@interop/wallet-core 0.41.0 → 0.42.0

package/dist/resourceLog/pin.js

@@ -11,21 +11,46 @@
  * adopted. Storage is the app's concern (freewallet: beside its other pins in
  * localStorage; DCW: a table row), so only the seam lives here, plus an
  * in-memory implementation for tests and single-session use.
+ *
+ * The seam is keyed: every read and write names the log it concerns with a
+ * `logId`, so one store instance serves every log a wallet holds. Wallet-core
+ * supplies the key at every call, built by {@link resourceLogPinId} (or one of
+ * the named builders over it), so an app implements one keyed store and never
+ * chooses keys itself.
+ */
+/**
+ * The pin-slot key for one log: an opaque per-log identity key for pin
+ * storage, not a fetchable path or URL.
+ *
+ * It is deliberately host-free. The `spaceId` is the account's stable random
+ * id, so a log served from a claimed new host lands in the SAME pin slot and
+ * is checked against the pin already held, rather than opening a fresh
+ * trust-on-first-use slate (the mirror-fork concern).
+ *
+ * @param options {object}
+ * @param options.spaceId {string}   the Space the log lives in
+ * @param options.collectionId {string}   the collection holding the log
+ * @param options.resourceId {string}   the log resource's id
+ * @returns {string}
  */
+export function resourceLogPinId({ spaceId, collectionId, resourceId }) {
+    return `space/${spaceId}/${collectionId}/${resourceId}`;
+}
 /**
- * An in-memory pin store: continuity within one session only. Tests use it
- * as the seam's reference implementation; apps persist for real.
+ * An in-memory pin store: continuity within one session only, keyed by
+ * `logId` like any other implementation, so one instance serves several logs.
+ * Tests use it as the seam's reference implementation; apps persist for real.
  *
  * @returns {ResourceLogPinStore}
  */
 export function memoryResourceLogPinStore() {
-    let pin = null;
+    const pins = new Map();
     return {
-        async read() {
-            return pin;
+        async read({ logId }) {
+            return pins.get(logId) ?? null;
         },
-        async write(next) {
-            pin = next;
+        async write({ logId, pin }) {
+            pins.set(logId, pin);
         }
     };
 }

package/dist/resourceLog/pin.js.map

@@ -1 +1 @@
-{"version":3,"file":"pin.js","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AA0BH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,GAAG,GAA8B,IAAI,CAAA;IACzC,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAwB;YAClC,GAAG,GAAG,IAAI,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"pin.js","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AAgCH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,OAAO,EACP,YAAY,EACZ,UAAU,EAKX;IACC,OAAO,SAAS,OAAO,IAAI,YAAY,IAAI,UAAU,EAAE,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAA;IAClD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE;YAClB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;QAChC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACtB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/resourceLog/seal.d.ts

@@ -67,6 +67,8 @@ export declare function latestAssertionRemovalIndex({ controller }: {
  * @param options.expectedMethod {string}   the format identifier expected
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pin for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key
  * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
@@ -79,11 +81,12 @@ export declare function latestAssertionRemovalIndex({ controller }: {
  *   anything is written
  * @returns {Promise<{ sealed: boolean, verified: VerifiedResourceLog | null }>}
  */
-export declare function sealResourceLog({ store, controller, expectedMethod, pinStore, signer, versionTime, verified: knownVerified }: {
+export declare function sealResourceLog({ store, controller, expectedMethod, pinStore, logId, signer, versionTime, verified: knownVerified }: {
     store: ResourceLogStore;
     controller: ResourceLogController;
     expectedMethod: string;
     pinStore: ResourceLogPinStore;
+    logId: string;
     signer: ResourceLogSigner;
     versionTime?: string;
     verified?: VerifiedResourceLog;

package/dist/resourceLog/seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,WAAW,EACX,QAAQ,EAAE,aAAa,EACxB,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;CAAE,CAAC,CA2CrE"}
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,KAAK,EACL,MAAM,EACN,WAAW,EACX,QAAQ,EAAE,aAAa,EACxB,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,iBAAiB,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;CAAE,CAAC,CA6CrE"}

