@interop/wallet-core 0.65.0 → 0.67.0

package/dist/keys/clientKeyRecord.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientKeyRecord.js","sourceRoot":"","sources":["../../src/keys/clientKeyRecord.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAI5C;;;;GAIG;AACH,MAAM,YAAY,GAAG,EAAE,CAAA;AAEvB;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AA8E9B;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,IAAI,EACJ,MAAM,GAAG,YAAY,EAKtB;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,cAAc,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,oBAAoB,EAAE;YAC7D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,WAAW,MAAM,SAAS,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAInC,CAAA;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC;QAC/B,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAA;IACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACpC,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,YAAY,CAAC;YACxB,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,KAIrD,CAAA;IACD,OAAO;QACL,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,GAAG,CAAC,iBAAiB,KAAK,SAAS;YACjC,CAAC,CAAC;gBACE,iBAAiB,EAAE,YAAY,CAAC;oBAC9B,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,+BAA+B;iBACtC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,KAK7D,CAAA;IACD,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAA;IACH,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,WAG3B,CAAA;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAChC,GAAG,CAAC,SAAS,KAAK,SAAS;YACzB,CAAC,CAAC;gBACE,SAAS,EAAE,YAAY,CAAC;oBACtB,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,oBAAoB;iBAC3B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,eAAe,KAAK,SAAS;YAC/B,CAAC,CAAC;gBACE,eAAe,EAAE,YAAY,CAAC;oBAC5B,KAAK,EAAE,eAAe;oBACtB,IAAI,EAAE,0BAA0B;oBAChC,MAAM,EAAE,mBAAmB;iBAC5B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,IAAI,EACJ,MAAM,GAAG,YAAY,EAKtB;IACC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,WAAW,MAAM,SAAS,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,UAAU,EACV,OAAO,EACP,eAAe,EACf,UAAU,EACV,UAAU,EACV,OAAO,EACP,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EASrC;IACC,IACE,OAAO,EAAE,QAAQ,KAAK,iBAAiB;QACvC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,EAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAA;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,MAAM,EAAE,YAAY,CAAC;wBACnB,KAAK,EAAE,OAAO,CAAC,MAAM;wBACrB,IAAI,EAAE,mBAAmB;qBAC1B,CAAC;oBACF,GAAG,CAAC,OAAO,CAAC,WAAW;wBACrB,CAAC,CAAC;4BACE,WAAW,EAAE,YAAY,CAAC;gCACxB,KAAK,EAAE,OAAO,CAAC,WAAW;gCAC1B,IAAI,EAAE,uBAAuB;6BAC9B,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC;gBACE,KAAK,EAAE;oBACL,UAAU,EAAE,YAAY,CAAC;wBACvB,KAAK,EAAE,eAAe,CAAC,UAAU;wBACjC,IAAI,EAAE,uBAAuB;qBAC9B,CAAC;oBACF,UAAU,EAAE,YAAY,CAAC;wBACvB,KAAK,EAAE,eAAe,CAAC,UAAU;wBACjC,IAAI,EAAE,uBAAuB;qBAC9B,CAAC;oBACF,GAAG,CAAC,eAAe,CAAC,iBAAiB;wBACnC,CAAC,CAAC;4BACE,iBAAiB,EAAE,YAAY,CAAC;gCAC9B,KAAK,EAAE,eAAe,CAAC,iBAAiB;gCACxC,IAAI,EAAE,+BAA+B;6BACtC,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE;oBACvC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;wBACjC,CAAC,CAAC;4BACE,SAAS,EAAE,YAAY,CAAC;gCACtB,KAAK,EAAE,OAAO,CAAC,SAAS;gCACxB,IAAI,EAAE,oBAAoB;6BAC3B,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;wBACvC,CAAC,CAAC;4BACE,eAAe,EAAE,YAAY,CAAC;gCAC5B,KAAK,EAAE,OAAO,CAAC,eAAe;gCAC9B,IAAI,EAAE,0BAA0B;gCAChC,MAAM,EAAE,mBAAmB;6BAC5B,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EAGT;IACC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,GACnE,QAOC,CAAA;IACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;IACrE,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACvD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,MAAM,EAGP;IACC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AACxE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAuB;IAEvB,OAAO,OAAO,CACZ,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,eAAe;QACtB,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,UAAU,CAClB,CAAA;AACH,CAAC"}
+{"version":3,"file":"clientKeyRecord.js","sourceRoot":"","sources":["../../src/keys/clientKeyRecord.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAI5C;;;;GAIG;AACH,MAAM,YAAY,GAAG,EAAE,CAAA;AAEvB;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AA8E9B;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,IAAI,EACJ,MAAM,GAAG,YAAY,EAKtB;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,cAAc,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,oBAAoB,EAAE;YAC7D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,WAAW,MAAM,SAAS,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAInC,CAAA;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC;QAC/B,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAA;IACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACpC,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,YAAY,CAAC;YACxB,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,KAIrD,CAAA;IACD,OAAO;QACL,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,GAAG,CAAC,iBAAiB,KAAK,SAAS;YACjC,CAAC,CAAC;gBACE,iBAAiB,EAAE,YAAY,CAAC;oBAC9B,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,+BAA+B;iBACtC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,EAC1B,QAAQ,EACR,SAAS,EACT,eAAe,EAKhB;IACC,IACE,QAAQ,KAAK,iBAAiB;QAC9B,CAAC,SAAS,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,KAK7D,CAAA;IACD,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAA;IACH,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,WAG3B,CAAA;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAA;IACH,CAAC;IACD,kBAAkB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAA;IAC5D,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAA;IACvD,CAAC;IACD,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAChC,GAAG,CAAC,SAAS,KAAK,SAAS;YACzB,CAAC,CAAC;gBACE,SAAS,EAAE,YAAY,CAAC;oBACtB,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,oBAAoB;iBAC3B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,eAAe,KAAK,SAAS;YAC/B,CAAC,CAAC;gBACE,eAAe,EAAE,YAAY,CAAC;oBAC5B,KAAK,EAAE,eAAe;oBACtB,IAAI,EAAE,0BAA0B;oBAChC,MAAM,EAAE,mBAAmB;iBAC5B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,IAAI,EACJ,MAAM,GAAG,YAAY,EAKtB;IACC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,WAAW,MAAM,SAAS,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,UAAU,EACV,OAAO,EACP,eAAe,EACf,UAAU,EACV,UAAU,EACV,OAAO,EACP,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EASrC;IACC,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO;QACL,UAAU,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,MAAM,EAAE,YAAY,CAAC;wBACnB,KAAK,EAAE,OAAO,CAAC,MAAM;wBACrB,IAAI,EAAE,mBAAmB;qBAC1B,CAAC;oBACF,GAAG,CAAC,OAAO,CAAC,WAAW;wBACrB,CAAC,CAAC;4BACE,WAAW,EAAE,YAAY,CAAC;gCACxB,KAAK,EAAE,OAAO,CAAC,WAAW;gCAC1B,IAAI,EAAE,uBAAuB;6BAC9B,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC;gBACE,KAAK,EAAE;oBACL,UAAU,EAAE,YAAY,CAAC;wBACvB,KAAK,EAAE,eAAe,CAAC,UAAU;wBACjC,IAAI,EAAE,uBAAuB;qBAC9B,CAAC;oBACF,UAAU,EAAE,YAAY,CAAC;wBACvB,KAAK,EAAE,eAAe,CAAC,UAAU;wBACjC,IAAI,EAAE,uBAAuB;qBAC9B,CAAC;oBACF,GAAG,CAAC,eAAe,CAAC,iBAAiB;wBACnC,CAAC,CAAC;4BACE,iBAAiB,EAAE,YAAY,CAAC;gCAC9B,KAAK,EAAE,eAAe,CAAC,iBAAiB;gCACxC,IAAI,EAAE,+BAA+B;6BACtC,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE;oBACvC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;wBACjC,CAAC,CAAC;4BACE,SAAS,EAAE,YAAY,CAAC;gCACtB,KAAK,EAAE,OAAO,CAAC,SAAS;gCACxB,IAAI,EAAE,oBAAoB;6BAC3B,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;wBACvC,CAAC,CAAC;4BACE,eAAe,EAAE,YAAY,CAAC;gCAC5B,KAAK,EAAE,OAAO,CAAC,eAAe;gCAC9B,IAAI,EAAE,0BAA0B;gCAChC,MAAM,EAAE,mBAAmB;6BAC5B,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EAGT;IACC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,GACnE,QAOC,CAAA;IACH,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;IACrE,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACzD,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACvD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,MAAM,EAGP;IACC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AACxE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAuB;IAEvB,IAAI,CAAC;QACH,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/keys/index.d.ts

