@interop/was-client 0.25.0 → 0.27.0

package/dist/edv/didKeyRecipient.d.ts

@@ -0,0 +1,23 @@
+import type { RecipientPublicKey } from './epochCrypto.js';
+/**
+ * Whether a string is an Ed25519 `did:key` DID -- the only controller shape a
+ * recipient key can be derived from (an X25519 twin exists only for an Ed25519
+ * key). A key id (a DID with a fragment) is not one: the derivation is defined
+ * over the DID itself.
+ *
+ * @param did {string | undefined}
+ * @returns {boolean}
+ */
+export declare function isEd25519DidKey(did: string | undefined): boolean;
+/**
+ * Derives the X25519 epoch-recipient public key for an Ed25519 `did:key`
+ * controller.
+ *
+ * @param options {object}
+ * @param options.did {string}   the grantee's Ed25519 `did:key` DID
+ * @returns {RecipientPublicKey}
+ */
+export declare function x25519RecipientFromDidKey({ did }: {
+    did: string;
+}): RecipientPublicKey;
+//# sourceMappingURL=didKeyRecipient.d.ts.map

package/dist/edv/didKeyRecipient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"didKeyRecipient.d.ts","sourceRoot":"","sources":["../../src/edv/didKeyRecipient.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAQ1D;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAOhE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,kBAAkB,CAqBrB"}

package/dist/edv/didKeyRecipient.js

@@ -0,0 +1,68 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Derives a grantee's epoch-recipient key from the `did:key` DID a capability
+ * request already names as its `controller`. An Ed25519 `did:key` has a
+ * canonical X25519 twin (the Montgomery form) -- the same conversion a wallet
+ * applies to its own key-agreement key. So the recipient key never travels on
+ * the wire: it is derived locally from the controller DID.
+ *
+ * Deriving beats accepting an explicit `{ id, publicKeyMultibase }` field. An
+ * explicit key would let a request pair controller DID A with recipient key B,
+ * and the granting side would have to verify the binding anyway -- which for a
+ * `did:key` means performing this exact derivation. Deriving makes key
+ * substitution impossible by construction and keeps both axes of a share (the
+ * pull zcap and the epoch roster entry) pointing at the same entity.
+ *
+ * The resulting recipient `id` is `did:key:z6Mk...#z6LS...` -- byte-identical
+ * to what the grantee derives on its own side from the same key material, so
+ * its `kid` matches the epoch roster entry that gets written, and it resolves
+ * through the default `did:key` recipient resolver.
+ */
+import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+const DID_KEY_PREFIX = 'did:key:';
+// Multibase base58btc + multicodec ed25519-pub: every Ed25519 did:key
+// identifier starts with these four characters.
+const ED25519_MULTIBASE_PREFIX = 'z6Mk';
+/**
+ * Whether a string is an Ed25519 `did:key` DID -- the only controller shape a
+ * recipient key can be derived from (an X25519 twin exists only for an Ed25519
+ * key). A key id (a DID with a fragment) is not one: the derivation is defined
+ * over the DID itself.
+ *
+ * @param did {string | undefined}
+ * @returns {boolean}
+ */
+export function isEd25519DidKey(did) {
+    return (!!did &&
+        did.startsWith(DID_KEY_PREFIX) &&
+        did.slice(DID_KEY_PREFIX.length).startsWith(ED25519_MULTIBASE_PREFIX) &&
+        !did.includes('#'));
+}
+/**
+ * Derives the X25519 epoch-recipient public key for an Ed25519 `did:key`
+ * controller.
+ *
+ * @param options {object}
+ * @param options.did {string}   the grantee's Ed25519 `did:key` DID
+ * @returns {RecipientPublicKey}
+ */
+export function x25519RecipientFromDidKey({ did }) {
+    if (!isEd25519DidKey(did)) {
+        throw new Error(`Cannot derive a recipient key: "${did}" is not an Ed25519 did:key DID.`);
+    }
+    const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
+        keyPair: {
+            controller: did,
+            publicKeyMultibase: did.slice(DID_KEY_PREFIX.length)
+        }
+    });
+    const { id, publicKeyMultibase, type } = keyAgreementKey;
+    if (typeof id !== 'string' || typeof publicKeyMultibase !== 'string') {
+        throw new Error('Cannot derive a recipient key: the converted key-agreement key lacks ' +
+            'an id or publicKeyMultibase.');
+    }
+    return { id, publicKeyMultibase, type };
+}
+//# sourceMappingURL=didKeyRecipient.js.map

package/dist/edv/didKeyRecipient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"didKeyRecipient.js","sourceRoot":"","sources":["../../src/edv/didKeyRecipient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,MAAM,cAAc,GAAG,UAAU,CAAA;AAEjC,sEAAsE;AACtE,gDAAgD;AAChD,MAAM,wBAAwB,GAAG,MAAM,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,OAAO,CACL,CAAC,CAAC,GAAG;QACL,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;QAC9B,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,wBAAwB,CAAC;QACrE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,GAAG,EAGJ;IACC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,kCAAkC,CACzE,CAAA;IACH,CAAC;IACD,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE;YACP,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;SACrD;KACF,CAAC,CAAA;IACJ,MAAM,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,eAAe,CAAA;IACxD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,8BAA8B,CACjC,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;AACzC,CAAC"}

package/dist/edv/epochMac.d.ts

@@ -1,4 +1,27 @@
-import type { CollectionEncryption, CollectionEncryptionEpochsMac } from '../types.js';
+import type { CollectionEncryption, CollectionEncryptionEpochsMac, CollectionEncryptionEpochsSig } from '../types.js';
+/**
+ * A caller-supplied signer for the `epochsSig` member: given the canonical
+ * signature payload bytes ({@link epochsSigPayload} over the descriptor being
+ * written), it returns the full signature member to stamp. The signing key --
+ * and the root of trust the reader resolves its `kid` against -- are entirely
+ * the caller's; this module only defines the payload and where the result
+ * lands.
+ */
+export type EpochsSigner = (options: {
+    payload: Uint8Array;
+}) => Promise<CollectionEncryptionEpochsSig>;
+/**
+ * Builds the payload bytes an `epochsSig` signs: `UTF8(
+ * "was-epoch-config-sig/v1." + epochsConfigJson(descriptor))` -- the same
+ * epoch configuration the MAC covers, under its own domain-separation prefix.
+ * Exported so a signing caller and a verifying reader construct
+ * byte-identical input from the descriptor alone.
+ *
+ * @param descriptor {CollectionEncryption}   the descriptor whose epoch
+ *   configuration is being signed or verified
+ * @returns {Uint8Array}
+ */
+export declare function epochsSigPayload(descriptor: CollectionEncryption): Uint8Array;
 /**
  * Computes the `epochsMac` field for a descriptor under the current epoch's
  * secret. Compute this over the exact descriptor state being written (member

