@interop/wallet-core 0.13.0 → 0.15.0

package/dist/clients/revocation.js

@@ -0,0 +1,142 @@
+import { revokeWebvhClient } from '../webvh/index.js';
+import { cascadeCollectionsToPuk, readPukRoster, rosterRecipientKid, rotatePukRoster } from '../keys/index.js';
+/**
+ * Resolves the collection ids the fan-out covers, whether they are a fixed set
+ * or a listing the app performs.
+ *
+ * @param options {object}
+ * @param options.collections {CascadeCollections}
+ * @returns {Promise<string[]>}
+ */
+async function collectionIdsOf({ collections }) {
+    const { collectionIds } = collections;
+    return typeof collectionIds === 'function'
+        ? await collectionIds()
+        : collectionIds;
+}
+/**
+ * Runs the whole revocation cascade for one enrolled wallet client. See the
+ * module doc for the order and the convergence story. Throws before touching
+ * anything on a call that must not proceed (revoking this client itself, a
+ * client whose active update key was not attributed); once the document edit
+ * lands, a thrown later stage leaves durable state a naive re-run -- or the
+ * login-time sweep -- converges from.
+ *
+ * The document edit's `StagedCommitmentAmbiguousError` passes through
+ * unwrapped, so a surface can re-word it ("disconnect this wallet from the
+ * other one instead"). Match it on `err.name ===
+ * 'StagedCommitmentAmbiguousError'` -- a stable contract on that class --
+ * rather than on `instanceof`, which does not survive a linked or duplicated
+ * copy of this package.
+ *
+ * @param options {object}
+ * @param options.idStore {WebvhIdStore}   the account's `id` collection store
+ * @param options.updateKeys {ClientWebvhUpdateKeys}   THIS client's did:webvh
+ *   update-key seeds, which sign the document edit
+ * @param options.revokedClient {RevokedClientKeys}   the revoked client's
+ *   public halves (its two verification-method multibases and its active
+ *   update key)
+ * @param [options.knownLatentHashes] {string[]}   the standing recovery codes'
+ *   update-key hashes, so the document edit can tell the revoked client's
+ *   staged commitment apart from a latent recovery commitment (the one
+ *   ambiguous log shape). Best-effort on the caller's side: an unreadable
+ *   registry simply omits them
+ * @param [options.ownSigningKeyMultibase] {string}   this client's own signing
+ *   key; supplied, self-revocation is refused up front by the rule the surface
+ *   should name, rather than by the update-key check inside the edit
+ * @param options.rosterStore {EncryptionDescriptorStore}   the
+ *   `key-map/puk.json` roster store
+ * @param [options.puk] {Puk}   this client's cached per-user key
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key -- its roster entry
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onPukAdopted] {Function}   persists a rotated key: called
+ *   with `{ puk, latestEpochId, descriptor }` after the roster read and BEFORE
+ *   the fan-out. The key and the epoch pin must persist atomically
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param [options.remintRecoveryDelegations] {Function}   `({ document }) =>
+ *   Promise<{ reminted, skipped }>` -- the recovery-delegation re-mint stage,
+ *   for a wallet that issues recovery codes
+ * @param [options.onRotationAdopted] {Function}   `({ puk }) => Promise<void>`
+ *   -- the live-session adoption of a rotated key, run last so the session
+ *   keeps operating without a re-login
+ * @returns {Promise<ClientRevocationResult>}
+ */
+export async function revokeAccountClient({ idStore, updateKeys, revokedClient, knownLatentHashes, ownSigningKeyMultibase, rosterStore, puk, clientKeyAgreementKey, pinnedEpochId, onPukAdopted, collections, remintRecoveryDelegations, onRotationAdopted }) {
+    if (ownSigningKeyMultibase &&
+        ownSigningKeyMultibase === revokedClient.signingKeyMultibase) {
+        throw new Error('This wallet cannot disconnect itself; use another enrolled wallet ' +
+            'client (or a recovery code) instead.');
+    }
+    if (!revokedClient.updateKeyMultibase) {
+        throw new Error("This wallet's update key could not be attributed from the account " +
+            'log, so it cannot be disconnected from here.');
+    }
+    // 1. The document edit -- the pull axis everywhere, first. It resolves the
+    // document as it now stands, which is what stage 2 resolves its remaining
+    // recipients from.
+    const { doc } = await revokeWebvhClient({
+        idStore,
+        updateKeys,
+        revokedClient,
+        ...(knownLatentHashes ? { knownLatentHashes } : {})
+    });
+    // 2. The roster rotation, recipients resolved from that same document.
+    await rotatePukRoster({
+        store: rosterStore,
+        document: doc,
+        retireRecipientId: rosterRecipientKid(revokedClient)
+    });
+    const read = await readPukRoster({
+        store: rosterStore,
+        ...(puk ? { puk } : {}),
+        clientKeyAgreementKey,
+        pinnedEpochId
+    });
+    if (!read) {
+        // No roster to rotate (an account whose collections are not encrypted
+        // yet). The document edit has already landed, so the client IS
+        // disconnected -- a completed cascade with nothing rotated, not a failure.
+        return {
+            rotated: false,
+            collections: { outcomes: {}, failed: [] },
+            document: doc
+        };
+    }
+    if (read.rotated) {
+        await onPukAdopted?.({
+            puk: read.puk,
+            latestEpochId: read.latestEpochId,
+            descriptor: read.descriptor
+        });
+    }
+    // 3. The collection fan-out, in parallel -- run even when this call found
+    // the roster already rotated (a re-run after a crash), because the staleness
+    // rule finds exactly the stranded collections.
+    const cascade = await cascadeCollectionsToPuk({
+        collectionIds: await collectionIdsOf({ collections }),
+        storeFor: collections.storeFor,
+        ...(collections.isEncrypted
+            ? { isEncrypted: collections.isEncrypted }
+            : {}),
+        rosterDescriptor: read.descriptor,
+        clientKeyAgreementKey,
+        puk: read.puk
+    });
+    // 4. The recovery re-mints, while the registry is still readable under the
+    // session's pre-adoption vault keys.
+    const recovery = await remintRecoveryDelegations?.({ document: doc });
+    if (read.rotated) {
+        await onRotationAdopted?.({ puk: read.puk });
+    }
+    return {
+        rotated: read.rotated,
+        collections: cascade,
+        document: doc,
+        puk: read.puk,
+        rosterDescriptor: read.descriptor,
+        ...(recovery ? { recovery } : {})
+    };
+}
+//# sourceMappingURL=revocation.js.map

