@interop/wallet-core 0.67.0 → 0.69.0

package/dist/descriptors/acquire.js

@@ -1,100 +0,0 @@
-import { isResourceLogRefusal } from '../resourceLog/errors.js';
-/**
- * The {@link EncryptionDescriptorSource} over a was-client handle: reads the
- * collection's Description in the given Space and returns its `encryption`
- * descriptor.
- *
- * @param options {object}
- * @param options.was {WasClient}   a client whose signer can read the Space
- * @param options.spaceId {string}
- * @returns {EncryptionDescriptorSource}
- */
-export function wasDescriptorSource({ was, spaceId }) {
-    return {
-        async collectionEncryption({ collectionId }) {
-            const description = await was
-                .space(spaceId)
-                .collection(collectionId)
-                .describe();
-            return description?.encryption ?? undefined;
-        }
-    };
-}
-/**
- * Acquires one collection's descriptor: fetches it from the source, caching a
- * success; falls back to the cached copy whenever the fetch yields no
- * descriptor (it threw, or it came back empty -- a masked 404 for an
- * unauthorized read looks exactly like an unencrypted collection); and with no
- * source at all (a purely local code path) reads the cache alone. Any cached
- * copy is deliberately left in place, never cleared by an empty fetch.
- * `undefined` means no descriptor exists anywhere for this collection.
- *
- * @param options {object}
- * @param [options.source] {EncryptionDescriptorSource}   omit for cache-only
- *   acquisition
- * @param options.cache {EncryptionDescriptorCache}
- * @param options.collectionId {string}
- * @param [options.onFetchError] {function}   observes a swallowed fetch
- *   failure (the thrown-fetch branch only; an empty description is not an
- *   error). Errors from the cache itself throw through, as do a log-governed
- *   source's refusal classes (a fabricated or discontinuous log is a security
- *   signal, not an outage the cache should paper over) -- except a continuity
- *   `rollback`, which falls back to the cache like any transport hiccup
- * @returns {Promise<CollectionEncryption | undefined>}
- */
-export async function acquireDescriptor({ source, cache, collectionId, onFetchError }) {
-    if (!source) {
-        return cache.readDescriptor({ collectionId });
-    }
-    try {
-        const fetched = await source.collectionEncryption({ collectionId });
-        if (fetched) {
-            await cache.writeDescriptor({ collectionId, descriptor: fetched });
-            return fetched;
-        }
-        // Empty description: not authoritative (an unauthorized read is masked as
-        // an absent one), so a warm cache still serves the collection.
-        return cache.readDescriptor({ collectionId });
-    }
-    catch (err) {
-        // A resource-log refusal the cache must not paper over -- a fabricated
-        // log, or one that is not the continuation of the pinned history. A
-        // rollback is not one of them and falls through to the cache, as any
-        // transport failure does.
-        if (isResourceLogRefusal(err)) {
-            throw err;
-        }
-        onFetchError?.(err, { collectionId });
-        return cache.readDescriptor({ collectionId });
-    }
-}
-/**
- * Acquires descriptors for a set of collections concurrently (each fetch is an
- * independent signed round trip, so a session start is not gated on a serial
- * chain of describes). Collections that resolve no descriptor are simply
- * absent from the result.
- *
- * @param options {object}
- * @param [options.source] {EncryptionDescriptorSource}   omit for cache-only
- *   acquisition
- * @param options.cache {EncryptionDescriptorCache}
- * @param options.collectionIds {string[]}
- * @param [options.onFetchError] {function}   observes each swallowed fetch
- *   failure
- * @returns {Promise<Record<string, CollectionEncryption>>}   keyed by
- *   collection id
- */
-export async function acquireDescriptors({ source, cache, collectionIds, onFetchError }) {
-    const resolved = await Promise.all(collectionIds.map(async (collectionId) => [
-        collectionId,
-        await acquireDescriptor({ source, cache, collectionId, onFetchError })
-    ]));
-    const descriptors = {};
-    for (const [collectionId, descriptor] of resolved) {
-        if (descriptor) {
-            descriptors[collectionId] = descriptor;
-        }
-    }
-    return descriptors;
-}
-//# sourceMappingURL=acquire.js.map

