@interop/wallet-core 0.39.0 → 0.40.0

package/dist/keyring/record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/keyring/record.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,yBAAyB,CAAA;AAGhC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiBhC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,YAAY,CAAC,EACjC,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAoC,EACrC,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,UAAU,EAAE,oBAAoB,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,SAAS,CAAC,CAOrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,KAAK,EACL,OAAgC,EACjC,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG;IAAE,UAAU,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAoCzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,cAAc,CAAA;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,UAAU,EACV,KAAK,EACL,OAAO,EACP,eAAe,EACf,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,CAAC,CAwBD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,MAAM,EACN,eAAe,EACf,WAAW,EACZ,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgCjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAsB7E"}
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/keyring/record.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,yBAAyB,CAAA;AAGhC;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACvD;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,oBAAoB,CAAA;IAC1B,WAAW,EAAE,gBAAgB,CAAA;IAC7B,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,iBAAiB,CAAA;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,WAAW,CAAA;CACnB;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE;QACR,EAAE,EAAE,MAAM,CAAA;QACV,SAAS,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,KAAK,EAAE;gBAAE,IAAI,EAAE,UAAU,CAAA;aAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;SAC3D,CAAA;KACF,CAAA;CACF,GAAG,YAAY,CAmBf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAAC,EACpC,OAAO,EACP,UAAU,EACV,OAAO,EACP,MAAM,EACN,OAAO,EACR,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBxB;AAoCD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,kBAAkB,EAClB,KAAK,EACN,EAAE;IACD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,MAAM,CAWT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;CAClC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiBhC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,YAAY,CAAC,EACjC,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAoC,EACrC,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,UAAU,EAAE,oBAAoB,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,SAAS,CAAC,CAOrB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,KAAK,EACL,OAAgC,EACjC,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG;IACF,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,WAAW,CAAA;CACpB,CAmDA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,oBAAoB,EACpB,KAAiB,EAClB,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,oBAAoB,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,MAAM,CAAC,CA4ClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,UAAU,EACV,KAAK,EACL,OAAO,EACP,eAAe,EACf,WAAW,EACX,MAAM,EACN,SAAS,EACV,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,MAAM,EAAE,YAAY,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,YAAY,CAAC,CA6BxB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,MAAM,EACN,eAAe,EACf,WAAW,EACX,oBAAoB,EACrB,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,oBAAoB,EAAE,MAAM,CAAA;CAC7B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA2CjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,SAAS,EACV,EAAE;IACD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,MAAM,CAQT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,KAAK,EACL,KAAK,EACN,EAAE;IACD,KAAK,EAAE,OAAO,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,MAAM,CAKT;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAsB7E"}

package/dist/keyring/record.js

@@ -1,12 +1,158 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The keyring record codec: the `{ version, encryption, wrapped, proof }`
+ * envelope stored as the one resource of an account's unlock Space. Its
+ * plaintext carries the account controller, the email captured at bind time,
+ * the account pointer, and the bind timestamp -- and deliberately no key
+ * material of any kind, so the record locates an account without authorizing
+ * anything against it.
+ *
+ * The wrap is an EDV document envelope sealed under the record's own key
+ * epoch: every EDV envelope seals to an epoch key, so the record carries its
+ * one-epoch descriptor in its `encryption` member, epoch[0] wrapped to the
+ * unlock key-agreement key. The record stays self-contained -- unlock KAK in,
+ * contents out. The cipher's `keyring` collection context labels errors only
+ * (the codec is agnostic to it).
+ *
+ * The authenticity layer is the `proof` member, and it is load-bearing: the
+ * unlock KAK's public half is derivable from the unlock did:key the server
+ * stores as the unlock Space's controller, so a malicious storage host can
+ * seal a record of its own that decrypts perfectly. Confidentiality was never
+ * the missing property. So a record carries an eddsa-jcs-2022 Data Integrity
+ * proof over its sibling members (`version`, `encryption`, `wrapped`), signed
+ * by the unlock identity's Ed25519 key -- which derives from the unlock secret,
+ * so a fresh client holds the verification prior by construction and the
+ * server never holds the signing key. The proof is verified BEFORE the record
+ * is decrypted, and there is no unwrap path that skips it. Because the
+ * signature covers the ciphertext, the encrypted bind timestamp is covered
+ * transitively while staying inside the plaintext, so bind times do not leak
+ * to a reader of the unlock Space.
+ */
+import { createDataIntegrityProofTemplate, defaultWebvhLogVerifier, signDataIntegrityProof, signerFromExternalKey, verifyEntryProofs } from '@interop/did-method-webvh';
 import { createEdvDocCipher, initRecipients, ownerRecipient } from '@interop/was-client/edv';
 import { KEYRING_COLLECTION } from '../space/collections.js';
 /**
- * The version stamped on the stored `{ version, encryption, wrapped }` keyring
- * envelope: the record whose envelope seals under the record's own key epoch
- * (the `encryption` member). Any other version is refused as unusable -- such
- * accounts are re-provisioned, not migrated.
