@interop/was-client 0.53.0 → 0.55.0

package/dist/edv/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/edv/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAEH;;;;;;GAMG;AACH,qBAAa,uBAAuB;;gBAKtB,EACV,OAAO,EACR,EAAE;QACD,OAAO,EAAE,CAAC,OAAO,EAAE;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAC9D;IAID;;OAEG;IACH,aAAa,CAAC,EAAE,YAAY,EAAE,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;IAIlE;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,CAAC,EAAE,EACvB,YAAY,EACZ,IAAI,EACL,EAAE;QACD,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,MAAM,OAAO,CAAC;YAAE,KAAK,EAAE,CAAC,CAAC;YAAC,YAAY,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KACzD,GAAG,OAAO,CAAC,CAAC,CAAC;IAUd;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;CAOjD"}

package/dist/edv/refresh.js

@@ -0,0 +1,69 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The unknown-epoch refresh policy: an epoch rotation emits no change-feed
+ * entry, so a cipher built from a cached descriptor can meet envelopes stamped
+ * with an epoch it has never seen. The remedy is one re-read of the
+ * Collection Description plus a cipher rebuild and a single retry -- and the
+ * policy guards that remedy to ONCE per collection per session, so a
+ * genuinely foreign envelope (one no descriptor will ever route) cannot drive
+ * a refetch loop, let alone a refetch per resource.
+ */
+/**
+ * Tracks which collections have already spent their one refresh this session,
+ * and runs reads under the refresh-and-retry-once rule. One instance per
+ * session (it IS the session scope of the guard); the injected `refresh` does
+ * the host's whole swap -- re-acquire the descriptor(s), rebuild the
+ * cipher(s), and install them wherever the host keeps them.
+ */
+export class DescriptorRefreshPolicy {
+    #refresh;
+    // Collection ids whose one refresh this session is already spent.
+    #refreshed = new Set();
+    constructor({ refresh }) {
+        this.#refresh = refresh;
+    }
+    /**
+     * Whether a collection still has its one refresh this session.
+     */
+    shouldRefresh({ collectionId }) {
+        return !this.#refreshed.has(collectionId);
+    }
+    /**
+     * Runs a read that reports whether it skipped unknown-epoch rows; on the
+     * first such report for a collection this session, spends the collection's
+     * refresh (descriptor re-read + cipher swap, via the injected `refresh`) and
+     * re-reads once. A later unknown-epoch report for the same collection
+     * returns the read's value as-is.
+     *
+     * @param options {object}
+     * @param options.collectionId {string}
+     * @param options.read {function}   the read, reporting `unknownEpoch`
+     * @returns {Promise<T>}   the (possibly re-read) value
+     */
+    async readWithRefresh({ collectionId, read }) {
+        const first = await read();
+        if (first.unknownEpoch && this.shouldRefresh({ collectionId })) {
+            this.#refreshed.add(collectionId);
+            await this.#refresh({ collectionId });
+            return (await read()).value;
+        }
+        return first.value;
+    }
+    /**
+     * Re-arms the guard -- for one collection, or (with no argument) for all.
+     * Call when a fresh descriptor is installed by some other path (a share,
+     * unshare, or recipient rotation this session performed itself), since the
+     * next unknown-epoch read is then evidence of a NEW rotation elsewhere.
+     */
+    reset(options) {
+        if (options?.collectionId === undefined) {
+            this.#refreshed.clear();
+        }
+        else {
+            this.#refreshed.delete(options.collectionId);
+        }
+    }
+}
+//# sourceMappingURL=refresh.js.map

package/dist/edv/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/edv/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IACzB,QAAQ,CAAsD;IACvE,kEAAkE;IACzD,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IAEvC,YAAY,EACV,OAAO,EAGR;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,EAAE,YAAY,EAA4B;QACtD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAI,EACvB,YAAY,EACZ,IAAI,EAIL;QACC,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAA;QAC1B,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;YACrC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAA;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAmC;QACvC,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;CACF"}