@@ -18,6 +18,10 @@
  *   resource-hosted descriptor needs (the governing resource log, the
  *   latest-seen epoch pin, and a recipient resolver backed by the locally
  *   verified did:webvh document).
+ * - `currentEpochOf` -- the one implementation of "resolve a descriptor's
+ *   current epoch, refusing a `currentEpoch` that names no epoch in its own
+ *   list" (`UserKeyRosterIntegrityError`); every roster and collection
+ *   descriptor read that needs the current epoch goes through it.
  * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
  *   descriptor store: reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
@@ -51,27 +55,37 @@
  *   standing unlock credential retired): the post-edit minimum controller version, the
  *   convergence rotation with its seal backstop, and the collection fan-out
  *   onto the fresh user key.
+ * - `retireRosterRecipientAndCascade` -- the same tail for a ceremony that
+ *   rotates BEFORE its document edit (the two forgets): the minimum
+ *   controller version at the caller's anchor, one named recipient retired
+ *   (`rosterWrapsRecipient` deciding whether the append is still owed), the
+ *   fresh key read back through a surviving recipient's wrap, and the same
+ *   fan-out; no seal backstop.
  * - `ensureWalletSpaceEpochs` -- the provision-time epoch[0] install for the
  *   wallet Space's encrypted collections, the EDV-bearing second step of
  *   `provisionWalletSpace`.
  * - `ensureIndexedFirstEpoch` -- one collection's epoch[0] plus its
  *   blinded-index HMAC key, adopting a pre-blind-index roster as-is.
+ * - `walletSpaceProvisioner` -- the sync engine's `ensureProvisioned` closure
+ *   over both steps, single-flight across the app's engines, refusing with
+ *   `WalletSpaceProvisioningError` when a collection was left without its
+ *   epoch so the engine never memoizes a torn run.
  */
 export { mintUserKey, userKeyVaultKeys } from './userKey.js';
 export type { UserKey } from './userKey.js';
 export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, isEnrolledClientKeyRecord, parseClientRecordPending, parseClientRecordUserKey, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
 export type { ClientKeyRecord, ClientKeyRecordJson, ClientKeyRecordPending, EnrolledClientKeyRecord } from './clientKeyRecord.js';
-export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientKid, rosterRecipientsToRetire, rotateUserKeyRoster } from './userKeyRoster.js';
+export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientKid, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
 export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
 export type { CollectionUserKeyRotationOutcome, UserKeyCascadeResult } from './userKeyCascade.js';
-export { rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
-export type { CascadeCollections, RosterCascadeResult, RosterSealReport } from './userKeyRosterCascade.js';
-export type { UserKeyRosterReadResult } from './userKeyRoster.js';
+export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
+export type { CascadeCollections, RosterCascadeResult, RosterSealReport, UserKeyAdoptedHook } from './userKeyRosterCascade.js';
+export type { DescriptorStoreRead, UserKeyRosterReadResult } from './userKeyRoster.js';
 export type { KeyAgreementDocument } from '../resourceLog/document.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
 export type { SealableEncryptionDescriptorStore } from './rosterLogStore.js';
-export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs } from './spaceEpochs.js';
+export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs, WalletSpaceProvisioningError, walletSpaceProvisioner } from './spaceEpochs.js';
 export type { WalletSpaceEpochsResult } from './spaceEpochs.js';
 export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';
 export type { ClientLabelsRecord, ClientLabelsStore } from './clientLabels.js';

package/dist/keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAA;AAC5E,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AACjE,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/index.js