+ * The version stamped on the stored `{ version, encryption, wrapped, proof }`
+ * keyring envelope: the signed record, whose envelope seals under the record's
+ * own key epoch (the `encryption` member) and whose sibling members carry a
+ * Data Integrity proof by the unlock identity's signing key. Any other version
+ * is refused as unusable -- such accounts are re-provisioned, not migrated.
+ */
+export const KEYRING_RECORD_VERSION = 2;
+/**
+ * A record's proof is absent, malformed, signed by a key this client does not
+ * accept, or does not verify over the record's own members. Its own class,
+ * distinct from a decrypt failure or an unusable-version refusal: this is the
+ * refusal that says the storage host forged or tampered with the record, which
+ * an app maps to its own login copy.
+ */
+export class RecordProofError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'RecordProofError';
+    }
+}
+/**
+ * Adapts a signing key agent (the unlock identity's `CapabilityAgent`, or an
+ * enrolled client's own key agent) to the record signer seam: the agent's
+ * did:key id supplies the public multibase, its signer the raw signature.
+ *
+ * @param options {object}
+ * @param options.keyAgent {object}   a did:key `CapabilityAgent`-shaped agent
+ * @returns {RecordSigner}
+ */
+export function recordSignerFromAgent({ keyAgent }) {
+    const [scheme, method, keyMultibase] = keyAgent.id.split(':');
+    if (scheme !== 'did' || method !== 'key' || !keyMultibase) {
+        throw new Error(`Not a did:key agent id: "${keyAgent.id}".`);
+    }
+    const signer = keyAgent.getSigner();
+    return {
+        keyMultibase,
+        async sign({ data }) {
+            const signature = await signer.sign({ data });
+            // Re-wrap as a plain Uint8Array: a signer may return a Node Buffer (or
+            // a cross-realm view), which the kernel's strict byte check rejects.
+            return new Uint8Array(signature.buffer, signature.byteOffset, signature.byteLength);
+        }
+    };
+}
+/**
+ * Signs a record's frame members and returns the stored signed record. Shared
+ * by the keyring and recovery wrap paths (and available to an app's own record
+ * kinds), so one construction produces every signed record: the proof covers
+ * `{ version, encryption, wrapped }` plus any record-kind members under JCS
+ * canonicalization.
+ *
+ * @param options {object}
+ * @param options.version {number}   the frame version to stamp
+ * @param options.encryption {CollectionEncryption}   the record's descriptor
+ * @param options.wrapped {unknown}   the sealed envelope
+ * @param options.signer {RecordSigner}   the signing key
+ * @param [options.members] {object}   additional record-kind frame members the
+ *   proof must cover (e.g. the recovery record's `binding`)
+ * @returns {Promise<SignedRecord>}
  */
-export const KEYRING_RECORD_VERSION = 1;
+export async function signRecordFrame({ version, encryption, wrapped, signer, members }) {
+    const frame = { version, encryption, wrapped, ...(members ?? {}) };
+    const proofTemplate = createDataIntegrityProofTemplate({
+        verificationMethod: `did:key:${signer.keyMultibase}#${signer.keyMultibase}`
+    });
+    const proof = await signDataIntegrityProof(
+    // The kernel types its signable documents as did:webvh artifacts, but the
+    // construction is generic (JCS canonicalization over whatever it is
+    // handed), so the record frame rides through as one.
+    frame, proofTemplate, signerFromExternalKey({
+        publicKeyMultibase: signer.keyMultibase,
+        sign: signer.sign
+    }));
+    return { ...frame, proof: proof };
+}
+/**
+ * Structural check of a record's `proof` member against the fixed shape,
+ * before any cryptography runs.
+ *
+ * @param options {object}
+ * @param options.proof {unknown}
+ * @param options.label {string}   names the record kind in the refusal
+ * @returns {RecordProof}
+ */
+function checkRecordProofShape({ proof, label }) {
+    const candidate = proof;
+    if (candidate === null ||
+        typeof candidate !== 'object' ||
+        candidate.type !== 'DataIntegrityProof' ||
+        candidate.cryptosuite !== 'eddsa-jcs-2022' ||
+        candidate.proofPurpose !== 'assertionMethod' ||
+        typeof candidate.verificationMethod !== 'string' ||
+        typeof candidate.proofValue !== 'string') {
+        throw new RecordProofError(`The ${label} record carries no proof in the fixed shape ` +
+            `(DataIntegrityProof / eddsa-jcs-2022 / assertionMethod).`);
+    }
+    return candidate;
+}
+/**
+ * The signing key's public multibase named by a proof's `verificationMethod`:
+ * its fragment. The signer emits `did:key:<multibase>#<multibase>`; the DID
+ * half is not what authorizes anything -- the multibase IS the key, and the
+ * caller's allowlist decides whether it may sign this record.
