@interop/wallet-core 0.40.0 → 0.42.0

package/dist/recovery/recoveryCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryCode.js","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAc;IACrC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wBAAwB;CAC/B,CAAA;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,oCAAoC,CAAA;AACjE,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,YAAY,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,wBAAwB,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,oCAAoC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAA;IACjD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,KAAK,EAAqB;IAChE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,oDAAoD;QACpD,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAmCD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAC3C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,MAAM,CAAC,eAA6D,CAAA;IACtE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,CAAC,EAAE,AAAD,EAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO;QACL,SAAS;QACT,UAAU;QACV,UAAU;QACV,aAAa;QACb,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC7B,mBAAmB,EAAE,mBAAoB;QACzC,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,wBAAwB,EAAE;KAClE,CAAA;AACH,CAAC"}
+{"version":3,"file":"recoveryCode.js","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAc;IACrC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wBAAwB;CAC/B,CAAA;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,oCAAoC,CAAA;AACjE,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,YAAY,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,wBAAwB,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,oCAAoC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAA;IACjD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,KAAK,EAAqB;IAChE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,oDAAoD;QACpD,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAuBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAC3C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO;QACL,GAAG,QAAQ;QACX,SAAS;QACT,UAAU;QACV,aAAa;QACb,kBAAkB,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;KACnE,CAAA;AACH,CAAC"}

package/dist/recovery/recoveryDelegation.d.ts

@@ -0,0 +1,151 @@
+import type { IZcap } from '@interop/data-integrity-core';
+import type { ZcapClient } from '@interop/ezcap';
+import type { PublishedKeyDocument } from '../webvh/listClients.js';
+import type { AccountPointer, RecordSigner } from '../keyring/record.js';
+/**
+ * The recovery delegation's lifetime: one year, following NIST SP 800-57's
+ * one-to-two-year cryptoperiod guidance for private signature keys. The
+ * delegation's scope stays narrow (PUT on the one world-readable DID log
+ * resource, whose worst-case abuse is a log write that still has to verify
+ * against the published hash chain and prerotation commitments to resolve),
+ * but a standing bearer artifact should not outlive its signing key's
+ * recommended cryptoperiod. A code must keep working past the year, so
+ * expiry is watched rather than terminal: the registry entry records the
+ * delegation's `expires`, {@link zcapExpiring} treats the
+ * renewal window before it as stale, the re-mint refreshes a stale
+ * delegation, and the login-time recovery health check flags one the same
+ * way it flags rot (the signing client's verification method leaving the
+ * document).
+ */
+export declare const RECOVERY_DELEGATION_TTL_MS: number;
+/**
+ * How long before its `expires` a standing recorded zcap counts as stale:
+ * thirty days, so a refresh (a re-mint, a login-time re-delegation) or a
+ * regenerate nudge lands well before the zcap actually lapses.
+ */
+export declare const ZCAP_RENEWAL_WINDOW_MS: number;
+/**
+ * Whether a recorded zcap expiry is past or inside the renewal window -- the
+ * expiry half of the staleness predicate for every long-lived zcap a wallet
+ * records beside its registry entries (the recovery `did.jsonl` delegation,
+ * an unlock Space's management zcap). The re-mint and the wallets'
+ * login-time checks all ask this one predicate. A record carrying no expiry
+ * (or an unparseable one) is uncheckable and therefore not assumed healthy,
+ * matching the rot check's treatment of a missing `delegationKeyId`.
+ *
+ * @param options {object}
+ * @param [options.expires] {string}   the recorded ISO 8601 expiry
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {boolean}
+ */
+export declare function zcapExpiring({ expires, now }: {
+    expires?: string;
+    now?: number;
+}): boolean;
+/**
+ * Delegates the narrow log-write bridge to a code-derived client: PUT on the
+ * one `did.jsonl` resource, {@link RECOVERY_DELEGATION_TTL_MS} lifetime. The
+ * delegation is what lets a latent-authority code write its self-enrolling
+ * continuation without any standing invocation presence.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating client (an enrolled
+ *   client's promoted signer)
+ * @param options.pointer {AccountPointer}
+ * @param options.recoveryClientDid {string}
+ * @returns {Promise<IZcap>}
+ */
+export declare function delegateLogWrite({ zcapClient, pointer, recoveryClientDid }: {
+    zcapClient: ZcapClient;
+    pointer: AccountPointer;
+    recoveryClientDid: string;
+}): Promise<IZcap>;
+/**
+ * The verification method that signed a delegation's proof -- recorded in the
+ * registry entry so the health check and the re-mint's rot check can test it
+ * against the current document without holding the code.
