@interop/was-client 0.70.0 → 0.72.0

package/README.md

@@ -956,9 +956,18 @@ const cipher = await createEdvDocCipher({
 const data = await cipher.decrypt({ id, envelope })
 ```
 
+A consumer that also wants no resource-log dependency --
+`@interop/wallet-backup` opening an archive with no log to verify, say --
+imports `@interop/was-client/edv/cipher` instead: the same codec, doc ciphers,
+key epochs, recipient operations, blinding keys, and `resourceDescriptorStore`,
+without `./edv/core`'s log-governed descriptor stores. Importing it evaluates no
+`@interop/vh-resource-log` or `@interop/did-method-webvh` module, on top of no
+transport module.
+
 Online consumers keep importing `@interop/was-client/edv` and nothing changes
-for them: it re-exports everything `./edv/core` does and adds the transport
-(`WasTransport`, `createEdvEncryption`, descriptor acquisition and refresh).
+for them: it re-exports everything `./edv/core` does (which in turn re-exports
+everything `./edv/cipher` does) and adds the transport (`WasTransport`,
+`createEdvEncryption`, descriptor acquisition and refresh).
 
 #### Searching an encrypted collection
 

package/dist/edv/cipher.d.ts

@@ -0,0 +1,81 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/was-client/edv/cipher` subpath entry: the log-free part of the
+ * offline half of encrypted (EDV-over-WAS) storage support. Everything here
+ * works on bytes and keys a caller already holds -- the codec, the doc
+ * ciphers, the key epochs, the recipient operations, `resourceDescriptorStore`
+ * and the blinding keys -- with no server and no resource log in the graph. A
+ * consumer that opens archived bytes, derives keys, or decrypts rows it
+ * already has imports this entry and evaluates no transport module and no
+ * `@interop/vh-resource-log` / `@interop/did-method-webvh` module. The one
+ * gated exception is `createEdvDocCipher({ spaceId })`, which loads the
+ * transport factory through `import()` for the chunked paths. A call that
+ * names no Space loads nothing.
+ *
+ * `@interop/was-client/edv/core` re-exports all of it and adds the
+ * log-governed descriptor stores, which read through a resource log verified
+ * by `@interop/vh-resource-log`. `@interop/was-client/edv` re-exports core in
+ * turn and adds the online set on top.
+ *
+ * Every encrypted collection carries a key-epoch roster from birth:
+ * `ensureFirstEpoch` installs epoch[0] at provision time (create-if-absent;
+ * the crypto-free `ensureSpaceAndCollection` only ensures the container), and
+ * `initRecipients` / `addRecipient` / `removeRecipient` manage the readers and
+ * rotate the epoch key, so the same key material transparently encrypts each
+ * write under the current epoch and decrypts any epoch a reader still holds.
+ * They mutate the descriptor through the descriptor-store seam: any
+ * `EncryptionDescriptorStore` -- e.g. `resourceDescriptorStore` for a
+ * descriptor hosted as a plain JSON Resource, or `./edv/core`'s
+ * `logGovernedDescriptorStore` for one governed by a resource log.
+ *
+ * A collection provisioned with `ensureFirstEpoch({ blindedIndex: true })` also
+ * carries a blinded-index HMAC key, distributed to recipients exactly like an
+ * epoch key (see `hmacKey.ts`). It is installed at provisioning or never, and
+ * never rotates.
+ *
+ * `hasKeyEpochs` and `epochRostersEqual` are the crypto-free predicates over a
+ * descriptor: whether it carries a usable roster, and whether two descriptors
+ * carry the same epoch configuration (`scheme`, `version`, `currentEpoch`, and
+ * the ordered epoch ids; recipients and the `hmac` member deliberately
+ * excluded). `currentEpochOf` resolves the epoch a descriptor seals new writes
+ * under, failing closed on a stale or tampered roster.
