@interop/was-client 0.50.0 → 0.52.0

package/dist/edv/logGovernedDescriptorStore.js

@@ -0,0 +1,476 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The log-governed case of the descriptor-store seam. Two stores:
+ *
+ * - `logGovernedDescriptorStore` is the generic one, over any
+ *   `ResourceLogStore` (a Resource-hosted key roster, a Collection's history
+ *   log): reads resolve to the log's VERIFIED head state -- chain, proofs,
+ *   external authorization against a caller-supplied controller view, and the
+ *   chain-head pin all checked by `@interop/vh-resource-log` before any
+ *   descriptor is handed out -- and writes become signed appends (verified-head
+ *   build, the library's pre-write pass, compare-and-swap, read-back and pin).
+ *   It also carries the sealing sweep, the idempotent backstop append that
+ *   advances a log's head past the controller's latest membership change.
+ * - `logGovernedCollectionDescriptorStore` is the pointer-following one, over a
+ *   Collection whose served `encryption` member is a point-state projection of
+ *   its governing history log, named by the projection's `history` member. It
+ *   dispatches on that member, and for a governed Collection reads through the
+ *   generic store and then holds the served projection to the verified head:
+ *   a projection that does not JCS-equal the head's state after stripping
+ *   `history` is refused.
+ *
+ * The generic read boundary (`readGovernedEpochConfiguration`) and the
+ * `WasEpochConfiguration` state shape are shared with the wallet's user key
+ * roster, which wraps the generic store. What stays outside this module is
+ * DID-method resolution: the controller port and the pin store are injected by
+ * the caller.
+ */
+import { canonicalize } from 'json-canonicalize';
+import { RESOURCE_LOG_METHOD } from '@interop/storage-core';
+import { buildResourceLogEntry, confirmAppend, createResourceLog, isResourceLogConflictError, readResourceLog, ResourceLogClosedError, ResourceLogIntegrityError, sealResourceLog, verifyResourceLog, verifyResourceLogAppend } from '@interop/vh-resource-log';
+import { PreconditionFailedError, ValidationError } from '../errors.js';
+import { unreadableDescriptionError } from '../internal/describe.js';
+import { resourceLogStore } from '../log/logStore.js';
+/**
+ * The state-document schema identifier an encryption descriptor carries in a
+ * governed log entry, per the Encrypted Collections profile.
+ */
+export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
+/**
+ * The log-entry `state` for a descriptor: the point-state projection's
+ * `history` member stripped (it belongs to the projection only; the verifier
+ * refuses an entry whose state carries it) and the schema identifier stamped.
+ *
+ * @param descriptor {CollectionEncryption}
+ * @returns {CollectionEncryption & { type: string }}
+ */
+export function toEpochConfigurationState(descriptor) {
+    const { history: _history, ...rest } = descriptor;
+    return { ...rest, type: EPOCH_CONFIGURATION_STATE_TYPE };
+}
+/**
+ * The one governed epoch-configuration read: the fail-closed boundary that
+ * decides whether a served log state may be treated as an encryption
+ * descriptor. Resolves the controller view, reads and fully verifies the log
+ * (chain, proofs, external authorization, and the chain-head pin, via
+ * `readResourceLog`), and refuses a verified head whose state is not a
+ * `WasEpochConfiguration` rather than handing it out as a descriptor.
+ * Resolves `null` for an absent log (the pre-genesis state) only while no pin
+ * is held for it; under a held pin an absent log is refused as a `rollback`,
+ * the library's rule. Every trusted descriptor read goes through this helper,
+ * so a hardening applied here reaches all of them.