@@ -18,6 +18,10 @@
  *   resource-hosted descriptor needs (the governing resource log, the
  *   latest-seen epoch pin, and a recipient resolver backed by the locally
  *   verified did:webvh document).
+ * - `currentEpochOf` -- the one implementation of "resolve a descriptor's
+ *   current epoch, refusing a `currentEpoch` that names no epoch in its own
+ *   list" (`UserKeyRosterIntegrityError`); every roster and collection
+ *   descriptor read that needs the current epoch goes through it.
  * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
  *   descriptor store: reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
@@ -51,20 +55,30 @@
  *   standing unlock credential retired): the post-edit minimum controller version, the
  *   convergence rotation with its seal backstop, and the collection fan-out
  *   onto the fresh user key.
+ * - `retireRosterRecipientAndCascade` -- the same tail for a ceremony that
+ *   rotates BEFORE its document edit (the two forgets): the minimum
+ *   controller version at the caller's anchor, one named recipient retired
+ *   (`rosterWrapsRecipient` deciding whether the append is still owed), the
+ *   fresh key read back through a surviving recipient's wrap, and the same
+ *   fan-out; no seal backstop.
  * - `ensureWalletSpaceEpochs` -- the provision-time epoch[0] install for the
  *   wallet Space's encrypted collections, the EDV-bearing second step of
  *   `provisionWalletSpace`.
  * - `ensureIndexedFirstEpoch` -- one collection's epoch[0] plus its
  *   blinded-index HMAC key, adopting a pre-blind-index roster as-is.
+ * - `walletSpaceProvisioner` -- the sync engine's `ensureProvisioned` closure
+ *   over both steps, single-flight across the app's engines, refusing with
+ *   `WalletSpaceProvisioningError` when a collection was left without its
+ *   epoch so the engine never memoizes a torn run.
  */
 export { mintUserKey, userKeyVaultKeys } from './userKey.js';
 export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, isEnrolledClientKeyRecord, parseClientRecordPending, parseClientRecordUserKey, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
-export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientKid, rosterRecipientsToRetire, rotateUserKeyRoster } from './userKeyRoster.js';
+export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientKid, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
 export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
-export { rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
+export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
-export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs } from './spaceEpochs.js';
+export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs, WalletSpaceProvisioningError, walletSpaceProvisioner } from './spaceEpochs.js';
 export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';
 export { wasClientLabelsStore } from './wasLabelsStore.js';
 //# sourceMappingURL=index.js.map

package/dist/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAA;AAS5E,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAalC,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/rosterLogStore.d.ts

@@ -34,7 +34,9 @@ export interface SealableEncryptionDescriptorStore extends EncryptionDescriptorS
  * Whether a descriptor store is log-governed and sealable -- the guard the
  * ceremonies and sweeps use to run the seal backstop only where a governing
  * log exists (an ordinary Collection-Description-backed store has nothing to
- * seal).
+ * seal). Both members of the interface are probed, since the cascade tail's
+ * anchoring preamble relies on the second: a store decorated down to `seal`
+ * alone would otherwise pass as anchorable and never be anchored.
  *
  * @param store {EncryptionDescriptorStore}
  * @returns {boolean}

package/dist/keys/rosterLogStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAExE,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAEtB,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EACL,8BAA8B,EAE/B,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;IAClC,2BAA2B,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,0BAA0B,CAAA;KACvC,GAAG,IAAI,CAAA;CACT;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,yBAAyB,GAC/B,KAAK,IAAI,iCAAiC,CAK5C;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACP,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CA0PpC"}
+{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAExE,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAEtB,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EACL,8BAA8B,EAE/B,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;IAClC,2BAA2B,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,0BAA0B,CAAA;KACvC,GAAG,IAAI,CAAA;CACT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,yBAAyB,GAC/B,KAAK,IAAI,iCAAiC,CAM5C;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACP,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CAmQpC"}

package/dist/keys/rosterLogStore.js

@@ -38,14 +38,17 @@ export { EPOCH_CONFIGURATION_STATE_TYPE };
  * Whether a descriptor store is log-governed and sealable -- the guard the
  * ceremonies and sweeps use to run the seal backstop only where a governing
  * log exists (an ordinary Collection-Description-backed store has nothing to
- * seal).
+ * seal). Both members of the interface are probed, since the cascade tail's
+ * anchoring preamble relies on the second: a store decorated down to `seal`
+ * alone would otherwise pass as anchorable and never be anchored.
  *
  * @param store {EncryptionDescriptorStore}
  * @returns {boolean}
  */
 export function isSealableDescriptorStore(store) {
-    return (typeof store.seal ===
-        'function');
+    const candidate = store;
+    return (typeof candidate.seal === 'function' &&
+        typeof candidate.setMinimumControllerVersion === 'function');
 }
 /**
  * Translates the log-store port's CAS conflict (the library's
@@ -137,7 +140,7 @@ export function logGovernedDescriptorStore({ log, resolveController, pinStore, l
         lastVerified = confirmed;
         lastVerifiedView = controller;
     }
-    return {
+    const store = {
         async read() {
             let view = null;
             const current = await readGovernedEpochConfiguration({
@@ -162,14 +165,22 @@ export function logGovernedDescriptorStore({ log, resolveController, pinStore, l
             };
         },
         async replace(descriptor, { ifMatch }) {
-            if (lastVerified === null) {
-                throw new Error('Cannot replace the governed descriptor: replace must follow a ' +
-                    'read on the same store instance.');
-            }
             if (ifMatch === undefined) {
                 throw new Error('Cannot replace the governed descriptor: the backend returned no ' +
                     'validator, and the profile forbids an unconditional write.');
             }
+            // An append builds on the head this instance last verified. A replace
+            // that no read on this instance precedes -- a caller seeding was-client's
+            // compare-and-swap from a read another instance made -- acquires that
+            // head now, the one acquisition the seed was meant to save; the
+            // caller's validator still guards the append, so a seed behind the
+            // served log loses the compare-and-swap as it would anywhere.
+            if (lastVerified === null) {
+                await store.read();
+            }
+            if (lastVerified === null) {
+                throw new Error('Cannot replace the governed descriptor: the log is absent.');
+            }
             if (lastVerified.terminal) {
                 throw new ResourceLogClosedError({ nextLog: lastVerified.terminal });
             }
@@ -306,5 +317,6 @@ export function logGovernedDescriptorStore({ log, resolveController, pinStore, l
             minimumControllerVersion = controller;
         }
     };
+    return store;
 }
 //# sourceMappingURL=rosterLogStore.js.map

