@interop/wallet-core 0.41.0 → 0.42.0

package/dist/unlock/selfEnroll.js

@@ -0,0 +1,126 @@
+import { agentsFromSeed } from '../identity/agents.js';
+import { addUserKeyRosterRecipient, readUserKeyRoster, rosterRecipientKid, userKeyRosterLogSigner } from '../keys/userKeyRoster.js';
+import { userKeyRosterDescriptorStore } from '../keys/rosterStore.js';
+import { memoryResourceLogPinStore, webvhResourceLogController } from '../resourceLog/index.js';
+import { mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
+import { verifyAccountLog } from '../webvh/verifyLog.js';
+import { clientSigningKeyMultibase, isWebvhDid, webvhZcapClient } from '../webvh/zcap.js';
+import { selfEnrollWebvhClient } from './standingWebvh.js';
+/**
+ * Runs the whole self-enrollment described in the module doc. The caller has
+ * already unwrapped the credential's unlock record (so it holds the
+ * credential-authenticated pointer, the bridge delegation behind `logStore`,
+ * and the ladder seed) and derived the credential's client identity (so it
+ * holds the key-agreement key with its secret half).
+ *
+ * @param options {object}
+ * @param options.pointer {AccountPointer}   the credential-authenticated
+ *   account pointer; must name a did:webvh
+ * @param options.ladderSeed {Uint8Array}   the credential's update-key ladder
+ *   seed, from its unlock record
+ * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the
+ *   credential's own key-agreement key (secret half included) -- its roster
+ *   entry, which the user key is unwrapped from and every epoch re-wrapped
+ *   with
+ * @param options.logStore {UnlockLogStore}   the public log read plus the
+ *   delegated `did.jsonl` PUT, built by the app around the record's bridge
+ *   delegation
+ * @param [options.accountLogPinStore] {ResourceLogPinStore}   this client's
+ *   chain-head pin for the account log. A fresh browser normally has none
+ *   (this is its first contact), which is exactly the pin's
+ *   trust-on-first-use establishment
+ * @returns {Promise<object>}   the new client's key set (for the caller to
+ *   persist under its unlock layer), its did:key, the account DID, the user
+ *   key, and the roster epoch to pin
+ */
+export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, accountLogPinStore }) {
+    const expectedDid = pointer.did;
+    if (!expectedDid || !isWebvhDid(expectedDid)) {
+        throw new Error('The account pointer names no did:webvh; only a promoted account can ' +
+            'self-enroll a client.');
+    }
+    // The new client's whole key set, minted locally; nothing travels but the
+    // public halves the log entries publish.
+    const clientSeed = crypto.getRandomValues(new Uint8Array(32));
+    const { keyAgent, keyAgreementKey } = await agentsFromSeed({
+        seed: clientSeed
+    });
+    const { publicKeyMultibase: keyAgreementKeyMultibase } = keyAgreementKey;
+    if (!keyAgreementKeyMultibase) {
+        throw new Error('The minted key-agreement key has no public multibase.');
+    }
+    const signingKeyMultibase = clientSigningKeyMultibase({ keyAgent });
+    const webvhUpdateKeys = await mintClientWebvhUpdateKeys();
+    const newClientKeys = {
+        signingKeyMultibase,
+        keyAgreementKeyMultibase,
+        updateKeyMultibase: await updateKeyMultibase({
+            seed: webvhUpdateKeys.updateSeed
+        }),
+        stagedUpdateKeyMultibase: await updateKeyMultibase({
+            seed: webvhUpdateKeys.stagedSeed
+        })
+    };
+    // The loud half: two log entries through the delegated bridge.
+    await selfEnrollWebvhClient({
+        store: logStore,
+        ladderSeed,
+        newClientKeys,
+        newClientUpdateSeeds: webvhUpdateKeys,
+        expectedDid
+    });
+    // Verify the continuation from the world-readable log -- the same
+    // first-contact read an enrollee's completion runs, and the controller the
+    // roster log's entry proofs are checked against.
+    const verified = await verifyAccountLog({
+        did: expectedDid,
+        spaceId: pointer.spaceId,
+        host: pointer.host,
+        ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
+    });
+    // The first roster read: signed with the `<did:webvh>#<multibase>` keyId
+    // the add entry just published, unwrapping the user key from the
+    // CREDENTIAL's standing wrap. First contact: the chain-head pin this read
+    // establishes is session-local here; the app's durable pin is established
+    // by its own first login read.
+    const zcapClient = webvhZcapClient({ keyAgent, did: expectedDid });
+    const store = userKeyRosterDescriptorStore({
+        storageServerUrl: pointer.host,
+        zcapClient,
+        spaceId: pointer.spaceId,
+        resolveController: async () => webvhResourceLogController({ did: expectedDid, log: verified.log }),
+        pinStore: memoryResourceLogPinStore(),
+        signer: userKeyRosterLogSigner({ keyAgent })
+    });
+    const read = await readUserKeyRoster({
+        store,
+        clientKeyAgreementKey: credentialKeyAgreementKey
+    });
+    if (!read) {
+        throw new Error('The account has no user key roster; it must finish provisioning ' +
+            'before a client can self-enroll.');
+    }
+    // Escrow the new client into the roster as its own recipient, so later
+    // logins on this browser read the roster the ordinary enrolled way.
+    // Idempotent: a wrap already standing is returned as-is.
+    await addUserKeyRosterRecipient({
+        store,
+        recipient: {
+            id: rosterRecipientKid({
+                signingKeyMultibase,
+                keyAgreementKeyMultibase
+            }),
+            publicKeyMultibase: keyAgreementKeyMultibase
+        },
+        ownerKeyAgreementKey: credentialKeyAgreementKey
+    });
+    return {
+        clientSeed,
+        webvhUpdateKeys,
+        clientDid: keyAgent.id,
+        did: expectedDid,
+        userKey: read.userKey,
+        latestEpochId: read.latestEpochId
+    };
+}
+//# sourceMappingURL=selfEnroll.js.map

