@interop/was-client 0.99.0 → 0.100.0

package/dist/edv/acquire.d.ts

@@ -42,12 +42,12 @@ export interface EncryptionDescriptorCache {
  *
  * @param options {object}
  * @param options.was {WasClient}   a client whose signer can read the Space
- * @param options.spaceId {string}
+ * @param options.spaceUrl {string}
  * @returns {EncryptionDescriptorSource}
  */
-export declare function wasDescriptorSource({ was, spaceId }: {
+export declare function wasDescriptorSource({ was, spaceUrl }: {
     was: WasClient;
-    spaceId: string;
+    spaceUrl: string;
 }): EncryptionDescriptorSource;
 /**
  * Acquires one collection's descriptor: fetches it from the source, caching a

package/dist/edv/acquire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acquire.d.ts","sourceRoot":"","sources":["../../src/edv/acquire.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;IAC/B,oBAAoB,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,cAAc,CAAC,OAAO,EAAE;QACtB,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC7C,eAAe,CAAC,OAAO,EAAE;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,oBAAoB,CAAA;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAwC5C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,eAAe,EACf,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAuBhD"}
+{"version":3,"file":"acquire.d.ts","sourceRoot":"","sources":["../../src/edv/acquire.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;IAC/B,oBAAoB,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,cAAc,CAAC,OAAO,EAAE;QACtB,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC7C,eAAe,CAAC,OAAO,EAAE;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,oBAAoB,CAAA;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,GAAG,EACH,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,0BAA0B,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAwC5C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,eAAe,EACf,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAuBhD"}

package/dist/edv/acquire.js

@@ -61,14 +61,14 @@ import { isGovernedDescriptor } from '../internal/describe.js';
  *
  * @param options {object}
  * @param options.was {WasClient}   a client whose signer can read the Space
- * @param options.spaceId {string}
+ * @param options.spaceUrl {string}
  * @returns {EncryptionDescriptorSource}
  */
-export function wasDescriptorSource({ was, spaceId }) {
+export function wasDescriptorSource({ was, spaceUrl }) {
     return {
         async collectionEncryption({ collectionId }) {
             const description = await was
-                .space(spaceId)
+                .spaceAt(spaceUrl)
                 .collection(collectionId)
                 .describe();
             return description?.encryption ?? undefined;

package/dist/edv/acquire.js.map

@@ -1 +1 @@
-{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../src/edv/acquire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAwC9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EAIR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,WAAW,GAAG,MAAM,GAAG;iBAC1B,KAAK,CAAC,OAAO,CAAC;iBACd,UAAU,CAAC,YAAY,CAAC;iBACxB,QAAQ,EAAE,CAAA;YACb,OAAO,WAAW,EAAE,UAAU,IAAI,SAAS,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EAOb;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,eAAe,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,yBAAyB,CACjC,eAAe,YAAY,uCAAuC;YAChE,gEAAgE;YAChE,sDAAsD,CACzD,CAAA;IACH,CAAC;IACD,IAAI,OAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,0BAA0B;QAC1B,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAA;QACX,CAAC;QACD,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QACrC,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,yBAAyB,CACjC,eAAe,YAAY,kCAAkC;YAC3D,gEAAgE;YAChE,oEAAoE;YACpE,iCAAiC,CACpC,CAAA;IACH,CAAC;IACD,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAClE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,eAAe,EACf,YAAY,EAOb;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,aAAa,CAAC,GAAG,CACf,KAAK,EAAC,YAAY,EAAC,EAAE,CACnB;QACE,YAAY;QACZ,MAAM,iBAAiB,CAAC;YACtB,MAAM;YACN,KAAK;YACL,YAAY;YACZ,eAAe;YACf,YAAY;SACb,CAAC;KACM,CACb,CACF,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}
+{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../src/edv/acquire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAwC9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,QAAQ,EAIT;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,WAAW,GAAG,MAAM,GAAG;iBAC1B,OAAO,CAAC,QAAQ,CAAC;iBACjB,UAAU,CAAC,YAAY,CAAC;iBACxB,QAAQ,EAAE,CAAA;YACb,OAAO,WAAW,EAAE,UAAU,IAAI,SAAS,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,eAAe,EACf,YAAY,EAOb;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,eAAe,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,yBAAyB,CACjC,eAAe,YAAY,uCAAuC;YAChE,gEAAgE;YAChE,sDAAsD,CACzD,CAAA;IACH,CAAC;IACD,IAAI,OAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,0BAA0B;QAC1B,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAA;QACX,CAAC;QACD,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QACrC,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,yBAAyB,CACjC,eAAe,YAAY,kCAAkC;YAC3D,gEAAgE;YAChE,oEAAoE;YACpE,iCAAiC,CACpC,CAAA;IACH,CAAC;IACD,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAClE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,eAAe,EACf,YAAY,EAOb;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,aAAa,CAAC,GAAG,CACf,KAAK,EAAC,YAAY,EAAC,EAAE,CACnB;QACE,YAAY;QACZ,MAAM,iBAAiB,CAAC;YACtB,MAAM;YACN,KAAK;YACL,YAAY;YACZ,eAAe;YACf,YAAY;SACb,CAAC;KACM,CACb,CACF,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/edv/cipher.d.ts

@@ -10,7 +10,7 @@
  * consumer that opens archived bytes, derives keys, or decrypts rows it
  * already has imports this entry and evaluates no transport module and no
  * `@interop/vh-resource-log` / `@interop/did-method-webvh` module. The one
- * gated exception is `createEdvDocCipher({ spaceId })`, which loads the
+ * gated exception is `createEdvDocCipher({ spaceUrl })`, which loads the
  * transport factory through `import()` for the chunked paths. A call that
  * names no Space loads nothing.
  *
@@ -61,7 +61,10 @@
  * not on the descriptor the reader holds (a re-read may fix it) and
  * `KeyUnwrapError` when the epoch IS listed but this reader has no key for it
  * (never a recipient, or removed and the epoch rotated since -- re-reading
- * cannot help). Both ship from this entry beside the cipher that raises them,
+ * cannot help). A third class is not a no-key signal at all: `IntegrityError`
+ * when the reader's own recipient entry, or an envelope a held key unwrapped,
+ * fails its integrity check (tampering, not membership). All ship from this
+ * entry beside the cipher that raises them,
  * so a consumer classifying what a cipher threw need not reach for the package
  * root. Both assign their `name` explicitly, and a consumer whose cipher
  * arrives through an injected seam matches on that name rather than
@@ -83,9 +86,9 @@ export { resolveEpochKeys } from './epochKeys.js';
 export type { ResolvedEpochKeys } from './epochKeys.js';
 export { HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey } from './hmacKey.js';
 export type { BlindingKey } from './hmacKey.js';
-export { createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
+export { createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, IntegrityError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
 export type { DocCipher, EdvDocCipher } from './docCipher.js';
-export { isKeyUnwrapError } from '../sync/predicates.js';
+export { isIntegrityError, isKeyUnwrapError } from '../sync/predicates.js';
 export { edvIdFromBytes } from './edvId.js';
 export { blobBytes } from '../internal/blob.js';
 //# sourceMappingURL=cipher.d.ts.map

package/dist/edv/cipher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../src/edv/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../src/edv/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,YAAY,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EACL,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/edv/cipher.js