+ *
+ * @param delegation {IZcap}
+ * @returns {string | undefined}
+ */
+export declare function delegationProofKeyId(delegation: IZcap): string | undefined;
+/**
+ * The members of a recovery-code registry entry the re-mint reads: where the
+ * code's unlock Space and record are (`unlockSpaceId`, `manageCapability`),
+ * which key signed the recorded delegation and when it expires
+ * (`delegationKeyId` / `delegationExpires` -- either absent on an entry
+ * predating its field, which the staleness checks conservatively flag), and
+ * the re-mint fields: the code-derived signing DID the fresh delegation names
+ * and the unlock KAK public half the record is re-wrapped to. Structural on
+ * purpose -- an app's richer registry entry satisfies it, and the re-mint
+ * hands the SAME entry back (with the fresh `delegationKeyId`) through the
+ * record seam, extra members untouched.
+ */
+export interface RecoveryDelegationEntry {
+    label: string;
+    unlockSpaceId: string;
+    manageCapability?: IZcap;
+    delegationKeyId?: string;
+    delegationExpires?: string;
+    recoveryClientDid?: string;
+    unlockKeyAgreementKeyId?: string;
+    unlockKeyAgreementKeyMultibase?: string;
+}
+/**
+ * Re-mints the recovery delegations the current document no longer backs --
+ * the recovery-code delta riding the revocation cascade (see the module doc
+ * for the mechanism and the skip policy).
+ *
+ * The record's credential-authenticated core is preserved verbatim: the
+ * re-mint reads the standing record through the entry's management zcap and
+ * replaces only its bridge member ({@link remintUnlockRecordBridge}) -- the
+ * shell, the ladder member (where one rides), and the binding tag all travel
+ * untouched, since the re-mint can decrypt none of them and does not need to.
+ * A re-mint therefore can never change the pointer or controller the
+ * credential was bound against -- and after a host migration the tag no
+ * longer matches the moved pointer, so credentials must be rebound (codes
+ * re-issued) when the account moves hosts.
+ *
+ * The re-mint holds the code's KAK public half but not its signing key, so
+ * every record it re-PUTs is signed with the acting client's own account key
+ * (`recordSigner`) -- the mixed-signer case a reader settles against the
+ * verified did:webvh document.
+ *
+ * Best-effort per entry: a skipped entry stays flagged by the login-time
+ * health check, whose regenerate nudge remains the backstop.
+ *
+ * @param options {object}
+ * @param options.doc {PublishedKeyDocument}   the locally verified did:webvh
+ *   document, AFTER the revocation edit
+ * @param options.entries {RecoveryDelegationEntry[]}   the registry's
+ *   recovery-code entries, as the app's registry read returned them
+ * @param options.pointer {AccountPointer}
+ * @param options.storageServerUrl {string}   the unlock Spaces' storage server
+ * @param options.zcapClient {ZcapClient}   the acting client's promoted
+ *   signer, which mints the fresh delegations
+ * @param options.recordSigner {RecordSigner}   the acting client's account
+ *   key, which signs the re-wrapped records
+ * @param options.managementZcapClient {Function}   `({ capability }) =>
+ *   ZcapClient` -- the client an entry's management zcap is invoked with
+ * @param options.recordEntry {Function}   `({ entry }) => Promise<void>` --
+ *   persists one updated registry entry (matching on the app's entry key)
+ * @returns {Promise<{ reminted: number; skipped: number }>}
+ */
+export declare function remintRecoveryDelegations<Entry extends RecoveryDelegationEntry>({ doc, entries, pointer, storageServerUrl, zcapClient, recordSigner, managementZcapClient, recordEntry }: {
+    doc: PublishedKeyDocument;
+    entries: Entry[];
+    pointer: AccountPointer;
+    storageServerUrl: string;
+    zcapClient: ZcapClient;
+    recordSigner: RecordSigner;
+    managementZcapClient: (options: {
+        capability: IZcap;
+    }) => ZcapClient;
+    recordEntry: (options: {
+        entry: Entry;
+    }) => Promise<void>;
+}): Promise<{
+    reminted: number;
+    skipped: number;
+}>;
+//# sourceMappingURL=recoveryDelegation.d.ts.map

package/dist/recovery/recoveryDelegation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGxE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B,QAA4B,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,EAC3B,OAAO,EACP,GAAgB,EACjB,EAAE;IACD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CASV;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAClB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAU1E;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACZ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA+FjD"}

package/dist/recovery/recoveryDelegation.js

@@ -0,0 +1,261 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The recovery code's authorization bridge: the pre-minted PUT-on-`did.jsonl`
+ * delegation and the revocation cascade's re-mint of it. The delegation is a
+ * wire artifact both apps must mint byte-identically (issuance and every
+ * re-mint produce the record another replica later recovers with), so its
+ * builder lives here: PUT on the one `did.jsonl` resource, one-year TTL,
+ * delegated to the code-derived signing DID. Its narrow scope is what keeps
+ * recovery loud -- a stolen code must extend the world-readable log before it
+ * can read anything.