package/dist/edv/epochMac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epochMac.d.ts","sourceRoot":"","sources":["../../src/edv/epochMac.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,oBAAoB,EACpB,6BAA6B,EAC9B,MAAM,aAAa,CAAA;AAwEpB;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBnB"}
+{"version":3,"file":"epochMac.d.ts","sourceRoot":"","sources":["../../src/edv/epochMac.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,aAAa,CAAA;AAqBpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE;IACnC,OAAO,EAAE,UAAU,CAAA;CACpB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAA;AAuE5C;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,oBAAoB,GAAG,UAAU,CAE7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBnB"}

package/dist/edv/epochMac.js

@@ -29,6 +29,12 @@ const MAC_KEY_INFO = TEXT_ENCODER.encode('was-epoch-config-mac/v1');
  * The domain-separation prefix prepended to the JSON payload before it is MACed.
  */
 const MAC_PAYLOAD_PREFIX = 'was-epoch-config/v1.';
+/**
+ * The domain-separation prefix of the detached `epochsSig` signature payload --
+ * distinct from the MAC prefix so a signature can never be replayed as a MAC
+ * input or vice versa.
+ */
+const SIG_PAYLOAD_PREFIX = 'was-epoch-config-sig/v1.';
 /**
  * Derives the HMAC-SHA256 key from a 32-byte epoch secret:
  * HKDF-SHA256(ikm = the epoch secret, salt = empty, info =
@@ -48,26 +54,50 @@ async function deriveMacKey(epochSecret) {
     }, ikm, { name: 'HMAC', hash: 'SHA-256', length: 256 }, false, ['sign', 'verify']);
 }
 /**
- * Builds the MACed payload bytes for a descriptor's epoch configuration:
- * `UTF8("was-epoch-config/v1." + JSON.stringify({ scheme, version,
- * currentEpoch, epochs }))`, with `version` normalized to `null` when absent
- * and `epochs` the ordered list of epoch id strings. The object member order is
+ * The canonical JSON text of a descriptor's epoch configuration -- the part
+ * both the MAC and the detached signature cover: `{ scheme, version,
+ * currentEpoch, epochs }`, with `version` normalized to `null` when absent and
+ * `epochs` the ordered list of epoch id strings. The object member order is
  * fixed so both sides serialize identically.
  *
- * @param descriptor {CollectionEncryption}   the descriptor whose epoch configuration is
- *   being authenticated
- * @returns {Uint8Array}
+ * @param descriptor {CollectionEncryption}   the descriptor whose epoch
+ *   configuration is being authenticated
+ * @returns {string}
  */
-function macPayload(descriptor) {
-    const payload = {
+function epochsConfigJson(descriptor) {
+    return JSON.stringify({
         scheme: descriptor.scheme,
         version: descriptor.version ?? null,
         currentEpoch: descriptor.currentEpoch,
         epochs: (descriptor.epochs ?? []).map(epoch => epoch.id)
-    };
-    const bytes = TEXT_ENCODER.encode(MAC_PAYLOAD_PREFIX + JSON.stringify(payload));
+    });
+}
+/**
+ * Builds the MACed payload bytes for a descriptor's epoch configuration:
+ * `UTF8("was-epoch-config/v1." + epochsConfigJson(descriptor))`.
+ *
+ * @param descriptor {CollectionEncryption}   the descriptor whose epoch configuration is
+ *   being authenticated
+ * @returns {ArrayBuffer}
+ */
+function macPayload(descriptor) {
+    const bytes = TEXT_ENCODER.encode(MAC_PAYLOAD_PREFIX + epochsConfigJson(descriptor));
     return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
 }
+/**
+ * Builds the payload bytes an `epochsSig` signs: `UTF8(
+ * "was-epoch-config-sig/v1." + epochsConfigJson(descriptor))` -- the same
+ * epoch configuration the MAC covers, under its own domain-separation prefix.
+ * Exported so a signing caller and a verifying reader construct
+ * byte-identical input from the descriptor alone.
+ *
+ * @param descriptor {CollectionEncryption}   the descriptor whose epoch
+ *   configuration is being signed or verified
+ * @returns {Uint8Array}
+ */
+export function epochsSigPayload(descriptor) {
+    return TEXT_ENCODER.encode(SIG_PAYLOAD_PREFIX + epochsConfigJson(descriptor));
+}
 /**
  * Computes the `epochsMac` field for a descriptor under the current epoch's
  * secret. Compute this over the exact descriptor state being written (member

package/dist/edv/epochMac.js.map

@@ -1 +1 @@
-{"version":3,"file":"epochMac.js","sourceRoot":"","sources":["../../src/edv/epochMac.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAM5C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAEtC;;GAEG;AACH,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAEnE;;GAEG;AACH,MAAM,kBAAkB,GAAG,sBAAsB,CAAA;AAEjD;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,WAAuB;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,WAAqC,EACrC,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,YAAY;KACnB,EACD,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,UAAgC;IAClD,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI;QACnC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACzD,CAAA;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAC/B,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAC7C,CAAA;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CACvB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACrB,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,GAAG,EACH,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;IACD,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,GAAe,CAAA;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,GAA6B,EAC7B,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;AACH,CAAC"}
+{"version":3,"file":"epochMac.js","sourceRoot":"","sources":["../../src/edv/epochMac.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAO5C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAEtC;;GAEG;AACH,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAEnE;;GAEG;AACH,MAAM,kBAAkB,GAAG,sBAAsB,CAAA;AAEjD;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,0BAA0B,CAAA;AAcrD;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,WAAuB;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,WAAqC,EACrC,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,YAAY;KACnB,EACD,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,UAAgC;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI;QACnC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACzD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,UAAgC;IAClD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAC/B,kBAAkB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAClD,CAAA;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CACvB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACrB,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAgC;IAC/D,OAAO,YAAY,CAAC,MAAM,CAAC,kBAAkB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,GAAG,EACH,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;IACD,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,GAAe,CAAA;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,GAA6B,EAC7B,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;AACH,CAAC"}

