,OAAQ,GAA4B,CAAC,MAAM,KAAK,UAAU,CAAA;IAC5D,CAAC;IACD,OAAO,CACL,IAAI,KAAK,2BAA2B;QACpC,IAAI,KAAK,8BAA8B;QACvC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,0BAA0B,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,GAAG,CAAC,IAAI,CACN,uEAAuE,EACvE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAUjB;IAOC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,EAAc;QACjC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACrC,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACtD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;SACX,CAAC,CAAA;QACF,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;QAC3B,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CACN,kEAAkE,EAClE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0BAA0B;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,CAAA;IACjC,CAAC;IACD,GAAG,CAAC,IAAI,CACN,oEAAoE;QAClE,sEAAsE,EACxE,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAClD,CAAA;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,mEAAmE;YACnE,kBAAkB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,oEAAoE;YACpE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,iBAAiB;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}
+{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AA4DA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,OAAO,CACL,IAAI,KAAK,8BAA8B;QACvC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,0BAA0B,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,GAAG,CAAC,IAAI,CACN,uEAAuE,EACvE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAUjB;IAQC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,EAAc;QACjC,oBAAoB,EAAE,EAAc;QACpC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,oBAA8B,CAAA;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACrC,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACtD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;YACV,qEAAqE;YACrE,qEAAqE;YACrE,oEAAoE;YACpE,uEAAuE;YACvE,oBAAoB,EAAE,qBAAqB;SAC5C,CAAC,CAAA;QACF,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;QAC3B,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAA;QAC/C,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,CAAA;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CACN,kEAAkE,EAClE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0BAA0B;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CACN,sEAAsE;YACpE,qCAAqC,EACvC,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,GAAG,CAAC,IAAI,CACN,oEAAoE;QAClE,sEAAsE,EACxE,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAClD,CAAA;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,mEAAmE;YACnE,kBAAkB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,oEAAoE;YACpE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,iBAAiB;QACjB,oBAAoB;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}

package/dist/descriptors/acquire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acquire.d.ts","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AA2B1E;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,oBAAoB,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,cAAc,CAAC,OAAO,EAAE;QACtB,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC7C,eAAe,CAAC,OAAO,EAAE;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,oBAAoB,CAAA;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAoB5C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAiBhD"}
+{"version":3,"file":"acquire.d.ts","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG1E;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,oBAAoB,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,cAAc,CAAC,OAAO,EAAE;QACtB,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC7C,eAAe,CAAC,OAAO,EAAE;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,oBAAoB,CAAA;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAwB5C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAiBhD"}

package/dist/descriptors/acquire.js

@@ -1,25 +1,4 @@
-/**
- * Whether a thrown fetch failure is a resource-log refusal the cache must NOT
- * paper over: a fabricated log (`ResourceLogIntegrityError`), or a log that
- * is not the continuation of the pinned history
- * (`ResourceLogContinuityError`) -- EXCEPT continuity reason `rollback`,
- * which is reconcilable divergence (possibly replication lag): the pin is
- * never regressed and nothing rolled-back is adopted, so serving the cached
- * copy in the meantime is exactly the offline case. Matched on `err.name`
- * rather than `instanceof`, which keeps this file dependency-light and
- * survives a linked or duplicated copy of the package.
- *
- * @param err {unknown}
- * @returns {boolean}
- */
-function isLogRefusal(err) {
-    const name = err?.name;
-    if (name === 'ResourceLogIntegrityError') {
-        return true;
-    }
-    return (name === 'ResourceLogContinuityError' &&
-        err.reason !== 'rollback');
-}
+import { isResourceLogRefusal } from '../resourceLog/errors.js';
 /**
  * The {@link EncryptionDescriptorSource} over a was-client handle: reads the
  * collection's Description in the given Space and returns its `encryption`
@@ -78,7 +57,11 @@ export async function acquireDescriptor({ source, cache, collectionId, onFetchEr
         return cache.readDescriptor({ collectionId });
     }
     catch (err) {
-        if (isLogRefusal(err)) {
+        // A resource-log refusal the cache must not paper over -- a fabricated
+        // log, or one that is not the continuation of the pinned history. A
+        // rollback is not one of them and falls through to the cache, as any
+        // transport failure does.
+        if (isResourceLogRefusal(err)) {
             throw err;
         }
         onFetchError?.(err, { collectionId });