@@ -10,7 +10,7 @@
  * consumer that opens archived bytes, derives keys, or decrypts rows it
  * already has imports this entry and evaluates no transport module and no
  * `@interop/vh-resource-log` / `@interop/did-method-webvh` module. The one
- * gated exception is `createEdvDocCipher({ spaceId })`, which loads the
+ * gated exception is `createEdvDocCipher({ spaceUrl })`, which loads the
  * transport factory through `import()` for the chunked paths. A call that
  * names no Space loads nothing.
  *
@@ -61,7 +61,10 @@
  * not on the descriptor the reader holds (a re-read may fix it) and
  * `KeyUnwrapError` when the epoch IS listed but this reader has no key for it
  * (never a recipient, or removed and the epoch rotated since -- re-reading
- * cannot help). Both ship from this entry beside the cipher that raises them,
+ * cannot help). A third class is not a no-key signal at all: `IntegrityError`
+ * when the reader's own recipient entry, or an envelope a held key unwrapped,
+ * fails its integrity check (tampering, not membership). All ship from this
+ * entry beside the cipher that raises them,
  * so a consumer classifying what a cipher threw need not reach for the package
  * root. Both assign their `name` explicitly, and a consumer whose cipher
  * arrives through an injected seam matches on that name rather than
@@ -78,8 +81,8 @@ export { didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochS
 export { hasKeyEpochs, epochRostersEqual, currentEpochOf } from './epochRoster.js';
 export { resolveEpochKeys } from './epochKeys.js';
 export { HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey } from './hmacKey.js';
-export { createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
-export { isKeyUnwrapError } from '../sync/predicates.js';
+export { createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, IntegrityError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope } from './docCipher.js';
+export { isIntegrityError, isKeyUnwrapError } from '../sync/predicates.js';
 export { edvIdFromBytes } from './edvId.js';
 export { blobBytes } from '../internal/blob.js';
 //# sourceMappingURL=cipher.js.map

package/dist/edv/cipher.js.map

@@ -1 +1 @@
-{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/edv/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE9D,OAAO,EACL,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../src/edv/cipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AACtE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAE9D,OAAO,EACL,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD,OAAO,EACL,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/edv/core.d.ts

@@ -18,7 +18,7 @@
  * `collectionDescriptorStore`, descriptor acquisition and the refresh policy),
  * so an online consumer keeps importing that one entry and nothing moves.
  */
-export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, trustRosterDidKeys, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, currentEpochOf, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isKeyUnwrapError, edvIdFromBytes, blobBytes } from './cipher.js';
+export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, trustRosterDidKeys, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, currentEpochOf, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, IntegrityError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isIntegrityError, isKeyUnwrapError, edvIdFromBytes, blobBytes } from './cipher.js';
 export type { ChunkSource, CodecTransportFactory, EdvKeys, RecipientPublicKey, EncryptionDescriptorStore, ResolvedEpochKeys, BlindingKey, DocCipher, EdvDocCipher } from './cipher.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedCollectionDescriptorStore, logGovernedDescriptorStore, readGovernedEpochConfiguration, toEpochConfigurationState } from './logGovernedDescriptorStore.js';
 export type { LogGovernedDescriptorStore } from './logGovernedDescriptorStore.js';

package/dist/edv/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/edv/core.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,SAAS,EACV,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACb,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EAC1B,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/edv/core.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,SAAS,EACV,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,YAAY,EACb,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EAC1B,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA"}

package/dist/edv/core.js

@@ -18,6 +18,6 @@
  * `collectionDescriptorStore`, descriptor acquisition and the refresh policy),
  * so an online consumer keeps importing that one entry and nothing moves.
  */
-export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, trustRosterDidKeys, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, currentEpochOf, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isKeyUnwrapError, edvIdFromBytes, blobBytes } from './cipher.js';
+export { EdvCodec, EDV_SCHEME_VERSION, JOSE_CONTENT_TYPE, ensureFirstEpoch, initRecipients, addRecipient, removeRecipient, replaceRecipient, trustRosterDidKeys, isEd25519DidKey, x25519RecipientFromDidKey, resourceDescriptorStore, didKeyResolver, mintEpoch, epochKeyIdFor, unwrapEpochSecret, wrapEpochSecret, hasKeyEpochs, epochRostersEqual, currentEpochOf, resolveEpochKeys, HMAC_KEY_TYPE, mintHmacKey, hmacKeyFromSecret, resolveHmacKey, createEdvDocCipher, createEdvEncryptOnlyDocCipher, ownerRecipient, EncryptOnlyCipherError, IntegrityError, KeyUnwrapError, UnknownEpochError, isEncryptedEnvelope, isIntegrityError, isKeyUnwrapError, edvIdFromBytes, blobBytes } from './cipher.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedCollectionDescriptorStore, logGovernedDescriptorStore, readGovernedEpochConfiguration, toEpochConfigurationState } from './logGovernedDescriptorStore.js';
 //# sourceMappingURL=core.js.map

package/dist/edv/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/edv/core.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,SAAS,EACV,MAAM,aAAa,CAAA;AAYpB,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EAC1B,MAAM,iCAAiC,CAAA"}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/edv/core.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,SAAS,EACV,MAAM,aAAa,CAAA;AAYpB,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EAC1B,MAAM,iCAAiC,CAAA"}