package/dist/resourceLog/seal.js

@@ -53,6 +53,8 @@ export async function latestAssertionRemovalIndex({ controller }) {
  * @param options.expectedMethod {string}   the format identifier expected
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pin for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key
  * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
@@ -65,7 +67,7 @@ export async function latestAssertionRemovalIndex({ controller }) {
  *   anything is written
  * @returns {Promise<{ sealed: boolean, verified: VerifiedResourceLog | null }>}
  */
-export async function sealResourceLog({ store, controller, expectedMethod, pinStore, signer, versionTime, verified: knownVerified }) {
+export async function sealResourceLog({ store, controller, expectedMethod, pinStore, logId, signer, versionTime, verified: knownVerified }) {
     if (controller.versionIds.length === 0) {
         return { sealed: false, verified: null };
     }
@@ -79,7 +81,8 @@ export async function sealResourceLog({ store, controller, expectedMethod, pinSt
             store,
             controller,
             expectedMethod,
-            pinStore
+            pinStore,
+            logId
         });
         if (current === null) {
             return { sealed: false, verified: null };
@@ -95,6 +98,7 @@ export async function sealResourceLog({ store, controller, expectedMethod, pinSt
         controller,
         expectedMethod,
         pinStore,
+        logId,
         signer,
         // The rebase hook doubles as the convergence check: a concurrent writer
         // whose entry already anchors past the removal sealed the log for us.

package/dist/resourceLog/seal.js.map

@@ -1 +1 @@
-{"version":3,"file":"seal.js","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAMhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,UAAU,EAGX;IACC,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,QAAQ,GAAuB,IAAI,CAAA;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;QACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnB,YAAY,GAAG,KAAK,CAAA;oBACpB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,WAAW,EACX,QAAQ,EAAE,aAAa,EASxB;IACC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,QAAQ,GAAG,aAAa,IAAI,IAAI,CAAA;IACpC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,KAAK;YACL,UAAU;YACV,cAAc;YACd,QAAQ;SACT,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC1C,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAC7B,CAAC;IACD,IACE,QAAQ,CAAC,eAAe,KAAK,IAAI;QACjC,QAAQ,CAAC,eAAe,IAAI,YAAY,EACxC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACxC,KAAK;QACL,UAAU;QACV,cAAc;QACd,QAAQ;QACR,MAAM;QACN,wEAAwE;QACxE,sEAAsE;QACtE,UAAU,EAAE,OAAO,CAAC,EAAE,CACpB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,OAAO,CAAC,eAAe,IAAI,YAAY;YACrC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK;QACxB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAMhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,UAAU,EAGX;IACC,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,QAAQ,GAAuB,IAAI,CAAA;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;QACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnB,YAAY,GAAG,KAAK,CAAA;oBACpB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,KAAK,EACL,MAAM,EACN,WAAW,EACX,QAAQ,EAAE,aAAa,EAUxB;IACC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,QAAQ,GAAG,aAAa,IAAI,IAAI,CAAA;IACpC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,KAAK;YACL,UAAU;YACV,cAAc;YACd,QAAQ;YACR,KAAK;SACN,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC1C,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAC7B,CAAC;IACD,IACE,QAAQ,CAAC,eAAe,KAAK,IAAI;QACjC,QAAQ,CAAC,eAAe,IAAI,YAAY,EACxC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACxC,KAAK;QACL,UAAU;QACV,cAAc;QACd,QAAQ;QACR,KAAK;QACL,MAAM;QACN,wEAAwE;QACxE,sEAAsE;QACtE,UAAU,EAAE,OAAO,CAAC,EAAE,CACpB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,OAAO,CAAC,eAAe,IAAI,YAAY;YACrC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK;QACxB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AAC9C,CAAC"}