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}   the log's transport seam
+ * @param options.resolveController {function}
+ *   `() => Promise<ResourceLogController>` -- the caller's currently verified
+ *   controller view, resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pin for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
+ * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; controller: ResourceLogController; etag?: string } | null>}
+ *   the verified log, its head state as the descriptor, the controller view
+ *   it was verified under, and the log's validator
+ */
+export async function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }) {
+    const controller = await resolveController();
+    const current = await readResourceLog({
+        store,
+        controller,
+        expectedMethod: RESOURCE_LOG_METHOD,
+        pinStore,
+        logId
+    });
+    if (current === null) {
+        return null;
+    }
+    const state = current.verified.state;
+    if (state.type !== EPOCH_CONFIGURATION_STATE_TYPE) {
+        throw new ResourceLogIntegrityError(`The governed descriptor log carries state of type ` +
+            `"${state.type}", not "${EPOCH_CONFIGURATION_STATE_TYPE}".`);
+    }
+    return {
+        verified: current.verified,
+        descriptor: state,
+        controller,
+        etag: current.etag
+    };
+}
+/**
+ * Translates the log-store port's CAS conflict (the library's
+ * `ResourceLogConflictError`, matched by `name` -- it is minted in the store
+ * adapter's package, which may resolve its own library copy) into the
+ * `PreconditionFailedError` the `EncryptionDescriptorStore` port documents
+ * and the edv recipient loops rebase on. Any other error -- an untranslated
+ * `PreconditionFailedError` included -- returns unchanged.
+ *
+ * @param err {unknown}
+ * @returns {unknown}   the error to rethrow
+ */
+function asDescriptorStoreConflict(err) {
+    if (isResourceLogConflictError(err)) {
+        return new PreconditionFailedError(err.message, {
+            status: 412,
+            cause: err
+        });
+    }
+    return err;
+}
+/**
+ * Builds the generic log-governed `EncryptionDescriptorStore` over a resource
+ * log's transport seam. Because the seam is the same one the edv recipient
+ * primitives (`initRecipients` / `addRecipient` / `removeRecipient`, with
+ * their compare-and-swap retry loops) already drive, they run over a log
+ * without knowing it: a lost race on the log is translated back to the
+ * `PreconditionFailedError` those loops rebase on.
+ *
+ * The controller view is resolved per operation rather than held, so a
+ * caller that just edited its controller document hands every subsequent
+ * write the view it now verifies. A replace builds its entry on the head the most
+ * recent read on this instance verified, pinned to that read's `etag`, so a
+ * stale head loses the compare-and-swap instead of forking; the library's
+ * pre-write pass verifies the candidate as a reader would before it lands,
+ * so a refused entry never poisons the served log for other readers.
+ *
+ * @param options {object}
+ * @param options.log {ResourceLogStore}   the log's transport seam
+ * @param options.resolveController {function}
+ *   `() => Promise<ResourceLogController>` -- the caller's currently verified
+ *   controller view, resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head pin
+ *   for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
+ * @param [options.signer] {ResourceLogSigner}   this client's enrolled
+ *   signing key, for the appends this store writes; absent, the store is
+ *   read-only
+ * @returns {LogGovernedDescriptorStore}
+ */
+export function logGovernedDescriptorStore({ log, resolveController, pinStore, logId, signer }) {
+    // The verified log observed by the most recent read or confirmed append on
+    // this store instance, and the controller view it was verified under: the
+    // library's pre-write pass reads the head's controller version as an index
+    // into THAT view's version list, so a replace may only run it against a
+    // view this one is a prefix of.