+ *
+ * `x25519RecipientFromDidKey` is the one rule for turning a grantee named only
+ * by its Ed25519 `did:key` controller into a `RecipientPublicKey`, so a
+ * recipient key is always derived from an identifier both sides already hold
+ * rather than transmitted. `didKeyResolver` is the reverse direction, the
+ * resolver the codec hands the cipher.
+ *
+ * A decrypt that finds no key raises one of two classes, and a caller scanning
+ * rows must tell them apart: `UnknownEpochError` when the envelope's epoch is
+ * not on the descriptor the reader holds (a re-read may fix it) and
+ * `KeyUnwrapError` when the epoch IS listed but this reader has no key for it
+ * (never a recipient, or removed and the epoch rotated since -- re-reading
+ * cannot help). Both ship from this entry beside the cipher that raises them,
+ * so a consumer classifying what a cipher threw need not reach for the package
+ * root. Both assign their `name` explicitly, and a consumer whose cipher
+ * arrives through an injected seam matches on that name rather than
+ * `instanceof`, since the seam may resolve to a second copy of this package:
+ * `isKeyUnwrapError` here, and `isUnknownEpochError` on `./sync`, are those
+ * matchers.
+ */
+export { EdvCodec } from './EdvCodec.js';
+export type { CodecTransportFactory, EdvKeys } from './EdvCodec.js';
+export { EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE } from './constants.js';
+export { ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient } from './recipients.js';
+export type { RecipientPublicKey } from './recipients.js';
+export { isEd25519DidKey, x25519RecipientFromDidKey } from './didKeyRecipient.js';
+export { resourceDescriptorStore } from './descriptorStore.js';
+export type { EncryptionDescriptorStore } from './descriptorStore.js';
+export { didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
+export { hasKeyEpochs, epochRostersEqual, currentEpochOf } from './epochRoster.js';
+export { resolveEpochKeys } from './epochKeys.js';
+export type { ResolvedEpochKeys } from './epochKeys.js';
+export { HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey } from './hmacKey.js';
+export type { BlindingKey } from './hmacKey.js';
+export { createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
+export type { DocCipher, EdvDocCipher } from './docCipher.js';
+export { isKeyUnwrapError } from '../sync/predicates.js';
+//# sourceMappingURL=cipher.d.ts.map

package/dist/edv/cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../src/edv/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,YAAY,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/edv/cipher.js

@@ -0,0 +1,75 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/was-client/edv/cipher` subpath entry: the log-free part of the
+ * offline half of encrypted (EDV-over-WAS) storage support. Everything here
+ * works on bytes and keys a caller already holds -- the codec, the doc
+ * ciphers, the key epochs, the recipient operations, `resourceDescriptorStore`
+ * and the blinding keys -- with no server and no resource log in the graph. A
+ * consumer that opens archived bytes, derives keys, or decrypts rows it
+ * already has imports this entry and evaluates no transport module and no
+ * `@interop/vh-resource-log` / `@interop/did-method-webvh` module. The one
+ * gated exception is `createEdvDocCipher({ spaceId })`, which loads the
+ * transport factory through `import()` for the chunked paths. A call that
+ * names no Space loads nothing.
+ *
+ * `@interop/was-client/edv/core` re-exports all of it and adds the
+ * log-governed descriptor stores, which read through a resource log verified
+ * by `@interop/vh-resource-log`. `@interop/was-client/edv` re-exports core in
+ * turn and adds the online set on top.
+ *
+ * Every encrypted collection carries a key-epoch roster from birth:
+ * `ensureFirstEpoch` installs epoch[0] at provision time (create-if-absent;
+ * the crypto-free `ensureSpaceAndCollection` only ensures the container), and
+ * `initRecipients` / `addRecipient` / `removeRecipient` manage the readers and
+ * rotate the epoch key, so the same key material transparently encrypts each
+ * write under the current epoch and decrypts any epoch a reader still holds.
+ * They mutate the descriptor through the descriptor-store seam: any
+ * `EncryptionDescriptorStore` -- e.g. `resourceDescriptorStore` for a
+ * descriptor hosted as a plain JSON Resource, or `./edv/core`'s
+ * `logGovernedDescriptorStore` for one governed by a resource log.