package/dist/unlock/index.d.ts

@@ -0,0 +1,40 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/unlock` subpath: standing unlock credentials --
+ * every unlock method (passphrase, passkey PRF, recovery code) as a standing
+ * credential in the recovery-code posture, with self-enrolling login. The
+ * recovery subpath's spend-on-use flows sit on top of the machinery here.
+ *
+ * - `standingClientFromUnlockSeed` / `unlockClientIdentityFromSeed` -- the
+ *   deterministic client identity a credential derives (roster wrap target,
+ *   binding MAC key), shared with the recovery-code derivation.
+ * - `generateLadderSeed` / `ladderRung` / `attributeLadderRung` -- the
+ *   update-key ladder: latent-and-consumed did:webvh update authority from a
+ *   random seed carried in the unlock record, current rung recovered from the
+ *   log itself, ambiguity failing closed.
+ * - `wrapUnlockRecord` / `unwrapUnlockRecord` / `remintUnlockRecordBridge` --
+ *   the unlock record codec: the credential-authenticated shell-and-core
+ *   layout (controller, email, pointer under the binding MAC; the bridge
+ *   delegation re-mintable; the ladder seed sealed and carried verbatim).
+ * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
+ *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
+ *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
+ * - `selfEnrollWebvhClient` / `selfEnrollClientCore` -- the self-enrolling
+ *   continuation (reveal a rung, add an ordinary client, retire the rung) and
+ *   the composed completion a fresh browser runs end to end.
+ *
+ * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * was-client dependency graph (the same isolation pattern as `./keyring`).
+ */
+export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
+export type { StandingUnlockClient, UnlockClientIdentity } from './standingClient.js';
+export { attributeLadderRung, generateLadderSeed, LADDER_MAX_SCAN, LADDER_SEED_BYTES, LadderAttributionError, ladderRung, ladderRungSeed } from './ladder.js';
+export type { LadderRung, LadderRungState } from './ladder.js';
+export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
+export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from './unlockRecord.js';
+export { publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export type { StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
+export { selfEnrollClientCore } from './selfEnroll.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/unlock/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/unlock/index.js

@@ -0,0 +1,36 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/unlock` subpath: standing unlock credentials --
+ * every unlock method (passphrase, passkey PRF, recovery code) as a standing
+ * credential in the recovery-code posture, with self-enrolling login. The
+ * recovery subpath's spend-on-use flows sit on top of the machinery here.
+ *
+ * - `standingClientFromUnlockSeed` / `unlockClientIdentityFromSeed` -- the
+ *   deterministic client identity a credential derives (roster wrap target,
+ *   binding MAC key), shared with the recovery-code derivation.
+ * - `generateLadderSeed` / `ladderRung` / `attributeLadderRung` -- the
+ *   update-key ladder: latent-and-consumed did:webvh update authority from a
+ *   random seed carried in the unlock record, current rung recovered from the
+ *   log itself, ambiguity failing closed.
+ * - `wrapUnlockRecord` / `unwrapUnlockRecord` / `remintUnlockRecordBridge` --
+ *   the unlock record codec: the credential-authenticated shell-and-core
+ *   layout (controller, email, pointer under the binding MAC; the bridge
+ *   delegation re-mintable; the ladder seed sealed and carried verbatim).
+ * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
+ *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
+ *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
+ * - `selfEnrollWebvhClient` / `selfEnrollClientCore` -- the self-enrolling
+ *   continuation (reveal a rung, add an ordinary client, retire the rung) and
+ *   the composed completion a fresh browser runs end to end.
+ *
+ * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * was-client dependency graph (the same isolation pattern as `./keyring`).
+ */
+export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
+export { attributeLadderRung, generateLadderSeed, LADDER_MAX_SCAN, LADDER_SEED_BYTES, LadderAttributionError, ladderRung, ladderRungSeed } from './ladder.js';
+export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
+export { publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { selfEnrollClientCore } from './selfEnroll.js';
+//# sourceMappingURL=index.js.map