package/dist/keys/rosterLogStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterLogStore.js","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,0BAA0B,EAC1B,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EAKxB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AA8BzC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAgC;IAEhC,OAAO,CACL,OAAQ,KAAoD,CAAC,IAAI;QACjE,UAAU,CACX,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,uBAAuB,CAAE,GAAa,CAAC,OAAO,EAAE;YACzD,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EAOP;IACC,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,YAAY,GAA+B,IAAI,CAAA;IACnD,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,2BAA2B;IAC3B,IAAI,gBAAgB,GAAsC,IAAI,CAAA;IAE9D,mEAAmE;IACnE,kBAAkB;IAClB,IAAI,wBAAwB,GAAsC,IAAI,CAAA;IAEtE,KAAK,UAAU,iBAAiB;QAC9B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAA;QAC1C,IAAI,wBAAwB,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,MAAM,WAAW,GACf,wBAAwB,CAAC,UAAU,CACjC,wBAAwB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAC/C,CAAA;QACH,uEAAuE;QACvE,sEAAsE;QACtE,oDAAoD;QACpD,IACE,WAAW,KAAK,SAAS;YACzB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC1C,CAAC;YACD,OAAO,wBAAwB,CAAA;QACjC,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,SAAS,OAAO,CACd,UAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;QACjD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAA;IAC1D,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EACpB,KAAK,EACL,UAAU,EAIX;QACC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc,EAAE,mBAAmB;YACnC,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;SACpC,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QACnD,YAAY,GAAG,SAAS,CAAA;QACxB,gBAAgB,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,IAAI,IAAI,GAAsC,IAAI,CAAA;YAClD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,GAAG;gBACV,iBAAiB,EAAE,KAAK,IAAI,EAAE;oBAC5B,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;oBAChC,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,QAAQ;gBACR,KAAK;aACN,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,YAAY,GAAG,IAAI,CAAA;gBACnB,gBAAgB,GAAG,IAAI,CAAA;gBACvB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAA;YAC/B,gBAAgB,GAAG,IAAI,CAAA;YACvB,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,gEAAgE;oBAC9D,kCAAkC,CACrC,CAAA;YACH,CAAC;YACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,kEAAkE;oBAChE,4DAA4D,CAC/D,CAAA;YACH,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,YAAY,GAChB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACtE,IACE,YAAY,KAAK,SAAS;gBAC1B,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC7C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D;oBAC5D,mDAAmD,YAAY,KAAK;oBACpE,+DAA+D,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBACxC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,uEAAuE;YACvE,wEAAwE;YACxE,8DAA8D;YAC9D,uEAAuE;YACvE,kEAAkE;YAClE,4CAA4C;YAC5C,MAAM,uBAAuB,CAAC;gBAC5B,KAAK;gBACL,UAAU;gBACV,IAAI,EAAE,YAAY;aACnB,CAAC,CAAA;YACF,8DAA8D;YAC9D,qEAAqE;YACrE,gEAAgE;YAChE,oEAAoE;YACpE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,oEAAoE;YACpE,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,8BAA8B,CAAC;oBACnC,KAAK,EAAE,GAAG;oBACV,iBAAiB,EAAE,iBAAiB;oBACpC,QAAQ;oBACR,KAAK;iBACN,CAAC,CAAA;gBACF,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;oBAC/D,kDAAkD,EACpD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;gBAC5C,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,MAAM,EAAE,mBAAmB;gBAC3B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC;oBACtB,OAAO,EAAE,CAAC,OAAO,CAAC;oBAClB,UAAU;oBACV,cAAc,EAAE,mBAAmB;oBACnC,GAAG,EAAE,IAAI;iBACV,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gEAAgE;gBAChE,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,wBAAwB;gBACxB,IAAI,CAAC,CACH,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,CACjE,EAAE,CAAC;oBACF,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;oBAChC,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,oEAAoE;oBAClE,0BAA0B,GAAG,CAAC,OAAO,yBAAyB;oBAC9D,+BAA+B,EACjC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAC5B,CAAA;YACH,CAAC;YACD,kEAAkE;YAClE,mEAAmE;YACnE,cAAc;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;QAC9C,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,sEAAsE;YACtE,mEAAmE;YACnE,+DAA+D;YAC/D,oEAAoE;YACpE,4BAA4B;YAC5B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;gBACjD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,cAAc,EAAE,mBAAmB;gBACnC,QAAQ;gBACR,KAAK;gBACL,MAAM;gBACN,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;aAC7D,CAAC,CAAA;YACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,YAAY,GAAG,QAAQ,CAAA;gBACvB,gBAAgB,GAAG,UAAU,CAAA;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QACnC,CAAC;QAED,2BAA2B,CAAC,EAAE,UAAU,EAAE;YACxC,wBAAwB,GAAG,UAAU,CAAA;QACvC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"rosterLogStore.js","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,0BAA0B,EAC1B,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EAKxB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AA8BzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAgC;IAEhC,MAAM,SAAS,GAAG,KAAmD,CAAA;IACrE,OAAO,CACL,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;QACpC,OAAO,SAAS,CAAC,2BAA2B,KAAK,UAAU,CAC5D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,uBAAuB,CAAE,GAAa,CAAC,OAAO,EAAE;YACzD,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EAOP;IACC,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,YAAY,GAA+B,IAAI,CAAA;IACnD,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,2BAA2B;IAC3B,IAAI,gBAAgB,GAAsC,IAAI,CAAA;IAE9D,mEAAmE;IACnE,kBAAkB;IAClB,IAAI,wBAAwB,GAAsC,IAAI,CAAA;IAEtE,KAAK,UAAU,iBAAiB;QAC9B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAA;QAC1C,IAAI,wBAAwB,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,MAAM,WAAW,GACf,wBAAwB,CAAC,UAAU,CACjC,wBAAwB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAC/C,CAAA;QACH,uEAAuE;QACvE,sEAAsE;QACtE,oDAAoD;QACpD,IACE,WAAW,KAAK,SAAS;YACzB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC1C,CAAC;YACD,OAAO,wBAAwB,CAAA;QACjC,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,SAAS,OAAO,CACd,UAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;QACjD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAA;IAC1D,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EACpB,KAAK,EACL,UAAU,EAIX;QACC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc,EAAE,mBAAmB;YACnC,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;SACpC,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QACnD,YAAY,GAAG,SAAS,CAAA;QACxB,gBAAgB,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,MAAM,KAAK,GAAsC;QAC/C,KAAK,CAAC,IAAI;YACR,IAAI,IAAI,GAAsC,IAAI,CAAA;YAClD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,GAAG;gBACV,iBAAiB,EAAE,KAAK,IAAI,EAAE;oBAC5B,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;oBAChC,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,QAAQ;gBACR,KAAK;aACN,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,YAAY,GAAG,IAAI,CAAA;gBACnB,gBAAgB,GAAG,IAAI,CAAA;gBACvB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAA;YAC/B,gBAAgB,GAAG,IAAI,CAAA;YACvB,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,kEAAkE;oBAChE,4DAA4D,CAC/D,CAAA;YACH,CAAC;YACD,sEAAsE;YACtE,0EAA0E;YAC1E,sEAAsE;YACtE,gEAAgE;YAChE,mEAAmE;YACnE,8DAA8D;YAC9D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YACpB,CAAC;YACD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAA;YACH,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,YAAY,GAChB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACtE,IACE,YAAY,KAAK,SAAS;gBAC1B,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC7C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D;oBAC5D,mDAAmD,YAAY,KAAK;oBACpE,+DAA+D,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBACxC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,uEAAuE;YACvE,wEAAwE;YACxE,8DAA8D;YAC9D,uEAAuE;YACvE,kEAAkE;YAClE,4CAA4C;YAC5C,MAAM,uBAAuB,CAAC;gBAC5B,KAAK;gBACL,UAAU;gBACV,IAAI,EAAE,YAAY;aACnB,CAAC,CAAA;YACF,8DAA8D;YAC9D,qEAAqE;YACrE,gEAAgE;YAChE,oEAAoE;YACpE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,oEAAoE;YACpE,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,8BAA8B,CAAC;oBACnC,KAAK,EAAE,GAAG;oBACV,iBAAiB,EAAE,iBAAiB;oBACpC,QAAQ;oBACR,KAAK;iBACN,CAAC,CAAA;gBACF,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;oBAC/D,kDAAkD,EACpD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;gBAC5C,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,MAAM,EAAE,mBAAmB;gBAC3B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC;oBACtB,OAAO,EAAE,CAAC,OAAO,CAAC;oBAClB,UAAU;oBACV,cAAc,EAAE,mBAAmB;oBACnC,GAAG,EAAE,IAAI;iBACV,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gEAAgE;gBAChE,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,wBAAwB;gBACxB,IAAI,CAAC,CACH,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,CACjE,EAAE,CAAC;oBACF,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;oBAChC,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,oEAAoE;oBAClE,0BAA0B,GAAG,CAAC,OAAO,yBAAyB;oBAC9D,+BAA+B,EACjC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAC5B,CAAA;YACH,CAAC;YACD,kEAAkE;YAClE,mEAAmE;YACnE,cAAc;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;QAC9C,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,sEAAsE;YACtE,mEAAmE;YACnE,+DAA+D;YAC/D,oEAAoE;YACpE,4BAA4B;YAC5B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;gBACjD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,cAAc,EAAE,mBAAmB;gBACnC,QAAQ;gBACR,KAAK;gBACL,MAAM;gBACN,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;aAC7D,CAAC,CAAA;YACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,YAAY,GAAG,QAAQ,CAAA;gBACvB,gBAAgB,GAAG,UAAU,CAAA;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QACnC,CAAC;QAED,2BAA2B,CAAC,EAAE,UAAU,EAAE;YACxC,wBAAwB,GAAG,UAAU,CAAA;QACvC,CAAC;KACF,CAAA;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/keys/spaceEpochs.d.ts