+ *
+ * A collection provisioned with `ensureFirstEpoch({ blindedIndex: true })` also
+ * carries a blinded-index HMAC key, distributed to recipients exactly like an
+ * epoch key (see `hmacKey.ts`). It is installed at provisioning or never, and
+ * never rotates.
+ *
+ * `hasKeyEpochs` and `epochRostersEqual` are the crypto-free predicates over a
+ * descriptor: whether it carries a usable roster, and whether two descriptors
+ * carry the same epoch configuration (`scheme`, `version`, `currentEpoch`, and
+ * the ordered epoch ids; recipients and the `hmac` member deliberately
+ * excluded). `currentEpochOf` resolves the epoch a descriptor seals new writes
+ * under, failing closed on a stale or tampered roster.
+ *
+ * `x25519RecipientFromDidKey` is the one rule for turning a grantee named only
+ * by its Ed25519 `did:key` controller into a `RecipientPublicKey`, so a
+ * recipient key is always derived from an identifier both sides already hold
+ * rather than transmitted. `didKeyResolver` is the reverse direction, the
+ * resolver the codec hands the cipher.
+ *
+ * A decrypt that finds no key raises one of two classes, and a caller scanning
+ * rows must tell them apart: `UnknownEpochError` when the envelope's epoch is
+ * not on the descriptor the reader holds (a re-read may fix it) and
+ * `KeyUnwrapError` when the epoch IS listed but this reader has no key for it
+ * (never a recipient, or removed and the epoch rotated since -- re-reading
+ * cannot help). Both ship from this entry beside the cipher that raises them,
+ * so a consumer classifying what a cipher threw need not reach for the package
+ * root. Both assign their `name` explicitly, and a consumer whose cipher
+ * arrives through an injected seam matches on that name rather than
+ * `instanceof`, since the seam may resolve to a second copy of this package:
+ * `isKeyUnwrapError` here, and `isUnknownEpochError` on `./sync`, are those
+ * matchers.
+ */
+export { EdvCodec } from './EdvCodec.js';
+export { EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE } from './constants.js';
+export { ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient } from './recipients.js';
+export { isEd25519DidKey, x25519RecipientFromDidKey } from './didKeyRecipient.js';
+export { resourceDescriptorStore } from './descriptorStore.js';
+export { didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
+export { hasKeyEpochs, epochRostersEqual, currentEpochOf } from './epochRoster.js';
+export { resolveEpochKeys } from './epochKeys.js';
+export { HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey } from './hmacKey.js';
+export { createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
+export { isKeyUnwrapError } from '../sync/predicates.js';
+//# sourceMappingURL=cipher.js.map

package/dist/edv/cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/edv/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE9D,OAAO,EACL,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/edv/core.d.ts

@@ -2,80 +2,24 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/was-client/edv/core` subpath entry: the offline half of
- * encrypted (EDV-over-WAS) storage support. Everything here works on bytes and
- * keys a caller already holds -- the codec, the doc ciphers, the key epochs,
- * the recipient operations, `resourceDescriptorStore`, the log-governed
- * descriptor stores and the blinding keys -- with no server in the graph. A
- * consumer that opens archived bytes, derives keys, or decrypts rows it already
- * has imports this entry and never evaluates a transport module. The one gated
- * exception is `createEdvDocCipher({ spaceId })`, which loads the transport
- * factory through `import()` for the chunked paths. A call that names no Space
- * loads nothing.
+ * The `@interop/was-client/edv/core` subpath entry:
+ * `@interop/was-client/edv/cipher` plus the log-governed descriptor stores
+ * (`logGovernedDescriptorStore`, `logGovernedCollectionDescriptorStore`, and
+ * their read/state helpers), which read through a resource log verified by
+ * `@interop/vh-resource-log`. Still transport-free -- no HTTP module and no
+ * server in the graph -- but that verification does pull
+ * `@interop/vh-resource-log` (and thereby `@interop/did-method-webvh`) in. A
+ * consumer that wants neither the transport graph nor the resource-log graph,
+ * such as `@interop/wallet-backup` opening an archive, imports `./edv/cipher`
+ * instead.