package/dist/edv/index.d.ts

@@ -24,16 +24,23 @@
  * They mutate the descriptor through the descriptor-store seam: the Collection
  * Description by default, or any `EncryptionDescriptorStore` -- e.g.
  * `resourceDescriptorStore` for a descriptor hosted as a plain JSON Resource.
+ *
+ * `x25519RecipientFromDidKey` is the one rule for turning a grantee named only
+ * by its Ed25519 `did:key` controller into a `RecipientPublicKey`, so a
+ * recipient key is always derived from an identifier both sides already hold
+ * rather than transmitted.
  */
 export { createEdvEncryption, EdvCodec } from './EdvCodec.js';
 export type { EdvKeys } from './EdvCodec.js';
 export { WasTransport, JOSE_CONTENT_TYPE } from './WasTransport.js';
 export { initRecipients, addRecipient, removeRecipient, replaceRecipient } from './recipients.js';
 export type { OwnerKey, RecipientPublicKey } from './recipients.js';
+export { isEd25519DidKey, x25519RecipientFromDidKey } from './didKeyRecipient.js';
 export { collectionDescriptorStore, resourceDescriptorStore } from './descriptorStore.js';
 export type { EncryptionDescriptorStore } from './descriptorStore.js';
-export { mintEpoch, epochKeyIdFor, unwrapEpochSecret } from './epochCrypto.js';
-export { verifyEpochsMac } from './epochMac.js';
+export { mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
+export { computeEpochsMac, epochsSigPayload, verifyEpochsMac } from './epochMac.js';
+export type { EpochsSigner } from './epochMac.js';
 export { resolveEpochKeys } from './epochKeys.js';
 export type { ResolvedEpochKeys } from './epochKeys.js';
 export { createEdvDocCipher, ownerRecipient, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';

package/dist/edv/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7D,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7D,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/edv/index.js

@@ -24,13 +24,19 @@
  * They mutate the descriptor through the descriptor-store seam: the Collection
  * Description by default, or any `EncryptionDescriptorStore` -- e.g.
  * `resourceDescriptorStore` for a descriptor hosted as a plain JSON Resource.
+ *
+ * `x25519RecipientFromDidKey` is the one rule for turning a grantee named only
+ * by its Ed25519 `did:key` controller into a `RecipientPublicKey`, so a
+ * recipient key is always derived from an identifier both sides already hold
+ * rather than transmitted.
  */
 export { createEdvEncryption, EdvCodec } from './EdvCodec.js';
 export { WasTransport, JOSE_CONTENT_TYPE } from './WasTransport.js';
 export { initRecipients, addRecipient, removeRecipient, replaceRecipient } from './recipients.js';
+export { isEd25519DidKey, x25519RecipientFromDidKey } from './didKeyRecipient.js';
 export { collectionDescriptorStore, resourceDescriptorStore } from './descriptorStore.js';
-export { mintEpoch, epochKeyIdFor, unwrapEpochSecret } from './epochCrypto.js';
-export { verifyEpochsMac } from './epochMac.js';
+export { mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
+export { computeEpochsMac, epochsSigPayload, verifyEpochsMac } from './epochMac.js';
 export { resolveEpochKeys } from './epochKeys.js';
 export { createEdvDocCipher, ownerRecipient, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
 //# sourceMappingURL=index.js.map

package/dist/edv/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAChB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA"}

package/dist/edv/recipients.d.ts

@@ -35,6 +35,7 @@ import type { Collection } from '../Collection.js';
 import type { Space } from '../Space.js';
 import type { EncryptionDescriptorStore } from './descriptorStore.js';
 import type { CollectionEncryption, IDelegatedZcap } from '../types.js';
+import type { EpochsSigner } from './epochMac.js';
 import type { RecipientPublicKey } from './epochCrypto.js';
 export type { RecipientPublicKey } from './epochCrypto.js';
 /**
@@ -70,9 +71,12 @@ export interface OwnerKey {
  *   whose epoch key already exists (e.g. a per-user key being enrolled into
  *   its wrap-set roster). The `epochId` must be the key's did:key and `secret`
  *   its raw 32-byte private key, exactly what {@link mintEpoch} returns.
+ * @param [options.signEpochs] {EpochsSigner}   signs the epoch configuration
+ *   being written, stamping the descriptor's `epochsSig` beside its
+ *   `epochsMac`
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
-export declare function initRecipients({ collection, store, recipients, epoch: premintedEpoch }: {
+export declare function initRecipients({ collection, store, recipients, epoch: premintedEpoch, signEpochs }: {
     collection?: Collection;
     store?: EncryptionDescriptorStore;
     recipients: RecipientPublicKey[];
@@ -80,6 +84,7 @@ export declare function initRecipients({ collection, store, recipients, epoch: p
         epochId: string;
         secret: Uint8Array;
     };
+    signEpochs?: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
  * Adds a reader to a multi-recipient encrypted Collection. Escrow semantics: the
@@ -159,9 +164,12 @@ export declare function addRecipient({ collection, store, recipient, owner }: {
  *   self-describing `did:key`. May resolve `null` to signal drop-this-kid:
  *   the rotation then excludes that entry from the fresh epoch instead of
  *   throwing (subject to the no-recipients-remaining guard).
+ * @param [options.signEpochs] {EpochsSigner}   signs the rotated epoch
+ *   configuration, stamping the descriptor's `epochsSig` beside its
+ *   `epochsMac`
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
-export declare function removeRecipient({ collection, store, space, recipientId, revoke, pull, resolveRecipientKey }: {
+export declare function removeRecipient({ collection, store, space, recipientId, revoke, pull, resolveRecipientKey, signEpochs }: {
     collection?: Collection;
     store?: EncryptionDescriptorStore;
     space?: Space;
@@ -169,6 +177,7 @@ export declare function removeRecipient({ collection, store, space, recipientId,
     revoke?: IDelegatedZcap | IDelegatedZcap[];
     pull?: () => Promise<void>;
     resolveRecipientKey?: (kid: string) => Promise<RecipientPublicKey | null>;
+    signEpochs?: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
  * Replaces one reader (or several) with another in ONE descriptor write -- the
@@ -218,9 +227,12 @@ export declare function removeRecipient({ collection, store, space, recipientId,
  *   recipient's kid for the fresh epoch, `null` to drop it -- the
  *   {@link removeRecipient} contract (the incoming recipient never routes
  *   through it)
+ * @param [options.signEpochs] {EpochsSigner}   signs the rotated epoch
+ *   configuration, stamping the descriptor's `epochsSig` beside its
+ *   `epochsMac` (an escrow-only write leaves both untouched)
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
-export declare function replaceRecipient({ collection, store, space, retire, recipient, owner, revoke, pull, resolveRecipientKey }: {
+export declare function replaceRecipient({ collection, store, space, retire, recipient, owner, revoke, pull, resolveRecipientKey, signEpochs }: {
     collection?: Collection;
     store?: EncryptionDescriptorStore;
     space?: Space;
@@ -230,5 +242,6 @@ export declare function replaceRecipient({ collection, store, space, retire, rec
     revoke?: IDelegatedZcap | IDelegatedZcap[];
     pull?: () => Promise<void>;
     resolveRecipientKey?: (kid: string) => Promise<RecipientPublicKey | null>;
+    signEpochs?: EpochsSigner;
 }): Promise<CollectionEncryption>;
 //# sourceMappingURL=recipients.d.ts.map