package/dist/edv/docCipher.d.ts

@@ -33,7 +33,7 @@
  * stay stable across a rotation.
  *
  * The cipher also reads a chunked envelope, in one of two ways. Given the
- * Space the collection lives in (`spaceId`), `decrypt` fetches its chunk
+ * Space the collection lives in (`spaceUrl`), `decrypt` fetches its chunk
  * resources through the request context the caller passes
  * (`collection.codecContext()`). Given a `chunkSource` instead, `decrypt`
  * reads the chunks from bytes the caller already holds, such as an archive's
@@ -58,7 +58,7 @@ import type { ChunkSource } from './EdvCodec.js';
 import type { RecipientPublicKey } from './recipients.js';
 export { isEncryptedEnvelope } from '../sync/envelope.js';
 export type { DocCipher } from '../sync/types.js';
-export { EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError } from '../errors.js';
+export { EncryptOnlyCipherError, IntegrityError, KeyUnwrapError, UnknownEpochError } from '../errors.js';
 /**
  * A wallet's own key-agreement key as a `RecipientPublicKey` -- the "recipient
  * zero" entry a caller passes to `initRecipients` when it first makes a
@@ -108,7 +108,7 @@ export interface EdvDocCipher extends DocCipher {
     /**
      * {@link DocCipher.decrypt}, widened with `chunkSource`: a chunked envelope's
      * chunks come from `context` (fetched from the server, on a cipher built
-     * with a `spaceId`) or from `chunkSource` (bytes the caller holds, on any
+     * with a `spaceUrl`) or from `chunkSource` (bytes the caller holds, on any
      * cipher). Passing both throws `ValidationError`. Passing neither throws
      * `EncryptionError` for a chunked envelope. A chunk the source does not hold
      * throws `NotFoundError`, and a chunk whose `was` binding differs from the
@@ -194,7 +194,9 @@ export interface EdvDocCipher extends DocCipher {
  * The reader must be a recipient of every epoch on the descriptor (the owner is
  * "recipient zero"). If it is a recipient of none, building the cipher
  * throws {@link KeyUnwrapError}; this surfaces it with a clearer error rather
- * than silently writing envelopes other recipients cannot read.
+ * than silently writing envelopes other recipients cannot read. An entry that
+ * names this reader but fails its key-wrap integrity check throws
+ * {@link IntegrityError} instead, and that propagates untouched.
  *
  * @param options {object}
  * @param options.keyAgreementKey {IKeyAgreementKey}
@@ -203,7 +205,8 @@ export interface EdvDocCipher extends DocCipher {
  *   the real id, not a label: the collection's metadata envelope is
  *   AEAD-bound to it (`was.collection`), so `applyMeta` refuses an envelope
  *   bound elsewhere.
- * @param [options.spaceId] {string}   the WAS Space holding the collection.
+ * @param [options.spaceUrl] {string}   the URL of the WAS Space holding the
+ *   collection.
  *   It gives the codec a route to a chunked document's chunk resources, so a
  *   `decrypt` that also passes a request context reassembles a chunked
  *   envelope. Without it such a `decrypt` throws `NotSupportedError`; a
@@ -223,11 +226,11 @@ export interface EdvDocCipher extends DocCipher {
  *   as before.
  * @returns {Promise<EdvDocCipher>}
  */
-export declare function createEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, spaceId, idDerivation, encryption, meta }: {
+export declare function createEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, spaceUrl, idDerivation, encryption, meta }: {
     keyAgreementKey: IKeyAgreementKey;
     keyResolver: IKeyResolver;
     collectionId: string;
-    spaceId?: string;
+    spaceUrl?: string;
     idDerivation?: 'content' | 'random';
     encryption: CollectionEncryption;
     meta?: {

package/dist/edv/docCipher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docCipher.d.ts","sourceRoot":"","sources":["../../src/edv/docCipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAc,WAAW,EAAE,MAAM,aAAa,CAAA;AAU/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAGvD,OAAO,KAAK,EACV,WAAW,EAGZ,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAQzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EAClB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,EAC7B,eAAe,EAChB,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,kBAAkB,CAcrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,IAAI,CAAA;QACV,EAAE,CAAC,EAAE,MAAM,CAAA;KACZ,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAE3D;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,OAAO,EAAE;QACf,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,IAAI,CAAA;QACd,OAAO,CAAC,EAAE,mBAAmB,CAAA;QAC7B,WAAW,CAAC,EAAE,WAAW,CAAA;KAC1B,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAExB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAExE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAC/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,eAAe,EACf,WAAW,EACX,YAAY,EACZ,OAAO,EACP,YAAwB,EACxB,UAAU,EACV,IAAI,EACL,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACnC,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC5B,GAAG,OAAO,CAAC,YAAY,CAAC,CAuExB;AAkID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,YAAY,EACZ,YAAwB,EACxB,UAAU,EACX,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACnC,UAAU,EAAE,oBAAoB,CAAA;CACjC,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrB"}
+{"version":3,"file":"docCipher.d.ts","sourceRoot":"","sources":["../../src/edv/docCipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,mBAAmB,EAAc,WAAW,EAAE,MAAM,aAAa,CAAA;AAU/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAGvD,OAAO,KAAK,EACV,WAAW,EAGZ,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AASzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,iBAAiB,EAClB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,EAC7B,eAAe,EAChB,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,kBAAkB,CAcrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,IAAI,CAAA;QACV,EAAE,CAAC,EAAE,MAAM,CAAA;KACZ,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAE3D;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,OAAO,EAAE;QACf,EAAE,EAAE,MAAM,CAAA;QACV,QAAQ,EAAE,IAAI,CAAA;QACd,OAAO,CAAC,EAAE,mBAAmB,CAAA;QAC7B,WAAW,CAAC,EAAE,WAAW,CAAA;KAC1B,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAExB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAExE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAC/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,eAAe,EACf,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,YAAwB,EACxB,UAAU,EACV,IAAI,EACL,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACnC,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC5B,GAAG,OAAO,CAAC,YAAY,CAAC,CAuExB;AAkID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,YAAY,EACZ,YAAwB,EACxB,UAAU,EACX,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACnC,UAAU,EAAE,oBAAoB,CAAA;CACjC,GAAG,OAAO,CAAC,SAAS,CAAC,CAsBrB"}

