@interop/wallet-core 0.16.0 → 0.18.0

package/dist/keys/clientKeyRecord.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientKeyRecord.js","sourceRoot":"","sources":["../../src/keys/clientKeyRecord.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAI5C;;GAEG;AACH,MAAM,YAAY,GAAG,EAAE,CAAA;AAgDvB;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,IAAI,EAIL;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,cAAc,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,oBAAoB,EAAE;YAC7D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,WAAW,YAAY,SAAS,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAInC,CAAA;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC7E,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACpC,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,YAAY,CAAC;YACxB,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,kBAAkB;SACzB,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,KAIrD,CAAA;IACD,OAAO;QACL,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,GAAG,CAAC,iBAAiB,KAAK,SAAS;YACjC,CAAC,CAAC;gBACE,iBAAiB,EAAE,YAAY,CAAC;oBAC9B,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,+BAA+B;iBACtC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,UAAU,EACV,GAAG,EACH,eAAe,EACf,UAAU,EACV,UAAU,EACV,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAQrC;IACC,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,wCAAwC,YAAY,SAAS,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,GAAG,CAAC,GAAG;YACL,CAAC,CAAC;gBACE,GAAG,EAAE;oBACH,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;oBACzC,GAAG,CAAC,GAAG,CAAC,WAAW;wBACjB,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;wBACzD,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC;gBACE,KAAK,EAAE;oBACL,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC;oBAC7D,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC;oBAC7D,GAAG,CAAC,eAAe,CAAC,iBAAiB;wBACnC,CAAC,CAAC;4BACE,iBAAiB,EAAE,cAAc,CAAC,MAAM,CACtC,eAAe,CAAC,iBAAiB,CAClC;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EAGT;IACC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAM1D,CAAA;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;IACrE,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAC3C,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,MAAM,EAGP;IACC,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;IAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AACpE,CAAC"}
+{"version":3,"file":"clientKeyRecord.js","sourceRoot":"","sources":["../../src/keys/clientKeyRecord.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAI5C;;GAEG;AACH,MAAM,YAAY,GAAG,EAAE,CAAA;AAgDvB;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,IAAI,EAIL;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,cAAc,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,oBAAoB,EAAE;YAC7D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,WAAW,YAAY,SAAS,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAInC,CAAA;IACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC;QAC/B,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,mBAAmB;KAC1B,CAAC,CAAA;IACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IACpC,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,YAAY,CAAC;YACxB,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,KAIrD,CAAA;IACD,OAAO;QACL,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,UAAU,EAAE,YAAY,CAAC;YACvB,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE,uBAAuB;SAC9B,CAAC;QACF,GAAG,CAAC,iBAAiB,KAAK,SAAS;YACjC,CAAC,CAAC;gBACE,iBAAiB,EAAE,YAAY,CAAC;oBAC9B,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,+BAA+B;iBACtC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,IAAI,EAIL;IACC,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,WAAW,YAAY,SAAS,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,UAAU,EACV,OAAO,EACP,eAAe,EACf,UAAU,EACV,UAAU,EACV,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAQrC;IACC,OAAO;QACL,UAAU,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,OAAO,EAAE;oBACP,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,MAAM,EAAE,YAAY,CAAC;wBACnB,KAAK,EAAE,OAAO,CAAC,MAAM;wBACrB,IAAI,EAAE,mBAAmB;qBAC1B,CAAC;oBACF,GAAG,CAAC,OAAO,CAAC,WAAW;wBACrB,CAAC,CAAC;4BACE,WAAW,EAAE,YAAY,CAAC;gCACxB,KAAK,EAAE,OAAO,CAAC,WAAW;gCAC1B,IAAI,EAAE,uBAAuB;6BAC9B,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC;gBACE,KAAK,EAAE;oBACL,UAAU,EAAE,YAAY,CAAC;wBACvB,KAAK,EAAE,eAAe,CAAC,UAAU;wBACjC,IAAI,EAAE,uBAAuB;qBAC9B,CAAC;oBACF,UAAU,EAAE,YAAY,CAAC;wBACvB,KAAK,EAAE,eAAe,CAAC,UAAU;wBACjC,IAAI,EAAE,uBAAuB;qBAC9B,CAAC;oBACF,GAAG,CAAC,eAAe,CAAC,iBAAiB;wBACnC,CAAC,CAAC;4BACE,iBAAiB,EAAE,YAAY,CAAC;gCAC9B,KAAK,EAAE,eAAe,CAAC,iBAAiB;gCACxC,IAAI,EAAE,+BAA+B;6BACtC,CAAC;yBACH;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,SAAS;KACV,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EAGT;IACC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAM9D,CAAA;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;IACrE,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,MAAM,EAGP;IACC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAA;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;AACxE,CAAC"}

