@interop/was-client 0.59.1 → 0.61.0

package/dist/edv/epochKeys.js

@@ -1,7 +1,7 @@
-import { KeyUnwrapError } from '../errors.js';
+import { EncryptionError, EncryptOnlyCipherError, KeyUnwrapError } from '../errors.js';
 import { Memo } from '../internal/memo.js';
-import { epochKeyIdFor, reconstructEpochKeyPair, unwrapEpochSecret } from './epochCrypto.js';
-import { pickEpoch } from './epochRoster.js';
+import { didKeyResolver, epochKeyIdFor, reconstructEpochKeyPair, unwrapEpochSecret } from './epochCrypto.js';
+import { currentEpochOf } from './epochRoster.js';
 /**
  * Resolves the reader's epoch keys from a descriptor. Returns `null` when the
  * descriptor declares no epochs (the epoch codec refuses such a descriptor
@@ -10,13 +10,21 @@ import { pickEpoch } from './epochRoster.js';
  * recipient), so an encrypted collection is never silently read/written with
  * the wrong key.
  *
+ * The write epoch is always the descriptor's current epoch, whether or not
+ * this reader is a recipient of it: a reader rotated off the current epoch
+ * keeps reading the epochs it is still named in, and writes through a
+ * public-only stand-in for the current one rather than falling back to an
+ * epoch it was rotated off of. `namedInWriteEpoch` reports which of the two it
+ * is.
+ *
  * @param options {object}
  * @param options.encryption {CollectionEncryption}   the Collection's descriptor
  * @param options.keyAgreementKey {IKeyAgreementKey}   the reader's own KAK; its
  *   `id` must match a recipient `kid` in an epoch for that epoch to unwrap
+ * @param [options.label] {string}   names the collection in error messages
  * @returns {Promise<ResolvedEpochKeys | null>}
  */
-export async function resolveEpochKeys({ encryption, keyAgreementKey }) {
+export async function resolveEpochKeys({ encryption, keyAgreementKey, label = '(unnamed)' }) {
     const epochs = encryption.epochs;
     if (!epochs || epochs.length === 0) {
         return null;
@@ -32,10 +40,37 @@ export async function resolveEpochKeys({ encryption, keyAgreementKey }) {
             "reader's key-agreement key). Add this reader with addRecipient, or " +
             'supply the correct key-agreement key.');
     }
-    // The candidates are only the epochs this reader is named in: it can write
-    // under no other, so a `currentEpoch` it does not hold falls back within its
-    // own epochs rather than to a roster entry it cannot unwrap.
-    const writeEpochEntry = pickEpoch(namedEpochs, encryption.currentEpoch);
+    // The write epoch is the descriptor's CURRENT epoch, resolved against the
+    // full roster -- never against the subset this reader is named in. Falling
+    // back within the reader's own epochs would hand a reader rotated off the
+    // current epoch a write key for an epoch it was rotated off OF, so every
+    // document it wrote afterward would be sealed to a key each removed
+    // recipient of that epoch still holds. The rotation's read axis is
+    // prospective on its own terms; it must not depend on the pull axis having
+    // already taken effect.
+    const writeEpochEntry = currentEpochOf({
+        epochs,
+        currentEpoch: encryption.currentEpoch,
+        label
+    });
+    const namedInWriteEpoch = writeEpochEntry.recipients.some(recipient => recipient.header.kid === keyAgreementKey.id);
+    if (!namedInWriteEpoch) {
+        // A rotated-off reader: still a recipient of older epochs (history stays
+        // readable -- rotation is prospective, never retroactive), but of no key
+        // for the current one. It seals writes to the current epoch's PUBLIC key,
+        // reconstructed from the epoch id exactly as an encrypt-only writer does,
+        // so nothing it writes reaches a rotated-out epoch and nothing it writes
+        // is readable back to it.
+        return {
+            writeEpoch: writeEpochEntry.id,
+            writeKey: await epochWriteStandIn({
+                epochId: writeEpochEntry.id,
+                label
+            }),
+            readKeys: namedEpochs.map(epoch => lazyEpochKey({ epoch, keyAgreementKey })),
+            namedInWriteEpoch
+        };
+    }
     // The write epoch is unwrapped eagerly: `writeKey` must be a full key pair the
     // EDV cipher can name recipients with and encrypt under right away.
     const writeKey = await unwrapEpochKey({
@@ -61,7 +96,53 @@ export async function resolveEpochKeys({ encryption, keyAgreementKey }) {
             readKeys.push(lazyEpochKey({ epoch, keyAgreementKey }));
         }
     }
-    return { writeEpoch: writeEpochEntry.id, writeKey, readKeys };
+    return {
+        writeEpoch: writeEpochEntry.id,
+        writeKey,
+        readKeys,
+        namedInWriteEpoch
+    };
+}
+/**
+ * The public-only write key for an epoch this client holds no secret for,
+ * reconstructed from the epoch id alone. Sound because encryption in this
+ * scheme needs no secret: a write seals a fresh content-encryption key to the
+ * epoch's PUBLIC key, and the epoch id IS that key's did:key. Its
+ * `deriveSecret` refuses with {@link EncryptOnlyCipherError}, so the key can
+ * never be mistaken for one that decrypts.
+ *
+ * Shared by the encrypt-only build (a writer holding no key-agreement key at
+ * all) and the rotated-off reader (one holding keys, but none for the current
+ * epoch), so the two cannot drift.
+ *
+ * @param options {object}
+ * @param options.epochId {string}   the epoch to seal to
+ * @param options.label {string}   names the collection in error messages
+ * @returns {Promise<IKeyAgreementKey>}
+ */
+export async function epochWriteStandIn({ epochId, label }) {
+    let id;
+    try {
+        id = epochKeyIdFor(epochId);
+        // Fail fast on a malformed epoch id: the resolver validates the fragment
+        // is a well-formed X25519 public-key fingerprint, exactly what every
+        // write's recipient resolution will do.
+        await didKeyResolver({ id });
+    }
+    catch (err) {
+        throw new EncryptionError(`Collection ${label} lists a malformed key-epoch id "${epochId}": it ` +
+            'is not the did:key of an X25519 key-agreement key, so no write ' +
+            'recipient can be reconstructed from it.', { cause: err });
+    }
+    return {
+        id,
+        async deriveSecret() {
+            throw new EncryptOnlyCipherError(`The cipher for collection ${label} holds no key-agreement secret ` +
+                `for key epoch "${epochId}": it was built from the descriptor ` +
+                'alone, or this reader was rotated off that epoch. It encrypts to ' +
+                'the epoch and decrypts nothing under it.');
+        }
+    };
 }
 /**
  * Unwraps and reconstructs a single epoch's key pair for this reader, or returns