package/dist/edv/refreshingDocCipher.d.ts

@@ -0,0 +1,70 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * A self-refreshing EDV document cipher: `createEdvDocCipher` bound to
+ * descriptor acquisition and the once-per-session refresh rule, for a host
+ * whose decrypt seam is the cipher itself (a sync engine's `decryptDoc`, a
+ * conflict resolver) rather than a row-scanning store.
+ *
+ * Built, the cipher acquires the collection's descriptor (fetch, cache the
+ * success, cached fallback whenever the fetch yields none -- see
+ * `acquire.ts`) and constructs the underlying EDV cipher from it; with no
+ * descriptor, or a descriptor with no epochs, the build refuses fail-closed
+ * (every encrypted collection's descriptor carries an epoch roster from
+ * provisioning, so the absence can only mean the install has not landed or
+ * the host is lying). When a decrypt throws
+ * `UnknownEpochError`, the cipher re-acquires the descriptor, rebuilds itself,
+ * and retries that decrypt exactly once -- and only once per cipher instance,
+ * which the host scopes to one `(profile, collection)` session by dropping
+ * its cipher cache when the session ends. A second failure (or any unknown
+ * epoch after the one refresh is spent) propagates. A refresh that itself
+ * fails does not count as spent -- the original `UnknownEpochError` is
+ * rethrown and a later decrypt may try again.
+ *
+ * Only `UnknownEpochError` drives that refresh, and by design. The client
+ * splits the two ways a decrypt can find no key: an epoch the descriptor does
+ * not list at all raises `UnknownEpochError`, because a fresher descriptor may
+ * well list it; an epoch the descriptor does list but this reader holds no key
+ * for raises `KeyUnwrapError` (never a recipient, or removed and the epoch
+ * rotated). The second is rethrown immediately, with the refresh left
+ * untouched, since re-reading the same descriptor cannot produce a key the
+ * reader was not given.
+ */
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+import { type DocCipher } from './docCipher.js';
+import { type EncryptionDescriptorCache, type EncryptionDescriptorSource } from './acquire.js';
+/**
+ * Builds a {@link DocCipher} whose descriptor is acquired through the
+ * source/cache seams and refreshed (once per instance) on an unknown-epoch
+ * decrypt.
+ *
+ * With no `source` the descriptor is served from the cache alone and the
+ * refresh path is inert (an unknown-epoch decrypt propagates immediately) --
+ * the shape for a purely local code path that must never touch the network.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the vault key pair this
+ *   collection's envelopes are sealed to
+ * @param options.keyResolver {IKeyResolver}
+ * @param options.collectionId {string}
+ * @param [options.idDerivation] {'content' | 'random'}   defaults to
+ *   `'content'`
+ * @param [options.source] {EncryptionDescriptorSource}
+ * @param options.cache {EncryptionDescriptorCache}
+ * @param [options.onFetchError] {function}   observes swallowed
+ *   descriptor-fetch failures
+ * @returns {Promise<DocCipher>}
+ */
+export declare function createRefreshingEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, idDerivation, source, cache, onFetchError }: {
+    keyAgreementKey: IKeyAgreementKey;
+    keyResolver: IKeyResolver;
+    collectionId: string;
+    idDerivation?: 'content' | 'random';
+    source?: EncryptionDescriptorSource;
+    cache: EncryptionDescriptorCache;
+    onFetchError?: (err: unknown, info: {
+        collectionId: string;
+    }) => void;
+}): Promise<DocCipher>;
+//# sourceMappingURL=refreshingDocCipher.d.ts.map

package/dist/edv/refreshingDocCipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshingDocCipher.d.ts","sourceRoot":"","sources":["../../src/edv/refreshingDocCipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAErC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAChC,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EACb,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACnC,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,SAAS,CAAC,CAyFrB"}