package/dist/descriptors/acquire.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AA+B/D;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EAIR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,WAAW,GAAG,MAAM,GAAG;iBAC1B,KAAK,CAAC,OAAO,CAAC;iBACd,UAAU,CAAC,YAAY,CAAC;iBACxB,QAAQ,EAAE,CAAA;YACb,OAAO,WAAW,EAAE,UAAU,IAAI,SAAS,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EAMb;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;YAClE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,0BAA0B;QAC1B,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAA;QACX,CAAC;QACD,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QACrC,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EAMb;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,aAAa,CAAC,GAAG,CACf,KAAK,EAAC,YAAY,EAAC,EAAE,CACnB;QACE,YAAY;QACZ,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;KAC9D,CACb,CACF,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/descriptors/cipher.d.ts

@@ -1,71 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * A self-refreshing EDV document cipher: `createEdvDocCipher` bound to
- * descriptor acquisition and the once-per-session refresh rule, for a host
- * whose decrypt seam is the cipher itself (a sync engine's `decryptDoc`, a
- * conflict resolver) rather than a row-scanning store.
- *
- * Built, the cipher acquires the collection's descriptor (fetch, cache the
- * success, cached fallback whenever the fetch yields none -- see
- * `acquire.ts`) and constructs the
- * underlying EDV cipher from it; with no descriptor, or a descriptor with no
- * epochs, the build refuses fail-closed (every encrypted collection's
- * descriptor carries an epoch roster from provisioning, so the absence can
- * only mean the install has not landed or the host is lying). When a decrypt
- * throws
- * `UnknownEpochError`, the cipher re-acquires the descriptor, rebuilds itself,
- * and retries that decrypt exactly once -- and only once per cipher instance,
- * which the host scopes to one `(profile, collection)` session by dropping
- * its cipher cache when the session ends. A second failure (or any unknown
- * epoch after the one refresh is spent) propagates. A refresh that itself
- * fails does not count as spent -- the original `UnknownEpochError` is
- * rethrown and a later decrypt may try again.
- *
- * Only `UnknownEpochError` drives that refresh, and by design. The client
- * splits the two ways a decrypt can find no key: an epoch the descriptor does
- * not list at all raises `UnknownEpochError`, because a fresher descriptor may
- * well list it; an epoch the descriptor does list but this reader holds no key
- * for raises `KeyUnwrapError` (never a recipient, or removed and the epoch
- * rotated). The second is rethrown immediately, with the refresh left
- * untouched, since re-reading the same descriptor cannot produce a key the
- * reader was not given.
- */
-import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
-import { type DocCipher } from '@interop/was-client/edv';
-import { type EncryptionDescriptorCache, type EncryptionDescriptorSource } from './acquire.js';
-/**
- * Builds a {@link DocCipher} whose descriptor is acquired through the
- * source/cache seams and refreshed (once per instance) on an unknown-epoch
- * decrypt.
- *
- * With no `source` the descriptor is served from the cache alone and the
- * refresh path is inert (an unknown-epoch decrypt propagates immediately) --
- * the shape for a purely local code path that must never touch the network.
- *
- * @param options {object}
- * @param options.keyAgreementKey {IKeyAgreementKey}   the vault key pair this
- *   collection's envelopes are sealed to
- * @param options.keyResolver {IKeyResolver}
- * @param options.collectionId {string}
- * @param [options.idDerivation] {'content' | 'random'}   defaults to
- *   `'content'`
- * @param [options.source] {EncryptionDescriptorSource}
- * @param options.cache {EncryptionDescriptorCache}
- * @param [options.onFetchError] {function}   observes swallowed
- *   descriptor-fetch failures
- * @returns {Promise<DocCipher>}
- */
-export declare function createRefreshingEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, idDerivation, source, cache, onFetchError }: {
-    keyAgreementKey: IKeyAgreementKey;
-    keyResolver: IKeyResolver;
-    collectionId: string;
-    idDerivation?: 'content' | 'random';
-    source?: EncryptionDescriptorSource;
-    cache: EncryptionDescriptorCache;
-    onFetchError?: (err: unknown, info: {
-        collectionId: string;
-    }) => void;
-}): Promise<DocCipher>;
-//# sourceMappingURL=cipher.d.ts.map

package/dist/descriptors/cipher.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../src/descriptors/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAChC,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EACb,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACnC,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,SAAS,CAAC,CAyFrB"}

