@interop/was-client 0.26.0 → 0.27.2

package/dist/edv/epochKeys.js

@@ -39,10 +39,8 @@ export async function resolveEpochKeys({ encryption, keyAgreementKey }) {
     // server rejects via its revoked zcap anyway; selecting a deterministic
     // fallback here only keeps the local `writeEpoch`/`writeKey` well-defined
     // instead of assuming the `epochs` array is append-ordered newest-last.
-    const currentEpoch = encryption.currentEpoch;
-    const writeEpochEntry = (currentEpoch !== undefined &&
-        namedEpochs.find(epoch => epoch.id === currentEpoch)) ||
-        namedEpochs[namedEpochs.length - 1];
+    const writeEpochEntry = namedEpochs.find(epoch => epoch.id === encryption.currentEpoch) ??
+        namedEpochs.at(-1);
     // The write epoch is unwrapped eagerly: `writeKey` must be a full key pair the
     // EDV cipher can name recipients with and encrypt under right away. Its raw
     // secret is surfaced alongside so the epoch-configuration MAC can be verified.

package/dist/edv/epochKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"epochKeys.js","sourceRoot":"","sources":["../../src/edv/epochKeys.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAK7D,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAuB/C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,eAAe,EAIhB;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxC,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CACF,CAAA;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CACtB,oEAAoE;YAClE,mEAAmE;YACnE,qEAAqE;YACrE,uCAAuC,CAC1C,CAAA;IACH,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAA;IAC5C,MAAM,eAAe,GACnB,CAAC,YAAY,KAAK,SAAS;QACzB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;QACvD,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IACtC,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC;QAC1C,KAAK,EAAE,eAAe;QACtB,eAAe;KAChB,CAAC,CAAA;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CACtB,oDAAoD;YAClD,IAAI,eAAe,CAAC,EAAE,6CAA6C;YACnE,qEAAqE;YACrE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAA;IACnC,kEAAkE;IAClE,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,0DAA0D;IAC1D,IACE,eAAe,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY;QAC9C,UAAU,CAAC,SAAS,KAAK,SAAS,EAClC,CAAC;QACD,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,SAAS,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,cAAc,CACtB,sEAAsE;gBACpE,+BAA+B,CAAC,UAAU,GAAG,gBAAgB;gBAC7D,iCAAiC,CACpC,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;YACtC,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,cAAc,CAAC,MAAM;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,cAAc,CACtB,gEAAgE;gBAC9D,oEAAoE;gBACpE,oDAAoD,CACvD,CAAA;QACH,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,iBAAiB;IACjB,MAAM,QAAQ,GAAuB,CAAC,QAAQ,CAAC,CAAA;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,eAAe,EAIhB;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACjC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CAAA;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;AAChF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,eAAe,EAIhB;IACC,IAAI,OAA8C,CAAA;IAClD,MAAM,OAAO,GAAG,GAA8B,EAAE;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAC7D,SAAS,CAAC,EAAE;gBACV,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,kEAAkE;oBAClE,6DAA6D;oBAC7D,8DAA8D;oBAC9D,mCAAmC;oBACnC,MAAM,IAAI,cAAc,CACtB,4CAA4C,KAAK,CAAC,EAAE,YAAY;wBAC9D,2BAA2B,CAC9B,CAAA;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC,GAAG,CAAA;YACtB,CAAC,CACF,CAAA;YACD,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,8DAA8D;YAC9D,OAAO,CAAC,KAAK,CAAC,GAAS,EAAE;gBACvB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;oBACxB,OAAO,GAAG,SAAS,CAAA;gBACrB,CAAC;YACH,CAAC,CAAC,CAAA;YACF,OAAO,GAAG,OAAO,CAAA;QACnB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IACD,OAAO;QACL,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,YAAY,CAAC,OAA+B;YAChD,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;YAC3B,OAAO,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"epochKeys.js","sourceRoot":"","sources":["../../src/edv/epochKeys.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAK7D,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAuB/C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,eAAe,EAIhB;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxC,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CACF,CAAA;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CACtB,oEAAoE;YAClE,mEAAmE;YACnE,qEAAqE;YACrE,uCAAuC,CAC1C,CAAA;IACH,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,eAAe,GACnB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAAC;QAC/D,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;IACrB,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC;QAC1C,KAAK,EAAE,eAAe;QACtB,eAAe;KAChB,CAAC,CAAA;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CACtB,oDAAoD;YAClD,IAAI,eAAe,CAAC,EAAE,6CAA6C;YACnE,qEAAqE;YACrE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAA;IACnC,kEAAkE;IAClE,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,0DAA0D;IAC1D,IACE,eAAe,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY;QAC9C,UAAU,CAAC,SAAS,KAAK,SAAS,EAClC,CAAC;QACD,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,SAAS,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,cAAc,CACtB,sEAAsE;gBACpE,+BAA+B,CAAC,UAAU,GAAG,gBAAgB;gBAC7D,iCAAiC,CACpC,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;YACtC,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,cAAc,CAAC,MAAM;SACnC,CAAC,CAAA;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,cAAc,CACtB,gEAAgE;gBAC9D,oEAAoE;gBACpE,oDAAoD,CACvD,CAAA;QACH,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,iBAAiB;IACjB,MAAM,QAAQ,GAAuB,CAAC,QAAQ,CAAC,CAAA;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,eAAe,EAIhB;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACjC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CAAA;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;AAChF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,eAAe,EAIhB;IACC,IAAI,OAA8C,CAAA;IAClD,MAAM,OAAO,GAAG,GAA8B,EAAE;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAC7D,SAAS,CAAC,EAAE;gBACV,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,kEAAkE;oBAClE,6DAA6D;oBAC7D,8DAA8D;oBAC9D,mCAAmC;oBACnC,MAAM,IAAI,cAAc,CACtB,4CAA4C,KAAK,CAAC,EAAE,YAAY;wBAC9D,2BAA2B,CAC9B,CAAA;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC,GAAG,CAAA;YACtB,CAAC,CACF,CAAA;YACD,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,8DAA8D;YAC9D,OAAO,CAAC,KAAK,CAAC,GAAS,EAAE;gBACvB,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;oBACxB,OAAO,GAAG,SAAS,CAAA;gBACrB,CAAC;YACH,CAAC,CAAC,CAAA;YACF,OAAO,GAAG,OAAO,CAAA;QACnB,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IACD,OAAO;QACL,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,YAAY,CAAC,OAA+B;YAChD,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAA;YAC3B,OAAO,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/edv/epochMac.d.ts

