@interop/wallet-core 0.101.0 → 0.103.0

package/README.md

@@ -36,12 +36,14 @@ The subpaths:
 
 - **`@interop/wallet-core/space`** -- the wallet Space layout contract: the
   shared collection ids and descriptive specs (`private-credentials`,
-  `public-credentials`, `wallet-activity`, `app-connections`), the
-  `wallet-activity` wire shape with its pure `addHistory*` payload builders, the
+  `public-credentials`, `wallet-activity`, `app-keys`), the `wallet-activity`
+  wire shape with its pure `addHistory*` payload builders, the
   `publicCredentialUrl` derivation, and the `was-link` QR hand-off contract
   (`buildWasLinkPayload` / `parseWasLinkPayload` / `encodeWasLinkSecret`) with
-  its structural recognizer, `isWasLinkPayload`. Contacts collection specs live
-  in [`@interop/social-core`](https://npm.im/@interop/social-core).
+  its structural recognizer, `isWasLinkPayload`. It also carries the `inbox`
+  collection spec and the inbox message envelope (`inboxGrantMessage` /
+  `parseInboxGrantMessage`). Contacts collection specs live in
+  [`@interop/social-core`](https://npm.im/@interop/social-core).
 
 - **`@interop/wallet-core/webvh`** -- the account's did:webvh identity: the
   hosted DID log, its per-client update-key rotation, the client enrollment
@@ -85,16 +87,17 @@ The subpaths:
   the log-governed (and sealable) descriptor store those primitives drive, and
   the user key rotation cascade's per-collection op (re-epoch a collection onto
   the roster's current user key, staleness detected from durable state alone,
-  history escrowed -- also the completion sweep's building block), plus the
-  detector that converges a roster left wrapping the current key to a recipient
-  the account document no longer keys. Also `ensureWalletSpaceEpochs`, the
-  provision-time install of each encrypted wallet collection's key epoch[0] (a
-  fresh random epoch key wrapped to the user key) -- the EDV-bearing second step
-  of `provisionWalletSpace`. Also `walletSpaceProvisioner`, which builds the
-  sync engine's `ensureProvisioned` closure over both steps, single-flight
-  across concurrent callers. Also the client-key record codec: the contents and
-  strict validation of the local record each wallet client keeps its own key
-  material in (storage and wrapping stay app-side).
+  history escrowed -- also the completion sweep's building block). The decisions
+  behind that op and the roster convergence the login sweep runs are exported as
+  pure predicates, `userKeyRosterDrift` and `collectionEpochsCurrent`. Also
+  `ensureWalletSpaceEpochs`, the provision-time install of each encrypted wallet
+  collection's key epoch[0] (a fresh random epoch key wrapped to the user key)
+  -- the EDV-bearing second step of `provisionWalletSpace`. Also
+  `walletSpaceProvisioner`, which builds the sync engine's `ensureProvisioned`
+  closure over both steps, single-flight across concurrent callers. Also the
+  client-key record codec: the contents and strict validation of the local
+  record each wallet client keeps its own key material in (storage and wrapping
+  stay app-side).
 
 - **`@interop/wallet-core/clients`** -- the enrolled-client management surface:
   the listing over the locally verified did:webvh log with names joined from the
@@ -126,8 +129,21 @@ The subpaths:
   `removeGrants`, `retireConnection`, `unretireConnection`,
   `setConnectionLabel`); and the writer arm on a wallet client's entry (lazy
   registration, the throttled touch, the per-entry sweep, and the join a history
-  view resolves a revision's `writerId` through). The wallet writes every entry;
-  no party ever writes one.
+  view resolves a revision's `writerId` through). An agent's entry also carries
+  the wallet's side of the connection: the pairwise seed and its tag
+  (`connectionDidKey` derives the did:key), the grants the agent handed the
+  wallet, and the outbox of pending messages. Their readers (`receivedGrants`,
+  `liveInboxChannel`, `agentGrantDue`, ...) and writers (`recordReceivedGrants`,
+  `recordRenewedGrants`, `settleOutboxItem`, `pruneSupersededGrants`,
+  `clearReceivedGrants`, `markDeclined`) live here too. The wallet writes every
+  entry; no party ever writes one.
+
+- **`@interop/wallet-core/audiences`** -- the audience collection: a plaintext
+  collection in the owner's Space whose posts are its Resources. It carries the
+  provisioning attributes every audience shares
+  (`AUDIENCE_PROVISION_ATTRIBUTES`) and the member grant
+  (`delegateAudienceGrant`, GET and HEAD on the container, with no key epoch to
+  escrow). Nothing marks an audience on the wire.
 