package/dist/unlock/selfEnroll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfEnroll.js","sourceRoot":"","sources":["../../src/unlock/selfEnroll.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAGrE,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAE3B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,kBAAkB,EAOnB;IAQC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAA;IAC/B,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,yCAAyC;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnE,MAAM,eAAe,GAAG,MAAM,yBAAyB,EAAE,CAAA;IACzD,MAAM,aAAa,GAAwB;QACzC,mBAAmB;QACnB,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IAED,+DAA+D;IAC/D,MAAM,qBAAqB,CAAC;QAC1B,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,aAAa;QACb,oBAAoB,EAAE,eAAe;QACrC,WAAW;KACZ,CAAC,CAAA;IAEF,kEAAkE;IAClE,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;QACtC,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IAEF,yEAAyE;IACzE,iEAAiE;IACjE,0EAA0E;IAC1E,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrE,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,yBAAyB;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,kCAAkC,CACrC,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,yBAAyB,CAAC;QAC9B,KAAK;QACL,SAAS,EAAE;YACT,EAAE,EAAE,kBAAkB,CAAC;gBACrB,mBAAmB;gBACnB,wBAAwB;aACzB,CAAC;YACF,kBAAkB,EAAE,wBAAwB;SAC7C;QACD,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAA;IAEF,OAAO;QACL,UAAU;QACV,eAAe;QACf,SAAS,EAAE,QAAQ,CAAC,EAAE;QACtB,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAA;AACH,CAAC"}

package/dist/unlock/standingClient.d.ts

@@ -0,0 +1,68 @@
+import type { ProfileAgents } from '../identity/agents.js';
+/**
+ * The HKDF salt for a standing credential's client-side expansions, and the
+ * per-key info labels. All permanent. The salt differs from the recovery
+ * code's client salt (`freewallet/recovery/client-keys/v1`), so a code and a
+ * standing method that somehow shared input material could still never derive
+ * the same client identity.
+ */
+export declare const STANDING_CLIENT_SALT = "freewallet/unlock/standing-client/v1";
+/**
+ * A credential-derived client identity, assembled from its 32-byte client
+ * seed: the derived agents, the client did:key, the public multibases the
+ * document and roster carry, and the roster recipient kid. The shared shape
+ * of a standing credential's identity and a recovery code's (which extends it
+ * with the code's single update key).
+ */
+export interface UnlockClientIdentity {
+    clientSeed: Uint8Array;
+    agents: ProfileAgents;
+    clientDid: string;
+    signingKeyMultibase: string;
+    keyAgreementKeyMultibase: string;
+    /**
+     * The kid of the credential's user-key-roster entry -- its key-agreement
+     * key's id exactly as `agentsFromSeed` derives it (`did:key:<ed>#<x>`), so
+     * the wrap minted at bind time is the one a fresh browser's roster read
+     * looks for.
+     */
+    recipientKid: string;
+}
+/**
+ * Assembles a client identity from its 32-byte client seed: the one place the
+ * agents, multibases, and roster kid are derived, shared by the standing
+ * credential derivation here and the recovery code's
+ * (`recoveryClientFromCode`), so the two postures can never disagree on how a
+ * seed becomes an identity.
+ *
+ * @param options {object}
+ * @param options.clientSeed {Uint8Array}   the 32-byte client seed
+ * @returns {Promise<UnlockClientIdentity>}
+ */
+export declare function unlockClientIdentityFromSeed({ clientSeed }: {
+    clientSeed: Uint8Array;
+}): Promise<UnlockClientIdentity>;
+/**
+ * A standing unlock credential's full client-side key set: the client
+ * identity plus the binding MAC key that authenticates the unlock record's
+ * account core (computed at bind time, verified before the pointer is
+ * trusted -- the storage host never holds it).
+ */
+export interface StandingUnlockClient extends UnlockClientIdentity {
+    bindingMacKey: Uint8Array;
+}
+/**
+ * Derives a standing credential's client key set from the method's 32-byte
+ * unlock seed (the output of `deriveUnlockSeed` under the method's own KDF).
+ * Deterministic: the same secret under the same KDF always yields the same
+ * key set, which is what makes a fresh browser's self-enrollment possible
+ * with nothing but the credential in hand.
+ *
+ * @param options {object}
+ * @param options.unlockSeed {Uint8Array}   the method's 32-byte unlock seed
+ * @returns {Promise<StandingUnlockClient>}
+ */
+export declare function standingClientFromUnlockSeed({ unlockSeed }: {
+    unlockSeed: Uint8Array;
+}): Promise<StandingUnlockClient>;
+//# sourceMappingURL=standingClient.d.ts.map