@@ -42,6 +42,19 @@ export interface WalletSpaceEpochsResult {
         collectionId: string;
         error: unknown;
     }>;
+    /**
+     * Set when the fan-out was refused whole by the mint gate: the settled
+     * user-key roster's current epoch is not the `userKey` the caller handed
+     * in, so installing collection epochs under that key would strand them on
+     * a key the roster does not deliver. Nothing was installed and `outcomes`
+     * is empty. `rosterEpochId` is the roster's current epoch; it is absent
+     * only on a malformed roster naming no epoch at all, which is refused
+     * alike. The caller that recovers the roster's real key is the one
+     * installer.
+     */
+    skipped?: {
+        rosterEpochId?: string;
+    };
 }
 /**
  * Installs key epoch[0] on a collection together with its blinded-index HMAC
@@ -83,8 +96,9 @@ export declare function ensureIndexedFirstEpoch({ collection, recipients }: {
  * `provisionWalletSpace` has declared the collections; the wallet Space's
  * provisioning is complete only once both steps have.
  *
- * Run both steps from the sync engine's `ensureProvisioned` seam (or, for a
- * driver of its own, equally before the collection's first content push): the
+ * Run both steps from the sync engine's `ensureProvisioned` seam
+ * ({@link walletSpaceProvisioner} builds that closure) or, for a driver of its
+ * own, equally before the collection's first content push: the
  * descriptor-before-first-content-push invariant rests on it.
  *
  * A collection that fails is reported in `failed` and the rest proceed, so a
@@ -104,11 +118,26 @@ export declare function ensureIndexedFirstEpoch({ collection, recipients }: {
  * descriptor's cipher on every run is both correct and (in the settled case)
  * free.
  *
+ * **The mint gate.** Collection epochs install only under the key the user-key
+ * roster delivers. A caller holding the settled roster descriptor passes it as
+ * `rosterDescriptor`, and the fan-out is refused whole (`skipped`, nothing
+ * written) when the roster's current epoch is not `userKey`: epoch[0] is
+ * create-if-absent and every later ensure adopts it, so a collection installed
+ * under a key the roster does not deliver -- a genesis re-run's throwaway
+ * candidate over an adopted roster, a cached key the roster has rotated away
+ * from -- is keyed to nothing, permanently. The gate lives here so every
+ * installer runs the same test rather than re-deriving it. A caller without
+ * the roster in hand (the sync engine's provisioner, whose user key is the one
+ * login just adopted from the roster) runs ungated.
+ *
  * @param options {object}
  * @param options.was {WasClient}
  * @param options.spaceId {string}
  * @param options.userKey {UserKey}   the account's user key, epoch[0]'s one
  *   initial recipient
+ * @param [options.rosterDescriptor] {CollectionEncryption}   the settled
+ *   user-key roster descriptor, when the caller holds it: the mint gate
+ *   refuses the fan-out unless its current epoch IS `userKey`
  * @param [options.collectionIds] {string[]}   the encrypted collections to
  *   cover; defaults to the wallet Space roster's encrypted collections. A
  *   caller naming its own ids (e.g. `contacts`) must name only collections
@@ -121,11 +150,71 @@ export declare function ensureIndexedFirstEpoch({ collection, recipients }: {
  *   descriptor and whether this call installed its epoch[0] (`false` means an
  *   existing roster was adopted), plus the collections that failed
  */
-export declare function ensureWalletSpaceEpochs({ was, spaceId, userKey, collectionIds, capability }: {
+export declare function ensureWalletSpaceEpochs({ was, spaceId, userKey, rosterDescriptor, collectionIds, capability }: {
     was: WasClient;
     spaceId: string;
     userKey: UserKey;
+    rosterDescriptor?: CollectionEncryption;
     collectionIds?: string[];
     capability?: IZcap;
 }): Promise<WalletSpaceEpochsResult>;
+/**
+ * Thrown by a {@link walletSpaceProvisioner} closure when the epoch[0] install
+ * left any collection behind: the collections that did settle are adopted, and
+ * the throw keeps the sync engine from memoizing a torn provisioning, so the
+ * next cycle re-runs it and converges.
+ */
+export declare class WalletSpaceProvisioningError extends Error {
+    failed: WalletSpaceEpochsResult['failed'];
+    constructor({ failed }: {
+        failed: WalletSpaceEpochsResult['failed'];
+    });
+}
+/**
+ * Builds the sync engine's `ensureProvisioned` closure for a wallet Space: the
+ * provisioning two-step as one call -- `provisionWalletSpace` declares the
+ * roster, then {@link ensureWalletSpaceEpochs} installs epoch[0] on every
+ * encrypted collection -- with the memoization the engine adds on top.
+ *
+ * The closure is single-flight: one app runs one engine per synced
+ * collection, and every engine's first cycle asks for the same provisioning,
+ * so concurrent calls share one in-flight run instead of racing the same
+ * create-if-absent writes. A run that leaves a collection without its epoch
+ * throws {@link WalletSpaceProvisioningError} naming the collections, so the
+ * engine does not memoize it and the next cycle re-runs it; the collections
+ * that did settle are adopted untouched by that re-run.
+ *
+ * The optional `onSettled` hook receives every run's epoch report, a partial
+ * one included, BEFORE the refusal above: a transient failure on one
+ * collection never costs the caller the descriptors the others settled on,
+ * the property the epoch install itself keeps. That report is what an eager
+ * minter builds its cipher from: the returned descriptors are the settled
+ * ones, adopted or installed, and the engine's `remintPending` seam then
+ * re-mints whatever that cipher cannot route.
+ *
+ * @param options {object}
+ * @param options.was {WasClient}
+ * @param options.spaceId {string}
+ * @param options.controllerDid {string}   the Space controller, used only when
+ *   the Space does not exist yet
+ * @param options.userKey {UserKey}   the account's user key, epoch[0]'s one
+ *   initial recipient
+ * @param [options.collectionIds] {string[]}   the encrypted collections to
+ *   cover; defaults to the wallet Space roster's encrypted collections
+ * @param [options.capability] {IZcap}   an invocation capability attached to
+ *   every epoch-install request (see {@link ensureWalletSpaceEpochs})
+ * @param [options.onSettled] {function}
+ *   `(result: WalletSpaceEpochsResult) => void | Promise<void>`, called after
+ *   each run's epoch install with its report, before a partial run's refusal
+ * @returns {() => Promise<void>}   the engine's `ensureProvisioned` seam
+ */
+export declare function walletSpaceProvisioner({ was, spaceId, controllerDid, userKey, collectionIds, capability, onSettled }: {
+    was: WasClient;
+    spaceId: string;
+    controllerDid: string;
+    userKey: UserKey;
+    collectionIds?: string[];
+    capability?: IZcap;
+    onSettled?: (result: WalletSpaceEpochsResult) => void | Promise<void>;
+}): () => Promise<void>;
 //# sourceMappingURL=spaceEpochs.d.ts.map