package/dist/clients/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAiDA,OAAO,EACL,iBAAiB,EAIlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,kBAAkB,EAClB,eAAe,EAGhB,MAAM,kBAAkB,CAAA;AA8BzB;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,EAC7B,WAAW,EAGZ;IACC,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAA;IACrC,OAAO,OAAO,aAAa,KAAK,UAAU;QACxC,CAAC,CAAC,MAAM,aAAa,EAAE;QACvB,CAAC,CAAC,aAAa,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,GAAG,EACH,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,WAAW,EACX,yBAAyB,EACzB,iBAAiB,EAqBlB;IACC,IACE,sBAAsB;QACtB,sBAAsB,KAAK,aAAa,CAAC,mBAAmB,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,sCAAsC,CACzC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACtC,OAAO;QACP,UAAU;QACV,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF,uEAAuE;IACvE,MAAM,eAAe,CAAC;QACpB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,GAAG;QACb,iBAAiB,EAAE,kBAAkB,CAAC,aAAa,CAAC;KACrD,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;QAC/B,KAAK,EAAE,WAAW;QAClB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,qBAAqB;QACrB,aAAa;KACd,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,sEAAsE;QACtE,+DAA+D;QAC/D,2EAA2E;QAC3E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACzC,QAAQ,EAAE,GAAG;SACd,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,YAAY,EAAE,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;QAC5C,aAAa,EAAE,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;YACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,qBAAqB;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAA;IAEF,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC"}