  *
  * `@interop/was-client/edv` re-exports all of it and adds the online set on
  * top (`WasTransport`, `createEdvEncryption`, `wasTransportFactory`,
  * `collectionDescriptorStore`, descriptor acquisition and the refresh policy),
  * so an online consumer keeps importing that one entry and nothing moves.
- *
- * Every encrypted collection carries a key-epoch roster from birth:
- * `ensureFirstEpoch` installs epoch[0] at provision time (create-if-absent;
- * the crypto-free `ensureSpaceAndCollection` only ensures the container), and
- * `initRecipients` / `addRecipient` / `removeRecipient` manage the readers and
- * rotate the epoch key, so the same key material transparently encrypts each
- * write under the current epoch and decrypts any epoch a reader still holds.
- * They mutate the descriptor through the descriptor-store seam: any
- * `EncryptionDescriptorStore` -- e.g. `resourceDescriptorStore` for a
- * descriptor hosted as a plain JSON Resource, or
- * `logGovernedDescriptorStore` for one governed by a resource log.
- *
- * A collection provisioned with `ensureFirstEpoch({ blindedIndex: true })` also
- * carries a blinded-index HMAC key, distributed to recipients exactly like an
- * epoch key (see `hmacKey.ts`). It is installed at provisioning or never, and
- * never rotates.
- *
- * `hasKeyEpochs` and `epochRostersEqual` are the crypto-free predicates over a
- * descriptor: whether it carries a usable roster, and whether two descriptors
- * carry the same epoch configuration (`scheme`, `version`, `currentEpoch`, and
- * the ordered epoch ids; recipients and the `hmac` member deliberately
- * excluded).
- *
- * `x25519RecipientFromDidKey` is the one rule for turning a grantee named only
- * by its Ed25519 `did:key` controller into a `RecipientPublicKey`, so a
- * recipient key is always derived from an identifier both sides already hold
- * rather than transmitted. `didKeyResolver` is the reverse direction, the
- * resolver the codec hands the cipher.
- *
- * A decrypt that finds no key raises one of two classes, and a caller scanning
- * rows must tell them apart: `UnknownEpochError` when the envelope's epoch is
- * not on the descriptor the reader holds (a re-read may fix it) and
- * `KeyUnwrapError` when the epoch IS listed but this reader has no key for it
- * (never a recipient, or removed and the epoch rotated since -- re-reading
- * cannot help). Both ship from this entry beside the cipher that raises them,
- * so a consumer classifying what a cipher threw need not reach for the package
- * root. Both assign their `name` explicitly, and a consumer whose cipher
- * arrives through an injected seam matches on that name rather than
- * `instanceof`, since the seam may resolve to a second copy of this package:
- * `isKeyUnwrapError` here, and `isUnknownEpochError` on `./sync`, are those
- * matchers.