package/dist/edv/recipients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EACV,oBAAoB,EAEpB,cAAc,EACf,MAAM,aAAa,CAAA;AAQpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,eAAe,EAAE,gBAAgB,CAAA;CAClC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EACtB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;CAChD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8ChC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EACN,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE,QAAQ,CAAA;CAChB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuDhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgGhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqHhC"}
+{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EACV,oBAAoB,EAEpB,cAAc,EACf,MAAM,aAAa,CAAA;AAQpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,eAAe,EAAE,gBAAgB,CAAA;CAClC;AA6CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EACrB,UAAU,EACX,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;IAC/C,UAAU,CAAC,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8ChC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EACN,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE,QAAQ,CAAA;CAChB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuDhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAgD,EAChD,UAAU,EACX,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IACzE,UAAU,CAAC,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgGhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAgD,EAChD,UAAU,EACX,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IACzE,UAAU,CAAC,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqHhC"}

package/dist/edv/recipients.js

@@ -1,12 +1,41 @@
 import { PreconditionFailedError, ValidationError } from '../errors.js';
 import { collectionDescriptorStore } from './descriptorStore.js';
 import { didKeyResolver, mintEpoch, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
-import { computeEpochsMac } from './epochMac.js';
+import { computeEpochsMac, epochsSigPayload } from './epochMac.js';
 /**
  * How many times a recipient CAS write retries a stale (`412`) description
  * before surfacing {@link PreconditionFailedError}.
  */
 const MAX_CAS_ATTEMPTS = 3;
+/**
+ * Stamps the epoch-configuration authenticators onto a descriptor about to be
+ * written: the `epochsMac` under the current epoch's secret always, and the
+ * detached `epochsSig` when the caller supplied a signer. Without a signer any
+ * prior `epochsSig` is dropped rather than carried forward -- the epoch
+ * configuration just changed, so a stale signature over the old configuration
+ * would only ever fail verification.
+ *
+ * @param options {object}
+ * @param options.descriptor {CollectionEncryption}   the exact descriptor
+ *   state being written (epochs / currentEpoch already updated)
+ * @param options.epochSecret {Uint8Array}   the current epoch's 32-byte secret
+ * @param [options.signEpochs] {EpochsSigner}   the caller's epoch-config signer
+ * @returns {Promise<CollectionEncryption>}   the descriptor with `epochsMac`
+ *   (and `epochsSig`, when signed) stamped
+ */
+async function stampEpochsAuth({ descriptor, epochSecret, signEpochs }) {
+    const epochsMac = await computeEpochsMac({ descriptor, epochSecret });
+    const stamped = { ...descriptor, epochsMac };
+    if (signEpochs) {
+        stamped.epochsSig = await signEpochs({
+            payload: epochsSigPayload(stamped)
+        });
+    }
+    else {
+        delete stamped.epochsSig;
+    }
+    return stamped;
+}
 /**
  * Initializes the first key epoch on a descriptor that has no epochs yet: mints
  * a fresh epoch key, wraps it to each initial recipient, and writes `epochs:
@@ -33,9 +62,12 @@ const MAX_CAS_ATTEMPTS = 3;
  *   whose epoch key already exists (e.g. a per-user key being enrolled into
  *   its wrap-set roster). The `epochId` must be the key's did:key and `secret`
  *   its raw 32-byte private key, exactly what {@link mintEpoch} returns.
+ * @param [options.signEpochs] {EpochsSigner}   signs the epoch configuration
+ *   being written, stamping the descriptor's `epochsSig` beside its
+ *   `epochsMac`
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
-export async function initRecipients({ collection, store, recipients, epoch: premintedEpoch }) {
+export async function initRecipients({ collection, store, recipients, epoch: premintedEpoch, signEpochs }) {
     if (recipients.length === 0) {
         throw new ValidationError('initRecipients needs at least one recipient to wrap the epoch key to.');
     }
@@ -66,11 +98,11 @@ export async function initRecipients({ collection, store, recipients, epoch: pre
                 epochs: [epoch],
                 currentEpoch: epochId
             };
-            const epochsMac = await computeEpochsMac({
+            return stampEpochsAuth({
                 descriptor: next,
-                epochSecret: secret
+                epochSecret: secret,
+                signEpochs
             });
-            return { ...next, epochsMac };
         }
     });
 }
@@ -190,9 +222,12 @@ export async function addRecipient({ collection, store, recipient, owner }) {
  *   self-describing `did:key`. May resolve `null` to signal drop-this-kid:
  *   the rotation then excludes that entry from the fresh epoch instead of
  *   throwing (subject to the no-recipients-remaining guard).
+ * @param [options.signEpochs] {EpochsSigner}   signs the rotated epoch
+ *   configuration, stamping the descriptor's `epochsSig` beside its
+ *   `epochsMac`
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
-export async function removeRecipient({ collection, store, space, recipientId, revoke, pull, resolveRecipientKey = defaultResolveRecipientKey }) {
+export async function removeRecipient({ collection, store, space, recipientId, revoke, pull, resolveRecipientKey = defaultResolveRecipientKey, signEpochs }) {
     const descriptorStore = descriptorStoreFor({ collection, store });
     // Resolve the pull axis up front, before any rotation, so a malformed call
     // fails before the descriptor is mutated.
@@ -264,11 +299,11 @@ export async function removeRecipient({ collection, store, space, recipientId, r
                 epochs: [...epochs, newEpoch],
                 currentEpoch: epochId
             };
-            const epochsMac = await computeEpochsMac({
+            return stampEpochsAuth({
                 descriptor: next,
-                epochSecret: secret
+                epochSecret: secret,
+                signEpochs
             });
-            return { ...next, epochsMac };
         }
     });
     // 2. Pull axis: withdraw the reader's server-side access AFTER the rotation
@@ -324,9 +359,12 @@ export async function removeRecipient({ collection, store, space, recipientId, r
  *   recipient's kid for the fresh epoch, `null` to drop it -- the
  *   {@link removeRecipient} contract (the incoming recipient never routes
  *   through it)
+ * @param [options.signEpochs] {EpochsSigner}   signs the rotated epoch
+ *   configuration, stamping the descriptor's `epochsSig` beside its
+ *   `epochsMac` (an escrow-only write leaves both untouched)
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
-export async function replaceRecipient({ collection, store, space, retire, recipient, owner, revoke, pull, resolveRecipientKey = defaultResolveRecipientKey }) {
+export async function replaceRecipient({ collection, store, space, retire, recipient, owner, revoke, pull, resolveRecipientKey = defaultResolveRecipientKey, signEpochs }) {
     const descriptorStore = descriptorStoreFor({ collection, store });
     const pullAxis = resolvePullAxis({ space, revoke, pull });
     const retiring = Array.isArray(retire) ? retire : [retire];
@@ -411,11 +449,11 @@ export async function replaceRecipient({ collection, store, space, retire, recip
                 epochs: [...escrowed, newEpoch],
                 currentEpoch: epochId
             };
-            const epochsMac = await computeEpochsMac({
+            return stampEpochsAuth({
                 descriptor: next,
-                epochSecret: secret
+                epochSecret: secret,
+                signEpochs
             });
-            return { ...next, epochsMac };
         }
     });
     await pullAxis();