package/dist/descriptors/acquire.js.map

@@ -1 +1 @@
-{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CACL,IAAI,KAAK,4BAA4B;QACpC,GAA4B,CAAC,MAAM,KAAK,UAAU,CACpD,CAAA;AACH,CAAC;AA+BD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EAIR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,WAAW,GAAG,MAAM,GAAG;iBAC1B,KAAK,CAAC,OAAO,CAAC;iBACd,UAAU,CAAC,YAAY,CAAC;iBACxB,QAAQ,EAAE,CAAA;YACb,OAAO,WAAW,EAAE,UAAU,IAAI,SAAS,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EAMb;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;YAClE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QACrC,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EAMb;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,aAAa,CAAC,GAAG,CACf,KAAK,EAAC,YAAY,EAAC,EAAE,CACnB;QACE,YAAY;QACZ,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;KAC9D,CACb,CACF,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}
+{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AA+B/D;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EAIR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,WAAW,GAAG,MAAM,GAAG;iBAC1B,KAAK,CAAC,OAAO,CAAC;iBACd,UAAU,CAAC,YAAY,CAAC;iBACxB,QAAQ,EAAE,CAAA;YACb,OAAO,WAAW,EAAE,UAAU,IAAI,SAAS,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EAMb;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;YAClE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,0BAA0B;QAC1B,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAA;QACX,CAAC;QACD,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QACrC,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EAMb;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,aAAa,CAAC,GAAG,CACf,KAAK,EAAC,YAAY,EAAC,EAAE,CACnB;QACE,YAAY;QACZ,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;KAC9D,CACb,CACF,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/descriptors/cipher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../src/descriptors/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAChC,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EACb,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACnC,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,SAAS,CAAC,CAoFrB"}
+{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../src/descriptors/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAChC,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EACb,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACnC,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,SAAS,CAAC,CAyFrB"}

package/dist/descriptors/cipher.js

@@ -61,6 +61,11 @@ export async function createRefreshingEdvDocCipher({ keyAgreementKey, keyResolve
                 return await inner.decrypt({ envelope });
             }
             catch (err) {
+                // `instanceof` is safe here and only here: `inner` is built in this
+                // file by `createEdvDocCipher`, from the same `@interop/was-client`
+                // import this class comes from, so no injected seam is crossed. A
+                // caller classifying what THIS cipher throws is crossing one, and uses
+                // `isUnknownEpochError` / `isKeyUnwrapError` instead.
                 if (!(err instanceof UnknownEpochError) || !source) {
                     throw err;
                 }