 - **`@interop/wallet-core/enrollment`** -- the client enrollment ceremony
   (connect code, approval, completion) plus the onboarding-response envelope
@@ -228,9 +244,9 @@ import {
 
 The `sync` and `space` subpaths are re-exported from the package root as well.
 Every other subpath (`webvh`, `resourceLog`, `keys`, `clients`, `descriptors`,
-`keyring`, `connections`, `enrollment`, `genesis`, `unlock`, `recovery`,
-`clientAnnex`, `menders`) is import-directly-only, so consumers of the root
-never pull the signing / KMS / document-loader dependency graph.
+`keyring`, `connections`, `audiences`, `enrollment`, `genesis`, `unlock`,
+`recovery`, `clientAnnex`, `menders`) is import-directly-only, so consumers of
+the root never pull the signing / KMS / document-loader dependency graph.
 
 Nine further exports are leaves of that same isolation, carved out to stay
 dependency-light, for an offline consumer such as `@interop/wallet-backup` that

package/dist/audiences/audienceGrant.d.ts

@@ -0,0 +1,49 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The audience collection and its member grant. An audience is a plaintext
+ * collection in the owner's Space whose posts are its Resources. Nothing
+ * marks a collection as an audience on the wire.
+ */
+import type { IDelegatedZcap, IZcap } from '@interop/data-integrity-core';
+import type { ZcapClient } from '@interop/ezcap';
+/**
+ * The provisioning attributes every audience collection carries: it is
+ * plaintext, since its members read posts without a key epoch. The rest of
+ * the spec is the caller's. `isPublic` is the caller's choice (a public
+ * audience is one under world read), and the collection id follows the
+ * existing collection name grammar and is chosen by the caller.
+ */
+export declare const AUDIENCE_PROVISION_ATTRIBUTES: {
+    readonly encryption: "plaintext";
+};
+/**
+ * Delegates an audience member's read grant over the audience collection.
+ * The shape is the read-only share grant a wallet mints for a collection
+ * reader: GET and HEAD on the collection's container. No key epoch is
+ * escrowed, since the audience is plaintext.
+ *
+ * The authorization profile is adding an explicit subtree marker (`*`
+ * appended to the target), and this mint site will write it once the
+ * profile and the server ship it. Until then the target is the bare
+ * container URL, which the current server reads as covering the subtree.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating signer
+ * @param options.parentCapability {string | IZcap}   the parent: a root zcap
+ *   id string, or the embedded generation delegation
+ * @param options.collectionUrl {string}   the collection's canonical
+ *   container URL (trailing slash)
+ * @param options.controller {string}   the member's DID
+ * @param options.expires {Date}   the grant's expiry
+ * @returns {Promise<IDelegatedZcap>}
+ */
+export declare function delegateAudienceGrant({ zcapClient, parentCapability, collectionUrl, controller, expires }: {
+    zcapClient: ZcapClient;
+    parentCapability: string | IZcap;
+    collectionUrl: string;
+    controller: string;
+    expires: Date;
+}): Promise<IDelegatedZcap>;
+//# sourceMappingURL=audienceGrant.d.ts.map

package/dist/audiences/audienceGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audienceGrant.d.ts","sourceRoot":"","sources":["../../src/audiences/audienceGrant.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;GAIG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B;;CAEiB,CAAA;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,OAAO,EACR,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,GAAG,KAAK,CAAA;IAChC,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,IAAI,CAAA;CACd,GAAG,OAAO,CAAC,cAAc,CAAC,CAe1B"}