package/dist/edv/epochKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"epochKeys.js","sourceRoot":"","sources":["../../src/edv/epochKeys.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAK1C,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAuB5C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,eAAe,EAIhB;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxC,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CACF,CAAA;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CACtB,oEAAoE;YAClE,mEAAmE;YACnE,qEAAqE;YACrE,uCAAuC,CAC1C,CAAA;IACH,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,eAAe,GAAG,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,YAAY,CAAC,CAAA;IACvE,+EAA+E;IAC/E,oEAAoE;IACpE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC;QACpC,KAAK,EAAE,eAAe;QACtB,eAAe;KAChB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,cAAc,CACtB,oDAAoD;YAClD,IAAI,eAAe,CAAC,EAAE,6CAA6C;YACnE,qEAAqE;YACrE,MAAM,CACT,CAAA;IACH,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,iBAAiB;IACjB,MAAM,QAAQ,GAAuB,CAAC,QAAQ,CAAC,CAAA;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,eAAe,EAIhB;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACjC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CAAA;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,eAAe,EAIhB;IACC,6EAA6E;IAC7E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;QAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,0EAA0E;YAC1E,wEAAwE;YACxE,mEAAmE;YACnE,WAAW;YACX,MAAM,IAAI,cAAc,CACtB,4CAA4C,KAAK,CAAC,EAAE,YAAY;gBAC9D,2BAA2B,CAC9B,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAC,CAAA;IACF,OAAO;QACL,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,YAAY,CAAC,OAA+B;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;YAC5B,OAAO,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"epochKeys.js","sourceRoot":"","sources":["../../src/edv/epochKeys.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,cAAc,EACf,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAK1C,OAAO,EACL,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAiCjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,eAAe,EACf,KAAK,GAAG,WAAW,EAKpB;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;IAChC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,yEAAyE;IACzE,sEAAsE;IACtE,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxC,KAAK,CAAC,UAAU,CAAC,IAAI,CACnB,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CACF,CAAA;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CACtB,oEAAoE;YAClE,mEAAmE;YACnE,qEAAqE;YACrE,uCAAuC,CAC1C,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,oEAAoE;IACpE,mEAAmE;IACnE,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,eAAe,GAAG,cAAc,CAAC;QACrC,MAAM;QACN,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,KAAK;KACN,CAAC,CAAA;IACF,MAAM,iBAAiB,GAAG,eAAe,CAAC,UAAU,CAAC,IAAI,CACvD,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CAAA;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,0BAA0B;QAC1B,OAAO;YACL,UAAU,EAAE,eAAe,CAAC,EAAE;YAC9B,QAAQ,EAAE,MAAM,iBAAiB,CAAC;gBAChC,OAAO,EAAE,eAAe,CAAC,EAAE;gBAC3B,KAAK;aACN,CAAC;YACF,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAChC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CACzC;YACD,iBAAiB;SAClB,CAAA;IACH,CAAC;IACD,+EAA+E;IAC/E,oEAAoE;IACpE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC;QACpC,KAAK,EAAE,eAAe;QACtB,eAAe;KAChB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,cAAc,CACtB,oDAAoD;YAClD,IAAI,eAAe,CAAC,EAAE,6CAA6C;YACnE,qEAAqE;YACrE,MAAM,CACT,CAAA;IACH,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,iBAAiB;IACjB,MAAM,QAAQ,GAAuB,CAAC,QAAQ,CAAC,CAAA;IAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;QACzD,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,eAAe,CAAC,EAAE;QAC9B,QAAQ;QACR,QAAQ;QACR,iBAAiB;KAClB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,KAAK,EAIN;IACC,IAAI,EAAU,CAAA;IACd,IAAI,CAAC;QACH,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QAC3B,yEAAyE;QACzE,qEAAqE;QACrE,wCAAwC;QACxC,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,oCAAoC,OAAO,QAAQ;YACpE,iEAAiE;YACjE,yCAAyC,EAC3C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,KAAK,CAAC,YAAY;YAChB,MAAM,IAAI,sBAAsB,CAC9B,6BAA6B,KAAK,iCAAiC;gBACjE,kBAAkB,OAAO,sCAAsC;gBAC/D,mEAAmE;gBACnE,0CAA0C,CAC7C,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,eAAe,EAIhB;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACjC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CAAA;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,eAAe,EAIhB;IACC,6EAA6E;IAC7E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;QAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,0EAA0E;YAC1E,wEAAwE;YACxE,mEAAmE;YACnE,WAAW;YACX,MAAM,IAAI,cAAc,CACtB,4CAA4C,KAAK,CAAC,EAAE,YAAY;gBAC9D,2BAA2B,CAC9B,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAC,CAAA;IACF,OAAO;QACL,EAAE,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,YAAY,CAAC,OAA+B;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;YAC5B,OAAO,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/edv/epochRoster.d.ts