+    let lastVerified = null;
+    let lastVerifiedView = null;
+    function requireSigner(operation) {
+        if (signer === undefined) {
+            throw new ValidationError(`Cannot ${operation} the governed descriptor: this store was built ` +
+                'without a signer, so it is read-only.');
+        }
+        return signer;
+    }
+    async function settle({ entry, controller }) {
+        const readBack = await confirmAppend({ store: log, entry });
+        const confirmed = await verifyResourceLog({
+            entries: readBack.entries,
+            controller,
+            expectedMethod: RESOURCE_LOG_METHOD,
+            pin: await pinStore.read({ logId })
+        });
+        await pinStore.write({ logId, pin: confirmed.pin });
+        lastVerified = confirmed;
+        lastVerifiedView = controller;
+    }
+    const store = {
+        async read() {
+            const current = await readGovernedEpochConfiguration({
+                store: log,
+                resolveController,
+                pinStore,
+                logId
+            });
+            if (current === null) {
+                lastVerified = null;
+                lastVerifiedView = null;
+                return null;
+            }
+            lastVerified = current.verified;
+            lastVerifiedView = current.controller;
+            return {
+                descriptor: current.descriptor,
+                verified: current.verified,
+                etag: current.etag
+            };
+        },
+        async replace(descriptor, { ifMatch }) {
+            const logSigner = requireSigner('replace');
+            if (ifMatch === undefined) {
+                throw new ValidationError('Cannot replace the governed descriptor: the backend returned no ' +
+                    'validator, and the profile forbids an unconditional write.');
+            }
+            /**
+             * An append builds on the head this instance last verified. A replace
+             * that no read on this instance precedes (a caller seeding the
+             * compare-and-swap from a read another instance made) acquires that
+             * head now. The caller's validator still guards the append, so a seed
+             * behind the served log loses the compare-and-swap as it would anywhere.
+             */
+            if (lastVerified === null) {
+                await store.read();
+            }
+            if (lastVerified === null) {
+                throw new ValidationError('Cannot replace the governed descriptor: the log is absent.');
+            }
+            if (lastVerified.terminal) {
+                throw new ResourceLogClosedError({ nextLog: lastVerified.terminal });
+            }
+            const controller = await resolveController();
+            /**
+             * The pre-write pass's precondition, enforced rather than assumed: the
+             * view that verified `lastVerified` must be a prefix of this one (the
+             * controller log is append-only, so carrying its head version is
+             * enough). A resolver that regressed is reported as the port's conflict
+             * class, so the edv machinery re-reads under the current view and
+             * rebases instead of the pass refusing on a bound that indexes another
+             * list.
+             */
+            const verifiedHead = lastVerifiedView?.versionIds[lastVerifiedView.versionIds.length - 1];
+            if (verifiedHead !== undefined &&
+                !controller.versionIds.includes(verifiedHead)) {
+                throw new PreconditionFailedError('Cannot replace the governed descriptor: the controller view ' +
+                    `resolved for this write does not carry version "${verifiedHead}", ` +
+                    'which the preceding read verified against; re-read and retry.', { status: 412 });
+            }
+            const entry = await buildResourceLogEntry({
+                head: lastVerified.head,
+                state: toEpochConfigurationState(descriptor),
+                controller,
+                signer: logSigner
+            });
+            await verifyResourceLogAppend({ entry, controller, head: lastVerified });
+            try {
+                await log.append(entry, { ifMatch });
+            }
+            catch (err) {
+                throw asDescriptorStoreConflict(err);
+            }
+            await settle({ entry, controller });
+        },
+        async seal() {
+            const logSigner = requireSigner('seal');
+            const controller = await resolveController();
+            /**
+             * Reuse the log view the most recent read or confirmed append on this
+             * store instance verified: a rotation that just appended carries a
+             * version past the removal, so the sweep resolves noop with no
+             * re-fetch, and a stale view is safe (sealResourceLog's append path
+             * re-reads before writing).
+             */
+            const { sealed, verified } = await sealResourceLog({
+                store: log,
+                controller,
+                expectedMethod: RESOURCE_LOG_METHOD,
+                pinStore,
+                logId,
+                signer: logSigner,
+                ...(lastVerified === null ? {} : { verified: lastVerified })
+            });
+            // The sweep hands back the caller's own view untouched when it had
+            // nothing to write; only a log it read or appended was verified under
+            // this call's controller view.