package/dist/unlock/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/unlock/ladder.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The byte length of a ladder seed: 32 random bytes, minted at bind time and
+ * carried only inside the unlock record's sealed ladder member.
+ */
+export declare const LADDER_SEED_BYTES = 32;
+/**
+ * How many rungs {@link attributeLadderRung} derives before concluding the
+ * log commits none of them. Generous: one rung is consumed per
+ * self-enrollment, so a real ladder's standing commitment sits at the number
+ * of self-enrollments the credential has ever performed.
+ */
+export declare const LADDER_MAX_SCAN = 128;
+/**
+ * Thrown when the published log's standing parameters match no derivable rung
+ * -- the credential's posture was revoked (or never published), the ladder
+ * seed does not belong to this account, or the scan bound was exceeded -- or
+ * when they match more than one rung in the same role, which no legitimate
+ * history produces. Self-enrollment refuses loudly rather than guessing.
+ */
+export declare class LadderAttributionError extends Error {
+    constructor(message: string);
+}
+/**
+ * Generates a fresh random ladder seed.
+ *
+ * @returns {Uint8Array}
+ */
+export declare function generateLadderSeed(): Uint8Array;
+/**
+ * One rung of the ladder: its index, the 32-byte Ed25519 seed behind it, and
+ * the update key's public multibase as the log carries it.
+ */
+export interface LadderRung {
+    index: number;
+    seed: Uint8Array;
+    keyMultibase: string;
+}
+/**
+ * Derives the 32-byte update-key seed of rung `index`.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.index {number}   the rung index, from 0
+ * @returns {Uint8Array}
+ */
+export declare function ladderRungSeed({ ladderSeed, index }: {
+    ladderSeed: Uint8Array;
+    index: number;
+}): Uint8Array;
+/**
+ * Derives rung `index` in full: seed and public multibase.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.index {number}   the rung index, from 0
+ * @returns {Promise<LadderRung>}
+ */
+export declare function ladderRung({ ladderSeed, index }: {
+    ladderSeed: Uint8Array;
+    index: number;
+}): Promise<LadderRung>;
+/**
+ * Where an attributed rung stands in the published log: `'committed'` (the
+ * steady state -- only its hash stands in `nextKeyHashes`) or `'revealed'` (a
+ * torn self-enrollment published the reveal entry but not the add entry, so
+ * the rung sits in `updateKeys` awaiting the resumed add).
+ */
+export type LadderRungState = 'committed' | 'revealed';
+/**
+ * Recovers the ladder's current rung from the published log's standing
+ * parameters -- the counter recovery that replaces any stored counter. Scans
+ * rungs `0..maxScan - 1`; a rung whose key stands in `updateKeys` is a torn
+ * self-enrollment to resume (`'revealed'`), else a rung whose hash stands in
+ * `nextKeyHashes` is the standing commitment (`'committed'`). Exactly one
+ * revealed rung, or exactly one committed rung beside it, is legitimate --
+ * the reveal entry keeps the spent rung's hash committed so a resumed run can
+ * re-state it, which is why a revealed rung wins over a committed one.
+ * Anything else fails closed with {@link LadderAttributionError}.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.published {object}   the resolved log's standing parameters
+ * @param options.published.updateKeys {string[]}
+ * @param options.published.nextKeyHashes {string[]}
+ * @param [options.maxScan] {number}   how many rungs to derive before giving
+ *   up; defaults to {@link LADDER_MAX_SCAN}
+ * @returns {Promise<{ rung: LadderRung, state: LadderRungState }>}
+ */
+export declare function attributeLadderRung({ ladderSeed, published, maxScan }: {
+    ladderSeed: Uint8Array;
+    published: {
+        updateKeys: string[];
+        nextKeyHashes: string[];
+    };
+    maxScan?: number;
+}): Promise<{
+    rung: LadderRung;
+    state: LadderRungState;
+}>;
+//# sourceMappingURL=ladder.d.ts.map

package/dist/unlock/ladder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ladder.d.ts","sourceRoot":"","sources":["../../src/unlock/ladder.ts"],"names":[],"mappings":"AAiCA;;;GAGG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAA;AAUnC;;;;;GAKG;AACH,eAAO,MAAM,eAAe,MAAM,CAAA;AAElC;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,UAAU,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,UAAU,CAWb;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,EAC/B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,UAAU,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,SAAS,EACT,OAAyB,EAC1B,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BxD"}