package/dist/unlock/standingClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standingClient.d.ts","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,yCAAyC,CAAA;AAI1E;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,aAAa,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;IAChC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgBhC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,aAAa,EAAE,UAAU,CAAA;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkBhC"}

package/dist/unlock/standingClient.js

@@ -0,0 +1,81 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The standing unlock credential's client identity: the deterministic key set
+ * every unlock method (a passphrase, a passkey PRF output) derives from its
+ * own unlock seed under the standing-credential posture -- the recovery-code
+ * posture minus spend-on-use. The credential's key-agreement key holds a
+ * standing wrap in the user key roster (escrowed into every epoch, kept alive
+ * by rotation fan-out), and its binding MAC key authenticates the unlock
+ * record's account core, so a fresh browser holding nothing but the
+ * credential can locate the account, prove the record genuine, and decrypt.
+ * Update authority stays latent and rides the record instead: the ladder seed
+ * (`./ladder`) never derives from the secret.
+ *
+ * The derivations are wire-level: two wallet apps must produce byte-identical
+ * output for the same secret and KDF, so every salt and info label below is
+ * permanent. The HKDF input is the method's own 32-byte unlock seed
+ * (`deriveUnlockSeed`), so the expensive passphrase stretch runs once per
+ * typed secret and each unlock method's distinct KDF salt keeps two methods'
+ * client identities from ever colliding.
+ */
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { agentsFromSeed } from '../identity/agents.js';
+/**
+ * The HKDF salt for a standing credential's client-side expansions, and the
+ * per-key info labels. All permanent. The salt differs from the recovery
+ * code's client salt (`freewallet/recovery/client-keys/v1`), so a code and a
+ * standing method that somehow shared input material could still never derive
+ * the same client identity.
+ */
+export const STANDING_CLIENT_SALT = 'freewallet/unlock/standing-client/v1';
+const STANDING_CLIENT_SEED_INFO = 'client-seed';
+const STANDING_BINDING_MAC_INFO = 'binding-mac';
+/**
+ * Assembles a client identity from its 32-byte client seed: the one place the
+ * agents, multibases, and roster kid are derived, shared by the standing
+ * credential derivation here and the recovery code's
+ * (`recoveryClientFromCode`), so the two postures can never disagree on how a
+ * seed becomes an identity.
+ *
+ * @param options {object}
+ * @param options.clientSeed {Uint8Array}   the 32-byte client seed
+ * @returns {Promise<UnlockClientIdentity>}
+ */
+export async function unlockClientIdentityFromSeed({ clientSeed }) {
+    const agents = await agentsFromSeed({ seed: clientSeed });
+    const { publicKeyMultibase: keyAgreementKeyMultibase } = agents.keyAgreementKey;
+    if (!keyAgreementKeyMultibase) {
+        throw new Error('The derived key-agreement key has no public multibase.');
+    }
+    const [, , signingKeyMultibase] = agents.keyAgent.id.split(':');
+    return {
+        clientSeed,
+        agents,
+        clientDid: agents.keyAgent.id,
+        signingKeyMultibase: signingKeyMultibase,
+        keyAgreementKeyMultibase,
+        recipientKid: `${agents.keyAgent.id}#${keyAgreementKeyMultibase}`
+    };
+}
+/**
+ * Derives a standing credential's client key set from the method's 32-byte
+ * unlock seed (the output of `deriveUnlockSeed` under the method's own KDF).
+ * Deterministic: the same secret under the same KDF always yields the same
+ * key set, which is what makes a fresh browser's self-enrollment possible
+ * with nothing but the credential in hand.
+ *
+ * @param options {object}
+ * @param options.unlockSeed {Uint8Array}   the method's 32-byte unlock seed
+ * @returns {Promise<StandingUnlockClient>}
+ */
+export async function standingClientFromUnlockSeed({ unlockSeed }) {
+    const salt = new TextEncoder().encode(STANDING_CLIENT_SALT);
+    const clientSeed = hkdf(sha256, unlockSeed, salt, new TextEncoder().encode(STANDING_CLIENT_SEED_INFO), 32);
+    const bindingMacKey = hkdf(sha256, unlockSeed, salt, new TextEncoder().encode(STANDING_BINDING_MAC_INFO), 32);
+    const identity = await unlockClientIdentityFromSeed({ clientSeed });
+    return { ...identity, bindingMacKey };
+}
+//# sourceMappingURL=standingClient.js.map