@@ -1,19 +1,3 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * Crypto-free predicates over a Collection's `encryption` descriptor: whether it
- * carries a usable key-epoch roster, and whether two descriptors name the same
- * roster. Neither touches key material, so a caller deciding what to do with a
- * descriptor -- open it, refuse it fail-closed, rebuild a cipher for it -- does
- * not have to pull in the epoch crypto to ask.
- *
- * These exist because every consumer that holds descriptors (a local replica
- * deciding whether a collection is encrypted, a sync layer deciding whether a
- * freshly-read descriptor invalidates the cipher it opened with) otherwise
- * re-derives the same two checks, and the two definitions have to agree across
- * consumers to be worth anything.
- */
 import type { CollectionEncryption, CollectionEncryptionEpoch } from '../types.js';
 /**
  * Whether a descriptor carries a usable key-epoch roster: it is present, its
@@ -51,19 +35,20 @@ export declare function hasKeyEpochs(encryption?: CollectionEncryption): encrypt
  */
 export declare function epochRostersEqual(current?: CollectionEncryption, next?: CollectionEncryption): boolean;
 /**
- * Picks the epoch to write under from a roster: the entry named by
- * `currentEpoch` when the list holds it, otherwise the LAST entry in the
- * list's canonical order.
+ * Picks the current epoch out of a roster: the entry named by `currentEpoch`
+ * when the list holds it, otherwise the LAST entry in the list's canonical
+ * order.
  *
  * The fallback is defined against the list's own order rather than against the
  * incidental order in which secrets happened to unwrap, so the choice is
- * deterministic for every caller. Callers pass the list they are entitled to
- * write under -- the full roster during a rotation, or only the epochs a given
- * reader names -- and the rule itself does not vary between them. A reader that
- * does not hold `currentEpoch` is a removed/archive reader whose writes the
- * server rejects via its revoked zcap anyway; the fallback only keeps the
- * selection well-defined instead of assuming the list is append-ordered
- * newest-last.
+ * deterministic for every caller, instead of assuming the list is
+ * append-ordered newest-last.
+ *
+ * This is the tolerant form, for callers holding the full roster during a
+ * rotation, where `currentEpoch` naming an unlisted entry is not yet
+ * actionable. A caller choosing the epoch to SEAL PLAINTEXT UNDER wants
+ * {@link currentEpochOf} instead, which refuses that case rather than
+ * selecting another entry.
  *
  * The list must be non-empty -- every caller has already established that it
  * holds at least one epoch, so an empty list is a programming error rather than
@@ -74,4 +59,29 @@ export declare function epochRostersEqual(current?: CollectionEncryption, next?:
  * @returns {CollectionEncryptionEpoch}
  */
 export declare function pickEpoch(epochs: CollectionEncryptionEpoch[], currentEpoch?: string): CollectionEncryptionEpoch;
+/**
+ * The epoch a descriptor seals new writes under: the entry `currentEpoch`
+ * names, or the last listed entry when the descriptor declares none (the
+ * roster is append-only, so the last entry is the newest).
+ *
+ * Always resolved against the FULL roster, never against the subset of epochs
+ * one reader is named in, and fails closed when `currentEpoch` names an entry
+ * the roster does not list. Both rules exist for the same reason: selecting
+ * any other entry would seal new plaintext under a rotated-out epoch, whose
+ * key every removed recipient of that epoch still holds. A descriptor whose
+ * `currentEpoch` is unlisted violates the descriptor invariant -- it is stale,
+ * partially synced, or tampered with -- and re-reading it is the only sound
+ * recovery.
+ *
+ * @param options {object}
+ * @param options.epochs {CollectionEncryptionEpoch[]}   the non-empty roster
+ * @param [options.currentEpoch] {string}   the descriptor's declared write epoch
+ * @param options.label {string}   names the collection in the error message
+ * @returns {CollectionEncryptionEpoch}
+ */
+export declare function currentEpochOf({ epochs, currentEpoch, label }: {
+    epochs: CollectionEncryptionEpoch[];
+    currentEpoch?: string;
+    label: string;
+}): CollectionEncryptionEpoch;
 //# sourceMappingURL=epochRoster.d.ts.map

package/dist/edv/epochRoster.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epochRoster.d.ts","sourceRoot":"","sources":["../../src/edv/epochRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,UAAU,CAAC,EAAE,oBAAoB,GAChC,UAAU,IAAI,oBAAoB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,yBAAyB,EAAE,CAAA;CACpC,CAOA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAaT;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,yBAAyB,EAAE,EACnC,YAAY,CAAC,EAAE,MAAM,GACpB,yBAAyB,CAE3B"}
+{"version":3,"file":"epochRoster.d.ts","sourceRoot":"","sources":["../../src/edv/epochRoster.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,UAAU,CAAC,EAAE,oBAAoB,GAChC,UAAU,IAAI,oBAAoB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,yBAAyB,EAAE,CAAA;CACpC,CAOA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAaT;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,yBAAyB,EAAE,EACnC,YAAY,CAAC,EAAE,MAAM,GACpB,yBAAyB,CAE3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,MAAM,EACN,YAAY,EACZ,KAAK,EACN,EAAE;IACD,MAAM,EAAE,yBAAyB,EAAE,CAAA;IACnC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,yBAAyB,CAc5B"}