package/dist/edv/refreshingDocCipher.js

@@ -0,0 +1,110 @@
+import { UnknownEpochError } from '../errors.js';
+import { createEdvDocCipher } from './docCipher.js';
+import { acquireDescriptor } from './acquire.js';
+/**
+ * Builds a {@link DocCipher} whose descriptor is acquired through the
+ * source/cache seams and refreshed (once per instance) on an unknown-epoch
+ * decrypt.
+ *
+ * With no `source` the descriptor is served from the cache alone and the
+ * refresh path is inert (an unknown-epoch decrypt propagates immediately) --
+ * the shape for a purely local code path that must never touch the network.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the vault key pair this
+ *   collection's envelopes are sealed to
+ * @param options.keyResolver {IKeyResolver}
+ * @param options.collectionId {string}
+ * @param [options.idDerivation] {'content' | 'random'}   defaults to
+ *   `'content'`
+ * @param [options.source] {EncryptionDescriptorSource}
+ * @param options.cache {EncryptionDescriptorCache}
+ * @param [options.onFetchError] {function}   observes swallowed
+ *   descriptor-fetch failures
+ * @returns {Promise<DocCipher>}
+ */
+export async function createRefreshingEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, idDerivation, source, cache, onFetchError }) {
+    const build = async () => {
+        const encryption = await acquireDescriptor({
+            source,
+            cache,
+            collectionId,
+            onFetchError
+        });
+        if (!encryption) {
+            throw new Error(`Collection "${collectionId}" has no encryption descriptor available ` +
+                '(fetched or cached). Every encrypted collection carries its key ' +
+                'epochs from provisioning; refusing to build a cipher without them.');
+        }
+        return createEdvDocCipher({
+            keyAgreementKey,
+            keyResolver,
+            collectionId,
+            idDerivation,
+            encryption
+        });
+    };
+    let inner = await build();
+    // The one descriptor refresh this cipher instance (= this collection this
+    // session) may spend, shared so concurrent unknown-epoch decrypts ride a
+    // single re-read instead of each spending one.
+    let refreshed = null;
+    return {
+        encrypt: options => inner.encrypt(options),
+        encryptUpdate: options => {
+            if (!inner.encryptUpdate) {
+                throw new Error(`Collection "${collectionId}" cipher has no in-place update.`);
+            }
+            return inner.encryptUpdate(options);
+        },
+        async decrypt({ envelope }) {
+            try {
+                return await inner.decrypt({ envelope });
+            }
+            catch (err) {
+                // `instanceof` is safe here and only here: `inner` is built in this
+                // package by `createEdvDocCipher`, which raises this package's own
+                // class, so no injected seam is crossed. A caller classifying what
+                // THIS cipher throws is crossing one, and uses `isUnknownEpochError` /
+                // `isKeyUnwrapError` instead.
+                if (!(err instanceof UnknownEpochError) || !source) {
+                    throw err;
+                }
+                if (!refreshed) {
+                    const attempt = build().then(cipher => {
+                        inner = cipher;
+                    });
+                    refreshed = attempt;
+                    // Only a COMPLETED refresh is spent. A rejected one (the description
+                    // could not be read and no cached copy answered either) un-arms the
+                    // guard so a later unknown-epoch decrypt may try again; a successful
+                    // refresh that still cannot route the envelope stays spent for the
+                    // session, which is what keeps a genuinely foreign envelope from
+                    // driving a refetch loop.
+                    attempt.catch(() => {
+                        if (refreshed === attempt) {
+                            refreshed = null;
+                        }
+                    });
+                }
+                try {
+                    await refreshed;
+                }
+                catch {
+                    // The refresh failed, so nothing was learned about this envelope's
+                    // epoch: surface the original UnknownEpochError rather than the
+                    // build failure, so callers classifying on it (the create-loss
+                    // re-mint) still see the row they exist to repair.
+                    throw err;
+                }
+                // One retry under the swapped cipher. If the refresh was already
+                // spent before this decrypt began, this re-attempt is a local
+                // no-network decrypt that fails the same way -- so a genuinely
+                // foreign envelope still surfaces UnknownEpochError, and never a
+                // second description read.
+                return inner.decrypt({ envelope });
+            }
+        }
+    };
+}
+//# sourceMappingURL=refreshingDocCipher.js.map

package/dist/edv/refreshingDocCipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshingDocCipher.js","sourceRoot":"","sources":["../../src/edv/refreshingDocCipher.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAkB,MAAM,gBAAgB,CAAA;AACnE,OAAO,EACL,iBAAiB,EAGlB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,eAAe,EACf,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,KAAK,EACL,YAAY,EASb;IACC,MAAM,KAAK,GAAG,KAAK,IAAwB,EAAE;QAC3C,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;YACzC,MAAM;YACN,KAAK;YACL,YAAY;YACZ,YAAY;SACb,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,2CAA2C;gBACpE,kEAAkE;gBAClE,oEAAoE,CACvE,CAAA;QACH,CAAC;QACD,OAAO,kBAAkB,CAAC;YACxB,eAAe;YACf,WAAW;YACX,YAAY;YACZ,YAAY;YACZ,UAAU;SACX,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,IAAI,KAAK,GAAG,MAAM,KAAK,EAAE,CAAA;IACzB,0EAA0E;IAC1E,yEAAyE;IACzE,+CAA+C;IAC/C,IAAI,SAAS,GAAyB,IAAI,CAAA;IAE1C,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAE1C,aAAa,EAAE,OAAO,CAAC,EAAE;YACvB,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,kCAAkC,CAC9D,CAAA;YACH,CAAC;YACD,OAAO,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE;YACxB,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,mEAAmE;gBACnE,mEAAmE;gBACnE,uEAAuE;gBACvE,8BAA8B;gBAC9B,IAAI,CAAC,CAAC,GAAG,YAAY,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACnD,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;wBACpC,KAAK,GAAG,MAAM,CAAA;oBAChB,CAAC,CAAC,CAAA;oBACF,SAAS,GAAG,OAAO,CAAA;oBACnB,qEAAqE;oBACrE,oEAAoE;oBACpE,qEAAqE;oBACrE,mEAAmE;oBACnE,iEAAiE;oBACjE,0BAA0B;oBAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;wBACjB,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;4BAC1B,SAAS,GAAG,IAAI,CAAA;wBAClB,CAAC;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAA;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;oBACnE,gEAAgE;oBAChE,+DAA+D;oBAC/D,mDAAmD;oBACnD,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,iEAAiE;gBACjE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iEAAiE;gBACjE,2BAA2B;gBAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/errors.d.ts