package/dist/audiences/audienceGrant.js

@@ -0,0 +1,46 @@
+/**
+ * The provisioning attributes every audience collection carries: it is
+ * plaintext, since its members read posts without a key epoch. The rest of
+ * the spec is the caller's. `isPublic` is the caller's choice (a public
+ * audience is one under world read), and the collection id follows the
+ * existing collection name grammar and is chosen by the caller.
+ */
+export const AUDIENCE_PROVISION_ATTRIBUTES = {
+    encryption: 'plaintext'
+};
+/**
+ * Delegates an audience member's read grant over the audience collection.
+ * The shape is the read-only share grant a wallet mints for a collection
+ * reader: GET and HEAD on the collection's container. No key epoch is
+ * escrowed, since the audience is plaintext.
+ *
+ * The authorization profile is adding an explicit subtree marker (`*`
+ * appended to the target), and this mint site will write it once the
+ * profile and the server ship it. Until then the target is the bare
+ * container URL, which the current server reads as covering the subtree.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating signer
+ * @param options.parentCapability {string | IZcap}   the parent: a root zcap
+ *   id string, or the embedded generation delegation
+ * @param options.collectionUrl {string}   the collection's canonical
+ *   container URL (trailing slash)
+ * @param options.controller {string}   the member's DID
+ * @param options.expires {Date}   the grant's expiry
+ * @returns {Promise<IDelegatedZcap>}
+ */
+export async function delegateAudienceGrant({ zcapClient, parentCapability, collectionUrl, controller, expires }) {
+    if (!collectionUrl.endsWith('/')) {
+        throw new TypeError('audience grant: `collectionUrl` must be the canonical container URL ' +
+            '(with a trailing slash).');
+    }
+    return (await zcapClient.delegate({
+        capability: parentCapability,
+        // Subtree marker: pending the profile change; flip this target to `${collectionUrl}*` when it ships.
+        invocationTarget: collectionUrl,
+        controller,
+        allowedActions: ['GET', 'HEAD'],
+        expires
+    }));
+}
+//# sourceMappingURL=audienceGrant.js.map

package/dist/audiences/audienceGrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audienceGrant.js","sourceRoot":"","sources":["../../src/audiences/audienceGrant.ts"],"names":[],"mappings":"AAYA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,UAAU,EAAE,WAAW;CACkC,CAAA;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,OAAO,EAOR;IACC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CACjB,sEAAsE;YACpE,0BAA0B,CAC7B,CAAA;IACH,CAAC;IACD,OAAO,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC;QAChC,UAAU,EAAE,gBAAgB;QAC5B,qGAAqG;QACrG,gBAAgB,EAAE,aAAa;QAC/B,UAAU;QACV,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/B,OAAO;KACR,CAAC,CAAmB,CAAA;AACvB,CAAC"}

package/dist/audiences/index.d.ts

@@ -0,0 +1,10 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/audiences` subpath: the audience collection's
+ * provisioning attributes and the member grant helper. The agent's own grants
+ * do not go through it. They arrive through a connection request.
+ */
+export { AUDIENCE_PROVISION_ATTRIBUTES, delegateAudienceGrant } from './audienceGrant.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audiences/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audiences/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;GAIG;AACH,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACtB,MAAM,oBAAoB,CAAA"}

package/dist/audiences/index.js

@@ -0,0 +1,10 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/audiences` subpath: the audience collection's
+ * provisioning attributes and the member grant helper. The agent's own grants
+ * do not go through it. They arrive through a connection request.
+ */
+export { AUDIENCE_PROVISION_ATTRIBUTES, delegateAudienceGrant } from './audienceGrant.js';
+//# sourceMappingURL=index.js.map

package/dist/audiences/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audiences/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;GAIG;AACH,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACtB,MAAM,oBAAoB,CAAA"}