package/dist/edv/epochRoster.js

@@ -1,3 +1,20 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Crypto-free predicates over a Collection's `encryption` descriptor: whether it
+ * carries a usable key-epoch roster, and whether two descriptors name the same
+ * roster. Neither touches key material, so a caller deciding what to do with a
+ * descriptor -- open it, refuse it fail-closed, rebuild a cipher for it -- does
+ * not have to pull in the epoch crypto to ask.
+ *
+ * These exist because every consumer that holds descriptors (a local replica
+ * deciding whether a collection is encrypted, a sync layer deciding whether a
+ * freshly-read descriptor invalidates the cipher it opened with) otherwise
+ * re-derives the same two checks, and the two definitions have to agree across
+ * consumers to be worth anything.
+ */
+import { EncryptionError } from '../errors.js';
 /**
  * Whether a descriptor carries a usable key-epoch roster: it is present, its
  * `currentEpoch` is a string, and its `epochs` list is a non-empty array. Both
@@ -47,19 +64,20 @@ export function epochRostersEqual(current, next) {
         currentIds.every((id, index) => id === nextIds[index]));
 }
 /**
- * Picks the epoch to write under from a roster: the entry named by
- * `currentEpoch` when the list holds it, otherwise the LAST entry in the
- * list's canonical order.
+ * Picks the current epoch out of a roster: the entry named by `currentEpoch`
+ * when the list holds it, otherwise the LAST entry in the list's canonical
+ * order.
  *
  * The fallback is defined against the list's own order rather than against the
  * incidental order in which secrets happened to unwrap, so the choice is
- * deterministic for every caller. Callers pass the list they are entitled to
- * write under -- the full roster during a rotation, or only the epochs a given
- * reader names -- and the rule itself does not vary between them. A reader that
- * does not hold `currentEpoch` is a removed/archive reader whose writes the
- * server rejects via its revoked zcap anyway; the fallback only keeps the
- * selection well-defined instead of assuming the list is append-ordered
- * newest-last.
+ * deterministic for every caller, instead of assuming the list is
+ * append-ordered newest-last.
+ *
+ * This is the tolerant form, for callers holding the full roster during a
+ * rotation, where `currentEpoch` naming an unlisted entry is not yet
+ * actionable. A caller choosing the epoch to SEAL PLAINTEXT UNDER wants
+ * {@link currentEpochOf} instead, which refuses that case rather than
+ * selecting another entry.
  *
  * The list must be non-empty -- every caller has already established that it
  * holds at least one epoch, so an empty list is a programming error rather than
@@ -72,4 +90,37 @@ export function epochRostersEqual(current, next) {
 export function pickEpoch(epochs, currentEpoch) {
     return epochs.find(epoch => epoch.id === currentEpoch) ?? epochs.at(-1);
 }
+/**
+ * The epoch a descriptor seals new writes under: the entry `currentEpoch`
+ * names, or the last listed entry when the descriptor declares none (the
+ * roster is append-only, so the last entry is the newest).
+ *
+ * Always resolved against the FULL roster, never against the subset of epochs
+ * one reader is named in, and fails closed when `currentEpoch` names an entry
+ * the roster does not list. Both rules exist for the same reason: selecting
+ * any other entry would seal new plaintext under a rotated-out epoch, whose
+ * key every removed recipient of that epoch still holds. A descriptor whose
+ * `currentEpoch` is unlisted violates the descriptor invariant -- it is stale,
+ * partially synced, or tampered with -- and re-reading it is the only sound
+ * recovery.
+ *
+ * @param options {object}
+ * @param options.epochs {CollectionEncryptionEpoch[]}   the non-empty roster
+ * @param [options.currentEpoch] {string}   the descriptor's declared write epoch
+ * @param options.label {string}   names the collection in the error message
+ * @returns {CollectionEncryptionEpoch}
+ */
+export function currentEpochOf({ epochs, currentEpoch, label }) {
+    if (currentEpoch === undefined) {
+        return epochs.at(-1);
+    }
+    const entry = epochs.find(epoch => epoch.id === currentEpoch);
+    if (entry === undefined) {
+        throw new EncryptionError(`Collection ${label} declares currentEpoch "${currentEpoch}" but its ` +
+            'epoch roster does not list it. A descriptor names its current ' +
+            'epoch among the epochs it lists; re-read the descriptor before ' +
+            'writing.');
+    }
+    return entry;
+}
 //# sourceMappingURL=epochRoster.js.map

package/dist/edv/epochRoster.js.map

@@ -1 +1 @@
-{"version":3,"file":"epochRoster.js","sourceRoot":"","sources":["../../src/edv/epochRoster.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAKjC,OAAO,CACL,UAAU,KAAK,SAAS;QACxB,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ;QAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAChC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA8B,EAC9B,IAA2B;IAE3B,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAA;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1D,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACpC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,SAAS,CACvB,MAAmC,EACnC,YAAqB;IAErB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;AAC1E,CAAC"}
+{"version":3,"file":"epochRoster.js","sourceRoot":"","sources":["../../src/edv/epochRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAM9C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAKjC,OAAO,CACL,UAAU,KAAK,SAAS;QACxB,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ;QAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAChC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA8B,EAC9B,IAA2B;IAE3B,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAA;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1D,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACpC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,SAAS,CACvB,MAAmC,EACnC,YAAqB;IAErB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,MAAM,EACN,YAAY,EACZ,KAAK,EAKN;IACC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,CAAA;IAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,2BAA2B,YAAY,YAAY;YACpE,gEAAgE;YAChE,iEAAiE;YACjE,UAAU,CACb,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/edv/hmacKey.d.ts

@@ -88,19 +88,31 @@ export declare function hmacKeyFromSecret({ id, secret }: {
  * no `hmac` member -- the collection is simply not indexable (installed at
  * provisioning or never).
  *
- * Fails closed when the descriptor DOES declare one but this key-agreement key
- * unwraps no entry: a current recipient must be able to blind, so a missing or
- * corrupt entry is an {@link EncryptionError} rather than a silent
- * "unindexable" downgrade that would write envelopes nobody can find.
+ * Fails closed when the descriptor DOES declare one, this key-agreement key
+ * unwraps no entry, and `required` is set: a current recipient must be able to
+ * blind, so a missing or corrupt entry is an {@link EncryptionError} rather
+ * than a silent "unindexable" downgrade that would write envelopes nobody can
+ * find.
+ *
+ * `required: false` is the rotated-off reader, whose blinding entry a removal
+ * drops along with its epoch key. There is no key to fail closed on behalf of
+ * there, and throwing would leave it unable to build any cipher at all --
+ * taking away the history reads that rotation is meant to leave untouched. It
+ * gets `null`, i.e. a cipher with no blinded index: it reads documents by id
+ * and cannot search.
  *
  * @param options {object}
  * @param options.encryption {EncryptionWithHmac}   the Collection's descriptor
  * @param options.keyAgreementKey {IKeyAgreementKey}   the reader's own KAK; its
  *   `id` must match an `hmac.recipients` entry's `kid`
+ * @param options.required {boolean}   whether an unusable entry is an error
+ *   rather than an unindexed cipher -- true for a recipient of the current key
+ *   epoch, false for a reader rotated off it
  * @returns {Promise<SHA256HMACKey | null>}
  */
-export declare function resolveHmacKey({ encryption, keyAgreementKey }: {
+export declare function resolveHmacKey({ encryption, keyAgreementKey, required }: {
     encryption: EncryptionWithHmac;
     keyAgreementKey: IKeyAgreementKey;
+    required: boolean;
 }): Promise<SHA256HMACKey | null>;
 //# sourceMappingURL=hmacKey.d.ts.map