@@ -174,9 +174,10 @@ export declare class WasSyncConflictError extends PreconditionFailedError {
     constructor(message?: string, options?: WasErrorOptions);
 }
 /**
- * The replication-port signal for a delete whose target resource is absent
- * (HTTP 404). For a delete this is a settled outcome (already gone, or the write
- * never reached the server), not a conflict, so a `WasSyncPort`
+ * The replication-port signal for a delete or a metadata write whose target
+ * resource is absent (HTTP 404). For a delete this is a settled outcome
+ * (already gone, or the write never reached the server); for a metadata write
+ * it is a race with a remote delete. Neither is a conflict, so a `WasSyncPort`
  * (`@interop/was-client/sync`) raises this distinct type rather than
  * {@link WasSyncConflictError}. A subtype of {@link NotFoundError}.
  */

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;GAEG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;gBAEP,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAU3D;AAED;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,QAAQ;IAChC,IAAI,SAAkB;CAChC;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAClC,IAAI,SAAoB;CAClC;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;IACpC,IAAI,SAAsB;CACpC;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IACtC,IAAI,SAAwB;CACtC;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;IACpC,IAAI,SAAsB;CACpC;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,QAAQ;IAChC,IAAI,SAAkB;CAChC;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IAC1C,IAAI,SAA4B;CAC1C;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;IACvC,IAAI,SAAyB;CACvC;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IACrC,IAAI,SAAuB;CACrC;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAClC,IAAI,SAAoB;CAClC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,cAAe,SAAQ,eAAe;IACxC,IAAI,SAAmB;CACjC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAe,SAAQ,eAAe;IACxC,IAAI,SAAmB;CACjC;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IAChD,IAAI,SAA2B;CACzC;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,uBAAuB;gBAE7D,OAAO,SAA+C,EACtD,OAAO,GAAE,eAAoB;CAKhC;AAED;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;gBAEnD,OAAO,SAA4B,EACnC,OAAO,GAAE,eAAoB;CAKhC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB;gBACzC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAO1D;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IACjC,IAAI,SAAmB;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,EACV,YAAY,EACZ,IAAI,EACL,EAAE;QACD,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,MAAM,EAAE,CAAA;KACf;CAUF;AA8DD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CA2D/C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;GAEG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;gBAEP,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAU3D;AAED;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,QAAQ;IAChC,IAAI,SAAkB;CAChC;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAClC,IAAI,SAAoB;CAClC;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;IACpC,IAAI,SAAsB;CACpC;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;IACtC,IAAI,SAAwB;CACtC;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;IACpC,IAAI,SAAsB;CACpC;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,QAAQ;IAChC,IAAI,SAAkB;CAChC;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IAC1C,IAAI,SAA4B;CAC1C;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;IACvC,IAAI,SAAyB;CACvC;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IACrC,IAAI,SAAuB;CACrC;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAClC,IAAI,SAAoB;CAClC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,cAAe,SAAQ,eAAe;IACxC,IAAI,SAAmB;CACjC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAe,SAAQ,eAAe;IACxC,IAAI,SAAmB;CACjC;AAED;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,eAAe;IAChD,IAAI,SAA2B;CACzC;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,uBAAuB;gBAE7D,OAAO,SAA+C,EACtD,OAAO,GAAE,eAAoB;CAKhC;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;gBAEnD,OAAO,SAA4B,EACnC,OAAO,GAAE,eAAoB;CAKhC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gBAAiB,SAAQ,iBAAiB;gBACzC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAO1D;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IACjC,IAAI,SAAmB;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,EACV,YAAY,EACZ,IAAI,EACL,EAAE;QACD,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,MAAM,EAAE,CAAA;KACf;CAUF;AA8DD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAEjD;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CA2D/C"}

package/dist/errors.js

@@ -180,9 +180,10 @@ export class WasSyncConflictError extends PreconditionFailedError {
     }
 }
 /**
- * The replication-port signal for a delete whose target resource is absent
- * (HTTP 404). For a delete this is a settled outcome (already gone, or the write
- * never reached the server), not a conflict, so a `WasSyncPort`
+ * The replication-port signal for a delete or a metadata write whose target
+ * resource is absent (HTTP 404). For a delete this is a settled outcome
+ * (already gone, or the write never reached the server); for a metadata write
+ * it is a race with a remote delete. Neither is a conflict, so a `WasSyncPort`
  * (`@interop/was-client/sync`) raises this distinct type rather than
  * {@link WasSyncConflictError}. A subtype of {@link NotFoundError}.
  */