package/dist/edv/recipients.js.map

@@ -1 +1 @@
-{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAOhE,OAAO,EACL,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAahD;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EAMtB;IACC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CACvB,uEAAuE,CACxE,CAAA;IACH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,cAAc,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;IACjE,MAAM,KAAK,GAA8B;QACvC,EAAE,EAAE,OAAO;QACX,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAC3B,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CACzB,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACpD,CACF;KACF,CAAA;IACD,OAAO,mBAAmB,CAAC;QACzB,KAAK,EAAE,kBAAkB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAChD,uEAAuE;QACvE,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACvB,MAAM,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YACzB,IAAI,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,eAAe,CACvB,oEAAoE;oBAClE,mCAAmC,CACtC,CAAA;YACH,CAAC;YACD,iEAAiE;YACjE,oEAAoE;YACpE,0EAA0E;YAC1E,0EAA0E;YAC1E,eAAe;YACf,MAAM,IAAI,GAAyB;gBACjC,GAAG,UAAU;gBACb,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC;gBAChC,MAAM,EAAE,CAAC,KAAK,CAAC;gBACf,YAAY,EAAE,OAAO;aACtB,CAAA;YACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;gBACvC,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,MAAM;aACpB,CAAC,CAAA;YACF,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAA;QAC/B,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EAMN;IACC,OAAO,mBAAmB,CAAC;QACzB,KAAK,EAAE,kBAAkB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAChD,MAAM,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YACzB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,eAAe,CACvB,+DAA+D;oBAC7D,uBAAuB,CAC1B,CAAA;YACH,CAAC;YACD,sEAAsE;YACtE,kEAAkE;YAClE,2CAA2C;YAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAsC,EAAE;gBAC7D,sEAAsE;gBACtE,IACE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC,EACjE,CAAC;oBACD,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe,CAAC,EAAE,CACvD,CAAA;gBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,eAAe,CACvB,8DAA8D;wBAC5D,IAAI,KAAK,CAAC,EAAE,kDAAkD;wBAC9D,uBAAuB,CAC1B,CAAA;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;oBACrC,KAAK,EAAE,QAAQ;oBACf,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAA;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,eAAe,CACvB,0CAA0C,KAAK,CAAC,EAAE,aAAa;wBAC7D,oCAAoC,CACvC,CAAA;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;oBACpC,WAAW,EAAE,MAAM;oBACnB,SAAS;iBACV,CAAC,CAAA;gBACF,OAAO;oBACL,GAAG,KAAK;oBACR,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;iBAC3C,CAAA;YACH,CAAC,CAAC,CACH,CAAA;YACD,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC9C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAmB,GAAG,0BAA0B,EASjD;IACC,MAAM,eAAe,GAAG,kBAAkB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC;QAClD,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YACzB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,eAAe,CACvB,4DAA4D,CAC7D,CAAA;YACH,CAAC;YACD,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,2EAA2E;YAC3E,gDAAgD;YAChD,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAAC;gBAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;YAC5B,sEAAsE;YACtE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,IACE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,WAAW,CAAC,EACxE,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;YACnC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;oBACrC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CACvB,+DAA+D;oBAC7D,8DAA8D,CACjE,CAAA;YACH,CAAC;YACD,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,6BAA6B;YAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;gBAC7B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAA;gBAChD,OAAO,SAAS,KAAK,IAAI;oBACvB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;YACzD,CAAC,CAAC,CACH,CAAA;YACD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAA;YAC7D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,eAAe,CACvB,+DAA+D;oBAC7D,8DAA8D;oBAC9D,yDAAyD,CAC5D,CAAA;YACH,CAAC;YACD,MAAM,QAAQ,GAA8B;gBAC1C,EAAE,EAAE,OAAO;gBACX,UAAU,EAAE,aAAa;aAC1B,CAAA;YACD,uEAAuE;YACvE,2EAA2E;YAC3E,qEAAqE;YACrE,MAAM,IAAI,GAAyB;gBACjC,GAAG,UAAU;gBACb,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC;gBAC7B,YAAY,EAAE,OAAO;aACtB,CAAA;YACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;gBACvC,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,MAAM;aACpB,CAAC,CAAA;YACF,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAA;QAC/B,CAAC;KACF,CAAC,CAAA;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,QAAQ,EAAE,CAAA;IAEhB,OAAO,iBAAiB,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAmB,GAAG,0BAA0B,EAWjD;IACC,MAAM,eAAe,GAAG,kBAAkB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,kEAAkE;YAChE,iCAAiC,CACpC,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CACvB,+DAA+D,CAChE,CAAA;IACH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC;QAClD,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YACzB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,eAAe,CACvB,6DAA6D,CAC9D,CAAA;YACH,CAAC;YACD,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,aAAa,GAAG,KAAK,CAAA;YACzB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAsC,EAAE;gBAC7D,IACE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC,EACjE,CAAC;oBACD,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe,CAAC,EAAE,CACvD,CAAA;gBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,eAAe,CACvB,4DAA4D;wBAC1D,UAAU,KAAK,CAAC,EAAE,2CAA2C;wBAC7D,mCAAmC,CACtC,CAAA;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC;oBAC1C,KAAK,EAAE,QAAQ;oBACf,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAA;gBACF,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,eAAe,CACvB,8CAA8C,KAAK,CAAC,EAAE,SAAS;wBAC7D,wCAAwC,CAC3C,CAAA;gBACH,CAAC;gBACD,aAAa,GAAG,IAAI,CAAA;gBACpB,OAAO;oBACL,GAAG,KAAK;oBACR,UAAU,EAAE;wBACV,GAAG,KAAK,CAAC,UAAU;wBACnB,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;qBAClD;iBACF,CAAA;YACH,CAAC,CAAC,CACH,CAAA;YACD,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,YAAY,GAChB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAAC;gBAC5D,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;YAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACpD,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CACpC,CAAA;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YACnE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;YACnC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;gBAC7B,IAAI,GAAG,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC;oBACzB,OAAO,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC5D,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAA;gBAC/C,OAAO,QAAQ,KAAK,IAAI;oBACtB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;YACnE,CAAC,CAAC,CACH,CAAA;YACD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAA;YAC7D,MAAM,QAAQ,GAA8B;gBAC1C,EAAE,EAAE,OAAO;gBACX,UAAU,EAAE,aAAa