+            if (verified !== null && verified !== lastVerified) {
+                lastVerified = verified;
+                lastVerifiedView = controller;
+            }
+            return sealed ? 'sealed' : 'noop';
+        }
+    };
+    if (signer !== undefined) {
+        const logSigner = signer;
+        store.create = async (descriptor) => {
+            /**
+             * The library's guarded create: under a held pin it adopts the pinned
+             * slot's served log (refusing an absent one as a rollback) and builds
+             * nothing; otherwise it verifies the built genesis pre-write, creates it
+             * guarded, and confirms by read-back and pin. Either way of losing the
+             * race (a refused genesis against a log that already exists, or a lost
+             * guarded create) adopts the winner's log, and is reported as the
+             * port's conflict class so the edv machinery re-reads and adopts the
+             * winner's descriptor.
+             */
+            const controller = await resolveController();
+            const { verified, created } = await createResourceLog({
+                store: log,
+                controller,
+                method: RESOURCE_LOG_METHOD,
+                pinStore,
+                logId,
+                signer: logSigner,
+                state: toEpochConfigurationState(descriptor)
+            });
+            lastVerified = verified;
+            lastVerifiedView = controller;
+            if (!created) {
+                throw new PreconditionFailedError('The resource log create lost its guarded-create race: a log is ' +
+                    'already served; re-read and adopt it.', { status: 412 });
+            }
+        };
+    }
+    return store;
+}
+/**
+ * Builds the `EncryptionDescriptorStore` over a Collection that may be
+ * log-governed. `read()` fetches the Collection Description and dispatches on
+ * its `encryption` member: absent, the store resolves `null` (a fresh
+ * Collection that `create` makes log-governed with a genesis entry); present
+ * without `history`, it is the plain point-state descriptor and the store
+ * behaves exactly like `collectionDescriptorStore`; present with `history`,
+ * the store refuses a `history.method` other than the profile's format
+ * identifier before any fetch, refuses a `history.resource` that is not this
+ * Collection's own log URL, opens the log through `resourceLogStore`, reads
+ * it through the generic {@link logGovernedDescriptorStore}, and holds the
+ * projection to the verified head's state after stripping `history`. The
+ * Description and the log are two reads, so a projection that equals an
+ * EARLIER entry's state is a concurrent append landing between them and is
+ * reported as `PreconditionFailedError` (412), which the recipient loops
+ * rebase on; a projection matching no entry at all is refused as
+ * `ResourceLogIntegrityError`. The descriptor handed out is the verified head
+ * state with the served `history` pointer kept on it.
+ *
+ * Writes on a governed Collection are the generic store's signed appends and
+ * need `signer`; without one the store is read-only for governed collections
+ * (`replace` and `seal` refuse, `create` is absent). A lost race surfaces as
+ * `PreconditionFailedError` (412), the port's documented class. `seal()` is
+ * the generic store's sealing sweep over the Collection's log.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}
+ * @param options.resolveController {function}
+ *   `() => Promise<ResourceLogController>` -- the caller's currently verified
+ *   controller view, resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head pin
+ *   for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
+ * @param [options.signer] {ResourceLogSigner}   this client's enrolled
+ *   signing key, for the appends this store writes
+ * @returns {LogGovernedDescriptorStore}
+ */
+export function logGovernedCollectionDescriptorStore({ collection, resolveController, pinStore, logId, signer }) {
+    const governed = logGovernedDescriptorStore({
+        log: resourceLogStore({ collection }),
+        resolveController,
+        pinStore,
+        logId,
+        signer
+    });
+    /**
+     * The description observed by the most recent read: its sibling fields are
+     * forwarded by a point-state replace (the server's replace semantics would
+     * otherwise drop them), and its `encryption` member decides which write path
+     * a replace takes. Safe to carry even if stale: every write is pinned to the
+     * same read's validator, so a concurrent change fails the CAS instead. A
+     * create clears it, since the Collection it described is now log-governed.