package/dist/unlock/ladder.js

@@ -0,0 +1,144 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The update-key ladder: a standing unlock credential's latent-and-consumed
+ * did:webvh update authority. Rungs derive deterministically from a random
+ * 32-byte ladder seed carried inside the credential's unlock record -- never
+ * from the unlock secret itself, because a revealed rung lives verbatim in
+ * the world-readable `updateKeys` forever, where no hash commitment can
+ * protect it, so a secret-derived rung would be a standing offline grind
+ * oracle against the credential.
+ *
+ * Between uses only `hash(rung i)` stands in the document's `nextKeyHashes`;
+ * each self-enrollment is one loud reveal-and-commit entry signing with rung
+ * `i` and committing `hash(rung i + 1)`, after which the add entry retires
+ * the spent rung. The credential never holds a standing `updateKeys` member.
+ *
+ * There is no stored counter: which rung is current is recovered by
+ * re-deriving and scanning the published log's standing parameters
+ * ({@link attributeLadderRung}), and ambiguity fails closed rather than
+ * guessing -- the clients-listing attribution precedent. A lost
+ * compare-and-swap race resolves by determinism: the winner's entry commits
+ * `hash(rung i + 1)`, which IS the loser's retry key, so a re-run
+ * re-attributes and climbs one rung.
+ *
+ * The rung derivation is wire-level (both wallet apps must climb the same
+ * ladder from the same seed), so the salt and info labels are permanent.
+ */
+import { deriveNextKeyHash } from '@interop/did-method-webvh';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { updateKeyMultibase } from '../webvh/didWebvh.js';
+/**
+ * The byte length of a ladder seed: 32 random bytes, minted at bind time and
+ * carried only inside the unlock record's sealed ladder member.
+ */
+export const LADDER_SEED_BYTES = 32;
+/**
+ * The HKDF salt for rung derivation and the per-rung info prefix (the rung
+ * index in decimal follows it). Both permanent -- changing either orphans
+ * every bound credential's ladder.
+ */
+const LADDER_SALT = 'freewallet/unlock/update-ladder/v1';
+const LADDER_RUNG_INFO_PREFIX = 'rung/';
+/**
+ * How many rungs {@link attributeLadderRung} derives before concluding the
+ * log commits none of them. Generous: one rung is consumed per
+ * self-enrollment, so a real ladder's standing commitment sits at the number
+ * of self-enrollments the credential has ever performed.
+ */
+export const LADDER_MAX_SCAN = 128;
+/**
+ * Thrown when the published log's standing parameters match no derivable rung
+ * -- the credential's posture was revoked (or never published), the ladder
+ * seed does not belong to this account, or the scan bound was exceeded -- or
+ * when they match more than one rung in the same role, which no legitimate
+ * history produces. Self-enrollment refuses loudly rather than guessing.
+ */
+export class LadderAttributionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'LadderAttributionError';
+    }
+}
+/**
+ * Generates a fresh random ladder seed.
+ *
+ * @returns {Uint8Array}
+ */
+export function generateLadderSeed() {
+    return crypto.getRandomValues(new Uint8Array(LADDER_SEED_BYTES));
+}
+/**