@@ -1,4 +1,27 @@
-import type { CollectionEncryption, CollectionEncryptionEpochsMac } from '../types.js';
+import type { CollectionEncryption, CollectionEncryptionEpochsMac, CollectionEncryptionEpochsSig } from '../types.js';
+/**
+ * A caller-supplied signer for the `epochsSig` member: given the canonical
+ * signature payload bytes ({@link epochsSigPayload} over the descriptor being
+ * written), it returns the full signature member to stamp. The signing key --
+ * and the root of trust the reader resolves its `kid` against -- are entirely
+ * the caller's; this module only defines the payload and where the result
+ * lands.
+ */
+export type EpochsSigner = (options: {
+    payload: Uint8Array;
+}) => Promise<CollectionEncryptionEpochsSig>;
+/**
+ * Builds the payload bytes an `epochsSig` signs: `UTF8(
+ * "was-epoch-config-sig/v1." + epochsConfigJson(descriptor))` -- the same
+ * epoch configuration the MAC covers, under its own domain-separation prefix.
+ * Exported so a signing caller and a verifying reader construct
+ * byte-identical input from the descriptor alone.
+ *
+ * @param descriptor {CollectionEncryption}   the descriptor whose epoch
+ *   configuration is being signed or verified
+ * @returns {Uint8Array}
+ */
+export declare function epochsSigPayload(descriptor: CollectionEncryption): Uint8Array;
 /**
  * Computes the `epochsMac` field for a descriptor under the current epoch's
  * secret. Compute this over the exact descriptor state being written (member