package/dist/edv/hmacKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmacKey.d.ts","sourceRoot":"","sources":["../../src/edv/hmacKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGrD;;GAEG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAA;AAEhD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACxD,MAAM,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/E;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC;IAC3C,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,UAAU,CAAA;CACnB,CAAC,CAGD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,EAAE,EACF,MAAM,EACP,EAAE;IACD,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,UAAU,CAAA;CACnB,GAAG,OAAO,CAAC,aAAa,CAAC,CAEzB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,eAAe,EAChB,EAAE;IACD,UAAU,EAAE,kBAAkB,CAAA;IAC9B,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAqBhC"}
+{"version":3,"file":"hmacKey.d.ts","sourceRoot":"","sources":["../../src/edv/hmacKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGrD;;GAEG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAA;AAEhD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACxD,MAAM,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/E;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC;IAC3C,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,UAAU,CAAA;CACnB,CAAC,CAGD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,EAAE,EACF,MAAM,EACP,EAAE;IACD,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,UAAU,CAAA;CACnB,GAAG,OAAO,CAAC,aAAa,CAAC,CAEzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,eAAe,EACf,QAAQ,EACT,EAAE;IACD,UAAU,EAAE,kBAAkB,CAAA;IAC9B,eAAe,EAAE,gBAAgB,CAAA;IACjC,QAAQ,EAAE,OAAO,CAAA;CAClB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAwBhC"}

package/dist/edv/hmacKey.js

@@ -66,18 +66,29 @@ export async function hmacKeyFromSecret({ id, secret }) {
  * no `hmac` member -- the collection is simply not indexable (installed at
  * provisioning or never).
  *
- * Fails closed when the descriptor DOES declare one but this key-agreement key
- * unwraps no entry: a current recipient must be able to blind, so a missing or
- * corrupt entry is an {@link EncryptionError} rather than a silent
- * "unindexable" downgrade that would write envelopes nobody can find.
+ * Fails closed when the descriptor DOES declare one, this key-agreement key
+ * unwraps no entry, and `required` is set: a current recipient must be able to
+ * blind, so a missing or corrupt entry is an {@link EncryptionError} rather
+ * than a silent "unindexable" downgrade that would write envelopes nobody can
+ * find.
+ *
+ * `required: false` is the rotated-off reader, whose blinding entry a removal
+ * drops along with its epoch key. There is no key to fail closed on behalf of
+ * there, and throwing would leave it unable to build any cipher at all --
+ * taking away the history reads that rotation is meant to leave untouched. It
+ * gets `null`, i.e. a cipher with no blinded index: it reads documents by id
+ * and cannot search.
  *
  * @param options {object}
  * @param options.encryption {EncryptionWithHmac}   the Collection's descriptor
  * @param options.keyAgreementKey {IKeyAgreementKey}   the reader's own KAK; its
  *   `id` must match an `hmac.recipients` entry's `kid`
+ * @param options.required {boolean}   whether an unusable entry is an error
+ *   rather than an unindexed cipher -- true for a recipient of the current key
+ *   epoch, false for a reader rotated off it
  * @returns {Promise<SHA256HMACKey | null>}
  */
-export async function resolveHmacKey({ encryption, keyAgreementKey }) {
+export async function resolveHmacKey({ encryption, keyAgreementKey, required }) {
     const hmac = encryption.hmac;
     if (!hmac) {
         return null;
@@ -87,6 +98,9 @@ export async function resolveHmacKey({ encryption, keyAgreementKey }) {
         ? await unwrapEpochSecret({ entry, keyAgreementKey })
         : null;
     if (!secret) {
+        if (!required) {
+            return null;
+        }
         throw new EncryptionError('This collection declares a blinded-index key ' +
             `("${hmac.id}") that this client's key-agreement key ` +
             `("${keyAgreementKey.id}") cannot unwrap (no recipient entry names ` +

package/dist/edv/hmacKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"hmacKey.js","sourceRoot":"","sources":["../../src/edv/hmacKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAkBhD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAK/B,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACzD,OAAO,EAAE,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,EAAE,EACF,MAAM,EAIP;IACC,OAAO,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,UAAU,EACV,eAAe,EAIhB;IACC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;IAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CACjC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CAAA;IACD,MAAM,MAAM,GAAG,KAAK;QAClB,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACrD,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CACvB,+CAA+C;YAC7C,KAAK,IAAI,CAAC,EAAE,0CAA0C;YACtD,KAAK,eAAe,CAAC,EAAE,6CAA6C;YACpE,sEAAsE;YACtE,0CAA0C,CAC7C,CAAA;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AACnD,CAAC"}
+{"version":3,"file":"hmacKey.js","sourceRoot":"","sources":["../../src/edv/hmacKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAkBhD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAK/B,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACzD,OAAO,EAAE,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,EAAE,EACF,MAAM,EAIP;IACC,OAAO,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,UAAU,EACV,eAAe,EACf,QAAQ,EAKT;IACC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;IAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CACjC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,CACzD,CAAA;IACD,MAAM,MAAM,GAAG,KAAK;QAClB,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACrD,CAAC,CAAC,IAAI,CAAA;IACR,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,+CAA+C;YAC7C,KAAK,IAAI,CAAC,EAAE,0CAA0C;YACtD,KAAK,eAAe,CAAC,EAAE,6CAA6C;YACpE,sEAAsE;YACtE,0CAA0C,CAC7C,CAAA;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;AACnD,CAAC"}

package/dist/edv/index.d.ts

@@ -61,7 +61,7 @@
  * loudly; it fails as a resource one of them cannot decrypt):
  *
  * - `EncryptionDescriptorSource` / `EncryptionDescriptorCache` -- the narrow
- *   seams a host implements: one signed Collection Description read, and a
+ *   seams a host implements: one signed Collection Metadata read, and a
  *   client-local get/put pre-scoped to one Space. `wasDescriptorSource` is the
  *   source over a `WasClient` handle.
  * - `acquireDescriptor` / `acquireDescriptors` -- fetch + cache with the

package/dist/edv/index.js

@@ -61,7 +61,7 @@
  * loudly; it fails as a resource one of them cannot decrypt):
  *
  * - `EncryptionDescriptorSource` / `EncryptionDescriptorCache` -- the narrow
- *   seams a host implements: one signed Collection Description read, and a
+ *   seams a host implements: one signed Collection Metadata read, and a
  *   client-local get/put pre-scoped to one Space. `wasDescriptorSource` is the
  *   source over a `WasClient` handle.
  * - `acquireDescriptor` / `acquireDescriptors` -- fetch + cache with the

package/dist/edv/logGovernedDescriptorStore.d.ts

@@ -118,8 +118,8 @@ export declare function logGovernedDescriptorStore({ log, resolveController, pin
 }): LogGovernedDescriptorStore;
 /**
  * Builds the `EncryptionDescriptorStore` over a Collection that may be
- * log-governed. `read()` fetches the Collection Description and dispatches on
- * its `encryption` member: absent, the store resolves `null` (a fresh
+ * log-governed. `read()` fetches the Collection Metadata object and dispatches
+ * on its `encryption` member: absent, the store resolves `null` (a fresh
  * Collection that `create` makes log-governed with a genesis entry); present
  * without `history`, it is the plain point-state descriptor and the store
  * behaves exactly like `collectionDescriptorStore`; present with `history`,