package/dist/unlock/standingClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standingClient.js","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAA;AAC1E,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAwB/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,MAAM,CAAC,eAA6D,CAAA;IACtE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,CAAC,EAAE,AAAD,EAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO;QACL,UAAU;QACV,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC7B,mBAAmB,EAAE,mBAAoB;QACzC,wBAAwB;QACxB,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,wBAAwB,EAAE;KAClE,CAAA;AACH,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,CAAA;AACvC,CAAC"}

package/dist/unlock/standingWebvh.d.ts

@@ -0,0 +1,153 @@
+import type { VerificationMethod } from '@interop/did-method-webvh';
+import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
+/**
+ * The narrow store seam the self-enrollment continuation writes through: a
+ * public read of the log and the delegated `did.jsonl` PUT. A subset of
+ * {@link WebvhIdStore}, so an app's remote-store class satisfies it too.
+ */
+export type UnlockLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
+/**
+ * How a credential's key-agreement key is published in the document: the key
+ * verbatim (a high-entropy credential -- passkey PRF, recovery code), or its
+ * hash commitment (`keyAgreementCommitment`) for a low-entropy-derived key.
+ * A commitment withholds the key material and gives the roster's recipient
+ * resolver a document-anchored check to verify a roster-carried key against.
+ */
+export type UnlockKeyAgreementPublication = {
+    publicKeyMultibase: string;
+} | {
+    commitment: string;
+};
+/**
+ * A standing credential's public posture as the document and log carry it:
+ * its key-agreement publication and the update key whose hash stands in
+ * `nextKeyHashes` (ladder rung 0 at bind time; a code's single derived key).
+ */
+export interface StandingUnlockKeys {
+    keyAgreement: UnlockKeyAgreementPublication;
+    updateKeyMultibase: string;
+}
+/**
+ * The verification-method id a credential's key-agreement entry publishes
+ * under: `<did>#<multibase>` for a verbatim key (indistinguishable by id from
+ * any other keyAgreement entry), `<did>#<commitment>` for a commitment entry
+ * (the commitment string is deterministic, so the id is too).
+ *
+ * @param options {object}
+ * @param options.did {string}   the account's did:webvh
+ * @param options.keyAgreement {UnlockKeyAgreementPublication}
+ * @returns {string}
+ */
+export declare function unlockKeyVmId({ did, keyAgreement }: {
+    did: string;
+    keyAgreement: UnlockKeyAgreementPublication;
+}): string;
+/**
+ * The credential's `keyAgreement` verification method: an ordinary unmarked
+ * entry carrying either the key verbatim (a `Multikey` with
+ * `publicKeyMultibase`) or its hash commitment (a `MultikeyCommitment` with
+ * `publicKeyCommitment` -- the document convention for a low-entropy-derived
+ * key, which withholds the key material and gives the roster resolver a
+ * document-anchored check). Controlled by the account and deliberately
+ * unmarked: a credential is not a listed client, so its entry must never
+ * carry the controller marker a client listing or a revocation removal
+ * matches on.
+ *
+ * @param options {object}
+ * @param options.did {string}   the account's did:webvh
+ * @param options.keyAgreement {UnlockKeyAgreementPublication}
+ * @returns {VerificationMethod}
+ */
+export declare function unlockKeyVerificationMethod({ did, keyAgreement }: {
+    did: string;
+    keyAgreement: UnlockKeyAgreementPublication;
+}): VerificationMethod;
+/**
+ * BIND (run by an enrolled client, root authority): publishes a standing
+ * credential's split posture into the document -- one entry adding the
+ * credential's `keyAgreement` entry (verbatim or commitment) and committing
+ * its current update key's hash in `nextKeyHashes`. The update key joins