+ * Derives the 32-byte update-key seed of rung `index`.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.index {number}   the rung index, from 0
+ * @returns {Uint8Array}
+ */
+export function ladderRungSeed({ ladderSeed, index }) {
+    if (!Number.isInteger(index) || index < 0) {
+        throw new Error(`Invalid ladder rung index "${String(index)}".`);
+    }
+    return hkdf(sha256, ladderSeed, new TextEncoder().encode(LADDER_SALT), new TextEncoder().encode(`${LADDER_RUNG_INFO_PREFIX}${index}`), 32);
+}
+/**
+ * Derives rung `index` in full: seed and public multibase.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.index {number}   the rung index, from 0
+ * @returns {Promise<LadderRung>}
+ */
+export async function ladderRung({ ladderSeed, index }) {
+    const seed = ladderRungSeed({ ladderSeed, index });
+    return { index, seed, keyMultibase: await updateKeyMultibase({ seed }) };
+}
+/**
+ * Recovers the ladder's current rung from the published log's standing
+ * parameters -- the counter recovery that replaces any stored counter. Scans
+ * rungs `0..maxScan - 1`; a rung whose key stands in `updateKeys` is a torn
+ * self-enrollment to resume (`'revealed'`), else a rung whose hash stands in
+ * `nextKeyHashes` is the standing commitment (`'committed'`). Exactly one
+ * revealed rung, or exactly one committed rung beside it, is legitimate --
+ * the reveal entry keeps the spent rung's hash committed so a resumed run can
+ * re-state it, which is why a revealed rung wins over a committed one.
+ * Anything else fails closed with {@link LadderAttributionError}.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.published {object}   the resolved log's standing parameters
+ * @param options.published.updateKeys {string[]}
+ * @param options.published.nextKeyHashes {string[]}
+ * @param [options.maxScan] {number}   how many rungs to derive before giving
+ *   up; defaults to {@link LADDER_MAX_SCAN}
+ * @returns {Promise<{ rung: LadderRung, state: LadderRungState }>}
+ */
+export async function attributeLadderRung({ ladderSeed, published, maxScan = LADDER_MAX_SCAN }) {
+    const revealed = [];
+    const committed = [];
+    for (let index = 0; index < maxScan; index++) {
+        const rung = await ladderRung({ ladderSeed, index });
+        if (published.updateKeys.includes(rung.keyMultibase)) {
+            revealed.push(rung);
+        }
+        else if (published.nextKeyHashes.includes(await deriveNextKeyHash(rung.keyMultibase))) {
+            committed.push(rung);
+        }
+    }
+    if (revealed.length > 1 || committed.length > 1) {
+        throw new LadderAttributionError('The published log commits more than one rung of this ladder in the ' +
+            'same role; refusing to self-enroll on an ambiguous attribution.');
+    }
+    if (revealed.length === 1) {
+        return { rung: revealed[0], state: 'revealed' };
+    }
+    if (committed.length === 1) {
+        return { rung: committed[0], state: 'committed' };
+    }
+    throw new LadderAttributionError('The published log commits no rung of this ladder; the credential has ' +
+        'been revoked, was never published, or does not belong to this account.');
+}
+//# sourceMappingURL=ladder.js.map