+ *
+ * Beside the builder lives the re-mint core (`remintRecoveryDelegations`):
+ * revoking a client kills, by the current-key-set rule, every `did.jsonl`
+ * delegation that client signed, which would brick recovery exactly when it
+ * is needed -- and a delegation left standing eventually reaches its own
+ * expiry. For each registry entry whose recorded delegation no longer
+ * chains (its signing verification method left the document) or is expired
+ * or inside the renewal window, the acting
+ * client signs a fresh delegation to the code's signing DID, re-wraps the
+ * record to the code's unlock KAK (the public half the registry records --
+ * the record carries no secrets, so re-encryption needs none), re-PUTs it
+ * through the entry's management zcap, and updates the registry's
+ * `delegationKeyId` and `delegationExpires`. The skip policy is
+ * cross-replica correctness and is
+ * decided here once: an entry that predates the re-mint fields, or whose
+ * standing record cannot be read or carries no binding, is skipped and stays
+ * flagged by the login-time health check. What stays app-side is the seams:
+ * the management-zcap client factory, the storage server URL, and the
+ * registry read/record halves.
+ */
+import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+import { DID_LOG_RESOURCE, ID_COLLECTION } from '../space/collections.js';
+import { delegationKeyInDocument } from '../webvh/listClients.js';
+import { getUnlockKeyringWithCapability, putUnlockKeyringWithCapability } from '../keyring/unlockSpace.js';
+import { remintUnlockRecordBridge } from '../unlock/unlockRecord.js';
+/**
+ * The recovery delegation's lifetime: one year, following NIST SP 800-57's
+ * one-to-two-year cryptoperiod guidance for private signature keys. The
+ * delegation's scope stays narrow (PUT on the one world-readable DID log
+ * resource, whose worst-case abuse is a log write that still has to verify
+ * against the published hash chain and prerotation commitments to resolve),
+ * but a standing bearer artifact should not outlive its signing key's
+ * recommended cryptoperiod. A code must keep working past the year, so
+ * expiry is watched rather than terminal: the registry entry records the
+ * delegation's `expires`, {@link zcapExpiring} treats the
+ * renewal window before it as stale, the re-mint refreshes a stale
+ * delegation, and the login-time recovery health check flags one the same
+ * way it flags rot (the signing client's verification method leaving the
+ * document).
+ */
+export const RECOVERY_DELEGATION_TTL_MS = 365 * 24 * 60 * 60 * 1000;
+/**
+ * How long before its `expires` a standing recorded zcap counts as stale:
+ * thirty days, so a refresh (a re-mint, a login-time re-delegation) or a
+ * regenerate nudge lands well before the zcap actually lapses.
+ */
+export const ZCAP_RENEWAL_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * Whether a recorded zcap expiry is past or inside the renewal window -- the
+ * expiry half of the staleness predicate for every long-lived zcap a wallet
+ * records beside its registry entries (the recovery `did.jsonl` delegation,
+ * an unlock Space's management zcap). The re-mint and the wallets'
+ * login-time checks all ask this one predicate. A record carrying no expiry
+ * (or an unparseable one) is uncheckable and therefore not assumed healthy,
+ * matching the rot check's treatment of a missing `delegationKeyId`.
+ *
+ * @param options {object}
+ * @param [options.expires] {string}   the recorded ISO 8601 expiry
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {boolean}
+ */
+export function zcapExpiring({ expires, now = Date.now() }) {
+    if (!expires) {
+        return true;
+    }
+    const expiresAt = Date.parse(expires);
+    if (Number.isNaN(expiresAt)) {
+        return true;
+    }
+    return expiresAt - now <= ZCAP_RENEWAL_WINDOW_MS;
+}
+/**
+ * The absolute URL of the account's `did.jsonl` log resource -- the
+ * invocation target of the pre-minted recovery delegation.