  */
-export { EdvCodec } from './EdvCodec.js';
-export type { CodecTransportFactory, EdvKeys } from './EdvCodec.js';
-export { EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE } from './constants.js';
-export { ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient } from './recipients.js';
-export type { RecipientPublicKey } from './recipients.js';
-export { isEd25519DidKey, x25519RecipientFromDidKey } from './didKeyRecipient.js';
-export { resourceDescriptorStore } from './descriptorStore.js';
-export type { EncryptionDescriptorStore } from './descriptorStore.js';
+export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, currentEpochOf, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isKeyUnwrapError } from './cipher.js';
+export type { CodecTransportFactory, EdvKeys, RecipientPublicKey, EncryptionDescriptorStore, ResolvedEpochKeys, BlindingKey, DocCipher, EdvDocCipher } from './cipher.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedCollectionDescriptorStore, logGovernedDescriptorStore, readGovernedEpochConfiguration, toEpochConfigurationState } from './logGovernedDescriptorStore.js';
 export type { LogGovernedDescriptorStore } from './logGovernedDescriptorStore.js';
-export { didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
-export { hasKeyEpochs, epochRostersEqual } from './epochRoster.js';
-export { resolveEpochKeys } from './epochKeys.js';
-export type { ResolvedEpochKeys } from './epochKeys.js';
-export { HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey } from './hmacKey.js';
-export type { BlindingKey } from './hmacKey.js';
-export { createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
-export type { DocCipher, EdvDocCipher } from './docCipher.js';
-export { isKeyUnwrapError } from '../sync/predicates.js';
 //# sourceMappingURL=core.d.ts.map

package/dist/edv/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/edv/core.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,YAAY,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EAC1B,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AACjF,OAAO,EACL,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/edv/core.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,qBAAqB,EACrB,OAAO,EACP,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACb,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EAC1B,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA"}

package/dist/edv/core.js

@@ -2,73 +2,22 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/was-client/edv/core` subpath entry: the offline half of
- * encrypted (EDV-over-WAS) storage support. Everything here works on bytes and
- * keys a caller already holds -- the codec, the doc ciphers, the key epochs,
- * the recipient operations, `resourceDescriptorStore`, the log-governed
- * descriptor stores and the blinding keys -- with no server in the graph. A
- * consumer that opens archived bytes, derives keys, or decrypts rows it already
- * has imports this entry and never evaluates a transport module. The one gated
- * exception is `createEdvDocCipher({ spaceId })`, which loads the transport
- * factory through `import()` for the chunked paths. A call that names no Space
- * loads nothing.
+ * The `@interop/was-client/edv/core` subpath entry:
+ * `@interop/was-client/edv/cipher` plus the log-governed descriptor stores
+ * (`logGovernedDescriptorStore`, `logGovernedCollectionDescriptorStore`, and
+ * their read/state helpers), which read through a resource log verified by
+ * `@interop/vh-resource-log`. Still transport-free -- no HTTP module and no
+ * server in the graph -- but that verification does pull
+ * `@interop/vh-resource-log` (and thereby `@interop/did-method-webvh`) in. A
+ * consumer that wants neither the transport graph nor the resource-log graph,
+ * such as `@interop/wallet-backup` opening an archive, imports `./edv/cipher`
+ * instead.
  *
  * `@interop/was-client/edv` re-exports all of it and adds the online set on
  * top (`WasTransport`, `createEdvEncryption`, `wasTransportFactory`,
  * `collectionDescriptorStore`, descriptor acquisition and the refresh policy),
  * so an online consumer keeps importing that one entry and nothing moves.
- *
- * Every encrypted collection carries a key-epoch roster from birth:
- * `ensureFirstEpoch` installs epoch[0] at provision time (create-if-absent;
- * the crypto-free `ensureSpaceAndCollection` only ensures the container), and
- * `initRecipients` / `addRecipient` / `removeRecipient` manage the readers and
- * rotate the epoch key, so the same key material transparently encrypts each
- * write under the current epoch and decrypts any epoch a reader still holds.
- * They mutate the descriptor through the descriptor-store seam: any
- * `EncryptionDescriptorStore` -- e.g. `resourceDescriptorStore` for a
- * descriptor hosted as a plain JSON Resource, or
- * `logGovernedDescriptorStore` for one governed by a resource log.
- *
- * A collection provisioned with `ensureFirstEpoch({ blindedIndex: true })` also
- * carries a blinded-index HMAC key, distributed to recipients exactly like an
- * epoch key (see `hmacKey.ts`). It is installed at provisioning or never, and
- * never rotates.
- *
- * `hasKeyEpochs` and `epochRostersEqual` are the crypto-free predicates over a
- * descriptor: whether it carries a usable roster, and whether two descriptors
- * carry the same epoch configuration (`scheme`, `version`, `currentEpoch`, and
- * the ordered epoch ids; recipients and the `hmac` member deliberately
- * excluded).