package/dist/unlock/ladder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ladder.js","sourceRoot":"","sources":["../../src/unlock/ladder.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAEnC;;;;GAIG;AACH,MAAM,WAAW,GAAG,oCAAoC,CAAA;AACxD,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAA;AAElC;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAClE,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EAIN;IACC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,IAAI,CACT,MAAM,EACN,UAAU,EACV,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACrC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,uBAAuB,GAAG,KAAK,EAAE,CAAC,EAC9D,EAAE,CACH,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAC/B,UAAU,EACV,KAAK,EAIN;IACC,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAC1E,CAAC;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,SAAS,EACT,OAAO,GAAG,eAAe,EAK1B;IACC,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAiB,EAAE,CAAA;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC;aAAM,IACL,SAAS,CAAC,aAAa,CAAC,QAAQ,CAC9B,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAC3C,EACD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,sBAAsB,CAC9B,qEAAqE;YACnE,iEAAiE,CACpE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IAClD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IACpD,CAAC;IACD,MAAM,IAAI,sBAAsB,CAC9B,uEAAuE;QACrE,wEAAwE,CAC3E,CAAA;AACH,CAAC"}

package/dist/unlock/selfEnroll.d.ts

@@ -0,0 +1,83 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The self-enrollment completion core: what a fresh browser runs once its
+ * typed credential has located the account, proven the unlock record genuine,
+ * and handed over the bridge delegation and the ladder seed. One call turns
+ * the credential's latent authority into an ordinary enrolled client, with no
+ * second party involved:
+ *
+ * 1. Mint the new client's whole key set locally (client seed, did:webvh
+ *    update-key seeds). Nothing is durable before the ceremony succeeds.
+ * 2. Write the self-enrolling continuation through the delegated `did.jsonl`
+ *    bridge ({@link selfEnrollWebvhClient}): the reveal-and-commit entry
+ *    signed by the attributed ladder rung, then the add entry that publishes
+ *    the new client and retires the rung. Loud by construction -- the
+ *    world-readable, hash-chained log extends before a single byte can be
+ *    read.
+ * 3. Verify the account log locally and perform the first roster read,
+ *    signed with the just-published `<did:webvh>#<multibase>` key and
+ *    unwrapping the user key from the CREDENTIAL's standing wrap (escrowed
+ *    into every epoch at bind time, kept alive by rotation fan-out).
+ * 4. Escrow the new client into the roster as its own recipient
+ *    (`addUserKeyRosterRecipient`, epochs unwrapped with the credential's
+ *    key-agreement key), so later logins on this browser read the roster the
+ *    ordinary enrolled way.
+ *
+ * Persisting the key set under the app's own unlock layer is the caller's
+ * job, exactly as with the enrollment ceremony's completion: this module
+ * hands back the key set, the user key, and the roster epoch to pin, and
+ * stops there. Every stage is idempotent, so a torn run converges by
+ * re-running with the same credential (step 2 resumes from the standing
+ * commitments; a re-run after completion mints a fresh client, which is the
+ * ordinary next self-enrollment).
+ */
+import type { IKeyAgreementKey } from '@interop/data-integrity-core';
+import type { UserKey } from '../keys/userKey.js';
+import type { AccountPointer } from '../keyring/record.js';
+import { type ResourceLogPinStore } from '../resourceLog/index.js';
+import type { ClientWebvhUpdateKeys } from '../webvh/didWebvh.js';
+import type { UnlockLogStore } from './standingWebvh.js';
+/**
+ * Runs the whole self-enrollment described in the module doc. The caller has
+ * already unwrapped the credential's unlock record (so it holds the
+ * credential-authenticated pointer, the bridge delegation behind `logStore`,
+ * and the ladder seed) and derived the credential's client identity (so it
+ * holds the key-agreement key with its secret half).
+ *
+ * @param options {object}
+ * @param options.pointer {AccountPointer}   the credential-authenticated
+ *   account pointer; must name a did:webvh
+ * @param options.ladderSeed {Uint8Array}   the credential's update-key ladder
+ *   seed, from its unlock record
+ * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the
+ *   credential's own key-agreement key (secret half included) -- its roster
+ *   entry, which the user key is unwrapped from and every epoch re-wrapped
+ *   with
+ * @param options.logStore {UnlockLogStore}   the public log read plus the
+ *   delegated `did.jsonl` PUT, built by the app around the record's bridge
+ *   delegation
+ * @param [options.accountLogPinStore] {ResourceLogPinStore}   this client's
+ *   chain-head pin for the account log. A fresh browser normally has none
+ *   (this is its first contact), which is exactly the pin's
+ *   trust-on-first-use establishment
+ * @returns {Promise<object>}   the new client's key set (for the caller to
+ *   persist under its unlock layer), its did:key, the account DID, the user
+ *   key, and the roster epoch to pin
+ */
+export declare function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, accountLogPinStore }: {
+    pointer: AccountPointer;
+    ladderSeed: Uint8Array;
+    credentialKeyAgreementKey: IKeyAgreementKey;
+    logStore: UnlockLogStore;
+    accountLogPinStore?: ResourceLogPinStore;
+}): Promise<{
+    clientSeed: Uint8Array;
+    webvhUpdateKeys: ClientWebvhUpdateKeys;
+    clientDid: string;
+    did: string;
+    userKey: UserKey;
+    latestEpochId: string;
+}>;
+//# sourceMappingURL=selfEnroll.d.ts.map

package/dist/unlock/selfEnroll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfEnroll.d.ts","sourceRoot":"","sources":["../../src/unlock/selfEnroll.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AASpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAA;AAKhC,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,EAAE,cAAc,CAAA;IACxB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC;IACV,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB,CAAC,CAqGD"}