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAmBpD;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAS;IACb,KAAK,CAAS;IACd,OAAO,CAAW;IAClB,UAAU,CAAS;IAEnB,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;QACnE,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAChC,IAAI,GAAG,eAAe,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAClC,IAAI,GAAG,iBAAiB,CAAA;CAClC;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IACpC,IAAI,GAAG,mBAAmB,CAAA;CACpC;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IACtC,IAAI,GAAG,qBAAqB,CAAA;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IACpC,IAAI,GAAG,mBAAmB,CAAA;CACpC;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAChC,IAAI,GAAG,eAAe,CAAA;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IAC1C,IAAI,GAAG,yBAAyB,CAAA;CAC1C;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IACvC,IAAI,GAAG,sBAAsB,CAAA;CACvC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IACrC,IAAI,GAAG,oBAAoB,CAAA;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAClC,IAAI,GAAG,iBAAiB,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACxC,IAAI,GAAG,gBAAgB,CAAA;CACjC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACxC,IAAI,GAAG,gBAAgB,CAAA;CACjC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IAChD,IAAI,GAAG,wBAAwB,CAAA;CACzC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAqB,SAAQ,uBAAuB;IAC/D,YACE,OAAO,GAAG,4CAA4C,EACtD,UAA2B,EAAE;QAE7B,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,YACE,OAAO,GAAG,yBAAyB,EACnC,UAA2B,EAAE;QAE7B,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrD,YAAY,MAAc,EAAE,UAA2B,EAAE;QACvD,KAAK,CAAC,mCAAmC,MAAM,IAAI,EAAE;YACnD,GAAG,OAAO;YACV,MAAM;SACP,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACjC,IAAI,GAAG,gBAAgB,CAAA;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,EACV,YAAY,EACZ,IAAI,EAIL;QACC,KAAK,CACH,4CAA4C,YAAY,SAAS;YAC/D,uCAAuC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;YACpE,oEAAoE;YACpE,6DAA6D;YAC7D,wDAAwD,CAC3D,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAuBD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAkC;IACzD,CAAC,eAAe,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa;IACxD,CAAC,eAAe,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,eAAe;IAC3D,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe;IACrE,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe;IACrE,CAAC,eAAe,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC,EAAE,eAAe;IAC7E,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,eAAe;IACpE,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,eAAe;IAC/D,CAAC,eAAe,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,EAAE,iBAAiB;IACxE,CAAC,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa;IAC1D,CAAC,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa;IAC1D,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,aAAa;IAClE,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa;IACnE,CAAC,eAAe,CAAC,YAAY,CAAC,+BAA+B,CAAC,CAAC,EAC7D,aAAa;IACf,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,uBAAuB;IAC5E,CAAC,eAAe,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,EAAE,oBAAoB;IACvE,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,kBAAkB;IAClE,CAAC,eAAe,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,EAAE,mBAAmB;IAC1E,CAAC,eAAe,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,cAAc;IAC7D,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,cAAc;CAC/D,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,GAAG,GAAG,GAA0D,CAAA;IACtE,OAAO,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAA;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,CAAoB,CAAA;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAA;IAC3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAA;IACvB,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAA;IACzB,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,KAAK,CAAC,EAAE,CAAE,KAAoC,EAAE,MAAM,CAAC;aAC3D,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAA;IACvC,MAAM,OAAO,GAAG,KAAK,IAAI,SAAS,CAAC,OAAO,IAAI,oBAAoB,CAAA;IAClE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;IAExE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9C,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACN,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAChD,KAAK,GAAG;YACN,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5C,KAAK,GAAG;YACN,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5C,KAAK,GAAG;YACN,OAAO,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACtD,KAAK,GAAG;YACN,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAClD,KAAK,GAAG;YACN,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAChD,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AACvC,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAmBpD;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAS;IACb,KAAK,CAAS;IACd,OAAO,CAAW;IAClB,UAAU,CAAS;IAEnB,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;QACnE,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAChC,IAAI,GAAG,eAAe,CAAA;CAChC;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAClC,IAAI,GAAG,iBAAiB,CAAA;CAClC;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IACpC,IAAI,GAAG,mBAAmB,CAAA;CACpC;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IACtC,IAAI,GAAG,qBAAqB,CAAA;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IACpC,IAAI,GAAG,mBAAmB,CAAA;CACpC;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IAChC,IAAI,GAAG,eAAe,CAAA;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IAC1C,IAAI,GAAG,yBAAyB,CAAA;CAC1C;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IACvC,IAAI,GAAG,sBAAsB,CAAA;CACvC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IACrC,IAAI,GAAG,oBAAoB,CAAA;CACrC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAClC,IAAI,GAAG,iBAAiB,CAAA;CAClC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACxC,IAAI,GAAG,gBAAgB,CAAA;CACjC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACxC,IAAI,GAAG,gBAAgB,CAAA;CACjC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IAChD,IAAI,GAAG,wBAAwB,CAAA;CACzC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAqB,SAAQ,uBAAuB;IAC/D,YACE,OAAO,GAAG,4CAA4C,EACtD,UAA2B,EAAE;QAE7B,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,YACE,OAAO,GAAG,yBAAyB,EACnC,UAA2B,EAAE;QAE7B,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gBAAiB,SAAQ,iBAAiB;IACrD,YAAY,MAAc,EAAE,UAA2B,EAAE;QACvD,KAAK,CAAC,mCAAmC,MAAM,IAAI,EAAE;YACnD,GAAG,OAAO;YACV,MAAM;SACP,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACjC,IAAI,GAAG,gBAAgB,CAAA;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,EACV,YAAY,EACZ,IAAI,EAIL;QACC,KAAK,CACH,4CAA4C,YAAY,SAAS;YAC/D,uCAAuC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;YACpE,oEAAoE;YACpE,6DAA6D;YAC7D,wDAAwD,CAC3D,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAuBD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAkC;IACzD,CAAC,eAAe,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa;IACxD,CAAC,eAAe,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,eAAe;IAC3D,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe;IACrE,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe;IACrE,CAAC,eAAe,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC,EAAE,eAAe;IAC7E,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,eAAe;IACpE,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,eAAe;IAC/D,CAAC,eAAe,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,EAAE,iBAAiB;IACxE,CAAC,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa;IAC1D,CAAC,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa;IAC1D,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,aAAa;IAClE,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa;IACnE,CAAC,eAAe,CAAC,YAAY,CAAC,+BAA+B,CAAC,CAAC,EAC7D,aAAa;IACf,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,uBAAuB;IAC5E,CAAC,eAAe,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,EAAE,oBAAoB;IACvE,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,kBAAkB;IAClE,CAAC,eAAe,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,EAAE,mBAAmB;IAC1E,CAAC,eAAe,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,cAAc;IAC7D,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,cAAc;CAC/D,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,GAAG,GAAG,GAA0D,CAAA;IACtE,OAAO,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAA;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,CAAoB,CAAA;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAA;IAC3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAA;IACvB,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAA;IACzB,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,KAAK,CAAC,EAAE,CAAE,KAAoC,EAAE,MAAM,CAAC;aAC3D,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAA;IACvC,MAAM,OAAO,GAAG,KAAK,IAAI,SAAS,CAAC,OAAO,IAAI,oBAAoB,CAAA;IAClE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;IAExE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9C,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACN,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAChD,KAAK,GAAG;YACN,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5C,KAAK,GAAG;YACN,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5C,KAAK,GAAG;YACN,OAAO,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACtD,KAAK,GAAG;YACN,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAClD,KAAK,GAAG;YACN,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAChD,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AACvC,CAAC"}