package/dist/descriptors/cipher.js.map

@@ -1 +1 @@
-{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/descriptors/cipher.ts"],"names":[],"mappings":"AAsCA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,iBAAiB,EAGlB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EASb;IACC,MAAM,KAAK,GAAG,KAAK,IAAwB,EAAE;QAC3C,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;YACzC,MAAM;YACN,KAAK;YACL,YAAY;YACZ,YAAY;SACb,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,2CAA2C;gBACpE,kEAAkE;gBAClE,oEAAoE,CACvE,CAAA;QACH,CAAC;QACD,OAAO,kBAAkB,CAAC;YACxB,eAAe;YACf,WAAW;YACX,YAAY;YACZ,YAAY;YACZ,UAAU;SACX,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,IAAI,KAAK,GAAG,MAAM,KAAK,EAAE,CAAA;IACzB,0EAA0E;IAC1E,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,SAAS,GAAyB,IAAI,CAAA;IAE1C,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAE1C,aAAa,EAAE,OAAO,CAAC,EAAE;YACvB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,kCAAkC,CAC9D,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACnD,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;wBACpC,KAAK,GAAG,MAAM,CAAA;oBAChB,CAAC,CAAC,CAAA;oBACF,SAAS,GAAG,OAAO,CAAA;oBACnB,qEAAqE;oBACrE,oEAAoE;oBACpE,qEAAqE;oBACrE,mEAAmE;oBACnE,iEAAiE;oBACjE,0BAA0B;oBAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;wBACjB,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;4BAC1B,SAAS,GAAG,IAAI,CAAA;wBAClB,CAAC;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAA;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,gEAAgE;oBAChE,+DAA+D;oBAC/D,mDAAmD;oBACnD,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,iEAAiE;gBACjE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iEAAiE;gBACjE,2BAA2B;gBAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/descriptors/cipher.ts"],"names":[],"mappings":"AAsCA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,iBAAiB,EAGlB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EASb;IACC,MAAM,KAAK,GAAG,KAAK,IAAwB,EAAE;QAC3C,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;YACzC,MAAM;YACN,KAAK;YACL,YAAY;YACZ,YAAY;SACb,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,2CAA2C;gBACpE,kEAAkE;gBAClE,oEAAoE,CACvE,CAAA;QACH,CAAC;QACD,OAAO,kBAAkB,CAAC;YACxB,eAAe;YACf,WAAW;YACX,YAAY;YACZ,YAAY;YACZ,UAAU;SACX,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,IAAI,KAAK,GAAG,MAAM,KAAK,EAAE,CAAA;IACzB,0EAA0E;IAC1E,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,SAAS,GAAyB,IAAI,CAAA;IAE1C,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAE1C,aAAa,EAAE,OAAO,CAAC,EAAE;YACvB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,kCAAkC,CAC9D,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,uEAAuE;gBACvE,sDAAsD;gBACtD,IAAI,CAAC,CAAC,GAAG,YAAY,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACnD,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;wBACpC,KAAK,GAAG,MAAM,CAAA;oBAChB,CAAC,CAAC,CAAA;oBACF,SAAS,GAAG,OAAO,CAAA;oBACnB,qEAAqE;oBACrE,oEAAoE;oBACpE,qEAAqE;oBACrE,mEAAmE;oBACnE,iEAAiE;oBACjE,0BAA0B;oBAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;wBACjB,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;4BAC1B,SAAS,GAAG,IAAI,CAAA;wBAClB,CAAC;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAA;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,gEAAgE;oBAChE,+DAA+D;oBAC/D,mDAAmD;oBACnD,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,iEAAiE;gBACjE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iEAAiE;gBACjE,2BAA2B;gBAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/descriptors/errors.d.ts

@@ -0,0 +1,43 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The read-side classification of what an injected `DocCipher` throws when it
+ * cannot open an envelope.
+ *
+ * A decrypt has two distinguishable no-key outcomes, and a host that scans
+ * rows must tell them apart: an epoch the descriptor this reader holds does
+ * not list at all (`UnknownEpochError` -- possibly fresh data behind a stale
+ * descriptor, so a re-read may fix it), and an epoch the descriptor does list
+ * but this reader holds no key for (`KeyUnwrapError` -- real data, and
+ * permanently unreadable here, since re-reading the same descriptor cannot
+ * produce a key the reader was not given). Neither is corruption, so neither
+ * row may be treated as garbage.
+ *
+ * Both are matched on `err.name`, never `instanceof`: the cipher is an
+ * injected seam, and in a wallet whose `@interop/was-client` resolves to a
+ * second copy (a `link:` dev setup, a dedupe miss through a dependency tree)
+ * the class the cipher throws is not the class the caller imported. The cost
+ * of the miss lands on real data -- a scan that misses `KeyUnwrapError` drops
+ * the row into its undecryptable bucket, which a host is entitled to purge.
+ * Both classes assign their `name` explicitly, which is what makes the string
+ * a contract.
+ *
+ * The unknown-epoch half of the pair ships from `@interop/wallet-core/sync`
+ * as `isUnknownEpochError`: the create-loss re-mint dispatches on it, and
+ * `sync` deliberately imports nothing else in this library. This file is the
+ * home of the other half, beside the cipher that raises it, and stays
+ * import-free for the same reason `resourceLog/errors.ts` does.
+ */
+/**
+ * Whether an error is the cipher's not-a-recipient signal (`KeyUnwrapError`):
+ * the envelope's epoch IS on the descriptor this reader holds, but the reader
+ * has no key for it -- never a recipient of that epoch, or removed and the
+ * epoch rotated since. Real data, unreadable by this wallet, and never
+ * garbage: a caller skips such a row and leaves it in place.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export declare function isKeyUnwrapError(err: unknown): boolean;
+//# sourceMappingURL=errors.d.ts.map