package/dist/descriptors/cipher.js

@@ -1,109 +0,0 @@
-import { createEdvDocCipher, UnknownEpochError } from '@interop/was-client/edv';
-import { acquireDescriptor } from './acquire.js';
-/**
- * Builds a {@link DocCipher} whose descriptor is acquired through the
- * source/cache seams and refreshed (once per instance) on an unknown-epoch
- * decrypt.
- *
- * With no `source` the descriptor is served from the cache alone and the
- * refresh path is inert (an unknown-epoch decrypt propagates immediately) --
- * the shape for a purely local code path that must never touch the network.
- *
- * @param options {object}
- * @param options.keyAgreementKey {IKeyAgreementKey}   the vault key pair this
- *   collection's envelopes are sealed to
- * @param options.keyResolver {IKeyResolver}
- * @param options.collectionId {string}
- * @param [options.idDerivation] {'content' | 'random'}   defaults to
- *   `'content'`
- * @param [options.source] {EncryptionDescriptorSource}
- * @param options.cache {EncryptionDescriptorCache}
- * @param [options.onFetchError] {function}   observes swallowed
- *   descriptor-fetch failures
- * @returns {Promise<DocCipher>}
- */
-export async function createRefreshingEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, idDerivation, source, cache, onFetchError }) {
-    const build = async () => {
-        const encryption = await acquireDescriptor({
-            source,
-            cache,
-            collectionId,
-            onFetchError
-        });
-        if (!encryption) {
-            throw new Error(`Collection "${collectionId}" has no encryption descriptor available ` +
-                '(fetched or cached). Every encrypted collection carries its key ' +
-                'epochs from provisioning; refusing to build a cipher without them.');
-        }
-        return createEdvDocCipher({
-            keyAgreementKey,
-            keyResolver,
-            collectionId,
-            idDerivation,
-            encryption
-        });
-    };
-    let inner = await build();
-    // The one descriptor refresh this cipher instance (= this collection this
-    // session) may spend, shared so concurrent unknown-epoch decrypts ride a
-    // single re-read instead of each spending one.
-    let refreshed = null;
-    return {
-        encrypt: options => inner.encrypt(options),
-        encryptUpdate: options => {
-            if (!inner.encryptUpdate) {
-                throw new Error(`Collection "${collectionId}" cipher has no in-place update.`);
-            }
-            return inner.encryptUpdate(options);
-        },
-        async decrypt({ envelope }) {
-            try {
-                return await inner.decrypt({ envelope });
-            }
-            catch (err) {
-                // `instanceof` is safe here and only here: `inner` is built in this
-                // file by `createEdvDocCipher`, from the same `@interop/was-client`
-                // import this class comes from, so no injected seam is crossed. A
-                // caller classifying what THIS cipher throws is crossing one, and uses
-                // `isUnknownEpochError` / `isKeyUnwrapError` instead.
-                if (!(err instanceof UnknownEpochError) || !source) {
-                    throw err;
-                }
-                if (!refreshed) {
-                    const attempt = build().then(cipher => {
-                        inner = cipher;
-                    });
-                    refreshed = attempt;
-                    // Only a COMPLETED refresh is spent. A rejected one (the description
-                    // could not be read and no cached copy answered either) un-arms the
-                    // guard so a later unknown-epoch decrypt may try again; a successful
-                    // refresh that still cannot route the envelope stays spent for the
-                    // session, which is what keeps a genuinely foreign envelope from
-                    // driving a refetch loop.
-                    attempt.catch(() => {
-                        if (refreshed === attempt) {
-                            refreshed = null;
-                        }
-                    });
-                }
-                try {
-                    await refreshed;
-                }
-                catch {
-                    // The refresh failed, so nothing was learned about this envelope's
-                    // epoch: surface the original UnknownEpochError rather than the
-                    // build failure, so callers classifying on it (the create-loss
-                    // re-mint) still see the row they exist to repair.
-                    throw err;
-                }
-                // One retry under the swapped cipher. If the refresh was already
-                // spent before this decrypt began, this re-attempt is a local
-                // no-network decrypt that fails the same way -- so a genuinely
-                // foreign envelope still surfaces UnknownEpochError, and never a
-                // second description read.
-                return inner.decrypt({ envelope });
-            }
-        }
-    };
-}
-//# sourceMappingURL=cipher.js.map