- *
- * `x25519RecipientFromDidKey` is the one rule for turning a grantee named only
- * by its Ed25519 `did:key` controller into a `RecipientPublicKey`, so a
- * recipient key is always derived from an identifier both sides already hold
- * rather than transmitted. `didKeyResolver` is the reverse direction, the
- * resolver the codec hands the cipher.
- *
- * A decrypt that finds no key raises one of two classes, and a caller scanning
- * rows must tell them apart: `UnknownEpochError` when the envelope's epoch is
- * not on the descriptor the reader holds (a re-read may fix it) and
- * `KeyUnwrapError` when the epoch IS listed but this reader has no key for it
- * (never a recipient, or removed and the epoch rotated since -- re-reading
- * cannot help). Both ship from this entry beside the cipher that raises them,
- * so a consumer classifying what a cipher threw need not reach for the package
- * root. Both assign their `name` explicitly, and a consumer whose cipher
- * arrives through an injected seam matches on that name rather than
- * `instanceof`, since the seam may resolve to a second copy of this package:
- * `isKeyUnwrapError` here, and `isUnknownEpochError` on `./sync`, are those
- * matchers.
  */
-export { EdvCodec } from './EdvCodec.js';
-export { EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE } from './constants.js';
-export { ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient } from './recipients.js';
-export { isEd25519DidKey, x25519RecipientFromDidKey } from './didKeyRecipient.js';
-export { resourceDescriptorStore } from './descriptorStore.js';
+export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, currentEpochOf, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isKeyUnwrapError } from './cipher.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedCollectionDescriptorStore, logGovernedDescriptorStore, readGovernedEpochConfiguration, toEpochConfigurationState } from './logGovernedDescriptorStore.js';
-export { didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
-export { hasKeyEpochs, epochRostersEqual } from './epochRoster.js';
-export { resolveEpochKeys } from './epochKeys.js';
-export { HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey } from './hmacKey.js';
-export { createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
-export { isKeyUnwrapError } from '../sync/predicates.js';
 //# sourceMappingURL=core.js.map

package/dist/edv/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/edv/core.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE9D,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EAC1B,MAAM,iCAAiC,CAAA;AAExC,OAAO,EACL,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/edv/core.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,aAAa,CAAA;AAWpB,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EAC1B,MAAM,iCAAiC,CAAA"}

package/dist/edv/epochRoster.d.ts

@@ -61,7 +61,8 @@ export declare function epochRostersEqual(current?: CollectionEncryption, next?:
  * @param options.epochs {CollectionEncryptionEpoch[]}   the non-empty roster
  * @param [options.currentEpoch] {string}   the descriptor's declared write epoch
  * @param options.label {string}   names the collection in the error message
- * @returns {CollectionEncryptionEpoch}
+ * @returns {CollectionEncryptionEpoch}   the roster entry `currentEpoch` names
+ * @throws {EncryptionError}   when `currentEpoch` is absent or unlisted
  */
 export declare function currentEpochOf({ epochs, currentEpoch, label }: {
     epochs: CollectionEncryptionEpoch[];

package/dist/edv/epochRoster.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epochRoster.d.ts","sourceRoot":"","sources":["../../src/edv/epochRoster.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,UAAU,CAAC,EAAE,oBAAoB,GAChC,UAAU,IAAI,oBAAoB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,yBAAyB,EAAE,CAAA;CACpC,CAOA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAkBT;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,MAAM,EACN,YAAY,EACZ,KAAK,EACN,EAAE;IACD,MAAM,EAAE,yBAAyB,EAAE,CAAA;IACnC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,yBAAyB,CAkB5B"}
+{"version":3,"file":"epochRoster.d.ts","sourceRoot":"","sources":["../../src/edv/epochRoster.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,UAAU,CAAC,EAAE,oBAAoB,GAChC,UAAU,IAAI,oBAAoB,GAAG;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,yBAAyB,EAAE,CAAA;CACpC,CAOA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAkBT;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,MAAM,EACN,YAAY,EACZ,KAAK,EACN,EAAE;IACD,MAAM,EAAE,yBAAyB,EAAE,CAAA;IACnC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,yBAAyB,CAkB5B"}

package/dist/edv/epochRoster.js

@@ -4,7 +4,8 @@
 /**
  * Crypto-free predicates over a Collection's `encryption` descriptor: whether it
  * carries a usable key-epoch roster, and whether two descriptors carry the same
- * epoch configuration. Neither touches key material, so a caller deciding what
+ * epoch configuration; and which roster entry a descriptor seals new writes
+ * under. None touches key material, so a caller deciding what
  * to do with a descriptor -- open it, refuse it fail-closed, rebuild a cipher
  * for it -- does not have to pull in the epoch crypto to ask.