package/dist/edv/logGovernedDescriptorStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logGovernedDescriptorStore.d.ts","sourceRoot":"","sources":["../../src/edv/logGovernedDescriptorStore.ts"],"names":[],"mappings":"AA+BA,OAAO,EAWL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAOlD,OAAO,KAAK,EAAyB,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAErE;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,oBAAoB,GAC/B,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAGzC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,UAAU,EAAE,qBAAqB,CAAA;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAyBR;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA2B,SAAQ,yBAAyB;IAC3E;;;;;;OAMG;IACH,IAAI,IAAI,OAAO,CAAC;QACd,UAAU,EAAE,oBAAoB,CAAA;QAChC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;QAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC,CAAA;IACT,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;CACnC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACP,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAC3B,GAAG,0BAA0B,CA8L7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,oCAAoC,CAAC,EACnD,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACP,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAC3B,GAAG,0BAA0B,CAsI7B"}
+{"version":3,"file":"logGovernedDescriptorStore.d.ts","sourceRoot":"","sources":["../../src/edv/logGovernedDescriptorStore.ts"],"names":[],"mappings":"AA+BA,OAAO,EAWL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAOlD,OAAO,KAAK,EAAsB,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAErE;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,oBAAoB,GAC/B,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAGzC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,UAAU,EAAE,qBAAqB,CAAA;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAyBR;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA2B,SAAQ,yBAAyB;IAC3E;;;;;;OAMG;IACH,IAAI,IAAI,OAAO,CAAC;QACd,UAAU,EAAE,oBAAoB,CAAA;QAChC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;QAC9B,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC,CAAA;IACT,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;CACnC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACP,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAC3B,GAAG,0BAA0B,CA8L7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,oCAAoC,CAAC,EACnD,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACP,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAC3B,GAAG,0BAA0B,CAwI7B"}

package/dist/edv/logGovernedDescriptorStore.js

@@ -315,8 +315,8 @@ export function logGovernedDescriptorStore({ log, resolveController, pinStore, l
 }
 /**
  * Builds the `EncryptionDescriptorStore` over a Collection that may be
- * log-governed. `read()` fetches the Collection Description and dispatches on
- * its `encryption` member: absent, the store resolves `null` (a fresh
+ * log-governed. `read()` fetches the Collection Metadata object and dispatches
+ * on its `encryption` member: absent, the store resolves `null` (a fresh
  * Collection that `create` makes log-governed with a genesis entry); present
  * without `history`, it is the plain point-state descriptor and the store
  * behaves exactly like `collectionDescriptorStore`; present with `history`,
@@ -360,12 +360,13 @@ export function logGovernedCollectionDescriptorStore({ collection, resolveContro
         signer
     });
     /**
-     * The description observed by the most recent read: its sibling fields are
-     * forwarded by a point-state replace (the server's replace semantics would
-     * otherwise drop them), and its `encryption` member decides which write path
-     * a replace takes. Safe to carry even if stale: every write is pinned to the
-     * same read's validator, so a concurrent change fails the CAS instead. A
-     * create clears it, since the Collection it described is now log-governed.
+     * The Collection Metadata object observed by the most recent read: its
+     * configuration members are forwarded by a point-state replace (the
+     * full-replacement PUT would otherwise drop them), and its `encryption`
+     * member decides which write path a replace takes. Safe to carry even if
+     * stale: every write is pinned to the same read's validator, so a concurrent
+     * change fails the CAS instead. A create clears it, since the Collection it
+     * described is now log-governed.
      */
     let described;
     async function readGoverned(projection) {
@@ -413,7 +414,7 @@ export function logGovernedCollectionDescriptorStore({ collection, resolveContro
             if (current === null) {
                 throw unreadableDescriptionError({
                     operation: 'manage recipients',
-                    advice: 'Use a capability that can read the Collection Description.'
+                    advice: 'Use a capability that can read the Collection Metadata object.'
                 });
             }
             described = current.description;