+ *
+ * @param options {object}
+ * @param options.pointer {AccountPointer}
+ * @returns {string}
+ */
+function didLogUrl({ pointer }) {
+    return new URL(`/space/${pointer.spaceId}/${ID_COLLECTION.id}/${DID_LOG_RESOURCE}`, pointer.host).toString();
+}
+/**
+ * Delegates the narrow log-write bridge to a code-derived client: PUT on the
+ * one `did.jsonl` resource, {@link RECOVERY_DELEGATION_TTL_MS} lifetime. The
+ * delegation is what lets a latent-authority code write its self-enrolling
+ * continuation without any standing invocation presence.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating client (an enrolled
+ *   client's promoted signer)
+ * @param options.pointer {AccountPointer}
+ * @param options.recoveryClientDid {string}
+ * @returns {Promise<IZcap>}
+ */
+export async function delegateLogWrite({ zcapClient, pointer, recoveryClientDid }) {
+    return zcapClient.delegate({
+        invocationTarget: didLogUrl({ pointer }),
+        controller: recoveryClientDid,
+        allowedActions: ['PUT'],
+        expires: new Date(Date.now() + RECOVERY_DELEGATION_TTL_MS)
+    });
+}
+/**
+ * The verification method that signed a delegation's proof -- recorded in the
+ * registry entry so the health check and the re-mint's rot check can test it
+ * against the current document without holding the code.
+ *
+ * @param delegation {IZcap}
+ * @returns {string | undefined}
+ */
+export function delegationProofKeyId(delegation) {
+    const { proof } = delegation;
+    const single = Array.isArray(proof) ? proof[0] : proof;
+    return single?.verificationMethod;
+}
+/**
+ * Re-mints the recovery delegations the current document no longer backs --
+ * the recovery-code delta riding the revocation cascade (see the module doc
+ * for the mechanism and the skip policy).
+ *
+ * The record's credential-authenticated core is preserved verbatim: the
+ * re-mint reads the standing record through the entry's management zcap and
+ * replaces only its bridge member ({@link remintUnlockRecordBridge}) -- the
+ * shell, the ladder member (where one rides), and the binding tag all travel
+ * untouched, since the re-mint can decrypt none of them and does not need to.
+ * A re-mint therefore can never change the pointer or controller the
+ * credential was bound against -- and after a host migration the tag no
+ * longer matches the moved pointer, so credentials must be rebound (codes
+ * re-issued) when the account moves hosts.
+ *
+ * The re-mint holds the code's KAK public half but not its signing key, so
+ * every record it re-PUTs is signed with the acting client's own account key
+ * (`recordSigner`) -- the mixed-signer case a reader settles against the
+ * verified did:webvh document.
+ *
+ * Best-effort per entry: a skipped entry stays flagged by the login-time
+ * health check, whose regenerate nudge remains the backstop.
+ *
+ * @param options {object}
+ * @param options.doc {PublishedKeyDocument}   the locally verified did:webvh
+ *   document, AFTER the revocation edit
+ * @param options.entries {RecoveryDelegationEntry[]}   the registry's
+ *   recovery-code entries, as the app's registry read returned them
+ * @param options.pointer {AccountPointer}
+ * @param options.storageServerUrl {string}   the unlock Spaces' storage server
+ * @param options.zcapClient {ZcapClient}   the acting client's promoted
+ *   signer, which mints the fresh delegations
+ * @param options.recordSigner {RecordSigner}   the acting client's account
+ *   key, which signs the re-wrapped records
+ * @param options.managementZcapClient {Function}   `({ capability }) =>
+ *   ZcapClient` -- the client an entry's management zcap is invoked with
+ * @param options.recordEntry {Function}   `({ entry }) => Promise<void>` --
+ *   persists one updated registry entry (matching on the app's entry key)
+ * @returns {Promise<{ reminted: number; skipped: number }>}
+ */
+export async function remintRecoveryDelegations({ doc, entries, pointer, storageServerUrl, zcapClient, recordSigner, managementZcapClient, recordEntry }) {
+    let reminted = 0;
+    let skipped = 0;
+    for (const entry of entries) {
+        // The current-key-set rule, decided once in `webvh`: an entry whose
+        // recorded signing key the document no longer publishes -- or that
+        // records no signing key at all -- is rotted. Expiry is the other
+        // staleness axis: a delegation expired or inside the renewal window
+        // (or recording no expiry at all) is re-minted even though its key
+        // still stands.