package/dist/edv/docCipher.js

@@ -7,11 +7,12 @@ import { buildEdvCodec, encryptOnlyEdvCodec } from './EdvCodec.js';
 // `isEncryptedEnvelope` and the `DocCipher` interface live in the crypto-free
 // `../sync` module, and the decrypt-routing signals (`UnknownEpochError` for a
 // stale descriptor, `KeyUnwrapError` for a reader that is not a recipient of
-// the envelope's epoch) in the errors module; re-exported here so an
+// the envelope's epoch, `IntegrityError` for a kid-matched entry or envelope
+// that fails its integrity check) in the errors module; re-exported here so an
 // encrypted-collection consumer that imports this subpath gets them without a
 // second import.
 export { isEncryptedEnvelope } from '../sync/envelope.js';
-export { EncryptOnlyCipherError, KeyUnwrapError, UnknownEpochError } from '../errors.js';
+export { EncryptOnlyCipherError, IntegrityError, KeyUnwrapError, UnknownEpochError } from '../errors.js';
 /**
  * A wallet's own key-agreement key as a `RecipientPublicKey` -- the "recipient
  * zero" entry a caller passes to `initRecipients` when it first makes a
@@ -58,7 +59,9 @@ export function ownerRecipient({ keyAgreementKey }) {
  * The reader must be a recipient of every epoch on the descriptor (the owner is
  * "recipient zero"). If it is a recipient of none, building the cipher
  * throws {@link KeyUnwrapError}; this surfaces it with a clearer error rather
- * than silently writing envelopes other recipients cannot read.
+ * than silently writing envelopes other recipients cannot read. An entry that
+ * names this reader but fails its key-wrap integrity check throws
+ * {@link IntegrityError} instead, and that propagates untouched.
  *
  * @param options {object}
  * @param options.keyAgreementKey {IKeyAgreementKey}
@@ -67,7 +70,8 @@ export function ownerRecipient({ keyAgreementKey }) {
  *   the real id, not a label: the collection's metadata envelope is
  *   AEAD-bound to it (`was.collection`), so `applyMeta` refuses an envelope
  *   bound elsewhere.
- * @param [options.spaceId] {string}   the WAS Space holding the collection.
+ * @param [options.spaceUrl] {string}   the URL of the WAS Space holding the
+ *   collection.
  *   It gives the codec a route to a chunked document's chunk resources, so a
  *   `decrypt` that also passes a request context reassembles a chunked
  *   envelope. Without it such a `decrypt` throws `NotSupportedError`; a
@@ -87,17 +91,17 @@ export function ownerRecipient({ keyAgreementKey }) {
  *   as before.
  * @returns {Promise<EdvDocCipher>}
  */
-export async function createEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, spaceId, idDerivation = 'content', encryption, meta }) {
+export async function createEdvDocCipher({ keyAgreementKey, keyResolver, collectionId, spaceUrl, idDerivation = 'content', encryption, meta }) {
     // Only a cipher told which Space its collection lives in has a server to
     // address, and only the chunked-stream paths address one. Loading the
     // factory here rather than at module scope keeps `WasTransport` out of an
     // offline caller's import graph: a `createEdvDocCipher` call with no
-    // `spaceId` evaluates no transport module at all.
+    // `spaceUrl` evaluates no transport module at all.
     let transportFactory;
-    if (spaceId !== undefined) {
+    if (spaceUrl !== undefined) {
         const { wasTransportFactory } = await import('./transportFactory.js');
         transportFactory = wasTransportFactory({
-            spaceId,
+            spaceUrl,
             collectionId,
             contentType: DEFAULT_CONTENT_TYPE
         });

package/dist/edv/docCipher.js.map

@@ -1 +1 @@
-{"version":3,"file":"docCipher.js","sourceRoot":"","sources":["../../src/edv/docCipher.ts"],"names":[],"mappings":"AAyDA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAChF,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAChB,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAQlE,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AACrE,8EAA8E;AAC9E,iBAAiB;AACjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EAClB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,eAAe,EAGhB;IACC,MAAM,EAAE,EAAE,EAAE,GAAG,eAAe,CAAA;IAC9B,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,eAGpC,CAAA;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,wEAAwE;YACtE,uEAAuE;YACvE,aAAa,CAChB,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;AACzC,CAAC;AA6FD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,eAAe,EACf,WAAW,EACX,YAAY,EACZ,OAAO,EACP,YAAY,GAAG,SAAS,EACxB,UAAU,EACV,IAAI,EASL;IACC,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,kDAAkD;IAClD,IAAI,gBAAmD,CAAA;IACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;QACrE,gBAAgB,GAAG,mBAAmB,CAAC;YACrC,OAAO;YACP,YAAY;YACZ,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAA;IACJ,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,KAAe,CAAA;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,aAAa,CAAC;YAC1B,YAAY;YACZ,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;YAC3D,UAAU;YACV,IAAI,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE;YACtC,YAAY;SACb,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,cAAc,CACtB,6DAA6D;gBAC3D,IAAI,YAAY,qDAAqD;gBACrE,iEAAiE;gBACjE,mEAAmE;gBACnE,kCAAkC,EACpC,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,SAAS,GAAG,KAAK,EAAE,MAExB,EAAwB,EAAE;QACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;QAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,kBAAkB,CAAA;QAC3B,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CACvD,CAAA;QACD,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IAED,OAAO;QACL,SAAS;QACT,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAC,EAC1B,KAAK,EACL,YAAY,EAIb;IACC,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,CAClB,KAAiB,EAC+B,EAAE;QAClD,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,6CAA6C,YAAY,SAAS;gBAChE,iEAAiE;gBACjE,+DAA+D;gBAC/D,iEAAiE;gBACjE,gEAAgE;gBAChE,kEAAkE;gBAClE,gCAAgC,CACnC,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAA;QACrB,yEAAyE;QACzE,2EAA2E;QAC3E,uCAAuC;QACvC,IAAI,QAA0B,CAAA;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,QAAQ,GAAG,OAAO,CAAC,QAAgB,CAAA;QACrC,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,YAAY,UAAU,EAAE,CAAC;YAC9C,8DAA8D;YAC9D,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAS,CAAA;QAC7D,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,+BAA+B,YAAY,iCAAiC,CAC7E,CAAA;QACH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,QAAQ;YACR,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SACnE,CAAA;IACH,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAA+B;YACrD,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC/B,IAAI,EAAE,IAA6B;aACpC,CAAC,CAAA;YACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAClB,EAAE,EACF,IAAI,EACJ,OAAO,EAKR;YACC,wEAAwE;YACxE,0EAA0E;YAC1E,qBAAqB;YACrB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjC,EAAE;gBACF,IAAI,EAAE,IAA6B;gBACnC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;aACjC,CAAC,CAAA;YACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EACZ,EAAE,EACF,QAAQ,EACR,OAAO,EACP,WAAW,EAMZ;YACC,gEAAgE;YAChE,qEAAqE;YACrE,uEAAuE;YACvE,gEAAgE;YAChE,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,iBAAiB,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;YACvC,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QACzE,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAkC;YAClE,iBAAiB,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;YACvC,OAAO,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1D,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,YAAY,EACZ,YAAY,GAAG,SAAS,EACxB,UAAU,EAKX;IACC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;QACtC,YAAY;QACZ,YAAY;QACZ,UAAU;KACX,CAAC,CAAA;IACF,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC;QACpD,KAAK;QACL,YAAY;KACb,CAAC,CAAA;IACF,OAAO;QACL,OAAO;QACP,aAAa;QACb,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,sBAAsB,CAC9B,4CAA4C,YAAY,YAAY;gBAClE,kEAAkE;gBAClE,mDAAmD;gBACnD,wDAAwD,CAC3D,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"docCipher.js","sourceRoot":"","sources":["../../src/edv/docCipher.ts"],"names":[],"mappings":"AAyDA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAChF,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAChB,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAQlE,8EAA8E;AAC9E,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,iBAAiB;AACjB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,iBAAiB,EAClB,MAAM,cAAc,CAAA;AAErB;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,eAAe,EAGhB;IACC,MAAM,EAAE,EAAE,EAAE,GAAG,eAAe,CAAA;IAC9B,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,eAGpC,CAAA;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,wEAAwE;YACtE,uEAAuE;YACvE,aAAa,CAChB,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;AACzC,CAAC;AA6FD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,eAAe,EACf,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,YAAY,GAAG,SAAS,EACxB,UAAU,EACV,IAAI,EASL;IACC,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,mDAAmD;IACnD,IAAI,gBAAmD,CAAA;IACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;QACrE,gBAAgB,GAAG,mBAAmB,CAAC;YACrC,QAAQ;YACR,YAAY;YACZ,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAA;IACJ,CAAC;IAED,6EAA6E;IAC7E,6DAA6D;IAC7D,uEAAuE;IACvE,2EAA2E;IAC3E,IAAI,KAAe,CAAA;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,aAAa,CAAC;YAC1B,YAAY;YACZ,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;YAC3D,UAAU;YACV,IAAI,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE;YACtC,YAAY;SACb,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,cAAc,CACtB,6DAA6D;gBAC3D,IAAI,YAAY,qDAAqD;gBACrE,iEAAiE;gBACjE,mEAAmE;gBACnE,kCAAkC,EACpC,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,SAAS,GAAG,KAAK,EAAE,MAExB,EAAwB,EAAE;QACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;QAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,kBAAkB,CAAA;QAC3B,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAC5B,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CACvD,CAAA;QACD,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,SAAS,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IAED,OAAO;QACL,SAAS;QACT,GAAG,kBAAkB,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;KAC/C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAC,EAC1B,KAAK,EACL,YAAY,EAIb;IACC,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,CAClB,KAAiB,EAC+B,EAAE;QAClD,wEAAwE;QACxE,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,6CAA6C,YAAY,SAAS;gBAChE,iEAAiE;gBACjE,+DAA+D;gBAC/D,iEAAiE;gBACjE,gEAAgE;gBAChE,kEAAkE;gBAClE,gCAAgC,CACnC,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAA;QACrB,yEAAyE;QACzE,2EAA2E;QAC3E,uCAAuC;QACvC,IAAI,QAA0B,CAAA;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,QAAQ,GAAG,OAAO,CAAC,QAAgB,CAAA;QACrC,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,YAAY,UAAU,EAAE,CAAC;YAC9C,8DAA8D;YAC9D,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAS,CAAA;QAC7D,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,+BAA+B,YAAY,iCAAiC,CAC7E,CAAA;QACH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,QAAQ;YACR,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SACnE,CAAA;IACH,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAA+B;YACrD,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC/B,IAAI,EAAE,IAA6B;aACpC,CAAC,CAAA;YACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAClB,EAAE,EACF,IAAI,EACJ,OAAO,EAKR;YACC,wEAAwE;YACxE,0EAA0E;YAC1E,qBAAqB;YACrB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjC,EAAE;gBACF,IAAI,EAAE,IAA6B;gBACnC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC;aACjC,CAAC,CAAA;YACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7B,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EACZ,EAAE,EACF,QAAQ,EACR,OAAO,EACP,WAAW,EAMZ;YACC,gEAAgE;YAChE,qEAAqE;YACrE,uEAAuE;YACvE,gEAAgE;YAChE,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,iBAAiB,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;YACvC,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;QACzE,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAkC;YAClE,iBAAiB,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;YACvC,OAAO,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1D,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,YAAY,EACZ,YAAY,GAAG,SAAS,EACxB,UAAU,EAKX;IACC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;QACtC,YAAY;QACZ,YAAY;QACZ,UAAU;KACX,CAAC,CAAA;IACF,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC;QACpD,KAAK;QACL,YAAY;KACb,CAAC,CAAA;IACF,OAAO;QACL,OAAO;QACP,aAAa;QACb,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,sBAAsB,CAC9B,4CAA4C,YAAY,YAAY;gBAClE,kEAAkE;gBAClE,mDAAmD;gBACnD,wDAAwD,CAC3D,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/edv/encryption.d.ts