+ *
+ * @param options {object}
+ * @param options.verificationMethod {string}
+ * @param options.label {string}   names the record kind in the refusal
+ * @returns {string}
+ */
+export function recordProofKeyMultibase({ verificationMethod, label }) {
+    const hashIndex = verificationMethod.lastIndexOf('#');
+    const keyMultibase = hashIndex === -1 ? '' : verificationMethod.slice(hashIndex + 1);
+    if (!keyMultibase) {
+        throw new RecordProofError(`The ${label} record's proof names a verification method with no key ` +
+            `fragment.`);
+    }
+    return keyMultibase;
+}
 /**
  * Mints the one-epoch descriptor a fresh record is sealed under: epoch[0]
  * wrapped to the given KAK alone, built through `initRecipients` against a
@@ -67,9 +213,15 @@ export async function recordCipher({ keyAgreementKey, keyResolver, encryption, c
 /**
  * Validates the common `{ version, encryption, wrapped }` frame of a stored
  * record (keyring or recovery -- `label` names the refusals) and returns its
- * members. Exported so an app's own record kinds open their records through
- * the same frame validation the codec here seals with, rather than re-deriving
- * the version and shape checks.
+ * members, the `proof` among them for the signed frame. Exported so an app's
+ * own record kinds open their records through the same frame validation the
+ * codec here seals with, rather than re-deriving the version and shape checks.
+ *
+ * A frame at the keyring record version is the signed frame, so it must carry
+ * a fixed-shape proof; a record kind stamping its own version is unaffected
+ * (its authenticity story is its own). Validating the shape here does not
+ * verify it -- {@link verifyRecordProof} does, and every unwrap path in this
+ * module runs it before decrypting.
  *
  * @param options {object}
  * @param options.record {unknown}
@@ -77,38 +229,110 @@ export async function recordCipher({ keyAgreementKey, keyResolver, encryption, c
  *   kind's own label
  * @param [options.version] {number}   the version the frame must carry;
  *   defaults to the keyring record version
- * @returns {{ encryption: CollectionEncryption, wrapped: unknown }}
+ * @returns {{ encryption: CollectionEncryption, wrapped: unknown,
+ *   proof?: RecordProof }}
  */
 export function parseRecordFrame({ record, label, version = KEYRING_RECORD_VERSION }) {
     if (record === null || typeof record !== 'object') {
         throw new Error(`Malformed ${label} record.`);
     }
-    const { version: recordVersion, encryption, wrapped } = record;
+    const { version: recordVersion, encryption, wrapped, proof } = record;
     if (recordVersion !== version) {
+        // Two retired version-1 shapes are named rather than reported as an
+        // unsupported number, so neither refusal is read as corruption: the
+        // pre-extraction record (a data-seed wrap with no descriptor) and the
+        // unsigned envelope this version's proof replaced. Both are unusable.
+        if (version === KEYRING_RECORD_VERSION && recordVersion === 1) {
+            if (encryption === undefined) {
+                throw new Error(`The ${label} record uses the retired pre-extraction version 1 ` +
+                    'shape (a data-seed wrap with no encryption descriptor); such ' +
+                    'accounts are re-provisioned, not migrated.');
+            }
+            throw new Error(`The ${label} record uses the retired unsigned version 1 shape (no ` +
+                'proof over its frame, so a storage host could substitute it); ' +
+                'such accounts are re-provisioned, not migrated.');
+        }
         throw new Error(`Unsupported ${label} record version "${String(recordVersion)}".`);
     }
     if (wrapped === undefined || wrapped === null) {
         throw new Error(`Malformed ${label} record.`);
     }
-    // A version-1 frame carrying a wrap but no descriptor is the retired
-    // pre-extraction record shape, which shipped under this same version number
-    // and wrapped a data seed. It is unusable, not merely damaged -- name the
-    // shape so the refusal is not read as corruption.
-    if (encryption === undefined && version === KEYRING_RECORD_VERSION) {
-        throw new Error(`The ${label} record uses the retired pre-extraction version 1 shape ` +
-            '(a data-seed wrap with no encryption descriptor); such accounts are ' +
-            're-provisioned, not migrated.');
-    }
     if (encryption === null || typeof encryption !== 'object') {
         throw new Error(`The ${label} record is missing its encryption descriptor.`);
     }
-    return { encryption: encryption, wrapped };
+    return {
+        encryption: encryption,
+        wrapped,
+        ...(version === KEYRING_RECORD_VERSION
+            ? { proof: checkRecordProofShape({ proof, label }) }
+            : {})
+    };
+}
+/**
+ * Verifies a stored record's proof: the fixed proof shape, the signing key
+ * against the caller's allowlist, and the signature over the record's sibling
+ * members (everything except `proof`, JCS-canonicalized). Refuses with
+ * {@link RecordProofError} in every failing case -- a class of its own, so an
+ * app tells "the host forged or tampered with this record" apart from a wrong
+ * unlock secret or an unusable version.
+ *
+ * Standalone as well as internal, because the recovery record's re-minted
+ * signer is only knowable after the record is decrypted (see
+ * `unwrapRecoveryRecord`).