package/dist/keys/spaceEpochs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spaceEpochs.d.ts","sourceRoot":"","sources":["../../src/keys/spaceEpochs.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EACV,UAAU,EACV,oBAAoB,EACpB,KAAK,EACL,SAAS,EACV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAIhC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CACd,MAAM,EACN;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,oBAAoB,CAAA;KAAE,CACzD,CAAA;IACD,MAAM,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,UAAU,EACV,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,kBAAkB,EAAE,CAAA;CACjC,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAepE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,GAAG,EACH,OAAO,EACP,OAAO,EACP,aAAa,EACb,UAAU,EACX,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA2BnC"}
+{"version":3,"file":"spaceEpochs.d.ts","sourceRoot":"","sources":["../../src/keys/spaceEpochs.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EACV,UAAU,EACV,oBAAoB,EACpB,KAAK,EACL,SAAS,EACV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAKhC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CACd,MAAM,EACN;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,oBAAoB,CAAA;KAAE,CACzD,CAAA;IACD,MAAM,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IACvD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,UAAU,EACV,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,kBAAkB,EAAE,CAAA;CACjC,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAepE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,aAAa,EACb,UAAU,EACX,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAqCnC;AAED;;;;;GAKG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAA;gBAC7B,EAAE,MAAM,EAAE,EAAE;QAAE,MAAM,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAA;KAAE;CAUtE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,aAAa,EACb,OAAO,EACP,aAAa,EACb,UAAU,EACV,SAAS,EACV,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAwBtB"}