@@ -21,7 +21,7 @@ import type { EdvKeys } from './EdvCodec.js';
  * Collection's `encryption` descriptor (or a per-handle override). Core calls
  * `codecFor` only for a collection already known to be encrypted; this provider
  * then supplies the keys: the override-supplied `keys` when present, else
- * `resolveKeys({ spaceId, collectionId })`. `resolveKeys` returning `null` means
+ * `resolveKeys({ spaceUrl, collectionId })`. `resolveKeys` returning `null` means
  * "I hold no keys for this collection", so core fails closed (it does **not**
  * mean plaintext -- the descriptor/override already decided that). A non-`edv`
  * scheme yields `null` (this provider does not handle it).
@@ -60,7 +60,7 @@ import type { EdvKeys } from './EdvCodec.js';
  */
 export declare function createEdvEncryption({ resolveKeys, contentType, maxBlobBytes, chunkSize, idDerivation }: {
     resolveKeys: (ref: {
-        spaceId: string;
+        spaceUrl: string;
         collectionId: string;
     }) => Promise<EdvKeys | null>;
     contentType?: string;

package/dist/edv/encryption.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/edv/encryption.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AASrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAG5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,WAAW,EACX,WAAkC,EAClC,YAAqC,EACrC,SAAS,EACT,YAAuB,EACxB,EAAE;IACD,WAAW,EAAE,CAAC,GAAG,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;KACrB,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CACpC,GAAG,kBAAkB,CA2CrB"}
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/edv/encryption.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AASrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAI5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,WAAW,EACX,WAAkC,EAClC,YAAqC,EACrC,SAAS,EACT,YAAuB,EACxB,EAAE;IACD,WAAW,EAAE,CAAC,GAAG,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;KACrB,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CACpC,GAAG,kBAAkB,CA4CrB"}