package/dist/edv/epochMac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epochMac.d.ts","sourceRoot":"","sources":["../../src/edv/epochMac.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,oBAAoB,EACpB,6BAA6B,EAC9B,MAAM,aAAa,CAAA;AAwEpB;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBnB"}
+{"version":3,"file":"epochMac.d.ts","sourceRoot":"","sources":["../../src/edv/epochMac.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,aAAa,CAAA;AAmBpB;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE;IACnC,OAAO,EAAE,UAAU,CAAA;CACpB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAA;AAuE5C;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,oBAAoB,GAAG,UAAU,CAE7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAYzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBnB"}

package/dist/edv/epochMac.js

@@ -20,15 +20,21 @@
  * out of scope here.
  */
 import { base64urlnopad } from '@scure/base';
-const TEXT_ENCODER = new TextEncoder();
+import { ENCODER } from '../internal/content.js';
 /**
  * The HKDF `info` string binding the derived key to this MAC construction.
  */
-const MAC_KEY_INFO = TEXT_ENCODER.encode('was-epoch-config-mac/v1');
+const MAC_KEY_INFO = ENCODER.encode('was-epoch-config-mac/v1');
 /**
  * The domain-separation prefix prepended to the JSON payload before it is MACed.
  */
 const MAC_PAYLOAD_PREFIX = 'was-epoch-config/v1.';
+/**
+ * The domain-separation prefix of the detached `epochsSig` signature payload --
+ * distinct from the MAC prefix so a signature can never be replayed as a MAC
+ * input or vice versa.
+ */
+const SIG_PAYLOAD_PREFIX = 'was-epoch-config-sig/v1.';
 /**
  * Derives the HMAC-SHA256 key from a 32-byte epoch secret:
  * HKDF-SHA256(ikm = the epoch secret, salt = empty, info =
@@ -48,26 +54,50 @@ async function deriveMacKey(epochSecret) {
     }, ikm, { name: 'HMAC', hash: 'SHA-256', length: 256 }, false, ['sign', 'verify']);
 }
 /**
- * Builds the MACed payload bytes for a descriptor's epoch configuration:
- * `UTF8("was-epoch-config/v1." + JSON.stringify({ scheme, version,
- * currentEpoch, epochs }))`, with `version` normalized to `null` when absent
- * and `epochs` the ordered list of epoch id strings. The object member order is
+ * The canonical JSON text of a descriptor's epoch configuration -- the part
+ * both the MAC and the detached signature cover: `{ scheme, version,
+ * currentEpoch, epochs }`, with `version` normalized to `null` when absent and
+ * `epochs` the ordered list of epoch id strings. The object member order is
  * fixed so both sides serialize identically.
  *
- * @param descriptor {CollectionEncryption}   the descriptor whose epoch configuration is
- *   being authenticated
- * @returns {Uint8Array}
+ * @param descriptor {CollectionEncryption}   the descriptor whose epoch
+ *   configuration is being authenticated
+ * @returns {string}
  */
-function macPayload(descriptor) {
-    const payload = {
+function epochsConfigJson(descriptor) {
+    return JSON.stringify({
         scheme: descriptor.scheme,
         version: descriptor.version ?? null,
         currentEpoch: descriptor.currentEpoch,
         epochs: (descriptor.epochs ?? []).map(epoch => epoch.id)
-    };
-    const bytes = TEXT_ENCODER.encode(MAC_PAYLOAD_PREFIX + JSON.stringify(payload));
+    });
+}
+/**
+ * Builds the MACed payload bytes for a descriptor's epoch configuration:
+ * `UTF8("was-epoch-config/v1." + epochsConfigJson(descriptor))`.
+ *
+ * @param descriptor {CollectionEncryption}   the descriptor whose epoch configuration is
+ *   being authenticated
+ * @returns {ArrayBuffer}
+ */
+function macPayload(descriptor) {
+    const bytes = ENCODER.encode(MAC_PAYLOAD_PREFIX + epochsConfigJson(descriptor));
     return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
 }
+/**
+ * Builds the payload bytes an `epochsSig` signs: `UTF8(
+ * "was-epoch-config-sig/v1." + epochsConfigJson(descriptor))` -- the same
+ * epoch configuration the MAC covers, under its own domain-separation prefix.
+ * Exported so a signing caller and a verifying reader construct
+ * byte-identical input from the descriptor alone.
+ *
+ * @param descriptor {CollectionEncryption}   the descriptor whose epoch
+ *   configuration is being signed or verified
+ * @returns {Uint8Array}
+ */
+export function epochsSigPayload(descriptor) {
+    return ENCODER.encode(SIG_PAYLOAD_PREFIX + epochsConfigJson(descriptor));
+}
 /**
  * Computes the `epochsMac` field for a descriptor under the current epoch's
  * secret. Compute this over the exact descriptor state being written (member