package/dist/keys/spaceEpochs.js

@@ -1,5 +1,6 @@
 import { ensureFirstEpoch } from '@interop/was-client/edv';
 import { encryptedWalletCollectionIds } from '../space/collections.js';
+import { provisionWalletSpace } from '../space/provisioning.js';
 import { userKeyAsRecipient } from './userKeyCascade.js';
 /**
  * Installs key epoch[0] on a collection together with its blinded-index HMAC
@@ -34,7 +35,7 @@ export async function ensureIndexedFirstEpoch({ collection, recipients }) {
     catch (err) {
         // Errors cross package boundaries, so match the refusal on its stable
         // `name` rather than on `instanceof`.
-        if (err.name !== 'EncryptionError') {
+        if (err?.name !== 'EncryptionError') {
             throw err;
         }
         return await ensureFirstEpoch({ collection, recipients });
@@ -51,8 +52,9 @@ export async function ensureIndexedFirstEpoch({ collection, recipients }) {
  * `provisionWalletSpace` has declared the collections; the wallet Space's
  * provisioning is complete only once both steps have.
  *
- * Run both steps from the sync engine's `ensureProvisioned` seam (or, for a
- * driver of its own, equally before the collection's first content push): the
+ * Run both steps from the sync engine's `ensureProvisioned` seam
+ * ({@link walletSpaceProvisioner} builds that closure) or, for a driver of its
+ * own, equally before the collection's first content push: the
  * descriptor-before-first-content-push invariant rests on it.
  *
  * A collection that fails is reported in `failed` and the rest proceed, so a
@@ -72,11 +74,26 @@ export async function ensureIndexedFirstEpoch({ collection, recipients }) {
  * descriptor's cipher on every run is both correct and (in the settled case)
  * free.
  *
+ * **The mint gate.** Collection epochs install only under the key the user-key
+ * roster delivers. A caller holding the settled roster descriptor passes it as
+ * `rosterDescriptor`, and the fan-out is refused whole (`skipped`, nothing
+ * written) when the roster's current epoch is not `userKey`: epoch[0] is
+ * create-if-absent and every later ensure adopts it, so a collection installed
+ * under a key the roster does not deliver -- a genesis re-run's throwaway
+ * candidate over an adopted roster, a cached key the roster has rotated away
+ * from -- is keyed to nothing, permanently. The gate lives here so every
+ * installer runs the same test rather than re-deriving it. A caller without
+ * the roster in hand (the sync engine's provisioner, whose user key is the one
+ * login just adopted from the roster) runs ungated.
+ *
  * @param options {object}
  * @param options.was {WasClient}
  * @param options.spaceId {string}
  * @param options.userKey {UserKey}   the account's user key, epoch[0]'s one
  *   initial recipient
+ * @param [options.rosterDescriptor] {CollectionEncryption}   the settled
+ *   user-key roster descriptor, when the caller holds it: the mint gate
+ *   refuses the fan-out unless its current epoch IS `userKey`
  * @param [options.collectionIds] {string[]}   the encrypted collections to
  *   cover; defaults to the wallet Space roster's encrypted collections. A
  *   caller naming its own ids (e.g. `contacts`) must name only collections
@@ -89,7 +106,16 @@ export async function ensureIndexedFirstEpoch({ collection, recipients }) {
  *   descriptor and whether this call installed its epoch[0] (`false` means an
  *   existing roster was adopted), plus the collections that failed
  */
-export async function ensureWalletSpaceEpochs({ was, spaceId, userKey, collectionIds, capability }) {
+export async function ensureWalletSpaceEpochs({ was, spaceId, userKey, rosterDescriptor, collectionIds, capability }) {
+    if (rosterDescriptor && rosterDescriptor.currentEpoch !== userKey.id) {
+        return {
+            outcomes: {},
+            failed: [],
+            skipped: rosterDescriptor.currentEpoch !== undefined
+                ? { rosterEpochId: rosterDescriptor.currentEpoch }
+                : {}
+        };
+    }
     const ids = collectionIds ?? encryptedWalletCollectionIds();
     const outcomes = {};
     const failed = [];
@@ -113,4 +139,84 @@ export async function ensureWalletSpaceEpochs({ was, spaceId, userKey, collectio
     }));
     return { outcomes, failed };
 }
+/**
+ * Thrown by a {@link walletSpaceProvisioner} closure when the epoch[0] install
+ * left any collection behind: the collections that did settle are adopted, and
+ * the throw keeps the sync engine from memoizing a torn provisioning, so the
+ * next cycle re-runs it and converges.
+ */
+export class WalletSpaceProvisioningError extends Error {
+    failed;
+    constructor({ failed }) {
+        super(`Wallet Space provisioning left ${failed.length} collection(s) ` +
+            `without their first key epoch: ` +
+            failed.map(entry => `"${entry.collectionId}"`).join(', ') +
+            '.');
+        this.name = 'WalletSpaceProvisioningError';
+        this.failed = failed;
+    }
+}
+/**
+ * Builds the sync engine's `ensureProvisioned` closure for a wallet Space: the
+ * provisioning two-step as one call -- `provisionWalletSpace` declares the
+ * roster, then {@link ensureWalletSpaceEpochs} installs epoch[0] on every
+ * encrypted collection -- with the memoization the engine adds on top.
+ *
+ * The closure is single-flight: one app runs one engine per synced
+ * collection, and every engine's first cycle asks for the same provisioning,
+ * so concurrent calls share one in-flight run instead of racing the same
+ * create-if-absent writes. A run that leaves a collection without its epoch
+ * throws {@link WalletSpaceProvisioningError} naming the collections, so the
+ * engine does not memoize it and the next cycle re-runs it; the collections
+ * that did settle are adopted untouched by that re-run.
+ *
+ * The optional `onSettled` hook receives every run's epoch report, a partial
+ * one included, BEFORE the refusal above: a transient failure on one
+ * collection never costs the caller the descriptors the others settled on,
+ * the property the epoch install itself keeps. That report is what an eager
+ * minter builds its cipher from: the returned descriptors are the settled
+ * ones, adopted or installed, and the engine's `remintPending` seam then
+ * re-mints whatever that cipher cannot route.
+ *
+ * @param options {object}
+ * @param options.was {WasClient}
+ * @param options.spaceId {string}
+ * @param options.controllerDid {string}   the Space controller, used only when
+ *   the Space does not exist yet
+ * @param options.userKey {UserKey}   the account's user key, epoch[0]'s one
+ *   initial recipient
+ * @param [options.collectionIds] {string[]}   the encrypted collections to
+ *   cover; defaults to the wallet Space roster's encrypted collections
+ * @param [options.capability] {IZcap}   an invocation capability attached to
+ *   every epoch-install request (see {@link ensureWalletSpaceEpochs})
+ * @param [options.onSettled] {function}
+ *   `(result: WalletSpaceEpochsResult) => void | Promise<void>`, called after
+ *   each run's epoch install with its report, before a partial run's refusal
+ * @returns {() => Promise<void>}   the engine's `ensureProvisioned` seam
+ */
+export function walletSpaceProvisioner({ was, spaceId, controllerDid, userKey, collectionIds, capability, onSettled }) {
+    let inFlight = null;
+    const run = async () => {
+        await provisionWalletSpace({ was, spaceId, controllerDid });
+        const result = await ensureWalletSpaceEpochs({
+            was,
+            spaceId,
+            userKey,
+            collectionIds,
+            capability
+        });
+        await onSettled?.(result);
+        if (result.failed.length > 0) {
+            throw new WalletSpaceProvisioningError({ failed: result.failed });
+        }
+    };
+    return async () => {
+        if (inFlight === null) {
+            inFlight = run().finally(() => {
+                inFlight = null;
+            });
+        }
+        return inFlight;
+    };
+}
 //# sourceMappingURL=spaceEpochs.js.map