package/dist/edv/encryption.js

@@ -1,5 +1,6 @@
 import { DEFAULT_CONTENT_TYPE } from './constants.js';
 import { DEFAULT_MAX_BLOB_BYTES, EDV_SCHEME, buildEdvCodec, descriptorDefect, guardEncryptionDescriptor } from './EdvCodec.js';
+import { collectionUrl } from '../internal/paths.js';
 import { wasTransportFactory } from './transportFactory.js';
 /**
  * Builds an {@link EncryptionProvider} for the `edv` scheme: a pure **keystore**
@@ -10,7 +11,7 @@ import { wasTransportFactory } from './transportFactory.js';
  * Collection's `encryption` descriptor (or a per-handle override). Core calls
  * `codecFor` only for a collection already known to be encrypted; this provider
  * then supplies the keys: the override-supplied `keys` when present, else
- * `resolveKeys({ spaceId, collectionId })`. `resolveKeys` returning `null` means
+ * `resolveKeys({ spaceUrl, collectionId })`. `resolveKeys` returning `null` means
  * "I hold no keys for this collection", so core fails closed (it does **not**
  * mean plaintext -- the descriptor/override already decided that). A non-`edv`
  * scheme yields `null` (this provider does not handle it).
@@ -52,7 +53,7 @@ export function createEdvEncryption({ resolveKeys, contentType = DEFAULT_CONTENT
         canRoute({ scheme, encryption }) {
             return scheme === EDV_SCHEME && descriptorDefect(encryption) === null;
         },
-        async codecFor({ spaceId, collectionId, scheme, encryption, keys }) {
+        async codecFor({ spaceUrl, collectionId, scheme, encryption, keys }) {
             if (scheme !== EDV_SCHEME) {
                 return null;
             }
@@ -61,20 +62,21 @@ export function createEdvEncryption({ resolveKeys, contentType = DEFAULT_CONTENT
             // "holds no keys" the null return below would produce. `buildEdvCodec`
             // guards again for callers that reach it directly; the guard is pure, so
             // running it twice costs nothing.
+            const label = collectionUrl({ spaceUrl, collectionId });
             guardEncryptionDescriptor({
-                label: `${spaceId}/${collectionId}`,
+                label,
                 encryption
             });
             // Prefer override-supplied keys; otherwise consult the keystore.
             const resolved = keys ??
-                (await resolveKeys({ spaceId, collectionId }));
+                (await resolveKeys({ spaceUrl, collectionId }));
             if (!resolved) {
                 return null;
             }
             return buildEdvCodec({
-                label: `${spaceId}/${collectionId}`,
+                label,
                 transportFactory: wasTransportFactory({
-                    spaceId,
+                    spaceUrl,
                     collectionId,
                     contentType
                 }),

package/dist/edv/encryption.js.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/edv/encryption.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,WAAW,EACX,WAAW,GAAG,oBAAoB,EAClC,YAAY,GAAG,sBAAsB,EACrC,SAAS,EACT,YAAY,GAAG,QAAQ,EAUxB;IACC,OAAO;QACL,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE;YAC7B,OAAO,MAAM,KAAK,UAAU,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,IAAI,CAAA;QACvE,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;YAChE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,kCAAkC;YAClC,yBAAyB,CAAC;gBACxB,KAAK,EAAE,GAAG,OAAO,IAAI,YAAY,EAAE;gBACnC,UAAU;aACX,CAAC,CAAA;YACF,iEAAiE;YACjE,MAAM,QAAQ,GACX,IAA4B;gBAC7B,CAAC,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;YAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,aAAa,CAAC;gBACnB,KAAK,EAAE,GAAG,OAAO,IAAI,YAAY,EAAE;gBACnC,gBAAgB,EAAE,mBAAmB,CAAC;oBACpC,OAAO;oBACP,YAAY;oBACZ,WAAW;iBACZ,CAAC;gBACF,YAAY;gBACZ,UAAU;gBACV,IAAI,EAAE,QAAQ;gBACd,WAAW;gBACX,YAAY;gBACZ,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC7C,YAAY;aACb,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/edv/encryption.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,WAAW,EACX,WAAW,GAAG,oBAAoB,EAClC,YAAY,GAAG,sBAAsB,EACrC,SAAS,EACT,YAAY,GAAG,QAAQ,EAUxB;IACC,OAAO;QACL,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE;YAC7B,OAAO,MAAM,KAAK,UAAU,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,IAAI,CAAA;QACvE,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;YACjE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAA;YACb,CAAC;YACD,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,kCAAkC;YAClC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAA;YACvD,yBAAyB,CAAC;gBACxB,KAAK;gBACL,UAAU;aACX,CAAC,CAAA;YACF,iEAAiE;YACjE,MAAM,QAAQ,GACX,IAA4B;gBAC7B,CAAC,MAAM,WAAW,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;YACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,aAAa,CAAC;gBACnB,KAAK;gBACL,gBAAgB,EAAE,mBAAmB,CAAC;oBACpC,QAAQ;oBACR,YAAY;oBACZ,WAAW;iBACZ,CAAC;gBACF,YAAY;gBACZ,UAAU;gBACV,IAAI,EAAE,QAAQ;gBACd,WAAW;gBACX,YAAY;gBACZ,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC7C,YAAY;aACb,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/edv/epochCrypto.d.ts

@@ -48,10 +48,18 @@ export declare function wrapEpochSecretTo({ epochSecret, recipients }: {
 }): Promise<CollectionEncryptionRecipient[]>;
 /**
  * Unwraps an epoch secret from a descriptor `recipients` entry using the
- * reader's own key-agreement key. Returns `null` when this key does not match
- * the entry (the wrong recipient, or a corrupt entry) -- never treat `null` as
- * a key; try the next candidate entry or epoch, and fail with a typed error
- * when nothing unwraps.
+ * reader's own key-agreement key. Returns `null` when the entry is not
+ * addressed to this key (its `kid` is another reader's id) or is malformed (no
+ * usable `epk`, a non-base64url `encrypted_key`, a failed ECDH) -- never treat
+ * `null` as a key; try the next candidate entry or epoch, and fail with a
+ * typed error when nothing unwraps.
+ *
+ * Throws {@link IntegrityError} when the entry names this reader and is
+ * well-formed but its AES-KW integrity check fails. That cannot mean "not my
+ * entry": the entry is addressed to this reader and its wrapped bytes do not
+ * authenticate under the key they were wrapped to. It is the key-wrap
+ * counterpart of a content envelope whose AEAD tag fails for a kid-matched
+ * key, and it is reported the same way rather than as a membership decision.
  *
  * @param options {object}
  * @param options.entry {CollectionEncryptionRecipient}   the descriptor entry

package/dist/edv/epochCrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epochCrypto.d.ts","sourceRoot":"","sources":["../../src/edv/epochCrypto.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAEpE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAYhE;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAAa,CAAA;AAExC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,EAAE,MAAM,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,EACpC,WAAW,EACX,SAAS,EACV,EAAE;IACD,WAAW,EAAE,UAAU,CAAA;IACvB,SAAS,EAAE,kBAAkB,CAAA;CAC9B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA4BzC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,WAAW,EACX,UAAU,EACX,EAAE;IACD,WAAW,EAAE,UAAU,CAAA;IACvB,UAAU,EAAE,kBAAkB,EAAE,CAAA;CACjC,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAI3C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACL,eAAe,EAChB,EAAE;IACD,KAAK,EAAE,6BAA6B,CAAA;IACpC,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAuC7B;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,UAAU,CAAA;CACnB,CAAC,CAQD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACP,MAAM,EACP,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,UAAU,CAAA;CACnB,GAAG,gBAAgB,CASnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AA8BD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,EAAE,EACH,EAAE;IACD,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BpE"}
+{"version":3,"file":"epochCrypto.d.ts","sourceRoot":"","sources":["../../src/edv/epochCrypto.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAA;AAYhE;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAAa,CAAA;AAExC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,EAAE,MAAM,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,EACpC,WAAW,EACX,SAAS,EACV,EAAE;IACD,WAAW,EAAE,UAAU,CAAA;IACvB,SAAS,EAAE,kBAAkB,CAAA;CAC9B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA4BzC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,WAAW,EACX,UAAU,EACX,EAAE;IACD,WAAW,EAAE,UAAU,CAAA;IACvB,UAAU,EAAE,kBAAkB,EAAE,CAAA;CACjC,GAAG,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAI3C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACL,eAAe,EAChB,EAAE;IACD,KAAK,EAAE,6BAA6B,CAAA;IACpC,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2D7B;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,UAAU,CAAA;CACnB,CAAC,CAQD;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACP,MAAM,EACP,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,UAAU,CAAA;CACnB,GAAG,gBAAgB,CASnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AA8BD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,EAAE,EACH,EAAE;IACD,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BpE"}