package/dist/clients/rosterPolicy.d.ts

@@ -0,0 +1,124 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The login-time wrap-set roster policy: what a wallet does with
+ * `key-map/puk.json` when a session starts, and how it decides between
+ * refusing the session and carrying on offline.
+ *
+ * Two steps, in this order:
+ *
+ * - {@link checkPukRosterAtLogin} -- one direct read of the roster, before any
+ *   storage client or cipher is built (a stale key would silently fail to
+ *   decrypt everything written since another client rotated it). The served
+ *   roster is authenticated and checked against the locally pinned latest-seen
+ *   epoch either way.
+ *
+ *   **Failure semantics.** The three roster refusals -- a rolled-back or
+ *   replayed roster, an epoch configuration that fails authentication, and a
+ *   current epoch this client cannot unwrap -- rethrow and refuse the session:
+ *   they are the same continuity class as a substituted account pointer, and
+ *   proceeding would mean acting under a key nobody vouched for. Anything else
+ *   (an unreachable server, a transport hiccup) is warned about and resolves
+ *   `null`, so an offline start keeps working from the cached key.
+ *
+ * - {@link convergePukRosterToAccount} -- the roster stage of the
+ *   cascade-completion sweep, which the collection fan-out then runs behind. A
+ *   revocation torn between its document edit and its roster rotation leaves
+ *   the roster wrapping the CURRENT key to a client the document no longer
+ *   keys -- durable and silent, since the revoked client's document edit will
+ *   never be re-run -- so it is finished here. Strictly best-effort: a log
+ *   that cannot be fetched or verified (offline, an unpromoted account) leaves
+ *   the start's own roster read in place, and the next start tries again.
+ *
+ *   **Once per session.** A converged roster stays converged, and the engine
+ *   restart (or storage-cipher rebuild) that adopts a rotation must not
+ *   converge again. The guard is the caller's, because only the app knows what
+ *   a session is.
+ *
+ * Adoption is a callback in both: persisting a key, pinning an epoch, swapping
+ * a live session's vault keys, and rebuilding ciphers are app-side side
+ * effects. What is NOT app-side is the ordering -- the key and the epoch pin
+ * persist atomically (the pin must never advance without the key that
+ * authenticated the roster it advanced to), and the adoption lands BEFORE the
+ * collection fan-out runs against it.
+ */
+import type { IKeyAgreementKey } from '@interop/data-integrity-core';
+import type { CollectionEncryption } from '@interop/was-client';
+import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import { type Puk, type PukRosterReadResult } from '../keys/index.js';
+import type { AccountLogPointer } from './listing.js';
+/**
+ * What an adopted per-user key carries: the key itself, the roster epoch to
+ * pin as latest-seen, and the descriptor it was read from.
+ */
+export interface AdoptedPuk {
+    puk: Puk;
+    latestEpochId: string;
+    descriptor: CollectionEncryption;
+}
+/**
+ * The login-time roster read. See the module doc for the failure semantics.
+ *
+ * @param options {object}
+ * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
+ *   store
+ * @param [options.puk] {Puk}   this client's cached per-user key; omitted (a
+ *   freshly enrolled client's first read) the key is always taken from the
+ *   roster
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key -- its roster entry
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onRosterRead] {Function}   called with the
+ *   {@link AdoptedPuk} of every successful read (whether or not it rotated),
+ *   so the epoch pin advances to the epoch just authenticated; the key and the
+ *   pin must persist atomically
+ * @returns {Promise<PukRosterReadResult | null>}   the read, or `null` when
+ *   the account has no roster yet or the server could not be reached
+ */
+export declare function checkPukRosterAtLogin({ store, puk, clientKeyAgreementKey, pinnedEpochId, onRosterRead }: {
+    store: EncryptionDescriptorStore;
+    puk?: Puk;
+    clientKeyAgreementKey: IKeyAgreementKey;
+    pinnedEpochId?: string | null;
+    onRosterRead?: (adopted: AdoptedPuk) => Promise<void>;
+}): Promise<PukRosterReadResult | null>;
+/**
+ * Converges the roster onto the account's locally verified did:webvh document,
+ * adopting a rotation the ordinary way (a roster re-read) and handing back the
+ * key and descriptor the collection fan-out should run against.
+ *
+ * Best-effort throughout: any failure resolves to the unchanged input, since
+ * the fan-out is still worth running on the key this start already has.
+ *
+ * @param options {object}
+ * @param options.pointer {AccountLogPointer}   where the account log lives
+ * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
+ *   store
+ * @param options.puk {Puk}   the start's current per-user key
+ * @param options.descriptor {CollectionEncryption}   the start's roster read
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onPukAdopted] {Function}   called with the
+ *   {@link AdoptedPuk} of a rotation, before the fan-out runs
+ * @returns {Promise<object>}   whether the roster rotated on this call, the
+ *   stale recipient kids found, and the key + descriptor to fan out with
+ */
+export declare function convergePukRosterToAccount({ pointer, store, puk, descriptor, clientKeyAgreementKey, pinnedEpochId, onPukAdopted }: {
+    pointer: AccountLogPointer;
+    store: EncryptionDescriptorStore;
+    puk: Puk;
+    descriptor: CollectionEncryption;
+    clientKeyAgreementKey: IKeyAgreementKey;
+    pinnedEpochId?: string | null;
+    onPukAdopted?: (adopted: AdoptedPuk) => Promise<void>;
+}): Promise<{
+    rotated: boolean;
+    staleRecipientIds: string[];
+    puk: Puk;
+    descriptor: CollectionEncryption;
+}>;
+//# sourceMappingURL=rosterPolicy.d.ts.map