  *
@@ -94,7 +95,8 @@ export function epochRostersEqual(current, next) {
  * @param options.epochs {CollectionEncryptionEpoch[]}   the non-empty roster
  * @param [options.currentEpoch] {string}   the descriptor's declared write epoch
  * @param options.label {string}   names the collection in the error message
- * @returns {CollectionEncryptionEpoch}
+ * @returns {CollectionEncryptionEpoch}   the roster entry `currentEpoch` names
+ * @throws {EncryptionError}   when `currentEpoch` is absent or unlisted
  */
 export function currentEpochOf({ epochs, currentEpoch, label }) {
     if (currentEpoch === undefined) {

package/dist/edv/epochRoster.js.map

@@ -1 +1 @@
-{"version":3,"file":"epochRoster.js","sourceRoot":"","sources":["../../src/edv/epochRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAMnD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAKjC,OAAO,CACL,UAAU,KAAK,SAAS;QACxB,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ;QAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAChC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA8B,EAC9B,IAA2B;IAE3B,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAA;IACpD,CAAC;IACD,IACE,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,CAAC,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;YACrC,CAAC,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;QACtC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAC1C,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1D,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACpC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,MAAM,EACN,YAAY,EACZ,KAAK,EAKN;IACC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,kDAAkD;YACnE,mEAAmE;YACnE,mEAAmE,CACtE,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,CAAA;IAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,2BAA2B,YAAY,YAAY;YACpE,gEAAgE;YAChE,iEAAiE;YACjE,UAAU,CACb,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"epochRoster.js","sourceRoot":"","sources":["../../src/edv/epochRoster.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAMnD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAKjC,OAAO,CACL,UAAU,KAAK,SAAS;QACxB,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ;QAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAChC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA8B,EAC9B,IAA2B;IAE3B,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAA;IACpD,CAAC;IACD,IACE,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,CAAC,OAAO,CAAC,OAAO,IAAI,kBAAkB,CAAC;YACrC,CAAC,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;QACtC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAC1C,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1D,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACpC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,MAAM,EACN,YAAY,EACZ,KAAK,EAKN;IACC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,kDAAkD;YACnE,mEAAmE;YACnE,mEAAmE,CACtE,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,CAAA;IAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,2BAA2B,YAAY,YAAY;YACpE,gEAAgE;YAChE,iEAAiE;YACjE,UAAU,CACb,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/edv/index.d.ts

@@ -56,7 +56,7 @@
  *   re-reads the description, swaps itself, and retries exactly once per
  *   instance.