package/dist/edv/epochMac.js.map

@@ -1 +1 @@
-{"version":3,"file":"epochMac.js","sourceRoot":"","sources":["../../src/edv/epochMac.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAM5C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAEtC;;GAEG;AACH,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAEnE;;GAEG;AACH,MAAM,kBAAkB,GAAG,sBAAsB,CAAA;AAEjD;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,WAAuB;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,WAAqC,EACrC,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,YAAY;KACnB,EACD,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,UAAgC;IAClD,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI;QACnC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACzD,CAAA;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAC/B,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAC7C,CAAA;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CACvB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACrB,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,GAAG,EACH,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;IACD,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,GAAe,CAAA;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,GAA6B,EAC7B,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;AACH,CAAC"}
+{"version":3,"file":"epochMac.js","sourceRoot":"","sources":["../../src/edv/epochMac.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAOhD;;GAEG;AACH,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAE9D;;GAEG;AACH,MAAM,kBAAkB,GAAG,sBAAsB,CAAA;AAEjD;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,0BAA0B,CAAA;AAcrD;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,WAAuB;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,WAAqC,EACrC,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,YAAY;KACnB,EACD,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,UAAgC;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI;QACnC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACzD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,UAAgC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAC1B,kBAAkB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAClD,CAAA;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CACvB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACrB,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAgC;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,GAAG,EACH,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;IACD,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,GAAe,CAAA;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,GAA6B,EAC7B,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;AACH,CAAC"}

package/dist/edv/index.d.ts

@@ -32,14 +32,16 @@
  */
 export { createEdvEncryption, EdvCodec } from './EdvCodec.js';
 export type { EdvKeys } from './EdvCodec.js';
-export { WasTransport, JOSE_CONTENT_TYPE } from './WasTransport.js';
+export { WasTransport } from './WasTransport.js';
+export { EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE } from './constants.js';
 export { initRecipients, addRecipient, removeRecipient, replaceRecipient } from './recipients.js';
-export type { OwnerKey, RecipientPublicKey } from './recipients.js';
+export type { RecipientPublicKey } from './recipients.js';
 export { isEd25519DidKey, x25519RecipientFromDidKey } from './didKeyRecipient.js';
 export { collectionDescriptorStore, resourceDescriptorStore } from './descriptorStore.js';
 export type { EncryptionDescriptorStore } from './descriptorStore.js';
-export { mintEpoch, epochKeyIdFor, unwrapEpochSecret } from './epochCrypto.js';
-export { verifyEpochsMac } from './epochMac.js';
+export { mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
+export { computeEpochsMac, epochsSigPayload, verifyEpochsMac } from './epochMac.js';
+export type { EpochsSigner } from './epochMac.js';
 export { resolveEpochKeys } from './epochKeys.js';
 export type { ResolvedEpochKeys } from './epochKeys.js';
 export { createEdvDocCipher, ownerRecipient, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';

package/dist/edv/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7D,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7D,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/edv/index.js