package/dist/keys/index.d.ts

@@ -2,48 +2,50 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/wallet-core/keys` subpath: the per-user key (PUK) and its
+ * The `@interop/wallet-core/keys` subpath: the user key and its
  * wrap-set roster -- recipient zero of every encrypted collection, and the one
  * channel that delivers it to each enrolled wallet client.
  *
- * - `mintPuk` / `pukVaultKeys` -- minting the account's PUK and rebuilding the
+ * - `mintUserKey` / `userKeyVaultKeys` -- minting the account's user key and
+ *   rebuilding the
  *   vault key-agreement key + resolver from stored material.
  * - `encodeClientKeyRecord` / `decodeClientKeyRecord` -- the contents codec and
  *   strict validation of the local client-key record each client keeps its own
  *   key material in (storage and wrapping stay app-side).
- * - `ensurePukRoster` / `addPukRosterRecipient` / `readPukRoster` /
- *   `pukRosterRecipientResolver` -- the `key-map/puk.json` roster over the
+ * - `ensureUserKeyRoster` / `addUserKeyRosterRecipient` / `readUserKeyRoster` /
+ *   `userKeyRosterRecipientResolver` -- the `key-map/user-key.json` roster over the
  *   was-client descriptor-store seam, with the three client-side guards a
  *   resource-hosted descriptor needs (`epochsMac`, the latest-seen epoch pin,
  *   and a recipient resolver backed by the locally verified did:webvh
  *   document).
- * - `pukRosterDescriptorStore` -- that descriptor store, built from a bare
+ * - `userKeyRosterDescriptorStore` -- that descriptor store, built from a bare
  *   signing client for the login-time direct read.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap, the roster read, and the rotation that retires it.
- * - `convergePukRosterToDocument` -- the standing detector for a revocation
+ * - `convergeUserKeyRosterToDocument` -- the standing detector for a revocation
  *   cascade torn between the document edit and the roster rotation: a roster
  *   recipient the document no longer keys is rotated away from.
  * - `readClientLabels` / `setClientLabel` / `removeClientLabel` /
  *   `wasClientLabelsStore` -- the enrolled-client display labels
  *   (`key-map/client-labels.json`), the record a "your wallets" surface names
  *   clients from, and the WAS-backed store they run through.
- * - `rotatePukRoster` / `unwrapPukGenerations` / `rotateCollectionEpochsToPuk`
- *   / `cascadeCollectionsToPuk` / `pukAsRecipient` -- the PUK rotation
+ * - `rotateUserKeyRoster` / `unwrapUserKeyGenerations` /
+ *   `rotateCollectionEpochsToUserKey`
+ *   / `cascadeCollectionsToUserKey` / `userKeyAsRecipient` -- the user key rotation
  *   cascade: the roster rotation off a revoked recipient, the per-collection
  *   re-epoch that brings an encrypted collection onto the roster's current
- *   PUK, and the parallel best-effort fan-out over the collections the wallet
+ *   user key, and the parallel best-effort fan-out over the collections the wallet
  *   names (also the completion sweep's driver).
  */
-export { mintPuk, pukVaultKeys } from './puk.js';
-export type { Puk } from './puk.js';
-export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, parseClientRecordPuk, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
+export { mintUserKey, userKeyVaultKeys } from './userKey.js';
+export type { UserKey } from './userKey.js';
+export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, parseClientRecordUserKey, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
 export type { ClientKeyRecord, ClientKeyRecordJson, EnrolledClientKeyRecord } from './clientKeyRecord.js';
-export { addPukRosterRecipient, convergePukRosterToDocument, ensurePukRoster, PukRosterContinuityError, PukRosterIntegrityError, PukRosterUnwrapError, pukRosterRecipientResolver, readPukRoster, rosterRecipientKid, rotatePukRoster } from './pukRoster.js';
-export { cascadeCollectionsToPuk, pukAsRecipient, rotateCollectionEpochsToPuk, unwrapPukGenerations } from './pukCascade.js';
-export type { CollectionPukRotationOutcome, PukCascadeResult } from './pukCascade.js';
-export type { PukRosterReadResult, RosterRecipientDocument } from './pukRoster.js';
-export { pukRosterDescriptorStore } from './rosterStore.js';
+export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterEpochsSigner, userKeyRosterRecipientResolver, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster, verifyUserKeyRosterEpochsSig } from './userKeyRoster.js';
+export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
+export type { CollectionUserKeyRotationOutcome, UserKeyCascadeResult } from './userKeyCascade.js';
+export type { UserKeyRosterReadResult, RosterRecipientDocument } from './userKeyRoster.js';
+export { userKeyRosterDescriptorStore } from './rosterStore.js';
 export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';
 export type { ClientLabelsRecord, ClientLabelsStore } from './clientLabels.js';
 export { wasClientLabelsStore } from './wasLabelsStore.js';

package/dist/keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAChD,YAAY,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAEnC,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,4BAA4B,EAC5B,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,EAC7B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/index.js