;aAC1B,CAAA;YACD,MAAM,IAAI,GAAyB;gBACjC,GAAG,UAAU;gBACb,MAAM,EAAE,CAAC,GAAG,QAAQ,EAAE,QAAQ,CAAC;gBAC/B,YAAY,EAAE,OAAO;aACtB,CAAA;YACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;gBACvC,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,MAAM;aACpB,CAAC,CAAA;YACF,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAA;QAC/B,CAAC;KACF,CAAC,CAAA;IAEF,MAAM,QAAQ,EAAE,CAAA;IAEhB,OAAO,iBAAiB,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,EACvB,KAAK,EACL,MAAM,EACN,IAAI,EAKL;IACC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,eAAe,CACvB,gEAAgE;gBAC9D,qEAAqE,CACxE,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACvB,sEAAsE;YACpE,sDAAsD,CACzD,CAAA;IACH,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO,KAAK,UAAU,WAAW;QAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;oBACnC,SAAQ;gBACV,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,0BAA0B,CACvC,GAAW;IAEX,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAA;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,EAC1B,UAAU,EACV,KAAK,EAIN;IACC,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACvB,iEAAiE;YAC/D,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,yBAAyB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,wEAAwE;QACtE,UAAU,CACb,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,KAAK,UAAU,mBAAmB,CAAC,EACjC,KAAK,EACL,MAAM,EACN,IAAI,EAOL;IACC,IAAI,SAAkB,CAAA;IACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,IAAI,eAAe,CACvB,sEAAsE;oBACpE,4CAA4C,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,eAAe,CACvB,0EAA0E;oBACxE,oCAAoC,CACvC,CAAA;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC3B,OAAO,OAAO,CAAA;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;oBAC3C,gEAAgE;oBAChE,YAAY;oBACZ,SAAS,GAAG,GAAG,CAAA;oBACf,SAAQ;gBACV,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAC7C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,uEAAuE;YACvE,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,SAAS,GAAG,GAAG,CAAA;gBACf,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,yDAAyD,gBAAgB,GAAG;QAC1E,iEAAiE;QACjE,sBAAsB,EACxB,EAAE,KAAK,EAAE,SAAkB,EAAE,CAC9B,CAAA;AACH,CAAC"}
+{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAOhE,OAAO,EACL,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAclE;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,eAAe,CAAC,EAC7B,UAAU,EACV,WAAW,EACX,UAAU,EAKX;IACC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,MAAM,OAAO,GAAyB,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,CAAA;IAClE,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,SAAS,GAAG,MAAM,UAAU,CAAC;YACnC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;SACnC,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,SAAS,CAAA;IAC1B,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EACrB,UAAU,EAOX;IACC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CACvB,uEAAuE,CACxE,CAAA;IACH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,cAAc,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;IACjE,MAAM,KAAK,GAA8B;QACvC,EAAE,EAAE,OAAO;QACX,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAC3B,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CACzB,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACpD,CACF;KACF,CAAA;IACD,OAAO,mBAAmB,CAAC;QACzB,KAAK,EAAE,kBAAkB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAChD,uEAAuE;QACvE,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QACvB,MAAM,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YACzB,IAAI,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,eAAe,CACvB,oEAAoE;oBAClE,mCAAmC,CACtC,CAAA;YACH,CAAC;YACD,iEAAiE;YACjE,oEAAoE;YACpE,0EAA0E;YAC1E,0EAA0E;YAC1E,eAAe;YACf,MAAM,IAAI,GAAyB;gBACjC,GAAG,UAAU;gBACb,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC;gBAChC,MAAM,EAAE,CAAC,KAAK,CAAC;gBACf,YAAY,EAAE,OAAO;aACtB,CAAA;YACD,OAAO,eAAe,CAAC;gBACrB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,MAAM;gBACnB,UAAU;aACX,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EAMN;IACC,OAAO,mBAAmB,CAAC;QACzB,KAAK,EAAE,kBAAkB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAChD,MAAM,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YACzB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,eAAe,CACvB,+DAA+D;oBAC7D,uBAAuB,CAC1B,CAAA;YACH,CAAC;YACD,sEAAsE;YACtE,kEAAkE;YAClE,2CAA2C;YAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAsC,EAAE;gBAC7D,sEAAsE;gBACtE,IACE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC,EACjE,CAAC;oBACD,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe,CAAC,EAAE,CACvD,CAAA;gBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,eAAe,CACvB,8DAA8D;wBAC5D,IAAI,KAAK,CAAC,EAAE,kDAAkD;wBAC9D,uBAAuB,CAC1B,CAAA;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;oBACrC,KAAK,EAAE,QAAQ;oBACf,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAA;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,eAAe,CACvB,0CAA0C,KAAK,CAAC,EAAE,aAAa;wBAC7D,oCAAoC,CACvC,CAAA;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;oBACpC,WAAW,EAAE,MAAM;oBACnB,SAAS;iBACV,CAAC,CAAA;gBACF,OAAO;oBACL,GAAG,KAAK;oBACR,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;iBAC3C,CAAA;YACH,CAAC,CAAC,CACH,CAAA;YACD,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC9C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAmB,GAAG,0BAA0B,EAChD,UAAU,EAUX;IACC,MAAM,eAAe,GAAG,kBAAkB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC;QAClD,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YACzB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,eAAe,CACvB,4DAA4D,CAC7D,CAAA;YACH,CAAC;YACD,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,2EAA2E;YAC3E,gDAAgD;YAChD,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAAC;gBAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;YAC5B,sEAAsE;YACtE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,sDAAsD;YACtD,IACE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,WAAW,CAAC,EACxE,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;YACnC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;oBACrC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CACvB,+DAA+D;oBAC7D,8DAA8D,CACjE,CAAA;YACH,CAAC;YACD,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,6BAA6B;YAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;gBAC7B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAA;gBAChD,OAAO,SAAS,KAAK,IAAI;oBACvB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;YACzD,CAAC,CAAC,CACH,CAAA;YACD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAA;YAC7D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,eAAe,CACvB,+DAA+D;oBAC7D,8DAA8D;oBAC9D,yDAAyD,CAC5D,CAAA;YACH,CAAC;YACD,MAAM,QAAQ,GAA8B;gBAC1C,EAAE,EAAE,OAAO;gBACX,UAAU,EAAE,aAAa;aAC1B,CAAA;YACD,uEAAuE;YACvE,2EAA2E;YAC3E,qEAAqE;YACrE,MAAM,IAAI,GAAyB;gBACjC,GAAG,UAAU;gBACb,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC;gBAC7B,YAAY,EAAE,OAAO;aACtB,CAAA;YACD,OAAO,eAAe,CAAC;gBACrB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,MAAM;gBACnB,UAAU;aACX,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