package/dist/identity/agents.d.ts

@@ -0,0 +1,84 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity derivation: controller secret / seed to the agent set a did:key
+ * client operates with. Every consumer must derive byte-for-byte identically,
+ * so that supplying the same controller secret on any client joins the same
+ * WAS account/Space.
+ *
+ * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
+ * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
+ * every account's data identity derives through these exact strings, so they
+ * can never change without stranding existing accounts). The resulting Ed25519
+ * signing key backs a did:key DID, a `ZcapClient` for signing storage
+ * requests, and -- via did:key's encryption-key derivation (the Montgomery
+ * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
+ * DocCipher encrypts and decrypts with. Everything is deterministic: a
+ * returning user, on any client, decrypts the same envelopes.
+ */
+import { CapabilityAgent } from '@interop/webkms-client';
+import { ZcapClient } from '@interop/ezcap';
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * The load-bearing `CapabilityAgent` derivation names (see the module doc:
+ * the typo in the key name can never be fixed without stranding accounts).
+ */
+export declare const BOOTSTRAP_HANDLE = "bootstrap";
+export declare const BOOTSTRAP_KEY_NAME = "boostrap-key";
+/**
+ * The agents derived from a controller secret or seed: the signing
+ * CapabilityAgent / did:key, a ZcapClient for signing storage requests, and
+ * the X25519 key agreement key (KAK) + resolver used by the EDV DocCipher.
+ */
+export interface ProfileAgents {
+    controllerDid: string;
+    keyAgent: CapabilityAgent;
+    zcapClient: ZcapClient;
+    keyAgreementKey: IKeyAgreementKey;
+    keyResolver: IKeyResolver;
+}
+/**
+ * Derives the WAS agents from an already-derived 32-byte seed, skipping the
+ * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
+ * stands in for the original secret).
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte seed
+ * @returns {Promise<ProfileAgents>}
+ */
+export declare function agentsFromSeed({ seed }: {
+    seed: Uint8Array;
+}): Promise<ProfileAgents>;
+/**
+ * Derives the WAS agents from a controller secret. The secret is always a
+ * string: a passphrase, or the base64url text of 32 random bytes, not the
+ * decoded bytes. `CapabilityAgent.fromSecret`'s salted hash is
+ * type-sensitive, so a string and its UTF-8 bytes derive different keys.
+ * Passing a string keeps every secret typeable/scannable into a login form
+ * (the cross-wallet linking flow).
+ *
+ * @param options {object}
+ * @param options.secret {string}   the controller secret (see above)
+ * @returns {Promise<ProfileAgents>}
+ */
+export declare function agentsFromSecret({ secret }: {
+    secret: string;
+}): Promise<ProfileAgents>;
+/**
+ * Assembles the derived agents -- signer, `ZcapClient`, key agreement key (the
+ * Ed25519-to-X25519 Montgomery conversion), and single-key resolver -- from an
+ * already-derived `CapabilityAgent`. The shared tail of both derivations here,
+ * and exported because downstream packages derive their own `CapabilityAgent`
+ * (from an app seed, under their own handle / key name) and then need this same
+ * assembly: keeping it in one place means the Montgomery conversion that every
+ * encrypted collection is read with has exactly one implementation.
+ *
+ * @param options {object}
+ * @param options.keyAgent {CapabilityAgent}   the derived signing agent
+ * @returns {ProfileAgents}
+ */
+export declare function agentsFromKeyAgent({ keyAgent }: {
+    keyAgent: CapabilityAgent;
+}): ProfileAgents;
+//# sourceMappingURL=agents.d.ts.map

package/dist/identity/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAKrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,aAAa,CAAC,CAYzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,eAAe,CAAA;CAC1B,GAAG,aAAa,CAqBhB"}

package/dist/identity/agents.js

@@ -0,0 +1,104 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity derivation: controller secret / seed to the agent set a did:key
+ * client operates with. Every consumer must derive byte-for-byte identically,