+        const stands = delegationKeyInDocument({
+            doc,
+            ...(entry.delegationKeyId
+                ? { delegationKeyId: entry.delegationKeyId }
+                : {})
+        });
+        const expiring = zcapExpiring({
+            ...(entry.delegationExpires ? { expires: entry.delegationExpires } : {})
+        });
+        if (stands && !expiring) {
+            continue;
+        }
+        if (!entry.recoveryClientDid ||
+            !entry.unlockKeyAgreementKeyId ||
+            !entry.unlockKeyAgreementKeyMultibase ||
+            !entry.manageCapability) {
+            // An entry issued before the re-mint fields existed: the health check
+            // keeps flagging it until the code is regenerated.
+            skipped += 1;
+            continue;
+        }
+        try {
+            // The standing record, whose credential-authenticated core travels
+            // verbatim (a record with no binding predates the standing layout and
+            // cannot be re-minted -- `remintUnlockRecordBridge` refuses, and the
+            // entry is skipped into the health check's regenerate nudge).
+            const standing = await getUnlockKeyringWithCapability({
+                storageServerUrl,
+                zcapClient: managementZcapClient({
+                    capability: entry.manageCapability
+                }),
+                spaceId: entry.unlockSpaceId,
+                capability: entry.manageCapability
+            });
+            const delegation = await delegateLogWrite({
+                zcapClient,
+                pointer,
+                recoveryClientDid: entry.recoveryClientDid
+            });
+            // The credential's unlock KAK, public half only -- exactly enough to
+            // seal the fresh bridge to the same recipient the credential derives
+            // (sealing goes through the encrypt-only cipher, so no secret is
+            // needed).
+            const unlockKak = (await X25519KeyAgreementKey2020.from({
+                id: entry.unlockKeyAgreementKeyId,
+                controller: entry.unlockKeyAgreementKeyId.split('#')[0],
+                type: 'X25519KeyAgreementKey2020',
+                publicKeyMultibase: entry.unlockKeyAgreementKeyMultibase
+            }));
+            const wrapped = await remintUnlockRecordBridge({
+                record: standing,
+                delegation,
+                keyAgreementKey: unlockKak,
+                signer: recordSigner
+            });
+            await putUnlockKeyringWithCapability({
+                storageServerUrl,
+                zcapClient: managementZcapClient({
+                    capability: entry.manageCapability
+                }),
+                spaceId: entry.unlockSpaceId,
+                record: wrapped,
+                capability: entry.manageCapability
+            });
+            const delegationKeyId = delegationProofKeyId(delegation);
+            const delegationExpires = delegation.expires;
+            await recordEntry({
+                entry: {
+                    ...entry,
+                    ...(delegationKeyId ? { delegationKeyId } : {}),
+                    ...(delegationExpires ? { delegationExpires } : {})
+                }
+            });
+            reminted += 1;
+        }
+        catch (err) {
+            console.warn(`Could not re-mint the recovery delegation for "${entry.label}":`, err);
+            skipped += 1;
+        }
+    }
+    return { reminted, skipped };
+}
+//# sourceMappingURL=recoveryDelegation.js.map

package/dist/recovery/recoveryDelegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAEjE,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAA;AAEpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,OAAO,EACP,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAIjB;IACC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,SAAS,GAAG,GAAG,IAAI,sBAAsB,CAAA;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,IAAI,GAAG,CACZ,UAAU,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,IAAI,gBAAgB,EAAE,EACnE,OAAO,CAAC,IAAI,CACb,CAAC,QAAQ,EAAE,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAKlB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B,CAAC;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAiB;IACpD,MAAM,EAAE,KAAK,EAAE,GAAG,UAMjB,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACtD,OAAO,MAAM,EAAE,kBAAkB,CAAA;AACnC,CAAC;AAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EAUZ;IACC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,gBAAgB;QAChB,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,GAAG;YACH,GAAG,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAA;QACF,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,SAAQ;QACV,CAAC;QACD,IACE,CAAC,KAAK,CAAC,iBAAiB;YACxB,CAAC,KAAK,CAAC,uBAAuB;YAC9B,CAAC,KAAK,CAAC,8BAA8B;YACrC,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;YACD,sEAAsE;YACtE,mDAAmD;YACnD,OAAO,IAAI,CAAC,CAAA;YACZ,