package/dist/clients/rosterPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAML,KAAK,GAAG,EACR,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,GAAG,CAAA;IACR,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,KAAK,EACL,GAAG,EACH,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,GAAG,CAAC,EAAE,GAAG,CAAA;IACT,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAkCtC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,OAAO,EACP,KAAK,EACL,GAAG,EACH,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,GAAG,EAAE,GAAG,CAAA;IACR,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtD,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,GAAG,EAAE,GAAG,CAAA;IACR,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CAmDD"}

package/dist/clients/rosterPolicy.js

@@ -0,0 +1,125 @@
+import { convergePukRosterToDocument, PukRosterContinuityError, PukRosterIntegrityError, PukRosterUnwrapError, readPukRoster } from '../keys/index.js';
+import { verifyAccountLog } from '../webvh/index.js';
+/**
+ * The login-time roster read. See the module doc for the failure semantics.
+ *
+ * @param options {object}
+ * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
+ *   store
+ * @param [options.puk] {Puk}   this client's cached per-user key; omitted (a
+ *   freshly enrolled client's first read) the key is always taken from the
+ *   roster
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key -- its roster entry
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onRosterRead] {Function}   called with the
+ *   {@link AdoptedPuk} of every successful read (whether or not it rotated),
+ *   so the epoch pin advances to the epoch just authenticated; the key and the
+ *   pin must persist atomically
+ * @returns {Promise<PukRosterReadResult | null>}   the read, or `null` when
+ *   the account has no roster yet or the server could not be reached
+ */
+export async function checkPukRosterAtLogin({ store, puk, clientKeyAgreementKey, pinnedEpochId, onRosterRead }) {
+    try {
+        const read = await readPukRoster({
+            store,
+            ...(puk ? { puk } : {}),
+            clientKeyAgreementKey,
+            pinnedEpochId
+        });
+        if (!read) {
+            return null;
+        }
+        await onRosterRead?.({
+            puk: read.puk,
+            latestEpochId: read.latestEpochId,
+            descriptor: read.descriptor
+        });
+        return read;
+    }
+    catch (err) {
+        if (err instanceof PukRosterContinuityError ||
+            err instanceof PukRosterIntegrityError ||
+            err instanceof PukRosterUnwrapError) {
+            throw err;
+        }
+        // An unreachable server (or any transport hiccup) must not lock the user
+        // out of an offline start: the cached key stays authoritative.
+        console.warn('The wrap-set roster check failed; continuing with the cached ' +
+            'per-user key:', err);
+        return null;
+    }
+}
+/**
+ * Converges the roster onto the account's locally verified did:webvh document,
+ * adopting a rotation the ordinary way (a roster re-read) and handing back the
+ * key and descriptor the collection fan-out should run against.
+ *
+ * Best-effort throughout: any failure resolves to the unchanged input, since
+ * the fan-out is still worth running on the key this start already has.
+ *
+ * @param options {object}
+ * @param options.pointer {AccountLogPointer}   where the account log lives
+ * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
+ *   store
+ * @param options.puk {Puk}   the start's current per-user key
+ * @param options.descriptor {CollectionEncryption}   the start's roster read
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onPukAdopted] {Function}   called with the
+ *   {@link AdoptedPuk} of a rotation, before the fan-out runs
+ * @returns {Promise<object>}   whether the roster rotated on this call, the
+ *   stale recipient kids found, and the key + descriptor to fan out with
+ */
+export async function convergePukRosterToAccount({ pointer, store, puk, descriptor, clientKeyAgreementKey, pinnedEpochId, onPukAdopted }) {
+    const unchanged = {
+        rotated: false,
+        staleRecipientIds: [],
+        puk,
+        descriptor
+    };
+    try {
+        const { doc } = await verifyAccountLog(pointer);
+        const { rotated, staleRecipientIds } = await convergePukRosterToDocument({
+            store,
+            document: doc,
+            descriptor
+        });
+        if (!rotated) {
+            return unchanged;
+        }
+        console.warn('The wrap-set roster still wrapped the current key to ' +
+            `${staleRecipientIds.length} recipient(s) the account document no ` +
+            'longer keys; the rotation has been completed.');
+        // Rotated: the fresh key is only readable from the roster, so re-read it
+        // and adopt it before the collection fan-out runs against it.
+        const read = await readPukRoster({
+            store,
+            puk,
+            clientKeyAgreementKey,
+            pinnedEpochId
+        });
+        if (!read) {
+            return unchanged;
+        }
+        await onPukAdopted?.({
+            puk: read.puk,
+            latestEpochId: read.latestEpochId,
+            descriptor: read.descriptor
+        });
+        return {
+            rotated: true,
+            staleRecipientIds,
+            puk: read.puk,
+            descriptor: read.descriptor
+        };
+    }
+    catch (err) {
+        console.warn('Could not converge the wrap-set roster onto the account document:', err);
+        return unchanged;
+    }
+}
+//# sourceMappingURL=rosterPolicy.js.map