package/dist/keys/spaceEpochs.js.map

@@ -1 +1 @@
-{"version":3,"file":"spaceEpochs.js","sourceRoot":"","sources":["../../src/keys/spaceEpochs.ts"],"names":[],"mappings":"AAgCA,OAAO,EACL,gBAAgB,EAEjB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAiBxD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,UAAU,EACV,UAAU,EAIX;IACC,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC;YAC5B,UAAU;YACV,UAAU;YACV,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,sCAAsC;QACtC,IAAK,GAAa,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,GAAG,EACH,OAAO,EACP,OAAO,EACP,aAAa,EACb,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,aAAa,IAAI,4BAA4B,EAAE,CAAA;IAC3D,MAAM,QAAQ,GAAwC,EAAE,CAAA;IACxD,MAAM,MAAM,GAAoD,EAAE,CAAA;IAClE,MAAM,OAAO,CAAC,GAAG,CACf,GAAG,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,uBAAuB,CAAC;gBAC9D,UAAU,EAAE,GAAG;qBACZ,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC;qBAC9B,UAAU,CAAC,YAAY,CAAC;gBAC3B,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;aAC9C,CAAC,CAAA;YACF,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,YAAY;gBACZ,KAAK,EAAE,IAAI,KAAK,CACd,sDAAsD;oBACpD,IAAI,YAAY,eAAe,OAAO,IAAI,EAC5C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC"}
+{"version":3,"file":"spaceEpochs.js","sourceRoot":"","sources":["../../src/keys/spaceEpochs.ts"],"names":[],"mappings":"AAgCA,OAAO,EACL,gBAAgB,EAEjB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AA4BxD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,UAAU,EACV,UAAU,EAIX;IACC,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC;YAC5B,UAAU;YACV,UAAU;YACV,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,sCAAsC;QACtC,IAAK,GAAoB,EAAE,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACtD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IAC3D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,aAAa,EACb,UAAU,EAQX;IACC,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACrE,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE;YACV,OAAO,EACL,gBAAgB,CAAC,YAAY,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,YAAY,EAAE;gBAClD,CAAC,CAAC,EAAE;SACT,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,IAAI,4BAA4B,EAAE,CAAA;IAC3D,MAAM,QAAQ,GAAwC,EAAE,CAAA;IACxD,MAAM,MAAM,GAAoD,EAAE,CAAA;IAClE,MAAM,OAAO,CAAC,GAAG,CACf,GAAG,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,uBAAuB,CAAC;gBAC9D,UAAU,EAAE,GAAG;qBACZ,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC;qBAC9B,UAAU,CAAC,YAAY,CAAC;gBAC3B,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;aAC9C,CAAC,CAAA;YACF,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,YAAY;gBACZ,KAAK,EAAE,IAAI,KAAK,CACd,sDAAsD;oBACpD,IAAI,YAAY,eAAe,OAAO,IAAI,EAC5C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,MAAM,CAAmC;IACzC,YAAY,EAAE,MAAM,EAAiD;QACnE,KAAK,CACH,kCAAkC,MAAM,CAAC,MAAM,iBAAiB;YAC9D,iCAAiC;YACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACzD,GAAG,CACN,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,aAAa,EACb,OAAO,EACP,aAAa,EACb,UAAU,EACV,SAAS,EASV;IACC,IAAI,QAAQ,GAAyB,IAAI,CAAA;IACzC,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;QACpC,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;YAC3C,GAAG;YACH,OAAO;YACP,OAAO;YACP,aAAa;YACb,UAAU;SACX,CAAC,CAAA;QACF,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,CAAA;QACzB,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACnE,CAAC;IACH,CAAC,CAAA;IACD,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAA;YACjB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;AACH,CAAC"}

package/dist/keys/userKeyCascade.d.ts

@@ -23,11 +23,12 @@
  * carries an epoch roster from provisioning (`ensureWalletSpaceEpochs`), so a
  * descriptor met without epochs can only mean a tampering or pre-provisioning
  * host and is refused fail-closed. A descriptor whose `currentEpoch` names no
- * epoch in its own list is refused the same way (the shape
- * `readUserKeyRoster` refuses on the roster itself): collection descriptors
- * arrive host-served with no server-side epoch invariants, so a mismatched
- * pair is a configuration no enrolled client authenticated, never something
- * to evaluate against the last epoch. No construction anywhere installs a
+ * epoch in its own list is refused the same way, through the same helper
+ * `readUserKeyRoster` refuses on the roster itself ({@link currentEpochOf},
+ * `UserKeyRosterIntegrityError`): collection descriptors arrive host-served
+ * with no server-side epoch invariants, so a mismatched pair is a
+ * configuration no enrolled client authenticated, never something to
+ * evaluate against the last epoch. No construction anywhere installs a
  * user-key secret as a collection epoch secret, which is what keeps a
  * collection-epoch escrow (an App Connect grant, a share) from ever handing a
  * grantee the user key itself.
@@ -111,6 +112,8 @@ export type CollectionUserKeyRotationOutcome = 'noop' | 'sealed' | 'escrowed' |
  * @param options.generations {UserKey[]}   every roster generation this client
  *   could unwrap ({@link unwrapUserKeyGenerations}), oldest first
  * @returns {Promise<CollectionUserKeyRotationOutcome>}
+ * @throws {UserKeyRosterIntegrityError}   the descriptor's `currentEpoch`
+ *   names no epoch in its own list
  */
 export declare function rotateCollectionEpochsToUserKey({ store, userKey, generations }: {
     store: EncryptionDescriptorStore;