package/dist/clientAnnex/gc.d.ts

@@ -29,8 +29,37 @@
  *   delegation blind, reading was-client's genuine `AlreadyRevokedError` as
  *   success and an already-expired delegation as needing no POST at all;
  *   write the digest; delete), so a GC torn anywhere resumes at the next
- *   login instead of waiting a quarter. Failures are collected per generation
- *   and never abort the fan-out: a partial pass is a resumable success.
+ *   login instead of waiting a quarter. The pointer it compares against is
+ *   re-read from the account log under this client's pin right before the
+ *   fan-out, and a generation that log never pointed at is collected only
+ *   once it is GC-quiet (the same quiet bound the swap defers on), so a
+ *   sibling client's swap -- landed, or still between its mint and its
+ *   re-point -- never loses the generation the account points at. A
+ *   generation the log once pointed at is collected at once: it cannot be a
+ *   sibling's unpointed fresh generation, and a retire swap's refused revoke
+ *   is retried on it without waiting a day. Failures are collected per
+ *   generation and never abort the fan-out: a partial pass is a resumable
+ *   success. The re-read itself and the collection listing sit outside that
+ *   isolation: either failing rejects the pass, since there is nothing safe
+ *   to collect against.
+ *
+ * - The REPAIR is the swap off its cadence: when the pointed generation's
+ *   log does not exist (the pointer names a generation a stale pass
+ *   collected, or one never minted), every transient visit is shut out until
+ *   the pointer moves, so the pass mints a fresh generation and re-points at
+ *   once, with nothing to revoke. The pointed log is read on every pass for
+ *   this reason. The repair covers a dead generation inside a live Space
+ *   only: when the auxiliary Space itself is gone, or its metadata read
+ *   answers anything but 2xx, it refuses (`failed`), and the transient
+ *   readiness ensure, whose two-probe rule tells a gone Space from a masked
+ *   read, is the one that replaces a Space.
+ *
+ * Both the swap and the repair decide on the account log re-read under this
+ * client's pin at the start of the pass, not on the caller's view, and
+ * their re-point lands only while the account still points at the
+ * generation they replace. A sibling client's swap that landed since the
+ * caller's read, or while this pass minted, stands, and the pass reports
+ * `not-due`.
  *
  * The completion predicate is durable state alone (exactly one `gen-`
  * collection exists in the auxiliary Space and it is the one the pointer
@@ -114,14 +143,17 @@ export declare function clientAnnexGcDue({ log, now }: {
 /**
  * The live-entry guard: whether a generation is GC-quiet -- its newest
  * entry's `versionTime` is older than the quiet bound plus the skew grace
- * margin. Applies to the POINTED generation only (an unpointed generation
- * authorizes nothing under pointer equality, so nothing inside it ever
- * defers deletion). An unparseable `versionTime` reads as not quiet: the
- * swap defers rather than abandoning a possibly-live visit.
+ * margin. On the POINTED generation it defers the swap, so a possibly-live
+ * visit is not abandoned. On an unpointed generation the account log NEVER
+ * pointed at it defers the collect: such a generation authorizes nothing
+ * under pointer equality, but one written moments ago may be a sibling
+ * client's fresh generation whose re-point has not landed yet, and collecting
+ * it would leave the account pointing at a deleted generation. An
+ * unparseable `versionTime` reads as not quiet, so both arms defer rather
+ * than act.
  *
  * @param options {object}
- * @param options.log {DIDLog}   the pointed generation's VERIFIED annex
- *   log
+ * @param options.log {DIDLog}   the generation's VERIFIED annex log
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {boolean}
  */
@@ -130,27 +162,38 @@ export declare function generationQuiet({ log, now }: {
     now?: number;
 }): boolean;
 /**
- * What the swap half of one GC pass did. `replaced` is the successful swap;
- * `not-due` and `deferred-live` are the two healthy skips (cadence and quiet
- * bound); `no-pointer` means the account has no annex inventory (the whole
- * pass no-ops -- without a pointer there is no auxiliary Space to list);
- * `no-ladder-seed` means the swap was due but the login held no ladder seed
- * to mint with (a non-standing record); `failed` means a swap stage threw --
- * reported in `failed` under the pointed generation's id, with the collect
- * fan-out still run.
+ * What the swap half of one GC pass did. `replaced` is the successful
+ * quarterly swap; `repaired` is the off-cadence swap the pass runs when the
+ * pointed generation's log does not exist (the account was left pointing at
+ * a collected or never-minted generation, and no transient visit could
+ * enroll), so the pointer names a live generation again; `not-due` and
+ * `deferred-live` are the two healthy skips (cadence and quiet bound), and
+ * `not-due` also covers a caller's dead pointer the account log has since
+ * moved off; `no-pointer` means the account has no annex inventory (the
+ * whole pass no-ops -- without a pointer there is no auxiliary Space to
+ * list), or that the re-read ahead of a repair found the pointer removed;
+ * `no-ladder-seed` means a swap was due, or a repair needed, but the login
+ * held no ladder seed to mint with (a non-standing record); `failed` means
+ * the pointed generation's read or a swap stage threw -- reported in
+ * `failed` under the pointed generation's id, with the collect fan-out
+ * still run.
  */
-export type ClientAnnexGcSwapOutcome = 'replaced' | 'not-due' | 'deferred-live' | 'no-pointer' | 'no-ladder-seed' | 'failed';