@@ -2,44 +2,46 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/wallet-core/keys` subpath: the per-user key (PUK) and its
+ * The `@interop/wallet-core/keys` subpath: the user key and its
  * wrap-set roster -- recipient zero of every encrypted collection, and the one
  * channel that delivers it to each enrolled wallet client.
  *
- * - `mintPuk` / `pukVaultKeys` -- minting the account's PUK and rebuilding the
+ * - `mintUserKey` / `userKeyVaultKeys` -- minting the account's user key and
+ *   rebuilding the
  *   vault key-agreement key + resolver from stored material.
  * - `encodeClientKeyRecord` / `decodeClientKeyRecord` -- the contents codec and
  *   strict validation of the local client-key record each client keeps its own
  *   key material in (storage and wrapping stay app-side).
- * - `ensurePukRoster` / `addPukRosterRecipient` / `readPukRoster` /
- *   `pukRosterRecipientResolver` -- the `key-map/puk.json` roster over the
+ * - `ensureUserKeyRoster` / `addUserKeyRosterRecipient` / `readUserKeyRoster` /
+ *   `userKeyRosterRecipientResolver` -- the `key-map/user-key.json` roster over the
  *   was-client descriptor-store seam, with the three client-side guards a
  *   resource-hosted descriptor needs (`epochsMac`, the latest-seen epoch pin,
  *   and a recipient resolver backed by the locally verified did:webvh
  *   document).
- * - `pukRosterDescriptorStore` -- that descriptor store, built from a bare
+ * - `userKeyRosterDescriptorStore` -- that descriptor store, built from a bare
  *   signing client for the login-time direct read.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap, the roster read, and the rotation that retires it.
- * - `convergePukRosterToDocument` -- the standing detector for a revocation
+ * - `convergeUserKeyRosterToDocument` -- the standing detector for a revocation
  *   cascade torn between the document edit and the roster rotation: a roster
  *   recipient the document no longer keys is rotated away from.
  * - `readClientLabels` / `setClientLabel` / `removeClientLabel` /
  *   `wasClientLabelsStore` -- the enrolled-client display labels
  *   (`key-map/client-labels.json`), the record a "your wallets" surface names
  *   clients from, and the WAS-backed store they run through.
- * - `rotatePukRoster` / `unwrapPukGenerations` / `rotateCollectionEpochsToPuk`
- *   / `cascadeCollectionsToPuk` / `pukAsRecipient` -- the PUK rotation
+ * - `rotateUserKeyRoster` / `unwrapUserKeyGenerations` /
+ *   `rotateCollectionEpochsToUserKey`
+ *   / `cascadeCollectionsToUserKey` / `userKeyAsRecipient` -- the user key rotation
  *   cascade: the roster rotation off a revoked recipient, the per-collection
  *   re-epoch that brings an encrypted collection onto the roster's current
- *   PUK, and the parallel best-effort fan-out over the collections the wallet
+ *   user key, and the parallel best-effort fan-out over the collections the wallet
  *   names (also the completion sweep's driver).
  */
-export { mintPuk, pukVaultKeys } from './puk.js';
-export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, parseClientRecordPuk, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
-export { addPukRosterRecipient, convergePukRosterToDocument, ensurePukRoster, PukRosterContinuityError, PukRosterIntegrityError, PukRosterUnwrapError, pukRosterRecipientResolver, readPukRoster, rosterRecipientKid, rotatePukRoster } from './pukRoster.js';
-export { cascadeCollectionsToPuk, pukAsRecipient, rotateCollectionEpochsToPuk, unwrapPukGenerations } from './pukCascade.js';
-export { pukRosterDescriptorStore } from './rosterStore.js';
+export { mintUserKey, userKeyVaultKeys } from './userKey.js';
+export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, parseClientRecordUserKey, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
+export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterEpochsSigner, userKeyRosterRecipientResolver, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster, verifyUserKeyRosterEpochsSig } from './userKeyRoster.js';
+export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
+export { userKeyRosterDescriptorStore } from './rosterStore.js';
 export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';
 export { wasClientLabelsStore } from './wasLabelsStore.js';
 //# sourceMappingURL=index.js.map

package/dist/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAGhD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,kBAAkB,EAClB,eAAe,EAChB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,2BAA2B,EAC3B,oBAAoB,EACrB,MAAM,iBAAiB,CAAA;AAUxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,EAC7B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAU5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/rosterStore.d.ts