package/dist/edv/epochCrypto.js

@@ -33,6 +33,7 @@
 import { base64urlnopad } from '@scure/base';
 import { createKek, deriveKey } from '@interop/minimal-cipher/algorithms';
 import { X25519KeyAgreementKey2020, multibaseDecode, multibaseEncode, MULTICODEC_X25519_PUB_HEADER } from '@interop/x25519-key-agreement-key';
+import { IntegrityError } from '../errors.js';
 import { ENCODER } from '../internal/content.js';
 /**
  * The JOSE key-management algorithm for every epoch/recipient wrap.
@@ -101,10 +102,18 @@ export async function wrapEpochSecretTo({ epochSecret, recipients }) {
 }
 /**
  * Unwraps an epoch secret from a descriptor `recipients` entry using the
- * reader's own key-agreement key. Returns `null` when this key does not match
- * the entry (the wrong recipient, or a corrupt entry) -- never treat `null` as
- * a key; try the next candidate entry or epoch, and fail with a typed error
- * when nothing unwraps.
+ * reader's own key-agreement key. Returns `null` when the entry is not
+ * addressed to this key (its `kid` is another reader's id) or is malformed (no
+ * usable `epk`, a non-base64url `encrypted_key`, a failed ECDH) -- never treat
+ * `null` as a key; try the next candidate entry or epoch, and fail with a
+ * typed error when nothing unwraps.
+ *
+ * Throws {@link IntegrityError} when the entry names this reader and is
+ * well-formed but its AES-KW integrity check fails. That cannot mean "not my
+ * entry": the entry is addressed to this reader and its wrapped bytes do not
+ * authenticate under the key they were wrapped to. It is the key-wrap
+ * counterpart of a content envelope whose AEAD tag fails for a kid-matched
+ * key, and it is reported the same way rather than as a membership decision.
  *
  * @param options {object}
  * @param options.entry {CollectionEncryptionRecipient}   the descriptor entry
@@ -113,6 +122,12 @@ export async function wrapEpochSecretTo({ epochSecret, recipients }) {
  * @returns {Promise<Uint8Array | null>}
  */
 export async function unwrapEpochSecret({ entry, keyAgreementKey }) {
+    if (entry.header.kid !== keyAgreementKey.id) {
+        // Another reader's entry: the KDF binds the wrap to the recipient's key
+        // id, so this key could never unwrap it, and a failure below would say
+        // nothing about the entry's integrity.
+        return null;
+    }
     const epk = entry.header.epk;
     if (!epk || typeof epk.x !== 'string') {
         return null;
@@ -122,8 +137,8 @@ export async function unwrapEpochSecret({ entry, keyAgreementKey }) {
         ephemeralPublicKey = base64urlnopad.decode(epk.x);
     }
     catch {
-        // A malformed (non-base64url) `epk.x` is the same corrupt-entry class as a
-        // failed unwrap: honor the documented null contract.
+        // A malformed (non-base64url) `epk.x` is the malformed-entry class:
+        // honor the documented null contract.
         return null;
     }
     let secret;
@@ -142,15 +157,27 @@ export async function unwrapEpochSecret({ entry, keyAgreementKey }) {
     const consumerInfo = ENCODER.encode(keyAgreementKey.id);
     const keyData = await deriveKey({ secret, producerInfo, consumerInfo });
     const kek = await createKek({ keyData });
+    let unwrapped;
     try {
-        return await kek.unwrapKey({ wrappedKey: entry.encrypted_key });
+        unwrapped = await kek.unwrapKey({ wrappedKey: entry.encrypted_key });
     }
     catch {
-        // `unwrapKey` returns null on an AES integrity failure but throws on a
-        // malformed (non-base64url) `encrypted_key`; both are the same "corrupt
-        // entry" class to a caller, so honor the documented null contract here.
+        // `unwrapKey` throws on a malformed (non-base64url or wrong-length)
+        // `encrypted_key`: the malformed-entry class, so honor the documented
+        // null contract.
         return null;
     }
+    if (unwrapped === null) {
+        // `unwrapKey` returns null only when the bytes decoded and had a valid
+        // length but the AES-KW integrity check failed: the entry is addressed to
+        // this reader and does not authenticate under its key.
+        throw new IntegrityError(`This reader's recipient entry (kid "${entry.header.kid}") failed to ` +
+            'authenticate: its wrapped epoch key did not pass the AES-KW ' +
+            'integrity check. The entry names this reader, so this is not a ' +
+            'membership problem -- the stored entry is corrupt or has been ' +
+            'tampered with.');
+    }
+    return unwrapped;
 }
 /**
  * Mints a fresh key epoch: a new random X25519 key pair whose `did:key` is the