+     */
+    let described;
+    async function readGoverned(projection) {
+        const { history, ...pointState } = projection;
+        if (history.method !== RESOURCE_LOG_METHOD) {
+            throw new ResourceLogIntegrityError(`The descriptor's history names the format "${history.method}", ` +
+                `not "${RESOURCE_LOG_METHOD}".`);
+        }
+        if (!sameUrl(history.resource, collection.historyLogUrl)) {
+            throw new ResourceLogIntegrityError(`The descriptor's history names the log "${history.resource}", ` +
+                `not this Collection's own log "${collection.historyLogUrl}".`);
+        }
+        const current = await governed.read();
+        if (current === null) {
+            throw new ResourceLogIntegrityError('The descriptor names a governing log, but the Collection serves none.');
+        }
+        // The generic store's descriptor IS the verified head's state.
+        const served = canonicalize(pointState);
+        if (served !== canonicalize(current.descriptor)) {
+            /**
+             * The Description was read before the log. A projection that equals an
+             * earlier entry's state is the head the server derived it from before a
+             * concurrent append moved the log on: a lost race, not a forgery, so
+             * the port's conflict class lets the caller re-read and rebase.
+             */
+            const entries = current.verified?.entries ?? [];
+            const stale = entries
+                .slice(0, -1)
+                .some(entry => canonicalize(entry.state) === served);
+            if (stale) {
+                throw new PreconditionFailedError('The served descriptor is behind the verified head of its ' +
+                    'governing log (a concurrent append landed); re-read and retry.', { status: 412 });
+            }
+            throw new ResourceLogIntegrityError('The served descriptor does not match the verified head of its ' +
+                'governing log.');
+        }
+        return {
+            descriptor: { ...current.descriptor, history },
+            etag: current.etag
+        };
+    }
+    const store = {
+        async read() {
+            const current = await collection.describeWithEtag();
+            if (current === null) {
+                throw unreadableDescriptionError({
+                    operation: 'manage recipients',
+                    advice: 'Use a capability that can read the Collection Description.'
+                });
+            }
+            described = current.description;
+            const descriptor = current.description.encryption;
+            if (!descriptor) {
+                return null;
+            }
+            if (descriptor.scheme !== 'edv') {
+                throw new ValidationError('Cannot manage recipients: this collection is not declared ' +
+                    "encrypted with the 'edv' scheme.");
+            }
+            if (descriptor.history === undefined) {
+                return { descriptor, etag: current.etag };
+            }
+            return readGoverned(descriptor);
+        },
+        async replace(descriptor, { ifMatch }) {
+            if (described === undefined) {
+                await store.read();
+            }
+            if (described?.encryption?.history !== undefined) {
+                await governed.replace(descriptor, { ifMatch });
+                return;
+            }
+            await collection.replaceDescription({
+                name: described?.name,
+                backend: described?.backend,
+                generator: described?.generator,
+                generatorOrigin: described?.generatorOrigin,
+                encryption: descriptor
+            }, { ifMatch });
+        },
+        seal: () => governed.seal()
+    };
+    if (governed.create !== undefined) {
+        const create = governed.create;
+        store.create = async (descriptor) => {
+            await create(descriptor);
+            described = undefined;
+        };
+    }
+    return store;
+}
+/**
+ * Whether two absolute URLs name the same resource, compared normalized (so
+ * a differently cased host or a default port does not read as a mismatch).