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record, proof included
+ * @param options.allowedKeyMultibases {string | string[]}   the signing keys
+ *   this caller accepts, as public multibases or as verification-method ids
+ *   whose fragment is one
+ * @param [options.label] {string}   names the record kind in refusals;
+ *   defaults to the keyring record
+ * @returns {Promise<string>}   the verified signing key's public multibase
+ */
+export async function verifyRecordProof({ record, allowedKeyMultibases, label = 'keyring' }) {
+    if (record === null || typeof record !== 'object') {
+        throw new RecordProofError(`Malformed ${label} record.`);
+    }
+    const { proof, ...frame } = record;
+    const checked = checkRecordProofShape({ proof, label });
+    const keyMultibase = recordProofKeyMultibase({
+        verificationMethod: checked.verificationMethod,
+        label
+    });
+    const allowed = new Set((typeof allowedKeyMultibases === 'string'
+        ? [allowedKeyMultibases]
+        : allowedKeyMultibases).map(entry => {
+        const hashIndex = entry.lastIndexOf('#');
+        return hashIndex === -1 ? entry : entry.slice(hashIndex + 1);
+    }));
+    if (!allowed.has(keyMultibase)) {
+        throw new RecordProofError(`The ${label} record is signed by a key this client does not accept ` +
+            `for it ("${keyMultibase}").`);
+    }
+    try {
+        await verifyEntryProofs({ ...frame, proof: checked }, {
+            verifier: defaultWebvhLogVerifier,
+            // Authorization is the allowlist check above, made before any
+            // cryptography runs; the key material resolves from the proof's own
+            // verification method, which that check has already pinned.
+            authorize: () => { },
+            resolveVM: async () => ({ publicKeyMultibase: keyMultibase })
+        });
+    }
+    catch (err) {
+        throw new RecordProofError(`The ${label} record's proof does not verify over its contents.`, { cause: err });
+    }
+    return keyMultibase;
 }
 /**
  * Wraps the account-pointer contents into a keyring record: the controller,
  * email, and pointer (+ timestamp) sealed under a freshly minted record epoch
- * whose key is wrapped to the unlock KAK. Deliberately carries no key material
- * of any kind.
+ * whose key is wrapped to the unlock KAK, then signed by the unlock identity's
+ * signing key. Deliberately carries no key material of any kind.
+ *
+ * The timestamp stays inside the plaintext (the signature covers the
+ * ciphertext, so it is covered transitively), so bind times do not leak to a
+ * reader of the unlock Space.
  *
  * @param options {object}
  * @param options.controller {string}   the account did:key
@@ -117,10 +341,14 @@ export function parseRecordFrame({ record, label, version = KEYRING_RECORD_VERSI
  *   no-WAS deployments)
  * @param options.keyAgreementKey {IKeyAgreementKey}   the unlock KAK
  * @param options.keyResolver {IKeyResolver}
- * @returns {Promise<{ version: number, encryption: CollectionEncryption,
- *   wrapped: unknown }>}
+ * @param options.signer {RecordSigner}   the unlock identity's signing key
+ *   (`recordSignerFromAgent` over the unlock agent)
+ * @param [options.createdAt] {string}   the bind timestamp to stamp, as an ISO
+ *   string; defaults to now. Supplied by a caller that pins record freshness,
+ *   so it knows the stamp without unwrapping the record it just wrote.
+ * @returns {Promise<SignedRecord>}
  */
-export async function wrapKeyringRecord({ controller, email, pointer, keyAgreementKey, keyResolver }) {
+export async function wrapKeyringRecord({ controller, email, pointer, keyAgreementKey, keyResolver, signer, createdAt }) {
     const encryption = await mintRecordEncryption({ keyAgreementKey });
     const cipher = await recordCipher({
         keyAgreementKey,
@@ -140,28 +368,45 @@ export async function wrapKeyringRecord({ controller, email, pointer, keyAgreeme
                     }
                 }
                 : {}),
-            createdAt: new Date().toISOString()
+            createdAt: recordCreatedAtStamp({ createdAt })
         }
     });
-    return { version: KEYRING_RECORD_VERSION, encryption, wrapped: envelope };
+    return signRecordFrame({
+        version: KEYRING_RECORD_VERSION,
+        encryption,
+        wrapped: envelope,
+        signer
+    });
 }
 /**
- * Unwraps and validates a keyring record. Rejects a record whose `version` is
- * not the current one (accounts are re-provisioned, not migrated), and
- * sanity-checks the decrypted plaintext (non-empty controller, well-formed
- * pointer when present).
+ * Unwraps and validates a keyring record. Verifies the record's proof against
+ * the unlock identity's own signing key BEFORE decrypting -- there is no
+ * unwrap path that skips it, so a record the storage host substituted is
+ * refused ({@link RecordProofError}) rather than decrypted and inspected.
+ * Rejects a record whose `version` is not the current one (accounts are
+ * re-provisioned, not migrated), and sanity-checks the decrypted plaintext
+ * (non-empty controller, well-formed pointer when present, a parseable
+ * `createdAt`).