@@ -31,12 +31,13 @@
  * rather than transmitted.
  */
 export { createEdvEncryption, EdvCodec } from './EdvCodec.js';
-export { WasTransport, JOSE_CONTENT_TYPE } from './WasTransport.js';
+export { WasTransport } from './WasTransport.js';
+export { EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE } from './constants.js';
 export { initRecipients, addRecipient, removeRecipient, replaceRecipient } from './recipients.js';
 export { isEd25519DidKey, x25519RecipientFromDidKey } from './didKeyRecipient.js';
 export { collectionDescriptorStore, resourceDescriptorStore } from './descriptorStore.js';
-export { mintEpoch, epochKeyIdFor, unwrapEpochSecret } from './epochCrypto.js';
-export { verifyEpochsMac } from './epochMac.js';
+export { mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
+export { computeEpochsMac, epochsSigPayload, verifyEpochsMac } from './epochMac.js';
 export { resolveEpochKeys } from './epochKeys.js';
 export { createEdvDocCipher, ownerRecipient, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
 //# sourceMappingURL=index.js.map

package/dist/edv/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAChB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA"}

package/dist/edv/recipients.d.ts

@@ -35,15 +35,9 @@ import type { Collection } from '../Collection.js';
 import type { Space } from '../Space.js';
 import type { EncryptionDescriptorStore } from './descriptorStore.js';
 import type { CollectionEncryption, IDelegatedZcap } from '../types.js';
+import type { EpochsSigner } from './epochMac.js';
 import type { RecipientPublicKey } from './epochCrypto.js';
 export type { RecipientPublicKey } from './epochCrypto.js';
-/**
- * The caller's own key material, used to unwrap existing epoch keys so they can
- * be re-wrapped to a newly added reader (escrow).
- */
-export interface OwnerKey {
-    keyAgreementKey: IKeyAgreementKey;
-}
 /**
  * Initializes the first key epoch on a descriptor that has no epochs yet: mints
  * a fresh epoch key, wraps it to each initial recipient, and writes `epochs:
@@ -70,9 +64,12 @@ export interface OwnerKey {
  *   whose epoch key already exists (e.g. a per-user key being enrolled into
  *   its wrap-set roster). The `epochId` must be the key's did:key and `secret`
  *   its raw 32-byte private key, exactly what {@link mintEpoch} returns.
+ * @param [options.signEpochs] {EpochsSigner}   signs the epoch configuration
+ *   being written, stamping the descriptor's `epochsSig` beside its
+ *   `epochsMac`
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
-export declare function initRecipients({ collection, store, recipients, epoch: premintedEpoch }: {
+export declare function initRecipients({ collection, store, recipients, epoch: premintedEpoch, signEpochs }: {
     collection?: Collection;
     store?: EncryptionDescriptorStore;
     recipients: RecipientPublicKey[];
@@ -80,6 +77,7 @@ export declare function initRecipients({ collection, store, recipients, epoch: p
         epochId: string;
         secret: Uint8Array;
     };
+    signEpochs?: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
  * Adds a reader to a multi-recipient encrypted Collection. Escrow semantics: the
@@ -96,15 +94,18 @@ export declare function initRecipients({ collection, store, recipients, epoch: p
  *   hosts the descriptor; exactly one of `collection` / `store`
  * @param [options.store] {EncryptionDescriptorStore}   an explicit descriptor store
  * @param options.recipient {RecipientPublicKey}   the new reader's public KAK
- * @param options.owner {OwnerKey}   the caller's own key-agreement key, to
- *   unwrap each epoch key for re-wrapping to the new reader
+ * @param options.owner {object}   the caller's own key material
+ * @param options.owner.keyAgreementKey {IKeyAgreementKey}   unwraps each epoch
+ *   key for re-wrapping to the new reader
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
 export declare function addRecipient({ collection, store, recipient, owner }: {
     collection?: Collection;
     store?: EncryptionDescriptorStore;
     recipient: RecipientPublicKey;
-    owner: OwnerKey;
+    owner: {
+        keyAgreementKey: IKeyAgreementKey;
+    };
 }): Promise<CollectionEncryption>;
 /**
  * Removes a reader from a multi-recipient encrypted Collection -- one
@@ -159,9 +160,12 @@ export declare function addRecipient({ collection, store, recipient, owner }: {
  *   self-describing `did:key`. May resolve `null` to signal drop-this-kid:
  *   the rotation then excludes that entry from the fresh epoch instead of
  *   throwing (subject to the no-recipients-remaining guard).
+ * @param [options.signEpochs] {EpochsSigner}   signs the rotated epoch
+ *   configuration, stamping the descriptor's `epochsSig` beside its
+ *   `epochsMac`
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