+ * so that supplying the same controller secret on any client joins the same
+ * WAS account/Space.
+ *
+ * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
+ * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
+ * every account's data identity derives through these exact strings, so they
+ * can never change without stranding existing accounts). The resulting Ed25519
+ * signing key backs a did:key DID, a `ZcapClient` for signing storage
+ * requests, and -- via did:key's encryption-key derivation (the Montgomery
+ * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
+ * DocCipher encrypts and decrypts with. Everything is deterministic: a
+ * returning user, on any client, decrypts the same envelopes.
+ */
+import { CapabilityAgent } from '@interop/webkms-client';
+import { ZcapClient } from '@interop/ezcap';
+import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+import { ValidationError } from '../errors.js';
+import { zcapClientForSigner } from '../zcapClient.js';
+import { singleKeyResolver } from './keyResolver.js';
+/**
+ * The load-bearing `CapabilityAgent` derivation names (see the module doc:
+ * the typo in the key name can never be fixed without stranding accounts).
+ */
+export const BOOTSTRAP_HANDLE = 'bootstrap';
+export const BOOTSTRAP_KEY_NAME = 'boostrap-key';
+/**
+ * Derives the WAS agents from an already-derived 32-byte seed, skipping the
+ * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
+ * stands in for the original secret).
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte seed
+ * @returns {Promise<ProfileAgents>}
+ */
+export async function agentsFromSeed({ seed }) {
+    if (seed.length !== 32) {
+        throw new ValidationError(`Expected a 32-byte seed, got ${seed.length} bytes.`);
+    }
+    const keyAgent = await CapabilityAgent.fromSeed({
+        seed,
+        handle: BOOTSTRAP_HANDLE,
+        keyName: BOOTSTRAP_KEY_NAME
+    });
+    return agentsFromKeyAgent({ keyAgent });
+}
+/**
+ * Derives the WAS agents from a controller secret. The secret is always a
+ * string: a passphrase, or the base64url text of 32 random bytes, not the
+ * decoded bytes. `CapabilityAgent.fromSecret`'s salted hash is
+ * type-sensitive, so a string and its UTF-8 bytes derive different keys.
+ * Passing a string keeps every secret typeable/scannable into a login form
+ * (the cross-wallet linking flow).
+ *
+ * @param options {object}
+ * @param options.secret {string}   the controller secret (see above)
+ * @returns {Promise<ProfileAgents>}
+ */
+export async function agentsFromSecret({ secret }) {
+    const keyAgent = await CapabilityAgent.fromSecret({
+        secret,
+        handle: BOOTSTRAP_HANDLE,
+        keyName: BOOTSTRAP_KEY_NAME
+    });
+    return agentsFromKeyAgent({ keyAgent });
+}
+/**
+ * Assembles the derived agents -- signer, `ZcapClient`, key agreement key (the
+ * Ed25519-to-X25519 Montgomery conversion), and single-key resolver -- from an
+ * already-derived `CapabilityAgent`. The shared tail of both derivations here,
+ * and exported because downstream packages derive their own `CapabilityAgent`
+ * (from an app seed, under their own handle / key name) and then need this same
+ * assembly: keeping it in one place means the Montgomery conversion that every
+ * encrypted collection is read with has exactly one implementation.
+ *
+ * @param options {object}
+ * @param options.keyAgent {CapabilityAgent}   the derived signing agent
+ * @returns {ProfileAgents}
+ */
+export function agentsFromKeyAgent({ keyAgent }) {
+    const signer = keyAgent.getSigner();
+    // The root key also signs delegations (sharing grants, app capability
+    // grants).
+    const zcapClient = zcapClientForSigner({ signer });
+    const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
+        keyPair: keyAgent.getVerificationKeyPair()
+    });
+    const keyResolver = singleKeyResolver({ keyAgreementKey });
+    return {
+        controllerDid: keyAgent.id,
+        keyAgent,
+        zcapClient,
+        // `id` is always set on the KAK here (a controller was supplied at
+        // derivation), so it satisfies IKeyAgreementKey's required `id`.
+        keyAgreementKey: keyAgreementKey,
+        keyResolver
+    };
+}
+//# sourceMappingURL=agents.js.map