+ *
+ * @param left {string}
+ * @param right {string}
+ * @returns {boolean}
+ */
+function sameUrl(left, right) {
+    try {
+        return new URL(left).href === new URL(right).href;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=logGovernedDescriptorStore.js.map

package/dist/edv/logGovernedDescriptorStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logGovernedDescriptorStore.js","sourceRoot":"","sources":["../../src/edv/logGovernedDescriptorStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EAMxB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAIrD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;IACjD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAMC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,UAAU;QACV,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AA4BD;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,uBAAuB,CAAE,GAAa,CAAC,OAAO,EAAE;YACzD,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EAOP;IACC,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,gCAAgC;IAChC,IAAI,YAAY,GAA+B,IAAI,CAAA;IACnD,IAAI,gBAAgB,GAAiC,IAAI,CAAA;IAEzD,SAAS,aAAa,CAAC,SAAiB;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACvB,UAAU,SAAS,iDAAiD;gBAClE,uCAAuC,CAC1C,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EACpB,KAAK,EACL,UAAU,EAIX;QACC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc,EAAE,mBAAmB;YACnC,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;SACpC,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QACnD,YAAY,GAAG,SAAS,CAAA;QACxB,gBAAgB,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,MAAM,KAAK,GAA+B;QACxC,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,GAAG;gBACV,iBAAiB;gBACjB,QAAQ;gBACR,KAAK;aACN,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,YAAY,GAAG,IAAI,CAAA;gBACnB,gBAAgB,GAAG,IAAI,CAAA;gBACvB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAA;YAC/B,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAA;YACrC,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,eAAe,CACvB,kEAAkE;oBAChE,4DAA4D,CAC/D,CAAA;YACH,CAAC;YACD;;;;;;eAMG;YACH,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YACpB,CAAC;YACD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,eAAe,CACvB,4DAA4D,CAC7D,CAAA;YACH,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C;;;;;;;;eAQG;YACH,MAAM,YAAY,GAChB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACtE,IACE,YAAY,KAAK,SAAS;gBAC1B,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC7C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D;oBAC5D,mDAAmD,YAAY,KAAK;oBACpE,+DAA+D,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBACxC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,KAAK,EAAE,yBAAyB,CAAC,UAAU,CAAC;gBAC5C,UAAU;gBACV,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YACF,MAAM,uBAAuB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;YACxE,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C;;;;;;eAMG;YACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;gBACjD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,cAAc,EAAE,mBAAmB;gBACnC,QAAQ;gBACR,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;aAC7D,CAAC,CAAA;YACF,mEAAmE;YACnE,sEAAsE;YACtE,+BAA+B;YAC/B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACnD,YAAY,GAAG,QAAQ,CAAA;gBACvB,gBAAgB,GAAG,UAAU,CAAA;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QACnC,CAAC;KACF,CAAA;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAA;QACxB,KAAK,CAAC,MAAM,GAAG,KAAK,EAAC,UAAU,EAAC,EAAE;YAChC;;;;;;;;;eASG;YACH,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBACpD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ;gBACR,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,yBAAyB,CAAC,UAAU,CAAC;aAC7C,CAAC,CAAA;YACF,YAAY,GAAG,QAAQ,CAAA;YACvB,gBAAgB,GAAG,UAAU,CAAA;YAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;oBAC/D,uCAAuC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,oCAAoC,CAAC,EACnD,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EAOP;IACC,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC1C,GAAG,EAAE,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC;QACrC,iBAAiB;QACjB,QAAQ;QACR,KAAK;QACL,MAAM;KACP,CAAC,CAAA;IACF;;;;;;;OAOG;IACH,IAAI,SAA4C,CAAA;IAEhD,KAAK,UAAU,YAAY,CACzB,UAEC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,CAAA;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3C,MAAM,IAAI,yBAAyB,CACjC,8CAA8C,OAAO,CAAC,MAAM,KAAK;gBAC/D,QAAQ,mBAAmB,IAAI,CAClC,CAAA;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,yBAAyB,CACjC,2CAA2C,OAAO,CAAC,QAAQ,KAAK;gBAC9D,kCAAkC,UAAU,CAAC,aAAa,IAAI,CACjE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,yBAAyB,CACjC,uEAAuE,CACxE,CAAA;QACH,CAAC;QACD,+DAA+D;QAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QACvC,IAAI,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD;;;;;eAKG;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAA;YAC/C,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;iBACZ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAA;YACtD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,uBAAuB,CAC/B,2DAA2D;oBACzD,gEAAgE,EAClE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