@@ -1,8 +1,8 @@
 import type { ZcapClient } from '@interop/ezcap';
 import { type EncryptionDescriptorStore } from '@interop/was-client/edv';
 /**
- * Builds the compare-and-swap descriptor store over `key-map/puk.json` in a
- * data Space.
+ * Builds the compare-and-swap descriptor store over `key-map/user-key.json` in
+ * a data Space.
  *
  * @param options {object}
  * @param options.storageServerUrl {string}
@@ -10,7 +10,7 @@ import { type EncryptionDescriptorStore } from '@interop/was-client/edv';
  * @param options.spaceId {string}   the data Space id
  * @returns {EncryptionDescriptorStore}
  */
-export declare function pukRosterDescriptorStore({ storageServerUrl, zcapClient, spaceId }: {
+export declare function userKeyRosterDescriptorStore({ storageServerUrl, zcapClient, spaceId }: {
     storageServerUrl: string;
     zcapClient: ZcapClient;
     spaceId: string;

package/dist/keys/rosterStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterStore.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAMhC;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACR,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,yBAAyB,CAQ5B"}
+{"version":3,"file":"rosterStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterStore.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAMhC;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,gBAAgB,EAChB,UAAU,EACV,OAAO,EACR,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,yBAAyB,CAQ5B"}

package/dist/keys/rosterStore.js

@@ -2,11 +2,11 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The descriptor store over a Space's PUK wrap-set roster (`key-map/puk.json`).
- * Standalone rather than a method on a wallet's remote-store class, because
- * the login-time direct read checks the roster BEFORE any storage client (or
- * cipher) is built: it takes the bare signing client instead of a store
- * instance.
+ * The descriptor store over a Space's user key wrap-set roster
+ * (`key-map/user-key.json`). Standalone rather than a method on a wallet's
+ * remote-store class, because the login-time direct read checks the roster
+ * BEFORE any storage client (or cipher) is built: it takes the bare signing
+ * client instead of a store instance.
  *
  * The `plaintext` collection override is load-bearing. Without it the client
  * decides plaintext vs encrypted by describing the collection first, and a 404
@@ -15,10 +15,10 @@
  */
 import { WasClient } from '@interop/was-client';
 import { resourceDescriptorStore } from '@interop/was-client/edv';
-import { KEY_MAP_COLLECTION, PUK_ROSTER_RESOURCE } from '../space/collections.js';
+import { KEY_MAP_COLLECTION, USER_KEY_ROSTER_RESOURCE } from '../space/collections.js';
 /**
- * Builds the compare-and-swap descriptor store over `key-map/puk.json` in a
- * data Space.
+ * Builds the compare-and-swap descriptor store over `key-map/user-key.json` in
+ * a data Space.
  *
  * @param options {object}
  * @param options.storageServerUrl {string}
@@ -26,13 +26,13 @@ import { KEY_MAP_COLLECTION, PUK_ROSTER_RESOURCE } from '../space/collections.js
  * @param options.spaceId {string}   the data Space id
  * @returns {EncryptionDescriptorStore}
  */
-export function pukRosterDescriptorStore({ storageServerUrl, zcapClient, spaceId }) {
+export function userKeyRosterDescriptorStore({ storageServerUrl, zcapClient, spaceId }) {
     const was = new WasClient({ serverUrl: storageServerUrl, zcapClient });
+    const collection = was
+        .space(spaceId)
+        .collection(KEY_MAP_COLLECTION.id, { encryption: 'plaintext' });
     return resourceDescriptorStore({
-        resource: was
-            .space(spaceId)
-            .collection(KEY_MAP_COLLECTION.id, { encryption: 'plaintext' })
-            .resource(PUK_ROSTER_RESOURCE)
+        resource: collection.resource(USER_KEY_ROSTER_RESOURCE)
     });
 }
 //# sourceMappingURL=rosterStore.js.map

package/dist/keys/rosterStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterStore.js","sourceRoot":"","sources":["../../src/keys/rosterStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EACL,uBAAuB,EAExB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,yBAAyB,CAAA;AAEhC;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,gBAAgB,EAChB,UAAU,EACV,OAAO,EAKR;IACC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,OAAO,uBAAuB,CAAC;QAC7B,QAAQ,EAAE,GAAG;aACV,KAAK,CAAC,OAAO,CAAC;aACd,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;aAC9D,QAAQ,CAAC,mBAAmB,CAAC;KACjC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"rosterStore.js","sourceRoot":"","sources":["../../src/keys/rosterStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EACL,uBAAuB,EAExB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,yBAAyB,CAAA;AAEhC;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,gBAAgB,EAChB,UAAU,EACV,OAAO,EAKR;IACC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,GAAG;SACnB,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;IACjE,OAAO,uBAAuB,CAAC;QAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KACxD,CAAC,CAAA;AACJ,CAAC"}