package/dist/identity/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAehD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EAGL;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,gCAAgC,IAAI,CAAC,MAAM,SAAS,CACrD,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EAGP;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC;QAChD,MAAM;QACN,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,QAAQ,EAGT;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,sEAAsE;IACtE,WAAW;IACX,MAAM,UAAU,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAElD,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAE1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,mEAAmE;QACnE,iEAAiE;QACjE,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}

package/dist/identity/index.d.ts

@@ -0,0 +1,15 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/was-client/identity` subpath: the did:key data-identity
+ * derivation (`agents.ts`, which documents the derivation itself) and the
+ * one-key resolver it pairs with (`keyResolver.ts`). Kept off the core entry
+ * because it pulls the webkms-client / x25519-key-agreement-key dependency
+ * graph. `zcapClientForSigner` is a core export; import it from the package
+ * root.
+ */
+export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed } from './agents.js';
+export type { ProfileAgents } from './agents.js';
+export { singleKeyResolver } from './keyResolver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/identity/index.js

@@ -0,0 +1,14 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/was-client/identity` subpath: the did:key data-identity
+ * derivation (`agents.ts`, which documents the derivation itself) and the
+ * one-key resolver it pairs with (`keyResolver.ts`). Kept off the core entry
+ * because it pulls the webkms-client / x25519-key-agreement-key dependency
+ * graph. `zcapClientForSigner` is a core export; import it from the package
+ * root.
+ */
+export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed } from './agents.js';
+export { singleKeyResolver } from './keyResolver.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/identity/keyResolver.d.ts

@@ -0,0 +1,30 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * A single-key `IKeyResolver` factory. Key agreement in a wallet-style
+ * consumer happens against one known KAK at a time (the vault KAK of the data
+ * identity, an unlock KAK of a keyring), so the resolver only ever needs to
+ * answer for that one key. Any other key id is an error.
+ */
+import type { IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
+ * agreement key -- and throws for any other id.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {object}   the one KAK this resolver answers
+ *   for; only its `id`, `type`, and `publicKeyMultibase` are read
+ * @param [options.keyAgreementKey.id] {string}
+ * @param [options.keyAgreementKey.type] {string}
+ * @param [options.keyAgreementKey.publicKeyMultibase] {string}
+ * @returns {IKeyResolver}
+ */
+export declare function singleKeyResolver({ keyAgreementKey }: {
+    keyAgreementKey: {
+        id?: string;
+        type?: string;
+        publicKeyMultibase?: string;
+    };
+}): IKeyResolver;
+//# sourceMappingURL=keyResolver.d.ts.map

package/dist/identity/keyResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyResolver.d.ts","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE;QACf,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACF,GAAG,YAAY,CAWf"}