,QAAQ,EAAE,CAAA;IAEhB,OAAO,iBAAiB,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAmB,GAAG,0BAA0B,EAChD,UAAU,EAYX;IACC,MAAM,eAAe,GAAG,kBAAkB,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,kEAAkE;YAChE,iCAAiC,CACpC,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CACvB,+DAA+D,CAChE,CAAA;IACH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC;QAClD,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,KAAK,EAAC,UAAU,EAAC,EAAE;YACzB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;YAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,eAAe,CACvB,6DAA6D,CAC9D,CAAA;YACH,CAAC;YACD,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,aAAa,GAAG,KAAK,CAAA;YACzB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAsC,EAAE;gBAC7D,IACE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC,EACjE,CAAC;oBACD,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe,CAAC,EAAE,CACvD,CAAA;gBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,eAAe,CACvB,4DAA4D;wBAC1D,UAAU,KAAK,CAAC,EAAE,2CAA2C;wBAC7D,mCAAmC,CACtC,CAAA;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC;oBAC1C,KAAK,EAAE,QAAQ;oBACf,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAA;gBACF,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,eAAe,CACvB,8CAA8C,KAAK,CAAC,EAAE,SAAS;wBAC7D,wCAAwC,CAC3C,CAAA;gBACH,CAAC;gBACD,aAAa,GAAG,IAAI,CAAA;gBACpB,OAAO;oBACL,GAAG,KAAK;oBACR,UAAU,EAAE;wBACV,GAAG,KAAK,CAAC,UAAU;wBACnB,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;qBAClD;iBACF,CAAA;YACH,CAAC,CAAC,CACH,CAAA;YACD,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,YAAY,GAChB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAAC;gBAC5D,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;YAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACpD,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CACpC,CAAA;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;YACnE,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;YACnC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;gBAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,iEAAiE;YACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;gBAC7B,IAAI,GAAG,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC;oBACzB,OAAO,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC5D,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAA;gBAC/C,OAAO,QAAQ,KAAK,IAAI;oBACtB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;YACnE,CAAC,CAAC,CACH,CAAA;YACD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAA;YAC7D,MAAM,QAAQ,GAA8B;gBAC1C,EAAE,EAAE,OAAO;gBACX,UAAU,EAAE,aAAa;aAC1B,CAAA;YACD,MAAM,IAAI,GAAyB;gBACjC,GAAG,UAAU;gBACb,MAAM,EAAE,CAAC,GAAG,QAAQ,EAAE,QAAQ,CAAC;gBAC/B,YAAY,EAAE,OAAO;aACtB,CAAA;YACD,OAAO,eAAe,CAAC;gBACrB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,MAAM;gBACnB,UAAU;aACX,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;IAEF,MAAM,QAAQ,EAAE,CAAA;IAEhB,OAAO,iBAAiB,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,EACvB,KAAK,EACL,MAAM,EACN,IAAI,EAKL;IACC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,eAAe,CACvB,gEAAgE;gBAC9D,qEAAqE,CACxE,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACvB,sEAAsE;YACpE,sDAAsD,CACzD,CAAA;IACH,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO,KAAK,UAAU,WAAW;QAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;oBACnC,SAAQ;gBACV,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,0BAA0B,CACvC,GAAW;IAEX,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAA;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,EAC1B,UAAU,EACV,KAAK,EAIN;IACC,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACvB,iEAAiE;YAC/D,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,yBAAyB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,wEAAwE;QACtE,UAAU,CACb,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,KAAK,UAAU,mBAAmB,CAAC,EACjC,KAAK,EACL,MAAM,EACN,IAAI,EAOL;IACC,IAAI,SAAkB,CAAA;IACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,IAAI,eAAe,CACvB,sEAAsE;oBACpE,4CAA4C,CAC/C,CAAA;YACH,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,eAAe,CACvB,0EAA0E;oBACxE,oCAAoC,CACvC,CAAA;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC3B,OAAO,OAAO,CAAA;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;oBAC3C,gEAAgE;oBAChE,YAAY;oBACZ,SAAS,GAAG,GAAG,CAAA;oBACf,SAAQ;gBACV,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAC7C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,uEAAuE;YACvE,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;YACpD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,SAAS,GAAG,GAAG,CAAA;gBACf,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,yDAAyD,gBAAgB,GAAG;QAC1E,iEAAiE;QACjE,sBAAsB,EACxB,EAAE,KAAK,EAAE,SAAkB,EAAE,CAC9B,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -15,5 +15,5 @@ export { readEtag, writeHeaders } from './internal/conditional.js';
 export type { WritePrecondition } from './internal/conditional.js';
 export { WasError, NotFoundError, ValidationError, AuthRequiredError, NotImplementedError, ConflictError, PreconditionFailedError, PayloadTooLargeError, QuotaExceededError, EncryptionError, KeyUnwrapError, IntegrityError, WasSyncConflictError, WasSyncNotFoundError, WasServerError, mapError } from './errors.js';
 export type { ResourceCodec, EncryptionProvider, EncodedWrite } from './codec.js';
-export type { Json, JsonPrimitive, JsonObject, JsonArray, ResourceData, Action, ActionInput, SpaceDescription, CollectionDescription, CollectionWritableFields, CollectionEncryption, CollectionEncryptionEpoch, CollectionEncryptionRecipient, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, AddResult, ImportStats, PolicyDocument, LinkSet, LinkSetEntry, HandleOptions, EncryptionOverride, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport, GrantOptions, RequestInput, IZcap, IDelegatedZcap, ISigner } from './types.js';
+export type { Json, JsonPrimitive, JsonObject, JsonArray, ResourceData, Action, ActionInput, SpaceDescription, CollectionDescription, CollectionWritableFields, CollectionEncryption, CollectionEncryptionEpoch, CollectionEncryptionEpochsSig, CollectionEncryptionRecipient, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, AddResult, ImportStats, PolicyDocument, LinkSet, LinkSetEntry, HandleOptions, EncryptionOverride, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport, GrantOptions, RequestInput, IZcap, IDelegatedZcap, ISigner } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA;AAEpB,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,IAAI,EACJ,aAAa,EACb,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,EACT,WAAW,EACX,cAAc,EACd,OAAO,EACP,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,cAAc,EACd,OAAO,EACR,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA;AAEpB,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,IAAI,EACJ,aAAa,EACb,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,EACT,WAAW,EACX,cAAc,EACd,OAAO,EACP,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,cAAc,EACd,OAAO,EACR,MAAM,YAAY,CAAA"}