-export declare function removeRecipient({ collection, store, space, recipientId, revoke, pull, resolveRecipientKey }: {
+export declare function removeRecipient({ collection, store, space, recipientId, revoke, pull, resolveRecipientKey, signEpochs }: {
     collection?: Collection;
     store?: EncryptionDescriptorStore;
     space?: Space;
@@ -169,6 +173,7 @@ export declare function removeRecipient({ collection, store, space, recipientId,
     revoke?: IDelegatedZcap | IDelegatedZcap[];
     pull?: () => Promise<void>;
     resolveRecipientKey?: (kid: string) => Promise<RecipientPublicKey | null>;
+    signEpochs?: EpochsSigner;
 }): Promise<CollectionEncryption>;
 /**
  * Replaces one reader (or several) with another in ONE descriptor write -- the
@@ -207,9 +212,10 @@ export declare function removeRecipient({ collection, store, space, recipientId,
  *   dropped from the fresh epoch's roster
  * @param options.recipient {RecipientPublicKey}   the incoming reader's public
  *   key-agreement key, escrowed into every epoch and wrapped into the fresh one
- * @param options.owner {OwnerKey}   the caller's own key-agreement key,
- *   unwrapping each epoch key for the escrow -- it must be a recipient of
- *   every epoch (a retiring key that was escrowed everywhere qualifies)
+ * @param options.owner {object}   the caller's own key material
+ * @param options.owner.keyAgreementKey {IKeyAgreementKey}   unwraps each epoch
+ *   key for the escrow -- it must be a recipient of every epoch (a retiring
+ *   key that was escrowed everywhere qualifies)
  * @param [options.revoke] {IDelegatedZcap | IDelegatedZcap[]}   the default
  *   pull axis, with `space`
  * @param [options.pull] {function}   a caller-supplied pull action; mutually
@@ -218,17 +224,23 @@ export declare function removeRecipient({ collection, store, space, recipientId,
  *   recipient's kid for the fresh epoch, `null` to drop it -- the
  *   {@link removeRecipient} contract (the incoming recipient never routes
  *   through it)
+ * @param [options.signEpochs] {EpochsSigner}   signs the rotated epoch
+ *   configuration, stamping the descriptor's `epochsSig` beside its
+ *   `epochsMac` (an escrow-only write leaves both untouched)
  * @returns {Promise<CollectionEncryption>}   the new descriptor
  */
-export declare function replaceRecipient({ collection, store, space, retire, recipient, owner, revoke, pull, resolveRecipientKey }: {
+export declare function replaceRecipient({ collection, store, space, retire, recipient, owner, revoke, pull, resolveRecipientKey, signEpochs }: {
     collection?: Collection;
     store?: EncryptionDescriptorStore;
     space?: Space;
     retire: string | string[];
     recipient: RecipientPublicKey;
-    owner: OwnerKey;
+    owner: {
+        keyAgreementKey: IKeyAgreementKey;
+    };
     revoke?: IDelegatedZcap | IDelegatedZcap[];
     pull?: () => Promise<void>;
     resolveRecipientKey?: (kid: string) => Promise<RecipientPublicKey | null>;
+    signEpochs?: EpochsSigner;
 }): Promise<CollectionEncryption>;
 //# sourceMappingURL=recipients.d.ts.map

package/dist/edv/recipients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EACV,oBAAoB,EAEpB,cAAc,EACf,MAAM,aAAa,CAAA;AAQpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,eAAe,EAAE,gBAAgB,CAAA;CAClC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EACtB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;CAChD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8ChC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EACN,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE,QAAQ,CAAA;CAChB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuDhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgGhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE,QAAQ,CAAA;IACf,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqHhC"}
+{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAIxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EACV,oBAAoB,EAEpB,cAAc,EACf,MAAM,aAAa,CAAA;AAQpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AA+J1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EACrB,UAAU,EACX,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;IAC/C,UAAU,CAAC,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+ChC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EACN,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;CAC7C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqBhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAgD,EAChD,UAAU,EACX,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IACzE,UAAU,CAAC,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyFhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAgD,EAChD,UAAU,EACX,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;IAC5C,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IACzE,UAAU,CAAC,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+EhC"}