package/dist/edv/logGovernedDescriptorStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"logGovernedDescriptorStore.js","sourceRoot":"","sources":["../../src/edv/logGovernedDescriptorStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EAMxB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAIrD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;IACjD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAMC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,UAAU;QACV,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AA4BD;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,uBAAuB,CAAE,GAAa,CAAC,OAAO,EAAE;YACzD,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EAOP;IACC,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,gCAAgC;IAChC,IAAI,YAAY,GAA+B,IAAI,CAAA;IACnD,IAAI,gBAAgB,GAAiC,IAAI,CAAA;IAEzD,SAAS,aAAa,CAAC,SAAiB;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACvB,UAAU,SAAS,iDAAiD;gBAClE,uCAAuC,CAC1C,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EACpB,KAAK,EACL,UAAU,EAIX;QACC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc,EAAE,mBAAmB;YACnC,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;SACpC,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QACnD,YAAY,GAAG,SAAS,CAAA;QACxB,gBAAgB,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,MAAM,KAAK,GAA+B;QACxC,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,GAAG;gBACV,iBAAiB;gBACjB,QAAQ;gBACR,KAAK;aACN,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,YAAY,GAAG,IAAI,CAAA;gBACnB,gBAAgB,GAAG,IAAI,CAAA;gBACvB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAA;YAC/B,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAA;YACrC,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,eAAe,CACvB,kEAAkE;oBAChE,4DAA4D,CAC/D,CAAA;YACH,CAAC;YACD;;;;;;eAMG;YACH,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YACpB,CAAC;YACD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,eAAe,CACvB,4DAA4D,CAC7D,CAAA;YACH,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C;;;;;;;;eAQG;YACH,MAAM,YAAY,GAChB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACtE,IACE,YAAY,KAAK,SAAS;gBAC1B,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC7C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D;oBAC5D,mDAAmD,YAAY,KAAK;oBACpE,+DAA+D,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBACxC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,KAAK,EAAE,yBAAyB,CAAC,UAAU,CAAC;gBAC5C,UAAU;gBACV,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YACF,MAAM,uBAAuB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;YACxE,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C;;;;;;eAMG;YACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;gBACjD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,cAAc,EAAE,mBAAmB;gBACnC,QAAQ;gBACR,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;aAC7D,CAAC,CAAA;YACF,mEAAmE;YACnE,sEAAsE;YACtE,+BAA+B;YAC/B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACnD,YAAY,GAAG,QAAQ,CAAA;gBACvB,gBAAgB,GAAG,UAAU,CAAA;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QACnC,CAAC;KACF,CAAA;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAA;QACxB,KAAK,CAAC,MAAM,GAAG,KAAK,EAAC,UAAU,EAAC,EAAE;YAChC;;;;;;;;;eASG;YACH,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBACpD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ;gBACR,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,yBAAyB,CAAC,UAAU,CAAC;aAC7C,CAAC,CAAA;YACF,YAAY,GAAG,QAAQ,CAAA;YACvB,gBAAgB,GAAG,UAAU,CAAA;YAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;oBAC/D,uCAAuC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,oCAAoC,CAAC,EACnD,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EAOP;IACC,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC1C,GAAG,EAAE,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC;QACrC,iBAAiB;QACjB,QAAQ;QACR,KAAK;QACL,MAAM;KACP,CAAC,CAAA;IACF;;;;;;;OAOG;IACH,IAAI,SAA4C,CAAA;IAEhD,KAAK,UAAU,YAAY,CACzB,UAEC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,CAAA;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3C,MAAM,IAAI,yBAAyB,CACjC,8CAA8C,OAAO,CAAC,MAAM,KAAK;gBAC/D,QAAQ,mBAAmB,IAAI,CAClC,CAAA;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,yBAAyB,CACjC,2CAA2C,OAAO,CAAC,QAAQ,KAAK;gBAC9D,kCAAkC,UAAU,CAAC,aAAa,IAAI,CACjE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,yBAAyB,CACjC,uEAAuE,CACxE,CAAA;QACH,CAAC;QACD,+DAA+D;QAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QACvC,IAAI,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD;;;;;eAKG;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAA;YAC/C,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;iBACZ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAA;YACtD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,uBAAuB,CAC/B,2DAA2D;oBACzD,gEAAgE,EAClE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,gEAAgE;gBAC9D,gBAAgB,CACnB,CAAA;QACH,CAAC;QACD,OAAO;YACL,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE;YAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAA+B;QACxC,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE,CAAA;YACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,0BAA0B,CAAC;oBAC/B,SAAS,EAAE,mBAAmB;oBAC9B,MAAM,EAAE,4DAA4D;iBACrE,CAAC,CAAA;YACJ,CAAC;YACD,SAAS,GAAG,OAAO,CAAC,WAAW,CAAA;YAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAA;YACjD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAChC,MAAM,IAAI,eAAe,CACvB,4DAA4D;oBAC1D,kCAAkC,CACrC,CAAA;YACH,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;YAC3C,CAAC;YACD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAA;QACjC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YACpB,CAAC;YACD,IACE,SAAS,EAAE,UAAU,KAAK,SAAS;gBACnC,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,EAC1C,CAAC;gBACD,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;gBAC/C,OAAM;YACR,CAAC;YACD,MAAM,UAAU,CAAC,kBAAkB,CACjC;gBACE,IAAI,EAAE,SAAS,EAAE,IAAI;gBACrB,OAAO,EAAE,SAAS,EAAE,OAAO;gBAC3B,SAAS,EAAE,SAAS,EAAE,SAAS;gBAC/B,eAAe,EAAE,SAAS,EAAE,eAAe;gBAC3C,UAAU,EAAE,UAAU;aACvB,EACD,EAAE,OAAO,EAAE,CACZ,CAAA;QACH,CAAC;QAED,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;KAC5B,CAAA;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;QAC9B,KAAK,CAAC,MAAM,GAAG,KAAK,EAAC,UAAU,EAAC,EAAE;YAChC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;YACxB,SAAS,GAAG,SAAS,CAAA;QACvB,CAAC,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"logGovernedDescriptorStore.js","sourceRoot":"","sources":["../../src/edv/logGovernedDescriptorStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EAMxB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAIrD;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;IACjD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAMC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,UAAU;QACV,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AA4BD;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,uBAAuB,CAAE,GAAa,CAAC,OAAO,EAAE;YACzD,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EAOP;IACC,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,gCAAgC;IAChC,IAAI,YAAY,GAA+B,IAAI,CAAA;IACnD,IAAI,gBAAgB,GAAiC,IAAI,CAAA;IAEzD,SAAS,aAAa,CAAC,SAAiB;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACvB,UAAU,SAAS,iDAAiD;gBAClE,uCAAuC,CAC1C,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EACpB,KAAK,EACL,UAAU,EAIX;QACC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc,EAAE,mBAAmB;YACnC,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;SACpC,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QACnD,YAAY,GAAG,SAAS,CAAA;QACxB,gBAAgB,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,MAAM,KAAK,GAA+B;QACxC,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,GAAG;gBACV,iBAAiB;gBACjB,QAAQ;gBACR,KAAK;aACN,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,YAAY,GAAG,IAAI,CAAA;gBACnB,gBAAgB,GAAG,IAAI,CAAA;gBACvB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAA;YAC/B,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAA;YACrC,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,eAAe,CACvB,kEAAkE;oBAChE,4DAA4D,CAC/D,CAAA;YACH,CAAC;YACD;;;;;;eAMG;YACH,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YACpB,CAAC;YACD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,eAAe,CACvB,4DAA4D,CAC7D,CAAA;YACH,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C;;;;;;;;eAQG;YACH,MAAM,YAAY,GAChB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACtE,IACE,YAAY,KAAK,SAAS;gBAC1B,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC7C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D;oBAC5D,mDAAmD,YAAY,KAAK;oBACpE,+DAA+D,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBACxC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,KAAK,EAAE,yBAAyB,CAAC,UAAU,CAAC;gBAC5C,UAAU;gBACV,MAAM,EAAE,SAAS;aAClB,CAAC,CAAA;YACF,MAAM,uBAAuB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;YACxE,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C;;;;;;eAMG;YACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;gBACjD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,cAAc,EAAE,mBAAmB;gBACnC,QAAQ;gBACR,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;aAC7D,CAAC,CAAA;YACF,mEAAmE;YACnE,sEAAsE;YACtE,+BAA+B;YAC/B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACnD,YAAY,GAAG,QAAQ,CAAA;gBACvB,gBAAgB,GAAG,UAAU,CAAA;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QACnC,CAAC;KACF,CAAA;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAA;QACxB,KAAK,CAAC,MAAM,GAAG,KAAK,EAAC,UAAU,EAAC,EAAE;YAChC;;;;;;;;;eASG;YACH,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC;gBACpD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ;gBACR,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,yBAAyB,CAAC,UAAU,CAAC;aAC7C,CAAC,CAAA;YACF,YAAY,GAAG,QAAQ,CAAA;YACvB,gBAAgB,GAAG,UAAU,CAAA;YAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;oBAC/D,uCAAuC,EACzC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;QACH,CAAC,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,oCAAoC,CAAC,EACnD,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EAOP;IACC,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC1C,GAAG,EAAE,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC;QACrC,iBAAiB;QACjB,QAAQ;QACR,KAAK;QACL,MAAM;KACP,CAAC,CAAA;IACF;;;;;;;;OAQG;IACH,IAAI,SAAyC,CAAA;IAE7C,KAAK,UAAU,YAAY,CACzB,UAEC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,UAAU,CAAA;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3C,MAAM,IAAI,yBAAyB,CACjC,8CAA8C,OAAO,CAAC,MAAM,KAAK;gBAC/D,QAAQ,mBAAmB,IAAI,CAClC,CAAA;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,yBAAyB,CACjC,2CAA2C,OAAO,CAAC,QAAQ,KAAK;gBAC9D,kCAAkC,UAAU,CAAC,aAAa,IAAI,CACjE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,yBAAyB,CACjC,uEAAuE,CACxE,CAAA;QACH,CAAC;QACD,+DAA+D;QAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QACvC,IAAI,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD;;;;;eAKG;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAA;YAC/C,MAAM,KAAK,GAAG,OAAO;iBAClB,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;iBACZ,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAA;YACtD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,uBAAuB,CAC/B,2DAA2D;oBACzD,gEAAgE,EAClE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,gEAAgE;gBAC9D,gBAAgB,CACnB,CAAA;QACH,CAAC;QACD,OAAO;YACL,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE;YAC9C,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAA+B;QACxC,KAAK,CAAC,IAAI;YACR,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE,CAAA;YACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,0BAA0B,CAAC;oBAC/B,SAAS,EAAE,mBAAmB;oBAC9B,MAAM,EACJ,gEAAgE;iBACnE,CAAC,CAAA;YACJ,CAAC;YACD,SAAS,GAAG,OAAO,CAAC,WAAW,CAAA;YAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAA;YACjD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAChC,MAAM,IAAI,eAAe,CACvB,4DAA4D;oBAC1D,kCAAkC,CACrC,CAAA;YACH,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;YAC3C,CAAC;YACD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAA;QACjC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YACpB,CAAC;YACD,IACE,SAAS,EAAE,UAAU,KAAK,SAAS;gBACnC,oBAAoB,CAAC,SAAS,CAAC,UAAU,CAAC,EAC1C,CAAC;gBACD,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;gBAC/C,OAAM;YACR,CAAC;YACD,MAAM,UAAU,CAAC,kBAAkB,CACjC;gBACE,IAAI,EAAE,SAAS,EAAE,IAAI;gBACrB,OAAO,EAAE,SAAS,EAAE,OAAO;gBAC3B,SAAS,EAAE,SAAS,EAAE,SAAS;gBAC/B,eAAe,EAAE,SAAS,EAAE,eAAe;gBAC3C,UAAU,EAAE,UAAU;aACvB,EACD,EAAE,OAAO,EAAE,CACZ,CAAA;QACH,CAAC;QAED,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;KAC5B,CAAA;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;QAC9B,KAAK,CAAC,MAAM,GAAG,KAAK,EAAC,UAAU,EAAC,EAAE;YAChC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;YACxB,SAAS,GAAG,SAAS,CAAA;QACvB,CAAC,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/edv/recipients.d.ts