package/dist/keys/userKey.d.ts

@@ -0,0 +1,43 @@
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * The user key material: the X25519 key-agreement half as minted by the epoch
+ * construction (`id` is the key's own did:key; `secret` its raw 32-byte private
+ * key), plus the 32-byte seed of the user key's Ed25519 signing pair. Random
+ * per account; held in memory for the life of a session and persisted only
+ * inside a wrapped client-key record. The signing seed is absent on a user key
+ * adopted from a roster rotation -- the roster wraps the key-agreement secret
+ * alone, and the signing half has no consumer yet.
+ */
+export interface UserKey {
+    id: string;
+    secret: Uint8Array;
+    signingSeed?: Uint8Array;
+}
+/**
+ * Mints a fresh user key: the X25519 key-agreement pair via the was-client
+ * epoch construction (its did:key is the key id, its raw secret is what wraps),
+ * plus a random 32-byte Ed25519 signing seed -- a minted user key is always a
+ * complete identity (only a rotation-adopted one lacks the signing half).
+ *
+ * @returns {Promise<Required<UserKey>>}
+ */
+export declare function mintUserKey(): Promise<Required<UserKey>>;
+/**
+ * Reconstructs the user key's key-agreement key and its single-key resolver
+ * from the stored material -- the vault-key pair a session supplies to the
+ * storage layer, making the user key recipient zero of every encrypted
+ * collection. The key id is the self-describing `<did:key>#<fingerprint>` form,
+ * so grantee-side did:key recipient resolution routes it like any other roster
+ * entry.
+ *
+ * @param options {object}
+ * @param options.userKey {UserKey}
+ * @returns {{ keyAgreementKey: IKeyAgreementKey, keyResolver: IKeyResolver }}
+ */
+export declare function userKeyVaultKeys({ userKey }: {
+    userKey: UserKey;
+}): {
+    keyAgreementKey: IKeyAgreementKey;
+    keyResolver: IKeyResolver;
+};
+//# sourceMappingURL=userKey.d.ts.map

package/dist/keys/userKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userKey.d.ts","sourceRoot":"","sources":["../../src/keys/userKey.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAIrC;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,UAAU,CAAA;IAClB,WAAW,CAAC,EAAE,UAAU,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAK9D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IACnE,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B,CAQA"}

package/dist/keys/{puk.js → userKey.js}

@@ -2,7 +2,7 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The per-user key (PUK): the user's single roster identity for encrypted
+ * The user key: the user's single roster identity for encrypted
  * collections, standing in as "recipient zero" of every key-epoch roster. It is
  * minted at wallet provisioning -- random, client-side, never server-held, and
  * never derivable from any passphrase or seed -- and delivered to each enrolled
@@ -12,45 +12,47 @@
  * The key-agreement half is exactly what `@interop/was-client`'s epoch
  * construction mints: a fresh X25519 pair whose did:key is the key's id and
  * whose raw 32-byte secret is what gets wrapped to recipients -- so the roster
- * machinery consumes the PUK unchanged. The Ed25519 signing half is a second
- * independent 32-byte seed, minted now so the PUK is a complete identity, with
- * no consumer yet (the pair derives from the seed on demand once one lands).
+ * machinery consumes the user key unchanged. The Ed25519 signing half is a
+ * second independent 32-byte seed, minted now so the user key is a complete
+ * identity, with no consumer yet (the pair derives from the seed on demand once
+ * one lands).
  */
 import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
 import { epochKeyIdFor, mintEpoch } from '@interop/was-client/edv';
 import { singleKeyResolver } from '../identity/keyResolver.js';
 /**
- * Mints a fresh PUK: the X25519 key-agreement pair via the was-client epoch
- * construction (its did:key is the key id, its raw secret is what wraps), plus
- * a random 32-byte Ed25519 signing seed -- a minted PUK is always a complete
- * identity (only a rotation-adopted one lacks the signing half).
+ * Mints a fresh user key: the X25519 key-agreement pair via the was-client
+ * epoch construction (its did:key is the key id, its raw secret is what wraps),
+ * plus a random 32-byte Ed25519 signing seed -- a minted user key is always a
+ * complete identity (only a rotation-adopted one lacks the signing half).
  *
- * @returns {Promise<Required<Puk>>}
+ * @returns {Promise<Required<UserKey>>}
  */
-export async function mintPuk() {
+export async function mintUserKey() {
     const { epochId, secret } = await mintEpoch();
     const signingSeed = new Uint8Array(32);
     crypto.getRandomValues(signingSeed);
     return { id: epochId, secret, signingSeed };
 }
 /**
- * Reconstructs the PUK's key-agreement key and its single-key resolver from
- * the stored material -- the vault-key pair a session supplies to the storage
- * layer, making the PUK recipient zero of every encrypted collection. The key
- * id is the self-describing `<did:key>#<fingerprint>` form, so grantee-side
- * did:key recipient resolution routes it like any other roster entry.
+ * Reconstructs the user key's key-agreement key and its single-key resolver
+ * from the stored material -- the vault-key pair a session supplies to the
+ * storage layer, making the user key recipient zero of every encrypted
+ * collection. The key id is the self-describing `<did:key>#<fingerprint>` form,
+ * so grantee-side did:key recipient resolution routes it like any other roster
+ * entry.
  *
  * @param options {object}
- * @param options.puk {Puk}
+ * @param options.userKey {UserKey}
  * @returns {{ keyAgreementKey: IKeyAgreementKey, keyResolver: IKeyResolver }}
  */
-export function pukVaultKeys({ puk }) {
+export function userKeyVaultKeys({ userKey }) {
     const keyAgreementKey = X25519KeyAgreementKey2020.fromRawSecret({
-        secret: puk.secret,
-        controller: puk.id,
-        id: epochKeyIdFor(puk.id)
+        secret: userKey.secret,
+        controller: userKey.id,
+        id: epochKeyIdFor(userKey.id)
     });
     const keyResolver = singleKeyResolver({ keyAgreementKey });
     return { keyAgreementKey, keyResolver };
 }
-//# sourceMappingURL=puk.js.map
+//# sourceMappingURL=userKey.js.map