  *
  * @param options {object}
  * @param options.record {unknown}
  * @param options.keyAgreementKey {IKeyAgreementKey}   the unlock KAK
  * @param options.keyResolver {IKeyResolver}
+ * @param options.expectedKeyMultibase {string}   the unlock identity's signing
+ *   key multibase, derived from the typed secret -- the only key that may have
+ *   signed this record
  * @returns {Promise<KeyringRecordContents>}
  */
-export async function unwrapKeyringRecord({ record, keyAgreementKey, keyResolver }) {
+export async function unwrapKeyringRecord({ record, keyAgreementKey, keyResolver, expectedKeyMultibase }) {
     const { encryption, wrapped } = parseRecordFrame({
         record,
         label: 'keyring'
     });
+    await verifyRecordProof({
+        record,
+        allowedKeyMultibases: expectedKeyMultibase,
+        label: 'keyring'
+    });
     const cipher = await recordCipher({
         keyAgreementKey,
         keyResolver,
@@ -174,8 +419,13 @@ export async function unwrapKeyringRecord({ record, keyAgreementKey, keyResolver
         throw new Error('Keyring record is missing a controller.');
     }
     const pointer = parseRecordPointer(plaintext.pointer);
+    const createdAt = parseRecordCreatedAt({
+        value: plaintext.createdAt,
+        label: 'Keyring'
+    });
     return {
         controller: plaintext.controller,
+        createdAt,
         // A record bound without an email simply has no email; anything
         // non-string is ignored, not fatal.
         ...(typeof plaintext.email === 'string' && plaintext.email
@@ -184,6 +434,42 @@ export async function unwrapKeyringRecord({ record, keyAgreementKey, keyResolver
         ...(pointer ? { pointer } : {})
     };
 }
+/**
+ * The bind timestamp a wrap path stamps into a record's plaintext: the
+ * caller's, validated as a parseable ISO timestamp, or now. A caller supplies
+ * one when it pins record freshness, so it knows the stamp of the record it is
+ * writing without reading it back.
+ *
+ * @param options {object}
+ * @param [options.createdAt] {string}   the caller's timestamp
+ * @returns {string}
+ */
+export function recordCreatedAtStamp({ createdAt }) {
+    if (createdAt === undefined) {
+        return new Date().toISOString();
+    }
+    if (typeof createdAt !== 'string' || Number.isNaN(Date.parse(createdAt))) {
+        throw new Error(`Invalid record createdAt timestamp "${createdAt}".`);
+    }
+    return createdAt;
+}
+/**
+ * Parses and validates the required `createdAt` member of a record plaintext:
+ * the moment the record was bound, as an ISO timestamp that must parse. Apps
+ * pin freshness on it, so a record that cannot state its own bind time is
+ * refused rather than defaulted.
+ *
+ * @param options {object}
+ * @param options.value {unknown}   the plaintext's `createdAt` member
+ * @param options.label {string}   names the record kind in the refusal
+ * @returns {string}
+ */
+export function parseRecordCreatedAt({ value, label }) {
+    if (typeof value !== 'string' || Number.isNaN(Date.parse(value))) {
+        throw new Error(`${label} record has no valid createdAt timestamp.`);
+    }
+    return value;
+}
 /**
  * Parses and validates the optional `pointer` member of a keyring record
  * plaintext. An absent member is a no-WAS record (returns undefined); a

package/dist/keyring/record.js.map

@@ -1 +1 @@
-{"version":3,"file":"record.js","sourceRoot":"","sources":["../../src/keyring/record.ts"],"names":[],"mappings":"AAuBA,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,cAAc,EAGf,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEvC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,eAAe,EAGhB;IACC,IAAI,MAAM,GAAgC,IAAI,CAAA;IAC9C,MAAM,KAAK,GAA8B;QACvC,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,IAAI,CAAA;QACf,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,GAAG,IAAI,CAAA;QACf,CAAC;KACF,CAAA;IACD,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;KAClD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAY,GAAG,kBAAkB,CAAC,EAAE,EAMrC;IACC,OAAO,kBAAkB,CAAC;QACxB,eAAe;QACf,WAAW;QACX,YAAY;QACZ,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,MAAM,EACN,KAAK,EACL,OAAO,GAAG,sBAAsB,EAKjC;IACC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,EACJ,OAAO,EAAE,aAAa,EACtB,UAAU,EACV,OAAO,EACR,GAAG,MAIH,CAAA;IACD,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,oBAAoB,MAAM,CAAC,aAAa,CAAC,IAAI,CAClE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAA;IAC/C,CAAC;IACD,qEAAqE;IACrE,4EAA4E;IAC5E,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,OAAO,KAAK,0DAA0D;YACpE,sEAAsE;YACtE,+BAA+B,CAClC,CAAA;IACH,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,+CAA+C,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,UAAkC,EAAE,OAAO,EAAE,CAAA;AACpE,CAAC;AA2BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,UAAU,EACV,KAAK,EACL,OAAO,EACP,eAAe,EACf,WAAW,EAOZ;IAKC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,eAAe;QACf,WAAW;QACX,UAAU;KACX,CAAC,CAAA;IACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACxC,IAAI,EAAE;YACJ,UAAU;YACV,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,OAAO,EAAE;wBACP,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;qBACnB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC;KACF,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC3E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,MAAM,EACN,eAAe,EACf,WAAW,EAKZ;IACC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC;QAC/C,MAAM;QACN,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,eAAe;QACf,WAAW;QACX,UAAU;KACX,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC;QACtC,QAAQ,EAAE,OAAgB;KAC3B,CAAC,CAID,CAAA;IAED,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAErD,OAAO;QACL,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,gEAAgE;QAChE,oCAAoC;QACpC,GAAG,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK;YACxD,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;YAC5B,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAI9B,CAAA;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC"}