,gEAAgE;gBAC9D,gBAAgB,CACnB,CAAA;QACH,CAAC;QACD,OAAO;YACL,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE;YAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAA+B;QACxC,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE,CAAA;YACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,0BAA0B,CAAC;oBAC/B,SAAS,EAAE,mBAAmB;oBAC9B,MAAM,EAAE,4DAA4D;iBACrE,CAAC,CAAA;YACJ,CAAC;YACD,SAAS,GAAG,OAAO,CAAC,WAAW,CAAA;YAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAA;YACjD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAChC,MAAM,IAAI,eAAe,CACvB,4DAA4D;oBAC1D,kCAAkC,CACrC,CAAA;YACH,CAAC;YACD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;YAC3C,CAAC;YACD,OAAO,YAAY,CACjB,UAEC,CACF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YACpB,CAAC;YACD,IAAI,SAAS,EAAE,UAAU,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;gBAC/C,OAAM;YACR,CAAC;YACD,MAAM,UAAU,CAAC,kBAAkB,CACjC;gBACE,IAAI,EAAE,SAAS,EAAE,IAAI;gBACrB,OAAO,EAAE,SAAS,EAAE,OAAO;gBAC3B,SAAS,EAAE,SAAS,EAAE,SAAS;gBAC/B,eAAe,EAAE,SAAS,EAAE,eAAe;gBAC3C,UAAU,EAAE,UAAU;aACvB,EACD,EAAE,OAAO,EAAE,CACZ,CAAA;QACH,CAAC;QAED,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;KAC5B,CAAA;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;QAC9B,KAAK,CAAC,MAAM,GAAG,KAAK,EAAC,UAAU,EAAC,EAAE;YAChC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;YACxB,SAAS,GAAG,SAAS,CAAA;QACvB,CAAC,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/edv/recipients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAQxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EACV,oBAAoB,EAIpB,cAAc,EACf,MAAM,aAAa,CAAA;AASpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAG1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAuW1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,UAAU,EACV,YAAoB,EACrB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CA8CpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EACtB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;CAChD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuChC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EACN,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;CAC7C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAmChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoBhC;AA+KD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAA;IACpD,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;IAC5C,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8BhC"}
+{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAKxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EACV,oBAAoB,EAIpB,cAAc,EACf,MAAM,aAAa,CAAA;AASpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAG1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAiW1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,UAAU,EACV,YAAoB,EACrB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CA8CpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EACtB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;CAChD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuChC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EACN,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;CAC7C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAmChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoBhC;AA+KD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAA;IACpD,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;IAC5C,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8BhC"}

package/dist/edv/recipients.js

@@ -1,14 +1,10 @@
 import { EDV_SCHEME_VERSION } from './constants.js';
-import { EncryptionError, PreconditionFailedError, ValidationError } from '../errors.js';
+import { EncryptionError, ValidationError } from '../errors.js';
+import { compareAndSwap } from '../internal/cas.js';
 import { collectionDescriptorStore } from './descriptorStore.js';
 import { didKeyResolver, mintEpoch, unwrapEpochSecret, wrapEpochSecret, wrapEpochSecretTo } from './epochCrypto.js';
 import { pickEpoch } from './epochRoster.js';
 import { mintHmacKey } from './hmacKey.js';
-/**
- * How many times a recipient CAS write retries a stale (`412`) description
- * before surfacing {@link PreconditionFailedError}.
- */
-const MAX_CAS_ATTEMPTS = 3;
 /**
  * Escrows one or more readers into a single wrap roster (one epoch's
  * `recipients`, or the blinded-index key's): the caller unwraps its OWN entry
@@ -857,38 +853,13 @@ function descriptorStoreFor({ collection, store }) {
     throw new ValidationError('A recipient operation needs its descriptor host: pass `collection` or ' +
         '`store`.');
 }
-/**
- * Whether `err` is the compare-and-swap conflict a descriptor store raises
- * (`PreconditionFailedError`, 412). Matched by `name` as well as `instanceof`:
- * a store implemented by a consumer (wallet-core's log-governed store) mints
- * the conflict from its own `@interop/was-client` import, and in a tree that
- * resolves was-client twice that class is a different object from ours, so an
- * `instanceof`-only check would turn every lost race into a hard failure
- * instead of a rebase.