package/dist/keys/userKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userKey.js","sourceRoot":"","sources":["../../src/keys/userKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAiB9D;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IACnC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,OAAO,EAAwB;IAIhE,MAAM,eAAe,GAAG,yBAAyB,CAAC,aAAa,CAAC;QAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9B,CAAqB,CAAA;IACtB,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;AACzC,CAAC"}

package/dist/keys/{pukCascade.d.ts → userKeyCascade.d.ts}

@@ -2,92 +2,92 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The per-collection half of the PUK rotation cascade: once the roster's
- * current epoch has moved to a fresh PUK (a client revoked, a recovery code
- * spent or revoked), every encrypted collection must take a new epoch naming
- * the fresh PUK and retire the old one -- otherwise writes keep landing under
- * an epoch key the revoked party still holds.
+ * The per-collection half of the user key rotation cascade: once the roster's
+ * current epoch has moved to a fresh user key (a client revoked, a recovery
+ * code spent or revoked), every encrypted collection must take a new epoch
+ * naming the fresh user key and retire the old one -- otherwise writes keep
+ * landing under an epoch key the revoked party still holds.
  *
  * The staleness rule is the one the revocation spike verified: **a collection
- * is stale exactly when its current epoch names a PUK KAK other than the
+ * is stale exactly when its current epoch names a user key KAK other than the
  * roster's current** -- detectable from durable data alone, no checkpoint
- * resource anywhere, which is what makes a crashed cascade resumable by a
- * naive full re-run (and what the login-time completion sweep re-checks).
- * Which KAKs are "PUK generations" is read from the roster itself: its epochs
- * ARE the PUK generations, each escrow-wrapped to every enrolled client, so
- * any enrolled client can recover any generation's key
- * ({@link unwrapPukGenerations}) -- needed both to recognize a stale epoch
- * and to escrow the fresh PUK into a stranded collection's history.
+ * resource anywhere, which is what makes a crashed cascade resumable by a naive
+ * full re-run (and what the login-time completion sweep re-checks). Which KAKs
+ * are "user key generations" is read from the roster itself: its epochs ARE the
+ * user key generations, each escrow-wrapped to every enrolled client, so any
+ * enrolled client can recover any generation's key ({@link
+ * unwrapUserKeyGenerations}) -- needed both to recognize a stale epoch and to
+ * escrow the fresh user key into a stranded collection's history.
  *
  * One residue, accepted: a collection with NO epochs gets the newest prior
  * generation installed as its first epoch (pre-epoch envelopes are sealed to
- * the era's PUK KAK, and the PUK IS the epoch construction, so they ARE
- * epoch-of-that-generation envelopes) -- envelopes older than that
- * generation, on a collection every prior cascade missed, stay readable only
- * to sessions that held the older key.
+ * the era's user key KAK, and the user key IS the epoch construction, so they
+ * ARE epoch-of-that-generation envelopes) -- envelopes older than that
+ * generation, on a collection every prior cascade missed, stay readable only to
+ * sessions that held the older key.
  */
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
 import { type EncryptionDescriptorStore, type RecipientPublicKey } from '@interop/was-client/edv';
-import { type Puk } from './puk.js';
+import { type UserKey } from './userKey.js';
 /**
- * A PUK presented as an epoch-roster recipient: the kid is the
+ * A user key presented as an epoch-roster recipient: the kid is the
  * self-describing `<did:key>#<fingerprint>` form every collection epoch names
  * the user under, and the public key is the did:key's own multibase.
  *
  * @param options {object}
- * @param options.puk {Puk}
+ * @param options.userKey {UserKey}
  * @returns {RecipientPublicKey}
  */
-export declare function pukAsRecipient({ puk }: {
-    puk: Puk;
+export declare function userKeyAsRecipient({ userKey }: {
+    userKey: UserKey;
 }): RecipientPublicKey;
 /**
- * Recovers every PUK generation from the roster descriptor: each roster epoch