package/dist/descriptors/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/descriptors/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEtD"}

package/dist/descriptors/errors.js

@@ -0,0 +1,45 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The read-side classification of what an injected `DocCipher` throws when it
+ * cannot open an envelope.
+ *
+ * A decrypt has two distinguishable no-key outcomes, and a host that scans
+ * rows must tell them apart: an epoch the descriptor this reader holds does
+ * not list at all (`UnknownEpochError` -- possibly fresh data behind a stale
+ * descriptor, so a re-read may fix it), and an epoch the descriptor does list
+ * but this reader holds no key for (`KeyUnwrapError` -- real data, and
+ * permanently unreadable here, since re-reading the same descriptor cannot
+ * produce a key the reader was not given). Neither is corruption, so neither
+ * row may be treated as garbage.
+ *
+ * Both are matched on `err.name`, never `instanceof`: the cipher is an
+ * injected seam, and in a wallet whose `@interop/was-client` resolves to a
+ * second copy (a `link:` dev setup, a dedupe miss through a dependency tree)
+ * the class the cipher throws is not the class the caller imported. The cost
+ * of the miss lands on real data -- a scan that misses `KeyUnwrapError` drops
+ * the row into its undecryptable bucket, which a host is entitled to purge.
+ * Both classes assign their `name` explicitly, which is what makes the string
+ * a contract.
+ *
+ * The unknown-epoch half of the pair ships from `@interop/wallet-core/sync`
+ * as `isUnknownEpochError`: the create-loss re-mint dispatches on it, and
+ * `sync` deliberately imports nothing else in this library. This file is the
+ * home of the other half, beside the cipher that raises it, and stays
+ * import-free for the same reason `resourceLog/errors.ts` does.
+ */
+/**
+ * Whether an error is the cipher's not-a-recipient signal (`KeyUnwrapError`):
+ * the envelope's epoch IS on the descriptor this reader holds, but the reader
+ * has no key for it -- never a recipient of that epoch, or removed and the
+ * epoch rotated since. Real data, unreadable by this wallet, and never
+ * garbage: a caller skips such a row and leaves it in place.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export function isKeyUnwrapError(err) {
+    return err?.name === 'KeyUnwrapError';
+}
+//# sourceMappingURL=errors.js.map

package/dist/descriptors/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/descriptors/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAQ,GAAiC,EAAE,IAAI,KAAK,gBAAgB,CAAA;AACtE,CAAC"}

package/dist/descriptors/index.d.ts

@@ -35,10 +35,15 @@
  *   cipher that acquires its own descriptor and, on an unknown-epoch decrypt,
  *   re-reads the description, swaps itself, and retries exactly once per
  *   instance.
+ * - `isKeyUnwrapError` -- how a host scanning rows tells "not a recipient of
+ *   this epoch" from corruption, matched by `err.name` because the cipher is
+ *   an injected seam. Its sibling `isUnknownEpochError` ships from
+ *   `@interop/wallet-core/sync`.
  */
 export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
 export type { EncryptionDescriptorCache, EncryptionDescriptorSource } from './acquire.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
 export { DescriptorRefreshPolicy } from './refresh.js';
 export { createRefreshingEdvDocCipher } from './cipher.js';
+export { isKeyUnwrapError } from './errors.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/descriptors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}

package/dist/descriptors/index.js

@@ -35,9 +35,14 @@
  *   cipher that acquires its own descriptor and, on an unknown-epoch decrypt,
  *   re-reads the description, swaps itself, and retries exactly once per
  *   instance.
+ * - `isKeyUnwrapError` -- how a host scanning rows tells "not a recipient of
+ *   this epoch" from corruption, matched by `err.name` because the cipher is
+ *   an injected seam. Its sibling `isUnknownEpochError` ships from
+ *   `@interop/wallet-core/sync`.
  */
 export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
 export { DescriptorRefreshPolicy } from './refresh.js';
 export { createRefreshingEdvDocCipher } from './cipher.js';
+export { isKeyUnwrapError } from './errors.js';
 //# sourceMappingURL=index.js.map