package/dist/clients/rosterPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAgDA,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EAGd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,KAAK,EACL,GAAG,EACH,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;YAC/B,KAAK;YACL,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,YAAY,EAAE,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,wBAAwB;YACvC,GAAG,YAAY,uBAAuB;YACtC,GAAG,YAAY,oBAAoB,EACnC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,+DAA+D;YAC7D,eAAe,EACjB,GAAG,CACJ,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,OAAO,EACP,KAAK,EACL,GAAG,EACH,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EASb;IAMC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,iBAAiB,EAAE,EAAc;QACjC,GAAG;QACH,UAAU;KACX,CAAA;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,2BAA2B,CAAC;YACvE,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;SACX,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,CAAC,IAAI,CACV,uDAAuD;YACrD,GAAG,iBAAiB,CAAC,MAAM,wCAAwC;YACnE,+CAA+C,CAClD,CAAA;QACD,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;YAC/B,KAAK;YACL,GAAG;YACH,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,YAAY,EAAE,CAAC;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;QACF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,iBAAiB;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,mEAAmE,EACnE,GAAG,CACJ,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/enrollment/connectCode.d.ts

@@ -0,0 +1,29 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The connect-code grammar, on its own: the scheme-like prefix a wallet
+ * connect code carries and the predicate that recognizes one.
+ *
+ * It is a leaf module deliberately. Recognizing a connect code is something a
+ * paste box or a QR scanner does long before any ceremony machinery is
+ * involved, so the input classifier can depend on this without pulling in the
+ * enrollment ceremony's whole graph -- and there is still exactly one spelling
+ * of the prefix in the codebase.
+ */
+/**
+ * The connect-code prefix; the payload after it is base64url(JSON) of an
+ * enrollment request plus a `v` version stamp.
+ */
+export declare const CONNECT_CODE_PREFIX = "freewallet-connect:";
+/**
+ * Whether some pasted or scanned text is a wallet connect code. A prefix
+ * check only -- whether the payload is well-formed (and of a supported
+ * version) is `parseEnrollmentRequest`'s answer, which is what surfaces a
+ * clear refusal for a code that is recognizable but unusable.
+ *
+ * @param text {string}
+ * @returns {boolean}
+ */
+export declare function isConnectCode(text: string): boolean;
+//# sourceMappingURL=connectCode.d.ts.map

package/dist/enrollment/connectCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectCode.d.ts","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/enrollment/connectCode.js