- * is one generation (its id the generation's did:key, its wrapped secret the
- * generation's raw key), escrow-wrapped to every enrolled client -- so this
- * client's key-agreement key unwraps them all, in roster (chronological)
- * order. A generation whose wrap is missing or fails to unwrap is skipped
- * rather than fatal (the cascade then simply cannot recognize or escrow that
- * generation; the current epoch always unwraps or the roster read itself
- * would have refused).
+ * Recovers every user key generation from the roster descriptor: each roster
+ * epoch is one generation (its id the generation's did:key, its wrapped secret
+ * the generation's raw key), escrow-wrapped to every enrolled client -- so this
+ * client's key-agreement key unwraps them all, in roster (chronological) order.
+ * A generation whose wrap is missing or fails to unwrap is skipped rather than
+ * fatal (the cascade then simply cannot recognize or escrow that generation;
+ * the current epoch always unwraps or the roster read itself would have
+ * refused).
  *
  * @param options {object}
  * @param options.descriptor {CollectionEncryption}   the roster descriptor
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key
- * @returns {Promise<Puk[]>}   the generations, oldest first
+ * @returns {Promise<UserKey[]>}   the generations, oldest first
  */
-export declare function unwrapPukGenerations({ descriptor, clientKeyAgreementKey }: {
+export declare function unwrapUserKeyGenerations({ descriptor, clientKeyAgreementKey }: {
     descriptor: CollectionEncryption;
     clientKeyAgreementKey: IKeyAgreementKey;
-}): Promise<Puk[]>;
+}): Promise<UserKey[]>;
 /**
- * What one collection's cascade step did: `noop` (already on the current
- * PUK), `installed` (a pre-epoch collection on a first-generation account
- * gained its first epoch; nothing to retire), `escrowed` (the current PUK's
- * wrap was completed into history with no stale epoch to rotate), or
- * `rotated` (a fresh epoch sealed to the current PUK, the stale generations
- * retired -- the pre-epoch install falls through to this).
+ * What one collection's cascade step did: `noop` (already on the current user
+ * key), `installed` (a pre-epoch collection on a first-generation account
+ * gained its first epoch; nothing to retire), `escrowed` (the current user
+ * key's wrap was completed into history with no stale epoch to rotate), or
+ * `rotated` (a fresh epoch sealed to the current user key, the stale
+ * generations retired -- the pre-epoch install falls through to this).
  */
-export type CollectionPukRotationOutcome = 'noop' | 'installed' | 'escrowed' | 'rotated';
+export type CollectionUserKeyRotationOutcome = 'noop' | 'installed' | 'escrowed' | 'rotated';
 /**
- * Brings ONE encrypted collection's epoch roster onto the current PUK -- the
- * per-collection op of the revocation cascade and of the completion sweep:
+ * Brings ONE encrypted collection's epoch roster onto the current user key --
+ * the per-collection op of the revocation cascade and of the completion sweep:
  *
  * - **No epochs yet**: install the newest PRIOR generation as the first epoch
- *   (see the module doc), wrapped to that generation and the current PUK,
+ *   (see the module doc), wrapped to that generation and the current user key,
  *   then fall through to the rotation. A first-generation account (nothing
- *   prior) installs the current PUK alone and is done.
+ *   prior) installs the current user key alone and is done.
  * - **Stale current epoch** (names a non-current generation): one
- *   `replaceRecipient` write -- the current PUK escrowed into every epoch,
+ *   `replaceRecipient` write -- the current user key escrowed into every epoch,
  *   a fresh epoch minted without the stale generations. Two requests per
  *   collection; app recipients and other readers ride through untouched (the
  *   default did:key resolver re-wraps them).
  * - **Current already** and fully escrowed: no write at all, so a naive
  *   re-run after a mid-cascade crash converges with zero redundant epochs.
  *
- * The pull axis is deliberately a no-op here: a PUK rotation follows a
+ * The pull axis is deliberately a no-op here: a user key rotation follows a
  * document edit (client revocation, code retirement) that already killed the