+{"version":3,"file":"record.js","sourceRoot":"","sources":["../../src/keyring/record.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,cAAc,EAGf,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAwCvC;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EAQT;IACC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7D,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,OAAO;QACL,YAAY;QACZ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAwB;YACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7C,uEAAuE;YACvE,qEAAqE;YACrE,OAAO,IAAI,UAAU,CACnB,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CACrB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,OAAO,EACP,UAAU,EACV,OAAO,EACP,MAAM,EACN,OAAO,EAOR;IACC,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAA;IAClE,MAAM,aAAa,GAAG,gCAAgC,CAAC;QACrD,kBAAkB,EAAE,WAAW,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,EAAE;KAC5E,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,MAAM,sBAAsB;IACxC,0EAA0E;IAC1E,oEAAoE;IACpE,qDAAqD;IACrD,KAAoC,EACpC,aAAa,EACb,qBAAqB,CAAC;QACpB,kBAAkB,EAAE,MAAM,CAAC,YAAY;QACvC,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CACH,CAAA;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAoB,EAAE,CAAA;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,EAC7B,KAAK,EACL,KAAK,EAIN;IACC,MAAM,SAAS,GAAG,KAAoC,CAAA;IACtD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,SAAS,CAAC,WAAW,KAAK,gBAAgB;QAC1C,SAAS,CAAC,YAAY,KAAK,iBAAiB;QAC5C,OAAO,SAAS,CAAC,kBAAkB,KAAK,QAAQ;QAChD,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,EACxC,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,OAAO,KAAK,8CAA8C;YACxD,0DAA0D,CAC7D,CAAA;IACH,CAAC;IACD,OAAO,SAAwB,CAAA;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,kBAAkB,EAClB,KAAK,EAIN;IACC,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrD,MAAM,YAAY,GAChB,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,gBAAgB,CACxB,OAAO,KAAK,0DAA0D;YACpE,WAAW,CACd,CAAA;IACH,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,eAAe,EAGhB;IACC,IAAI,MAAM,GAAgC,IAAI,CAAA;IAC9C,MAAM,KAAK,GAA8B;QACvC,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,IAAI,CAAA;QACf,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,GAAG,IAAI,CAAA;QACf,CAAC;KACF,CAAA;IACD,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;KAClD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAY,GAAG,kBAAkB,CAAC,EAAE,EAMrC;IACC,OAAO,kBAAkB,CAAC;QACxB,eAAe;QACf,WAAW;QACX,YAAY;QACZ,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,MAAM,EACN,KAAK,EACL,OAAO,GAAG,sBAAsB,EAKjC;IAKC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,EACJ,OAAO,EAAE,aAAa,EACtB,UAAU,EACV,OAAO,EACP,KAAK,EACN,GAAG,MAKH,CAAA;IACD,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,OAAO,KAAK,sBAAsB,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,OAAO,KAAK,oDAAoD;oBAC9D,+DAA+D;oBAC/D,4CAA4C,CAC/C,CAAA;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,OAAO,KAAK,wDAAwD;gBAClE,gEAAgE;gBAChE,iDAAiD,CACpD,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,oBAAoB,MAAM,CAAC,aAAa,CAAC,IAAI,CAClE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,+CAA+C,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO;QACL,UAAU,EAAE,UAAkC;QAC9C,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,sBAAsB;YACpC,CAAC,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,MAAM,EACN,oBAAoB,EACpB,KAAK,GAAG,SAAS,EAKlB;IACC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CAAC,aAAa,KAAK,UAAU,CAAC,CAAA;IAC1D,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,MAA6B,CAAA;IACzD,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,uBAAuB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK;KACN,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,OAAO,oBAAoB,KAAK,QAAQ;QACvC,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACxB,CAAC,CAAC,oBAAoB,CACvB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACZ,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACxC,OAAO,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAC9D,CAAC,CAAC,CACH,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CACxB,OAAO,KAAK,yDAAyD;YACnE,YAAY,YAAY,KAAK,CAChC,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,iBAAiB,CACrB,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,EAA6C,EACvE;YACE,QAAQ,EAAE,uBAAuB;YACjC,8DAA8D;YAC9D,oEAAoE;YACpE,4DAA4D;YAC5D,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;YACnB,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;SAC9D,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CACxB,OAAO,KAAK,oDAAoD,EAChE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AA4BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,UAAU,EACV,KAAK,EACL,OAAO,EACP,eAAe,EACf,WAAW,EACX,MAAM,EACN,SAAS,EASV;IACC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,