@@ -0,0 +1,31 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The connect-code grammar, on its own: the scheme-like prefix a wallet
+ * connect code carries and the predicate that recognizes one.
+ *
+ * It is a leaf module deliberately. Recognizing a connect code is something a
+ * paste box or a QR scanner does long before any ceremony machinery is
+ * involved, so the input classifier can depend on this without pulling in the
+ * enrollment ceremony's whole graph -- and there is still exactly one spelling
+ * of the prefix in the codebase.
+ */
+/**
+ * The connect-code prefix; the payload after it is base64url(JSON) of an
+ * enrollment request plus a `v` version stamp.
+ */
+export const CONNECT_CODE_PREFIX = 'freewallet-connect:';
+/**
+ * Whether some pasted or scanned text is a wallet connect code. A prefix
+ * check only -- whether the payload is well-formed (and of a supported
+ * version) is `parseEnrollmentRequest`'s answer, which is what surfaces a
+ * clear refusal for a code that is recognizable but unusable.
+ *
+ * @param text {string}
+ * @returns {boolean}
+ */
+export function isConnectCode(text) {
+    return text.trim().startsWith(CONNECT_CODE_PREFIX);
+}
+//# sourceMappingURL=connectCode.js.map

package/dist/enrollment/connectCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectCode.js","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAA;AACpD,CAAC"}

package/dist/enrollment/enrollment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAQxE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAU7B,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAa1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AASD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,cAAc,EAAE,yBAAyB,CAAA;IACzC,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB3E;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACR,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;CACxB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CA8D/C"}
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAQxE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAU7B,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AASD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,cAAc,EAAE,yBAAyB,CAAA;IACzC,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB3E;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACR,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;CACxB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CA8D/C"}

package/dist/enrollment/enrollment.js

@@ -6,11 +6,7 @@ import { AccountLogMissingError, verifyAccountLog } from '../webvh/verifyLog.js'
 import { addPukRosterRecipient } from '../keys/pukRoster.js';
 import { readPukRoster, rosterRecipientKid } from '../keys/pukRoster.js';
 import { pukRosterDescriptorStore } from '../keys/rosterStore.js';
-/**
- * The connect-code prefix; the payload after it is base64url(JSON) of an
- * `EnrollmentRequest` plus a `v` version stamp.
- */
-const CONNECT_CODE_PREFIX = 'freewallet-connect:';
+import { CONNECT_CODE_PREFIX } from './connectCode.js';
 /**
  * The connect-code payload version this build mints and accepts.
  */