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;gBACpD,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,UAAU;gBACV,OAAO;gBACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAA;YACF,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,MAAM,SAAS,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC;gBACtD,EAAE,EAAE,KAAK,CAAC,uBAAuB;gBACjC,UAAU,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,EAAE,2BAA2B;gBACjC,kBAAkB,EAAE,KAAK,CAAC,8BAA8B;aACzD,CAAC,CAAqB,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;gBAC7C,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YACF,MAAM,8BAA8B,CAAC;gBACnC,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;YACxD,MAAM,iBAAiB,GAAI,UAAmC,CAAC,OAAO,CAAA;YACtE,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpD;aACF,CAAC,CAAA;YACF,QAAQ,IAAI,CAAC,CAAA;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,kDAAkD,KAAK,CAAC,KAAK,IAAI,EACjE,GAAG,CACJ,CAAA;YACD,OAAO,IAAI,CAAC,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC"}

package/dist/recovery/recoveryWebvh.d.ts

@@ -41,12 +41,12 @@ export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdRes
 /**
  * ISSUANCE (run by an enrolled client, root authority): publishes a recovery
  * code's split posture into the document -- one entry adding the code's
- * `keyAgreement` verification method (an ordinary, unmarked Multikey entry)
- * and committing its update-key hash in `nextKeyHashes`. The code's update
- * key joins `updateKeys` nowhere. Idempotent: a posture already published is
- * a no-op, so re-running a torn issuance converges. The entry publishes
- * conditionally on the log this call read; a race lost to a concurrent
- * ceremony re-runs and rebases on the new head.
+ * `keyAgreement` verification method (an ordinary, unmarked Multikey entry,
+ * the key published verbatim: a code is high-entropy, so no commitment is
+ * needed) and committing its update-key hash in `nextKeyHashes`. The code's
+ * update key joins `updateKeys` nowhere. A thin wrapper over the standing
+ * unlock-key posture core ({@link publishUnlockKey}), which owns idempotence
+ * and the conditional publish.
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}
@@ -57,7 +57,7 @@ export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdRes
  *   resolve to, from the caller's stored account pointer
  * @returns {Promise<{ did: string }>}
  */
-export declare function publishRecoveryKey(options: {
+export declare function publishRecoveryKey({ idStore, updateKeys, recovery, expectedDid }: {
     idStore: WebvhIdStore;
     updateKeys: ClientWebvhUpdateKeys;
     recovery: RecoveryPublicKeys;
@@ -68,24 +68,15 @@ export declare function publishRecoveryKey(options: {
 /**
  * REVOCATION (run by an enrolled client, root authority): removes a recovery
  * code's posture from the document -- its `keyAgreement` verification method
- * and its committed update-key hash -- in one entry. Idempotent. The
- * roster-side half (rotating the user key epoch off the code's wrap) is the
- * caller's, and runs after this so the resolver's document no longer backs
- * the removed entry.
+ * and its committed update-key hash -- in one entry, through the same shared
+ * posture core ({@link removeUnlockKey}). The roster-side half (rotating the
+ * user key epoch off the code's wrap) is the caller's, and runs after this so
+ * the resolver's document no longer backs the removed entry.
  *
- * The entry publishes conditionally on the log this call read; a race lost to
- * a concurrent ceremony re-runs and rebases on the new head.
- *
- * @param options {object}
- * @param options.idStore {WebvhIdStore}
- * @param options.updateKeys {ClientWebvhUpdateKeys}   the REVOKING client's
- *   own did:webvh update-key seeds
- * @param options.recovery {RecoveryPublicKeys}   the code's public halves
- * @param [options.expectedDid] {string}   the account DID the log must
- *   resolve to, from the caller's stored account pointer
+ * @param options {object}   see {@link publishRecoveryKey}
  * @returns {Promise<{ did: string }>}
  */
-export declare function removeRecoveryKey(options: {
+export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expectedDid }: {
     idStore: WebvhIdStore;
     updateKeys: ClientWebvhUpdateKeys;
     recovery: RecoveryPublicKeys;

package/dist/recovery/recoveryWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EACV,qBAAqB,EAErB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAE7B;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAsDD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3B;AA4ED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3B;AAqED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5C"}
+{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EACV,qBAAqB,EAErB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAsDD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAa3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAa3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5C"}