eAAe;QACf,WAAW;QACX,UAAU;KACX,CAAC,CAAA;IACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACxC,IAAI,EAAE;YACJ,UAAU;YACV,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO;gBACT,CAAC,CAAC;oBACE,OAAO,EAAE;wBACP,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;qBACnB;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC;SAC/C;KACF,CAAC,CAAA;IACF,OAAO,eAAe,CAAC;QACrB,OAAO,EAAE,sBAAsB;QAC/B,UAAU;QACV,OAAO,EAAE,QAAQ;QACjB,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,MAAM,EACN,eAAe,EACf,WAAW,EACX,oBAAoB,EAMrB;IACC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC;QAC/C,MAAM;QACN,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IACF,MAAM,iBAAiB,CAAC;QACtB,MAAM;QACN,oBAAoB,EAAE,oBAAoB;QAC1C,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,eAAe;QACf,WAAW;QACX,UAAU;KACX,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC;QACtC,QAAQ,EAAE,OAAgB;KAC3B,CAAC,CAKD,CAAA;IAED,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACrD,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACrC,KAAK,EAAE,SAAS,CAAC,SAAS;QAC1B,KAAK,EAAE,SAAS;KACjB,CAAC,CAAA;IAEF,OAAO;QACL,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS;QACT,gEAAgE;QAChE,oCAAoC;QACpC,GAAG,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK;YACxD,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE;YAC5B,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,SAAS,EAGV;IACC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACjC,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,IAAI,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,KAAK,EACL,KAAK,EAIN;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAI9B,CAAA;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC"}

package/dist/keyring/unlockSpace.d.ts

@@ -59,6 +59,31 @@ export declare function putUnlockKeyring({ storageServerUrl, zcapClient, spaceId
     spaceId: string;
     record: object;
 }): Promise<void>;
+/**
+ * Reads the keyring record with an explicitly attached management capability,
+ * rather than by root invocation, or returns `null` when it does not exist.
+ * The `zcapClient` here is an enrolled client's (not the unlock identity's);
+ * the attached `capability` -- the management zcap the unlock identity
+ * delegated at bind time, provided it allows GET -- authorizes the read
+ * against the unlock Space. This is what lets the revocation cascade's
+ * re-mint read a recovery code's standing record without holding the code:
+ * the record's code-authenticated binding rides the frame in the clear, so
+ * carrying it forward verbatim needs no decryption.
+ *
+ * @param options {object}
+ * @param options.storageServerUrl {string}
+ * @param options.zcapClient {ZcapClient}   an enrolled client's zcap client
+ * @param options.spaceId {string}   the unlock Space id
+ * @param options.capability {IZcap}   the delegated management zcap (must
+ *   allow GET)
+ * @returns {Promise<unknown | null>}
+ */
+export declare function getUnlockKeyringWithCapability({ storageServerUrl, zcapClient, spaceId, capability }: {
+    storageServerUrl: string;
+    zcapClient: ZcapClient;
+    spaceId: string;
+    capability: IZcap;
+}): Promise<unknown | null>;
 /**
  * Writes (upserts) the keyring record with an explicitly attached management
  * capability, rather than by root invocation. The `zcapClient` here is an

package/dist/keyring/unlockSpace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlockSpace.d.ts","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAA;AAoIrD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACV,IAAwB,EACzB,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACR,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAQ1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACP,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,KAAK,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACR,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,KAAK,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB"}
+{"version":3,"file":"unlockSpace.d.ts","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAA;AAoIrD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACV,IAAwB,EACzB,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACR,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAQ1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACP,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,KAAK,CAAA;CAClB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAQ1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,KAAK,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACR,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,+BAA+B,CAAC,EACpD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,KAAK,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAchB"}

package/dist/keyring/unlockSpace.js

@@ -20,6 +20,7 @@
  * surfacing the miss as a 404-shaped `null`.
  */
 import { WasClient } from '@interop/was-client';
+import { resourcePath, spacePath } from '@interop/was-client/paths';
 import { errorStatus } from '@interop/was-client/sync';
 import { KEYRING_COLLECTION, KEYRING_RESOURCE } from '../space/collections.js';
 /**
@@ -175,6 +176,34 @@ export async function putUnlockKeyring({ storageServerUrl, zcapClient, spaceId,
         record
     });
 }
+/**
+ * Reads the keyring record with an explicitly attached management capability,
+ * rather than by root invocation, or returns `null` when it does not exist.