package/dist/descriptors/cipher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/descriptors/cipher.ts"],"names":[],"mappings":"AAsCA,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,iBAAiB,EAGlB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EASb;IACC,MAAM,KAAK,GAAG,KAAK,IAAwB,EAAE;QAC3C,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;YACzC,MAAM;YACN,KAAK;YACL,YAAY;YACZ,YAAY;SACb,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,2CAA2C;gBACpE,kEAAkE;gBAClE,oEAAoE,CACvE,CAAA;QACH,CAAC;QACD,OAAO,kBAAkB,CAAC;YACxB,eAAe;YACf,WAAW;YACX,YAAY;YACZ,YAAY;YACZ,UAAU;SACX,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,IAAI,KAAK,GAAG,MAAM,KAAK,EAAE,CAAA;IACzB,0EAA0E;IAC1E,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,SAAS,GAAyB,IAAI,CAAA;IAE1C,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAE1C,aAAa,EAAE,OAAO,CAAC,EAAE;YACvB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,kCAAkC,CAC9D,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,uEAAuE;gBACvE,sDAAsD;gBACtD,IAAI,CAAC,CAAC,GAAG,YAAY,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACnD,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;wBACpC,KAAK,GAAG,MAAM,CAAA;oBAChB,CAAC,CAAC,CAAA;oBACF,SAAS,GAAG,OAAO,CAAA;oBACnB,qEAAqE;oBACrE,oEAAoE;oBACpE,qEAAqE;oBACrE,mEAAmE;oBACnE,iEAAiE;oBACjE,0BAA0B;oBAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;wBACjB,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;4BAC1B,SAAS,GAAG,IAAI,CAAA;wBAClB,CAAC;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAA;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,gEAAgE;oBAChE,+DAA+D;oBAC/D,mDAAmD;oBACnD,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,iEAAiE;gBACjE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iEAAiE;gBACjE,2BAA2B;gBAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/descriptors/errors.d.ts

@@ -1,44 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The read-side classification of what an injected `DocCipher` throws when it
- * cannot open an envelope.
- *
- * A decrypt has two distinguishable no-key outcomes, and a host that scans
- * rows must tell them apart: an epoch the descriptor this reader holds does
- * not list at all (`UnknownEpochError` -- possibly fresh data behind a stale
- * descriptor, so a re-read may fix it), and an epoch the descriptor does list
- * but this reader holds no key for (`KeyUnwrapError` -- real data, and
- * permanently unreadable here, since re-reading the same descriptor cannot
- * produce a key the reader was not given). Neither is corruption, so neither
- * row may be treated as garbage.
- *
- * Both are matched on `err.name`, never `instanceof`: the cipher is an
- * injected seam, and in a wallet whose `@interop/was-client` resolves to a
- * second copy (a `link:` dev setup, a dedupe miss through a dependency tree)
- * the class the cipher throws is not the class the caller imported. The cost
- * of the miss lands on real data -- a scan that misses `KeyUnwrapError` drops
- * the row into its undecryptable bucket, which a host is entitled to purge.
- * Both classes assign their `name` explicitly, which is what makes the string
- * a contract.
- *
- * The unknown-epoch half of the pair ships from `@interop/was-client/sync`
- * as `isUnknownEpochError`, beside the class that assigns the name. This half
- * stays here on policy rather than on class adjacency: it classifies a
- * roster-membership failure the wallet layer owns, and no sync driver
- * dispatches on it. The file sits beside the cipher that raises the error and
- * stays import-free for the same reason `resourceLog/errors.ts` does.
- */
-/**
- * Whether an error is the cipher's not-a-recipient signal (`KeyUnwrapError`):
- * the envelope's epoch IS on the descriptor this reader holds, but the reader
- * has no key for it -- never a recipient of that epoch, or removed and the
- * epoch rotated since. Real data, unreadable by this wallet, and never
- * garbage: a caller skips such a row and leaves it in place.
- *
- * @param err {unknown}
- * @returns {boolean}
- */
-export declare function isKeyUnwrapError(err: unknown): boolean;
-//# sourceMappingURL=errors.d.ts.map

package/dist/descriptors/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/descriptors/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEtD"}