  * revoked party's server-side access everywhere under the current-key-set
  * rule -- there is no per-collection revoke.
@@ -95,35 +95,35 @@ export type CollectionPukRotationOutcome = 'noop' | 'installed' | 'escrowed' | '
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the collection's
  *   descriptor store
- * @param options.puk {Puk}   the roster's CURRENT PUK
- * @param options.generations {Puk[]}   every roster generation this client
- *   could unwrap ({@link unwrapPukGenerations}), oldest first
- * @returns {Promise<CollectionPukRotationOutcome>}
+ * @param options.userKey {UserKey}   the roster's CURRENT user key
+ * @param options.generations {UserKey[]}   every roster generation this client
+ *   could unwrap ({@link unwrapUserKeyGenerations}), oldest first
+ * @returns {Promise<CollectionUserKeyRotationOutcome>}
  */
-export declare function rotateCollectionEpochsToPuk({ store, puk, generations }: {
+export declare function rotateCollectionEpochsToUserKey({ store, userKey, generations }: {
     store: EncryptionDescriptorStore;
-    puk: Puk;
-    generations: Puk[];
-}): Promise<CollectionPukRotationOutcome>;
+    userKey: UserKey;
+    generations: UserKey[];
+}): Promise<CollectionUserKeyRotationOutcome>;
 /**
  * What the collection fan-out did, per collection id: the outcomes for every
  * collection that needed (or took) work, and the per-collection failures the
  * caller surfaces -- the cascade never aborts on one stuck collection.
  */
-export interface PukCascadeResult {
-    outcomes: Record<string, CollectionPukRotationOutcome>;
+export interface UserKeyCascadeResult {
+    outcomes: Record<string, CollectionUserKeyRotationOutcome>;
     failed: Array<{
         collectionId: string;
         error: unknown;
     }>;
 }
 /**
- * The collection fan-out of the PUK rotation cascade: re-epochs every named
- * collection onto the roster's current PUK, in parallel, unwrapping the PUK
- * generations from the roster once. The wallet supplies what only it knows --
- * which collections exist (`collectionIds`) and how to reach each one's
- * descriptor (`storeFor`); the per-collection staleness rule and re-epoch live
- * in {@link rotateCollectionEpochsToPuk}.
+ * The collection fan-out of the user key rotation cascade: re-epochs every
+ * named collection onto the roster's current user key, in parallel, unwrapping
+ * the user key generations from the roster once. The wallet supplies what only
+ * it knows -- which collections exist (`collectionIds`) and how to reach each
+ * one's descriptor (`storeFor`); the per-collection staleness rule and re-epoch
+ * live in {@link rotateCollectionEpochsToUserKey}.
  *
  * A collection that fails is reported in `failed` and the rest proceed; the
  * caller decides what a failure means (the login-time completion sweep is the
@@ -140,18 +140,18 @@ export interface PukCascadeResult {
  *   own task so a throwing check lands in that collection's `failed` entry
  *   (e.g. a standard collection an account never provisioned server-side)
  * @param options.rosterDescriptor {CollectionEncryption}   the freshly read
- *   `key-map/puk.json` roster (the source of the PUK generations)
+ *   `key-map/user-key.json` roster (the source of the user key generations)
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key, unwrapping the generations
- * @param options.puk {Puk}   the roster's current PUK
- * @returns {Promise<PukCascadeResult>}
+ * @param options.userKey {UserKey}   the roster's current user key
+ * @returns {Promise<UserKeyCascadeResult>}
  */
-export declare function cascadeCollectionsToPuk({ collectionIds, storeFor, isEncrypted, rosterDescriptor, clientKeyAgreementKey, puk }: {
+export declare function cascadeCollectionsToUserKey({ collectionIds, storeFor, isEncrypted, rosterDescriptor, clientKeyAgreementKey, userKey }: {
     collectionIds: string[];
     storeFor: (collectionId: string) => EncryptionDescriptorStore;
     isEncrypted?: (collectionId: string) => Promise<boolean>;
     rosterDescriptor: CollectionEncryption;
     clientKeyAgreementKey: IKeyAgreementKey;
-    puk: Puk;
-}): Promise<PukCascadeResult>;
-//# sourceMappingURL=pukCascade.d.ts.map
+    userKey: UserKey;
+}): Promise<UserKeyCascadeResult>;
+//# sourceMappingURL=userKeyCascade.d.ts.map