+ * The `zcapClient` here is an enrolled client's (not the unlock identity's);
+ * the attached `capability` -- the management zcap the unlock identity
+ * delegated at bind time, provided it allows GET -- authorizes the read
+ * against the unlock Space. This is what lets the revocation cascade's
+ * re-mint read a recovery code's standing record without holding the code:
+ * the record's code-authenticated binding rides the frame in the clear, so
+ * carrying it forward verbatim needs no decryption.
+ *
+ * @param options {object}
+ * @param options.storageServerUrl {string}
+ * @param options.zcapClient {ZcapClient}   an enrolled client's zcap client
+ * @param options.spaceId {string}   the unlock Space id
+ * @param options.capability {IZcap}   the delegated management zcap (must
+ *   allow GET)
+ * @returns {Promise<unknown | null>}
+ */
+export async function getUnlockKeyringWithCapability({ storageServerUrl, zcapClient, spaceId, capability }) {
+    const was = unlockSpaceClient({ storageServerUrl, zcapClient });
+    const result = await was
+        .space(spaceId)
+        .collection(KEYRING_COLLECTION.id, { capability, encryption: 'plaintext' })
+        .resource(KEYRING_RESOURCE)
+        .get();
+    return result === null ? null : result;
+}
 /**
  * Writes (upserts) the keyring record with an explicitly attached management
  * capability, rather than by root invocation. The `zcapClient` here is an
@@ -200,7 +229,7 @@ export async function putUnlockKeyringWithCapability({ storageServerUrl, zcapCli
     const body = new TextEncoder().encode(JSON.stringify(record));
     await was.request({
         capability,
-        path: `/space/${spaceId}/${KEYRING_COLLECTION.id}/${KEYRING_RESOURCE}`,
+        path: resourcePath(spaceId, KEYRING_COLLECTION.id, KEYRING_RESOURCE),
         method: 'PUT',
         headers: { 'content-type': 'application/json' },
         body
@@ -243,7 +272,7 @@ export async function deleteUnlockSpaceWithCapability({ storageServerUrl, zcapCl
     try {
         await was.request({
             capability,
-            path: `/space/${spaceId}`,
+            path: spacePath(spaceId),
             method: 'DELETE'
         });
     }

package/dist/keyring/unlockSpace.js.map

@@ -1 +1 @@
-{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAGtD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EAIX;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,IAAI,EAOL;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG;SACrB,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SACrD,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EAQP;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SACrD,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAOzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACxD,MAAM,yBAAyB,CAAC;QAC9B,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EAKR;IACC,OAAO,kBAAkB,CAAC;QACxB,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EAMP;IACC,MAAM,kBAAkB,CAAC;QACvB,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,UAAU;QACV,IAAI,EAAE,UAAU,OAAO,IAAI,kBAAkB,CAAC,EAAE,IAAI,gBAAgB,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI;KACL,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EAKR;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EAMX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,UAAU;YACV,IAAI,EAAE,UAAU,OAAO,EAAE;YACzB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7B,OAAM;QACR,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAGtD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EAIX;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,IAAI,EAOL;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG;SACrB,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SACrD,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EAQP;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SACrD,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAOzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACxD,MAAM,yBAAyB,CAAC;QAC9B,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EAKR;IACC,OAAO,kBAAkB,CAAC;QACxB,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EAMP;IACC,MAAM,kBAAkB,CAAC;QACvB,gBAAgB;QAChB,UAAU;QACV,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EAMX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG;SACrB,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SAC1E,QAAQ,CAAC,gBAAgB,CAAC;SAC1B,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,MAAM,EACN,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,GAAG,CAAC,OAAO,CAAC;QAChB,UAAU;QACV,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE,gBAAgB,CAAC;QACpE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI;KACL,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,OAAO,EAKR;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,UAAU,EAMX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,OAAO,CAAC;YAChB,UAAU;YACV,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC;YACxB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7B,OAAM;QACR,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/keys/rosterLogStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAQL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EAEvB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAA;AAE5E,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,yBAAyB,GAC/B,KAAK,IAAI,iCAAiC,CAK5C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACP,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CAoHpC"}
+{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAQL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EAEvB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAA;AAE5E,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,yBAAyB,GAC/B,KAAK,IAAI,iCAAiC,CAK5C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACP,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CAyHpC"}

package/dist/keys/rosterLogStore.js

@@ -117,12 +117,17 @@ export function logGovernedDescriptorStore({ log, resolveController, pinStore, s
         },
         async seal() {
             const controller = await resolveController();
+            // Reuse the log view the most recent read or confirmed append on this
+            // store instance verified: a rotation that just appended anchors past
+            // the removal, so the sweep resolves noop with no re-fetch, and a stale
+            // view is safe (sealResourceLog's append path re-reads before writing).
             const { sealed, verified } = await sealResourceLog({
                 store: log,
                 controller,
                 expectedMethod: RESOURCE_LOG_METHOD,
                 pinStore,
-                signer
+                signer,
+                ...(lastVerified === null ? {} : { verified: lastVerified })
             });
             if (verified !== null) {
                 lastVerified = verified;