package/dist/types.d.ts

@@ -22,7 +22,7 @@ export type { IZcap, IDelegatedZcap, IRootZcap, ISigner };
  * `ResourceListing`) and the collections-in-a-space listing is `CollectionsList`
  * (formerly `CollectionListing`).
  */
-export type { Action, ActionInput, SpaceDescription, CollectionDescription, CollectionEncryption, CollectionEncryptionEpoch, CollectionEncryptionEpochsMac, CollectionEncryptionRecipient, PolicyDocument, LinkSet, LinkSetEntry, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, ImportStats, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport } from '@interop/storage-core';
+export type { Action, ActionInput, SpaceDescription, CollectionDescription, CollectionEncryption, CollectionEncryptionEpoch, CollectionEncryptionEpochsMac, CollectionEncryptionEpochsSig, CollectionEncryptionRecipient, PolicyDocument, LinkSet, LinkSetEntry, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, ImportStats, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport } from '@interop/storage-core';
 import type { BackendReference, CollectionEncryption } from '@interop/storage-core';
 /**
  * The client-writable fields of a Collection Description -- the shape shared

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,KAAK,EACL,cAAc,EACd,SAAS,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAEzD;;;;;GAKG;AACH,YAAY,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,uBAAuB,CAAA;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAA;CAClC;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AAC5D,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AACD,MAAM,MAAM,SAAS,GAAG,IAAI,EAAE,CAAA;AAC9B,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,IAAI,GAAG,UAAU,CAAA;AAErE;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,WAAW,CAAA;AAElD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,UAAU,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,KAAK,EACL,cAAc,EACd,SAAS,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAEzD;;;;;GAKG;AACH,YAAY,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,6BAA6B,EAC7B,cAAc,EACd,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,uBAAuB,CAAA;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAA;CAClC;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AAC5D,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AACD,MAAM,MAAM,SAAS,GAAG,IAAI,EAAE,CAAA;AAC9B,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,IAAI,GAAG,UAAU,CAAA;AAErE;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,WAAW,CAAA;AAElD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,UAAU,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-client",
   "description": "A developer-friendly client for Wallet Attached Storage (WAS) servers.",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -53,8 +53,8 @@
     "@interop/edv-client": "^17.8.0",
     "@interop/ezcap": "^7.4.1",
     "@interop/http-client": "^1.0.4",
-    "@interop/minimal-cipher": "^7.8.0",
-    "@interop/storage-core": "^0.3.12",
+    "@interop/minimal-cipher": "^7.8.1",
+    "@interop/storage-core": "^0.3.13",
     "@interop/x25519-key-agreement-key": "^5.2.1",
     "@noble/hashes": "^2.2.0",
     "@scure/base": "^2.2.0",