+export type ClientAnnexGcSwapOutcome = 'replaced' | 'repaired' | 'not-due' | 'deferred-live' | 'no-pointer' | 'no-ladder-seed' | 'failed';
 /**
- * One GC pass's report: the swap outcome, the annex DID the account
- * points at after the pass, the generation ids collected (revoked, digested,
- * deleted), and the per-generation failures. A report with `failed` entries
- * is a resumable success -- the next remembered login's pass picks up exactly
- * the generations still listed.
+ * One GC pass's report: the swap outcome, the annex DID the account points
+ * at after the pass (read back from the account log under this client's
+ * pin, so it is what the host serves and not what this pass believes), the
+ * generation ids collected (revoked, digested, deleted), the ids deferred
+ * (unpointed but not yet GC-quiet, kept for a later pass), and the
+ * per-generation failures. A report with `failed` or `deferred` entries is a
+ * resumable success -- the next remembered login's pass picks up exactly the
+ * generations still listed.
  */
 export interface ClientAnnexGcReport {
     swap: ClientAnnexGcSwapOutcome;
     pointedDid?: string;
     collected: string[];
+    deferred: string[];
     failed: Array<{
         generationId: string;
         error: unknown;
@@ -202,7 +245,38 @@ export interface ClientAnnexGenerationSwap {
  * a chain whose signer has left the document is read as that), re-writes
  * the digest (the deterministic payload id collapses the second row at read
  * time), and re-runs the idempotent delete; a swap torn before its re-point
- * leaves an unpointed fresh generation the same fan-out collects.
+ * leaves an unpointed fresh generation the same fan-out collects once it is
+ * GC-quiet.
+ *
+ * Two guards keep the fan-out off the pointed generation. The pointer the
+ * fan-out compares against is re-read from the account log under this
+ * client's pin immediately before the fan-out, so a sibling client's swap,
+ * or this pass's own re-point whose response was lost, is seen rather than
+ * the caller's pre-pass view. And an unpointed generation the fresh log
+ * never pointed at is collected only when GC-quiet, so a sibling mid-swap
+ * (minted, not yet pointed) keeps its fresh generation; one the log once
+ * pointed at is collected at once. A generation whose log does not exist
+ * carries no timestamp and is deleted at once. A sibling whose genesis and
+ * install both land in the gap between that read and the delete goes on to
+ * re-point at the deleted generation; the next remembered login's repair,
+ * or the next transient visit's readiness ensure, mends that.
+ *
+ * The pointed generation's log is read on every pass: when the swap is due
+ * it is the quiet gate, and on every pass it is the detector of a dead
+ * pointed generation (a collected or never-minted one the pointer still
+ * names), which the pass repairs with an off-cadence swap so the next
+ * transient visit can enroll. Before the repair the account log is re-read
+ * under this client's pin: when the pointer has moved off the one the caller
+ * passed, a sibling client swapped since the caller's read, and the pass
+ * reports `not-due` and repairs nothing (`no-pointer` when the re-read
+ * document carries none). The repair's own re-point is conditional on the
+ * same pointer, so a sibling's re-point landing while the repair mints also
+ * stands, and the pass reports `not-due`. The repair then confirms the
+ * auxiliary Space
+ * itself still answers, and refuses when it does not: replacing a gone Space
+ * is the transient readiness ensure's, whose two-probe rule tells absence
+ * from a masked read, and a repair racing it across two Spaces would strand
+ * whichever Space lost the re-point.
  *
  * @param options {object}
  * @param options.was {WasClient}   the storage client, signing as an
@@ -219,8 +293,8 @@ export interface ClientAnnexGenerationSwap {
  * @param options.zcapClient {ZcapClient}   signs the fresh generation
  *   delegation (the promoted account keyId)
  * @param [options.ladderSeed] {Uint8Array}   the login credential's ladder
- *   seed; absent, a due swap reports `no-ladder-seed` and only the collect
- *   fan-out runs
+ *   seed; absent, a due swap or a needed repair reports `no-ladder-seed` and
+ *   only the collect fan-out runs
  * @param options.recordDigest {Function}
  *   `({ generationId, firstEntry, lastEntry, entryCount }) => Promise<void>`
  *   -- writes the GenerationCollect wallet-activity row; called before the
@@ -277,6 +351,12 @@ export declare function runClientAnnexGc({ was, wasServerUrl, accountSpaceId, ac
  * refuses that chain, and the revoke stage reads the refusal against the
  * caller's `account.doc` and reports `signer-gone`.
  *
+ * The re-point lands only while the account log, re-read under this
+ * client's pin before the mint, still points at the generation the caller's
+ * `account.doc` names. A sibling's re-point that lands first stands, and the
+ * swap throws rather than move the account off it; the caller re-runs its
+ * ceremony over a fresh read.
+ *
  * @param options {object}   see {@link runClientAnnexGc} for the shared
  *   members ({ was, wasServerUrl, accountSpaceId, account, idStore,
  *   updateKeys, zcapClient }); `ladderSeed` here is the SURVIVING
@@ -284,6 +364,8 @@ export declare function runClientAnnexGc({ was, wasServerUrl, accountSpaceId, ac
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<ClientAnnexGenerationSwap>}   the fresh annex DID and
  *   what the revoke stage did
+ * @throws {Error}   `DelegatedClientsPointerMovedError` when the account log
+ *   no longer points at the generation `account.doc` names
  */
 export declare function swapClientAnnexGeneration({ was, wasServerUrl, accountSpaceId, account, idStore, signer, zcapClient, ladderSeed, now }: {
     was: WasClient;