@@ -7,7 +7,7 @@
  * the first epoch, adding a reader (escrow -- history included),
  * and removing a reader (the full revoke-and-rotate procedure). Each operation
  * mutates a `CollectionEncryption` descriptor through the descriptor-store seam
- * (see `descriptorStore.ts`) -- the Collection Description's `encryption`
+ * (see `descriptorStore.ts`) -- the Collection Metadata object's `encryption`
  * member for the `collection` sugar, or any explicit `store`, such as a
  * descriptor hosted as a plain JSON Resource -- and writes it back with a
  * compare-and-swap (`If-Match`), retrying on a concurrent change so two racing

package/dist/edv/recipients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAKxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EACV,oBAAoB,EAIpB,cAAc,EACf,MAAM,aAAa,CAAA;AASpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAG1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAiW1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,UAAU,EACV,YAAoB,EACrB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CA8CpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EACtB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;CAChD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuChC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EACN,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;CAC7C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAmChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoBhC;AA+KD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAA;IACpD,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;IAC5C,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8BhC"}
+{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAKxC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EACV,oBAAoB,EAIpB,cAAc,EACf,MAAM,aAAa,CAAA;AASpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAG1D,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAiW1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,UAAU,EACV,YAAoB,EACrB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CA8CpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,cAAc,CAAC,EACnC,UAAU,EACV,KAAK,EACL,UAAU,EACV,KAAK,EAAE,cAAc,EACtB,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAA;CAChD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuChC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,YAAY,CAAC,EACjC,UAAU,EACV,KAAK,EACL,SAAS,EACT,KAAK,EACN,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,SAAS,EAAE,kBAAkB,CAAA;IAC7B,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;CAC7C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2ChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9B,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoBhC;AA+KD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,KAAK,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,MAAM,EACN,IAAI,EACJ,mBAAgD,EACjD,EAAE;IACD,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,CAAC,EAAE,yBAAyB,CAAA;IACjC,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,SAAS,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAA;IACpD,KAAK,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAA;KAAE,CAAA;IAC5C,MAAM,CAAC,EAAE,cAAc,GAAG,cAAc,EAAE,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;CAC1E,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8BhC"}