  */
-export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedCollectionDescriptorStore, logGovernedDescriptorStore, readGovernedEpochConfiguration, toEpochConfigurationState, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isKeyUnwrapError } from './core.js';
+export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedCollectionDescriptorStore, logGovernedDescriptorStore, readGovernedEpochConfiguration, toEpochConfigurationState, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, currentEpochOf, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isKeyUnwrapError } from './core.js';
 export type { CodecTransportFactory, EdvKeys, RecipientPublicKey, EncryptionDescriptorStore, LogGovernedDescriptorStore, ResolvedEpochKeys, BlindingKey, DocCipher, EdvDocCipher } from './core.js';
 export { createEdvEncryption } from './encryption.js';
 export { wasTransportFactory } from './transportFactory.js';

package/dist/edv/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EACV,qBAAqB,EACrB,OAAO,EACP,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACb,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,WAAW,CAAA;AAClB,YAAY,EACV,qBAAqB,EACrB,OAAO,EACP,kBAAkB,EAClB,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACb,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/edv/index.js

@@ -60,7 +60,7 @@
 // This entry is the one every online consumer imports, so its surface is
 // stated here: an export added to `core.ts` widens `./edv/core` only, and
 // widening `./edv` takes an edit to this list.
-export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedCollectionDescriptorStore, logGovernedDescriptorStore, readGovernedEpochConfiguration, toEpochConfigurationState, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isKeyUnwrapError } from './core.js';
+export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedCollectionDescriptorStore, logGovernedDescriptorStore, readGovernedEpochConfiguration, toEpochConfigurationState, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, currentEpochOf, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isKeyUnwrapError } from './core.js';
 export { createEdvEncryption } from './encryption.js';
 export { wasTransportFactory } from './transportFactory.js';
 export { WasTransport } from './WasTransport.js';

package/dist/edv/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,+CAA+C;AAC/C,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,WAAW,CAAA;AAYlB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAKrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/edv/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,+CAA+C;AAC/C,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,WAAW,CAAA;AAYlB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAKrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-client",
   "description": "A developer-friendly client for Wallet Attached Storage (WAS) servers.",
-  "version": "0.70.0",
+  "version": "0.72.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -43,6 +43,12 @@
       "import": "./dist/edv/core.js",
       "default": "./dist/edv/core.js"
     },
+    "./edv/cipher": {
+      "types": "./dist/edv/cipher.d.ts",
+      "react-native": "./dist/edv/cipher.js",
+      "import": "./dist/edv/cipher.js",
+      "default": "./dist/edv/cipher.js"
+    },
     "./paths": {
       "types": "./dist/paths.d.ts",
       "react-native": "./dist/paths.js",
@@ -73,26 +79,26 @@
   "types": "dist/index.d.ts",
   "sideEffects": false,
   "dependencies": {
-    "@interop/capability-agent": "^0.2.0",
-    "@interop/data-integrity-core": "^8.7.1",
-    "@interop/ed25519-signature": "^7.2.2",
-    "@interop/edv-client": "^17.9.0",
-    "@interop/ezcap": "^7.4.9",
+    "@interop/capability-agent": "^0.2.1",
+    "@interop/data-integrity-core": "^8.8.0",
+    "@interop/ed25519-signature": "^7.2.3",
+    "@interop/edv-client": "^17.9.1",
+    "@interop/ezcap": "^7.4.10",
     "@interop/http-client": "^1.0.5",
-    "@interop/minimal-cipher": "^7.10.2",
-    "@interop/storage-core": "^0.18.0",
-    "@interop/vh-resource-log": "^0.5.2",
-    "@interop/x25519-key-agreement-key": "^5.4.0",
+    "@interop/minimal-cipher": "^7.10.3",
+    "@interop/storage-core": "^0.19.1",
+    "@interop/vh-resource-log": "^0.5.3",
+    "@interop/x25519-key-agreement-key": "^5.4.1",
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^2.3.0",
     "json-canonicalize": "3.0.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@interop/data-integrity-proof": "3.4.5",
-    "@interop/ed25519-verification-key": "^8.2.0",
-    "@interop/jsonld-signatures": "11.8.5",
-    "@interop/zcap": "11.3.1",
+    "@interop/data-integrity-proof": "3.4.6",
+    "@interop/ed25519-verification-key": "^8.2.1",
+    "@interop/jsonld-signatures": "11.8.6",
+    "@interop/zcap": "11.3.2",
     "@playwright/test": "^1.62.1",
     "@types/node": "^26.1.2",
     "@vitest/coverage-v8": "^4.1.10",