package/dist/clientAnnex/gc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gc.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/gc.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAepD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAEvE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAA2B,CAAA;AAE/D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAsB,CAAA;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAiB,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oCAAoC,CAAC,EACnD,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,GAAG,SAAS,CAgBrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,GAAG,EACH,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACH,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAUV;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,SAAS,GACT,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,QAAQ,CAAA;AAEZ;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,wBAAwB,CAAA;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,4BAA4B,CAAA;IACpC,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,YAAY,EAAE,CAAC,MAAM,EAAE;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8G/B;AAuLD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,MAAM,EACN,UAAU,EACV,UAAU,EACV,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,CAAC,CAAA;IAC/C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA6BrC"}
+{"version":3,"file":"gc.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/gc.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAkBpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAEhE,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAEvE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAA2B,CAAA;AAE/D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAsB,CAAA;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAiB,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oCAAoC,CAAC,EACnD,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,GAAG,SAAS,CAgBrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,GAAG,EACH,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACH,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,UAAU,GACV,SAAS,GACT,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,QAAQ,CAAA;AAEZ;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,wBAAwB,CAAA;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,4BAA4B,CAAA;IACpC,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,YAAY,EAAE,CAAC,MAAM,EAAE;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6L/B;AAoMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,MAAM,EACN,UAAU,EACV,UAAU,EACV,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,CAAC,CAAA;IAC/C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAuCrC"}