package/dist/descriptors/errors.js

@@ -1,46 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The read-side classification of what an injected `DocCipher` throws when it
- * cannot open an envelope.
- *
- * A decrypt has two distinguishable no-key outcomes, and a host that scans
- * rows must tell them apart: an epoch the descriptor this reader holds does
- * not list at all (`UnknownEpochError` -- possibly fresh data behind a stale
- * descriptor, so a re-read may fix it), and an epoch the descriptor does list
- * but this reader holds no key for (`KeyUnwrapError` -- real data, and
- * permanently unreadable here, since re-reading the same descriptor cannot
- * produce a key the reader was not given). Neither is corruption, so neither
- * row may be treated as garbage.
- *
- * Both are matched on `err.name`, never `instanceof`: the cipher is an
- * injected seam, and in a wallet whose `@interop/was-client` resolves to a
- * second copy (a `link:` dev setup, a dedupe miss through a dependency tree)
- * the class the cipher throws is not the class the caller imported. The cost
- * of the miss lands on real data -- a scan that misses `KeyUnwrapError` drops
- * the row into its undecryptable bucket, which a host is entitled to purge.
- * Both classes assign their `name` explicitly, which is what makes the string
- * a contract.
- *
- * The unknown-epoch half of the pair ships from `@interop/was-client/sync`
- * as `isUnknownEpochError`, beside the class that assigns the name. This half
- * stays here on policy rather than on class adjacency: it classifies a
- * roster-membership failure the wallet layer owns, and no sync driver
- * dispatches on it. The file sits beside the cipher that raises the error and
- * stays import-free for the same reason `resourceLog/errors.ts` does.
- */
-/**
- * Whether an error is the cipher's not-a-recipient signal (`KeyUnwrapError`):
- * the envelope's epoch IS on the descriptor this reader holds, but the reader
- * has no key for it -- never a recipient of that epoch, or removed and the
- * epoch rotated since. Real data, unreadable by this wallet, and never
- * garbage: a caller skips such a row and leaves it in place.
- *
- * @param err {unknown}
- * @returns {boolean}
- */
-export function isKeyUnwrapError(err) {
-    return err?.name === 'KeyUnwrapError';
-}
-//# sourceMappingURL=errors.js.map

package/dist/descriptors/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/descriptors/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAQ,GAAiC,EAAE,IAAI,KAAK,gBAAgB,CAAA;AACtE,CAAC"}

package/dist/descriptors/refresh.d.ts

@@ -1,62 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The unknown-epoch refresh policy: an epoch rotation emits no change-feed
- * entry, so a cipher built from a cached descriptor can meet envelopes stamped
- * with an epoch it has never seen. The remedy is one re-read of the
- * Collection Description plus a cipher rebuild and a single retry -- and the
- * policy guards that remedy to ONCE per collection per session, so a
- * genuinely foreign envelope (one no descriptor will ever route) cannot drive
- * a refetch loop, let alone a refetch per resource.
- */
-/**
- * Tracks which collections have already spent their one refresh this session,
- * and runs reads under the refresh-and-retry-once rule. One instance per
- * session (it IS the session scope of the guard); the injected `refresh` does
- * the host's whole swap -- re-acquire the descriptor(s), rebuild the
- * cipher(s), and install them wherever the host keeps them.
- */
-export declare class DescriptorRefreshPolicy {
-    #private;
-    constructor({ refresh }: {
-        refresh: (options: {
-            collectionId: string;
-        }) => Promise<void>;
-    });
-    /**
-     * Whether a collection still has its one refresh this session.
-     */
-    shouldRefresh({ collectionId }: {
-        collectionId: string;
-    }): boolean;
-    /**
-     * Runs a read that reports whether it skipped unknown-epoch rows; on the
-     * first such report for a collection this session, spends the collection's
-     * refresh (descriptor re-read + cipher swap, via the injected `refresh`) and
-     * re-reads once. A later unknown-epoch report for the same collection
-     * returns the read's value as-is.
-     *
-     * @param options {object}
-     * @param options.collectionId {string}
-     * @param options.read {function}   the read, reporting `unknownEpoch`
-     * @returns {Promise<T>}   the (possibly re-read) value
-     */
-    readWithRefresh<T>({ collectionId, read }: {
-        collectionId: string;
-        read: () => Promise<{
-            value: T;
-            unknownEpoch: boolean;
-        }>;
-    }): Promise<T>;
-    /**
-     * Re-arms the guard -- for one collection, or (with no argument) for all.
-     * Call when a fresh descriptor is installed by some other path (a share,
-     * unshare, or recipient rotation this session performed itself), since the
-     * next unknown-epoch read is then evidence of a NEW rotation elsewhere.
-     */
-    reset(options?: {
-        collectionId?: string;
-    }): void;
-}
-//# sourceMappingURL=refresh.d.ts.map