- *
- * @param err {unknown}
- * @returns {boolean}
- */
-function isPreconditionFailed(err) {
-    return (err instanceof PreconditionFailedError ||
-        (err instanceof Error && err.name === 'PreconditionFailedError'));
-}
 /**
  * Reads the store's descriptor, applies `mutate`, and writes the result back
- * with a compare-and-swap (`If-Match`). Retries on a stale (`412`) validator,
- * re-reading the fresh descriptor each time, up to {@link MAX_CAS_ATTEMPTS};
- * surfaces {@link PreconditionFailedError} if it keeps losing the race. A
- * `mutate` that resolves `null` signals "no change needed" (the descriptor
- * already reflects the desired state, e.g. an idempotent retry): nothing is
- * written and the current descriptor is returned as-is.
- *
- * When the store reports no descriptor yet (`read()` resolves `null`, e.g. the
- * resource adapter before the first `initRecipients`), the optional `seed` is
- * mutated instead and the result written with the store's create-if-absent
- * guard (`If-None-Match: *`). Only `initRecipients` passes a seed; without
- * one an absent descriptor is refused. Losing the create race (a concurrent
- * writer created the first descriptor) re-enters the loop and re-reads, like a
- * stale CAS.
+ * with a compare-and-swap: the shared {@link compareAndSwap} loop over an
+ * `EncryptionDescriptorStore`, with the recipient-specific handling of a store
+ * that holds no descriptor yet. Only `initRecipients` passes a `seed` (mutated
+ * in place of the absent descriptor and written create-if-absent); without one
+ * an absent descriptor is refused.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}
@@ -899,56 +870,28 @@ function isPreconditionFailed(err) {
  * @returns {Promise<CollectionEncryption>}   the written (or current) descriptor
  */
 async function casUpdateDescriptor({ store, mutate, seed }) {
-    let lastError;
-    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
-        const current = await store.read();
-        if (current === null) {
+    return compareAndSwap({
+        store: {
+            async read() {
+                const current = await store.read();
+                return current === null
+                    ? null
+                    : { value: current.descriptor, etag: current.etag };
+            },
+            replace: (descriptor, options) => store.replace(descriptor, options),
+            ...(store.create !== undefined && {
+                create: (descriptor) => store.create(descriptor)
+            })
+        },
+        mutate,
+        operation: 'Recipient change',
+        onAbsent: () => {
             if (seed === undefined) {
                 throw new ValidationError('Cannot manage recipients: this descriptor store holds no encryption ' +
                     'descriptor yet. Call initRecipients first.');
             }
-            if (store.create === undefined) {
-                throw new ValidationError('Cannot initialize recipients: this descriptor store holds no descriptor ' +
-                    'and does not support creating one.');
-            }
-            const created = await mutate(seed);
-            if (created === null) {
-                return seed;
-            }
-            try {
-                await store.create(created);
-                return created;
-            }
-            catch (err) {
-                if (isPreconditionFailed(err)) {
-                    // A concurrent writer created the first descriptor: re-read and
-                    // re-apply.
-                    lastError = err;
-                    continue;
-                }
-                throw err;
-            }
-        }
-        const next = await mutate(current.descriptor);
-        if (next === null) {
-            // The descriptor already reflects the desired state: nothing to write.
-            return current.descriptor;
-        }
-        try {
-            await store.replace(next, { ifMatch: current.etag });
-            return next;
-        }
-        catch (err) {
-            if (isPreconditionFailed(err)) {
-                // A concurrent recipient change landed first: re-read and re-apply.
-                lastError = err;
-                continue;
-            }
-            throw err;
+            return seed;
         }
-    }
-    throw new PreconditionFailedError(`Recipient change lost the compare-and-swap race after ${MAX_CAS_ATTEMPTS} ` +
-        'attempts (another writer kept updating the stored descriptor). ' +
-        'Retry the operation.', { cause: lastError });
+    });
 }
 //# sourceMappingURL=recipients.js.map