package/dist/enrollment/enrollment.js.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAIjE;;;GAGG;AACH,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAS9B;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YACE,OAAO,GAAG,6DAA6D;QACrE,oDAAoD;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EAGR;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACvE,OAAO,GAAG,mBAAmB,GAAG,cAAc,CAAC,MAAM,CACnD,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,EAAE,CAAA;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,IAAI,EAGL;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACjE,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EACJ,CAAC,EACD,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAAE,SAAS,EAC7B,wBAAwB,EACzB,GAAG,MAAiC,CAAA;IACrC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,MAAc,EAAE,IAAY,EAAU,EAAE;QAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAA;QAClE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IACD,OAAO;QACL,mBAAmB,EAAE,UAAU,CAC7B,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,CACd;QACD,wBAAwB,EAAE,UAAU,CAClC,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,CACpB;QACD,kBAAkB,EAAE,UAAU,CAC5B,SAAS,EACT,wBAAwB,EACxB,YAAY,CACb;QACD,wBAAwB,EAAE,UAAU,CAClC,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,CACpB;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EAGR;IACC,OAAO,WAAW,OAAO,CAAC,mBAAmB,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EAGR;IACC,OAAO,kBAAkB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAMzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,yBAAyB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IACD,OAAO;QACL,UAAU;QACV,eAAe;QACf,IAAI,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,SAAS,EAAE,QAAQ,CAAC,EAAE;KACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,OAAO,EAOR;IACC,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,qBAAqB,CAAC;QAC1B,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC;YACvC,kBAAkB,EAAE,OAAO,CAAC,wBAAwB;SACrD;QACD,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACtC,OAAO;QACP,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,OAAO;KACnB,CAAC,CAAA;IACF,OAAO;QACL,GAAG;QACH,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC3C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EAKR;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,4BAA4B,CAC/B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YAChC,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,UAAU;KACjC,CAAC,CAAA;IACF,MAAM,QAAQ,GACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB,CACzD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,wBAAwB,CAAC;QACrC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;QAC/B,KAAK;QACL,qBAAqB,EAAE,eAAe;KACvC,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAA;AAC7D,CAAC"}
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAGjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAS9B;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YACE,OAAO,GAAG,6DAA6D;QACrE,oDAAoD;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EAGR;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACvE,OAAO,GAAG,mBAAmB,GAAG,cAAc,CAAC,MAAM,CACnD,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,EAAE,CAAA;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,IAAI,EAGL;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACjE,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EACJ,CAAC,EACD,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAAE,SAAS,EAC7B,wBAAwB,EACzB,GAAG,MAAiC,CAAA;IACrC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,MAAc,EAAE,IAAY,EAAU,EAAE;QAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAA;QAClE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IACD,OAAO;QACL,mBAAmB,EAAE,UAAU,CAC7B,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,CACd;QACD,wBAAwB,EAAE,UAAU,CAClC,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,CACpB;QACD,kBAAkB,EAAE,UAAU,CAC5B,SAAS,EACT,wBAAwB,EACxB,YAAY,CACb;QACD,wBAAwB,EAAE,UAAU,CAClC,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,CACpB;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EAGR;IACC,OAAO,WAAW,OAAO,CAAC,mBAAmB,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EAGR;IACC,OAAO,kBAAkB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAMzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,yBAAyB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IACD,OAAO;QACL,UAAU;QACV,eAAe;QACf,IAAI,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,SAAS,EAAE,QAAQ,CAAC,EAAE;KACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,OAAO,EAOR;IACC,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,qBAAqB,CAAC;QAC1B,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC;YACvC,kBAAkB,EAAE,OAAO,CAAC,wBAAwB;SACrD;QACD,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACtC,OAAO;QACP,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,OAAO;KACnB,CAAC,CAAA;IACF,OAAO;QACL,GAAG;QACH,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC3C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EAKR;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,4BAA4B,CAC/B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YAChC,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,UAAU;KACjC,CAAC,CAAA;IACF,MAAM,QAAQ,GACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB,CACzD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,wBAAwB,CAAC;QACrC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;QAC/B,KAAK;QACL,qBAAqB,EAAE,eAAe;KACvC,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAA;AAC7D,CAAC"}

package/dist/enrollment/index.d.ts

@@ -6,6 +6,8 @@
  * ceremony -- connecting another wallet client to an existing account with
  * only public halves travelling, point to point.
  *
+ * - `CONNECT_CODE_PREFIX` / `isConnectCode` -- the connect-code grammar, on
+ *   its own so an input classifier can recognize a code without the ceremony.
  * - `mintEnrollmentRequest` / `encodeEnrollmentRequest` /
  *   `parseEnrollmentRequest` / `enrollmentClientDid` /
  *   `enrollmentRecipientKid` -- the connect-code channel layer.
@@ -17,4 +19,5 @@
  */
 export { approveEnrollment, completeEnrollmentCore, encodeEnrollmentRequest, EnrollmentPendingError, enrollmentClientDid, enrollmentRecipientKid, mintEnrollmentRequest, parseEnrollmentRequest } from './enrollment.js';
 export type { EnrollmentRequest } from './enrollment.js';
+export { CONNECT_CODE_PREFIX, isConnectCode } from './connectCode.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/enrollment/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/enrollment/index.js

@@ -6,6 +6,8 @@
  * ceremony -- connecting another wallet client to an existing account with
  * only public halves travelling, point to point.
  *
+ * - `CONNECT_CODE_PREFIX` / `isConnectCode` -- the connect-code grammar, on
+ *   its own so an input classifier can recognize a code without the ceremony.
  * - `mintEnrollmentRequest` / `encodeEnrollmentRequest` /
  *   `parseEnrollmentRequest` / `enrollmentClientDid` /
  *   `enrollmentRecipientKid` -- the connect-code channel layer.
@@ -16,4 +18,5 @@
  *   the key set stays with the caller's own unlock layer.
  */
 export { approveEnrollment, completeEnrollmentCore, encodeEnrollmentRequest, EnrollmentPendingError, enrollmentClientDid, enrollmentRecipientKid, mintEnrollmentRequest, parseEnrollmentRequest } from './enrollment.js';
+export { CONNECT_CODE_PREFIX, isConnectCode } from './connectCode.js';
 //# sourceMappingURL=index.js.map

package/dist/enrollment/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA"}