package/dist/edv/epochCrypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"epochCrypto.js","sourceRoot":"","sources":["../../src/edv/epochCrypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,4BAA4B,EAC7B,MAAM,mCAAmC,CAAA;AAE1C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAGhD;;GAEG;AACH,MAAM,YAAY,GAAG,gBAAgB,CAAA;AAErC;;GAEG;AACH,MAAM,WAAW,GAAG,2BAA2B,CAAA;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAA;AAaxC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,WAAW,EACX,SAAS,EAIV;IACC,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,CAAA;IAC5D,MAAM,kBAAkB,GAAG,eAAe,CACxC,4BAA4B,EAC5B,SAAS,CAAC,kBAAkB,CAC7B,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC;QAC1C,SAAS,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE;KAChE,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,kBAAkB,CAAA;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAA;IACvE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,OAAO;QACL,MAAM,EAAE;YACN,GAAG,EAAE,SAAS,CAAC,EAAE;YACjB,GAAG,EAAE,YAAY;YACjB,GAAG,EAAE;gBACH,GAAG,EAAE,KAAK;gBACV,GAAG,EAAE,QAAQ;gBACb,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC;aAC7C;YACD,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;YACxC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;SACzC;QACD,aAAa,EAAE,YAAY;KAC5B,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,WAAW,EACX,UAAU,EAIX;IACC,OAAO,OAAO,CAAC,GAAG,CAChB,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CACzE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,eAAe,EAIhB;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAkC,CAAA;IAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,kBAA8B,CAAA;IAClC,IAAI,CAAC;QACH,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,qDAAqD;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAkB,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC;YAC1C,SAAS,EAAE;gBACT,IAAI,EAAE,WAAW;gBACjB,kBAAkB,EAAE,eAAe,CACjC,4BAA4B,EAC5B,kBAAkB,CACnB;aACF;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAA;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAA;IACvE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAA;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAI7B,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,CAAA;IAC5D,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAA;IAClC,MAAM,OAAO,GAAG,GAAG,cAAc,GAAG,SAAS,CAAC,kBAAkB,EAAE,CAAA;IAClE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EACP,MAAM,EAIP;IACC,wEAAwE;IACxE,0EAA0E;IAC1E,+CAA+C;IAC/C,OAAO,yBAAyB,CAAC,aAAa,CAAC;QAC7C,MAAM;QACN,UAAU,EAAE,OAAO;QACnB,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC;KAC3B,CAAqB,CAAA;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,GAAG,OAAO,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,6BAA6B,CAAC,OAAe;IACpD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,aAAa,OAAO,iCAAiC;YACnD,IAAI,cAAc,YAAY,CACjC,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAA;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,EAAE,EAGH;IACC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACpC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,IAAI,CAAC,CAAA;IAC/D,CAAC;IACD,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,OAAO,GAAG,yBAAyB,CAAC,eAAe,CAAC;QACxD,WAAW,EAAE,QAAQ;KACtB,CAAC,CAAA;IACF,OAAO,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG;QACf,EAAE;QACF,IAAI,EAAE,WAAW;QACjB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAA;IACD,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IAC/B,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"epochCrypto.js","sourceRoot":"","sources":["../../src/edv/epochCrypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,4BAA4B,EAC7B,MAAM,mCAAmC,CAAA;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAGhD;;GAEG;AACH,MAAM,YAAY,GAAG,gBAAgB,CAAA;AAErC;;GAEG;AACH,MAAM,WAAW,GAAG,2BAA2B,CAAA;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAA;AAaxC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,WAAW,EACX,SAAS,EAIV;IACC,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,CAAA;IAC5D,MAAM,kBAAkB,GAAG,eAAe,CACxC,4BAA4B,EAC5B,SAAS,CAAC,kBAAkB,CAC7B,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC;QAC1C,SAAS,EAAE,EAAE,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,EAAE;KAChE,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,kBAAkB,CAAA;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAA;IACvE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAA;IACrE,OAAO;QACL,MAAM,EAAE;YACN,GAAG,EAAE,SAAS,CAAC,EAAE;YACjB,GAAG,EAAE,YAAY;YACjB,GAAG,EAAE;gBACH,GAAG,EAAE,KAAK;gBACV,GAAG,EAAE,QAAQ;gBACb,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC;aAC7C;YACD,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;YACxC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC;SACzC;QACD,aAAa,EAAE,YAAY;KAC5B,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,WAAW,EACX,UAAU,EAIX;IACC,OAAO,OAAO,CAAC,GAAG,CAChB,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,CACzE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,eAAe,EAIhB;IACC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;QAC5C,wEAAwE;QACxE,uEAAuE;QACvE,uCAAuC;QACvC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAkC,CAAA;IAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,kBAA8B,CAAA;IAClC,IAAI,CAAC;QACH,kBAAkB,GAAG,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,sCAAsC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAkB,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC;YAC1C,SAAS,EAAE;gBACT,IAAI,EAAE,WAAW;gBACjB,kBAAkB,EAAE,eAAe,CACjC,4BAA4B,EAC5B,kBAAkB,CACnB;aACF;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAA;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAA;IACvE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACxC,IAAI,SAA4B,CAAA;IAChC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,sEAAsE;QACtE,iBAAiB;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,uEAAuE;QACvE,0EAA0E;QAC1E,uDAAuD;QACvD,MAAM,IAAI,cAAc,CACtB,uCAAuC,KAAK,CAAC,MAAM,CAAC,GAAG,eAAe;YACpE,8DAA8D;YAC9D,iEAAiE;YACjE,gEAAgE;YAChE,gBAAgB,CACnB,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAI7B,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,CAAA;IAC5D,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAA;IAClC,MAAM,OAAO,GAAG,GAAG,cAAc,GAAG,SAAS,CAAC,kBAAkB,EAAE,CAAA;IAClE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EACP,MAAM,EAIP;IACC,wEAAwE;IACxE,0EAA0E;IAC1E,+CAA+C;IAC/C,OAAO,yBAAyB,CAAC,aAAa,CAAC;QAC7C,MAAM;QACN,UAAU,EAAE,OAAO;QACnB,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC;KAC3B,CAAqB,CAAA;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,GAAG,OAAO,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,6BAA6B,CAAC,OAAe;IACpD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,aAAa,OAAO,iCAAiC;YACnD,IAAI,cAAc,YAAY,CACjC,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAA;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,EAAE,EAGH;IACC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACpC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,IAAI,CAAC,CAAA;IAC/D,CAAC;IACD,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,OAAO,GAAG,yBAAyB,CAAC,eAAe,CAAC;QACxD,WAAW,EAAE,QAAQ;KACtB,CAAC,CAAA;IACF,OAAO,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG;QACf,EAAE;QACF,IAAI,EAAE,WAAW;QACjB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,CAAA;IACD,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;IAC/B,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/edv/epochKeys.d.ts

@@ -10,7 +10,8 @@
  * a resource written under an older epoch stays readable). The write epoch is
  * unwrapped eagerly; the other epochs' keys unwrap lazily on first decrypt
  * naming them, so a write-only handle does not pay to unwrap history it never
- * reads.
+ * reads. A lazy unwrap that fails its key-wrap check is remembered, so a run of
+ * resources under a damaged epoch pays for one unwrap, not one per resource.
  *
  * This is the read axis: holding an epoch key lets a reader decrypt resources
  * written under it. A reader removed from a later epoch keeps the earlier epoch
@@ -55,7 +56,10 @@ export interface ResolvedEpochKeys {
  * fail-closed before calling this). Throws {@link KeyUnwrapError} when the
  * descriptor HAS epochs but this reader can unwrap none of them (it is not a
  * recipient), so an encrypted collection is never silently read/written with
- * the wrong key.
+ * the wrong key. Throws {@link IntegrityError} when the entry addressed to
+ * this reader fails its key-wrap integrity check: that is a tamper signal, not
+ * a membership decision, and it propagates untouched (eagerly for the write
+ * epoch, on first decrypt for a lazily-unwrapped read epoch).
  *
  * The write epoch is always the descriptor's current epoch, whether or not
  * this reader is a recipient of it: a reader rotated off the current epoch