package/dist/descriptors/refresh.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/descriptors/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAEH;;;;;;GAMG;AACH,qBAAa,uBAAuB;;gBAKtB,EACV,OAAO,EACR,EAAE;QACD,OAAO,EAAE,CAAC,OAAO,EAAE;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAC9D;IAID;;OAEG;IACH,aAAa,CAAC,EAAE,YAAY,EAAE,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;IAIlE;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,CAAC,EAAE,EACvB,YAAY,EACZ,IAAI,EACL,EAAE;QACD,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,MAAM,OAAO,CAAC;YAAE,KAAK,EAAE,CAAC,CAAC;YAAC,YAAY,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KACzD,GAAG,OAAO,CAAC,CAAC,CAAC;IAUd;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CAOjD"}

package/dist/descriptors/refresh.js

@@ -1,69 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The unknown-epoch refresh policy: an epoch rotation emits no change-feed
- * entry, so a cipher built from a cached descriptor can meet envelopes stamped
- * with an epoch it has never seen. The remedy is one re-read of the
- * Collection Description plus a cipher rebuild and a single retry -- and the
- * policy guards that remedy to ONCE per collection per session, so a
- * genuinely foreign envelope (one no descriptor will ever route) cannot drive
- * a refetch loop, let alone a refetch per resource.
- */
-/**
- * Tracks which collections have already spent their one refresh this session,
- * and runs reads under the refresh-and-retry-once rule. One instance per
- * session (it IS the session scope of the guard); the injected `refresh` does
- * the host's whole swap -- re-acquire the descriptor(s), rebuild the
- * cipher(s), and install them wherever the host keeps them.
- */
-export class DescriptorRefreshPolicy {
-    #refresh;
-    // Collection ids whose one refresh this session is already spent.
-    #refreshed = new Set();
-    constructor({ refresh }) {
-        this.#refresh = refresh;
-    }
-    /**
-     * Whether a collection still has its one refresh this session.
-     */
-    shouldRefresh({ collectionId }) {
-        return !this.#refreshed.has(collectionId);
-    }
-    /**
-     * Runs a read that reports whether it skipped unknown-epoch rows; on the
-     * first such report for a collection this session, spends the collection's
-     * refresh (descriptor re-read + cipher swap, via the injected `refresh`) and
-     * re-reads once. A later unknown-epoch report for the same collection
-     * returns the read's value as-is.
-     *
-     * @param options {object}
-     * @param options.collectionId {string}
-     * @param options.read {function}   the read, reporting `unknownEpoch`
-     * @returns {Promise<T>}   the (possibly re-read) value
-     */
-    async readWithRefresh({ collectionId, read }) {
-        const first = await read();
-        if (first.unknownEpoch && this.shouldRefresh({ collectionId })) {
-            this.#refreshed.add(collectionId);
-            await this.#refresh({ collectionId });
-            return (await read()).value;
-        }
-        return first.value;
-    }
-    /**
-     * Re-arms the guard -- for one collection, or (with no argument) for all.
-     * Call when a fresh descriptor is installed by some other path (a share,
-     * unshare, or recipient rotation this session performed itself), since the
-     * next unknown-epoch read is then evidence of a NEW rotation elsewhere.
-     */
-    reset(options) {
-        if (options?.collectionId === undefined) {
-            this.#refreshed.clear();
-        }
-        else {
-            this.#refreshed.delete(options.collectionId);
-        }
-    }
-}
-//# sourceMappingURL=refresh.js.map

package/dist/descriptors/refresh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/descriptors/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IACzB,QAAQ,CAAsD;IACvE,kEAAkE;IACzD,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IAEvC,YAAY,EACV,OAAO,EAGR;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,YAAY,EAA4B;QACtD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAI,EACvB,YAAY,EACZ,IAAI,EAIL;QACC,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAA;QAC1B,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;YACrC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAA;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAmC;QACvC,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;CACF"}