+ * `updateKeys` nowhere. Idempotent: a posture already published is a no-op,
+ * so re-running a torn bind converges. The entry publishes conditionally on
+ * the log this call read; a race lost to a concurrent ceremony re-runs and
+ * rebases on the new head.
+ *
+ * @param options {object}
+ * @param options.idStore {WebvhIdStore}
+ * @param options.updateKeys {ClientWebvhUpdateKeys}   the BINDING client's own
+ *   did:webvh update-key seeds
+ * @param options.unlockKeys {StandingUnlockKeys}   the credential's public
+ *   posture
+ * @param [options.expectedDid] {string}   the account DID the log must resolve
+ *   to, from the caller's stored account pointer
+ * @param [options.verb] {string}   what the caller is doing, for the
+ *   pending-rotation refusal message (e.g. `'issuing a recovery code'`)
+ * @returns {Promise<{ did: string }>}
+ */
+export declare function publishUnlockKey(options: {
+    idStore: WebvhIdStore;
+    updateKeys: ClientWebvhUpdateKeys;
+    unlockKeys: StandingUnlockKeys;
+    expectedDid?: string;
+    verb?: string;
+}): Promise<{
+    did: string;
+}>;
+/**
+ * REMOVAL (run by an enrolled client, root authority): removes a standing
+ * credential's posture from the document -- its `keyAgreement` entry and its
+ * committed update-key hash -- in one entry. Idempotent. The roster-side half
+ * (rotating the user key epoch off the credential's wrap) is the caller's,
+ * and runs after this so the resolver's document no longer backs the removed
+ * entry.
+ *
+ * @param options {object}   see {@link publishUnlockKey}
+ * @returns {Promise<{ did: string }>}
+ */
+export declare function removeUnlockKey(options: {
+    idStore: WebvhIdStore;
+    updateKeys: ClientWebvhUpdateKeys;
+    unlockKeys: StandingUnlockKeys;
+    expectedDid?: string;
+    verb?: string;
+}): Promise<{
+    did: string;
+}>;
+/**
+ * SELF-ENROLLMENT (run by the credential-derived client through the delegated
+ * `did.jsonl` PUT): writes the standing continuation described in the module
+ * doc -- the reveal-and-commit entry signed by the attributed ladder rung,
+ * then the add entry signed by the new ordinary client's update key, which
+ * also retires the spent rung. Resumable from durable state alone: a
+ * completed continuation is detected by the new client's update key already
+ * being authorized (no-op), a torn one by the attribution finding the rung
+ * already revealed. Both entries publish conditionally on the read they were
+ * built on, and a race lost to a concurrent ceremony re-runs from the top --
+ * re-attributing, which is exactly the retry-up-the-ladder resolution.
+ *
+ * @param options {object}
+ * @param options.store {UnlockLogStore}   public log read + delegated PUT
+ * @param options.ladderSeed {Uint8Array}   the credential's ladder seed, from
+ *   its unlock record
+ * @param options.newClientKeys {WebvhEnrollmentKeys}   the new ordinary
+ *   client's public halves
+ * @param options.newClientUpdateSeeds {ClientWebvhUpdateKeys}   the new
+ *   client's update-key seeds (minted by the self-enrolling flow, which
+ *   therefore holds them and can sign the add entry)
+ * @param [options.expectedDid] {string}   the account DID the log must resolve
+ *   to, from the credential-authenticated pointer
+ * @returns {Promise<{ did: string, webDoc?: object }>}   the account DID and,
+ *   when the add entry ran here, the final `did.json` projection for the
+ *   enrolled session to republish
+ */
+export declare function selfEnrollWebvhClient(options: {
+    store: UnlockLogStore;
+    ladderSeed: Uint8Array;
+    newClientKeys: WebvhEnrollmentKeys;
+    newClientUpdateSeeds: ClientWebvhUpdateKeys;
+    expectedDid?: string;
+}): Promise<{
+    did: string;
+    webDoc?: object;
+}>;
+//# sourceMappingURL=standingWebvh.d.ts.map

package/dist/unlock/standingWebvh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAU,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAe3E,OAAO,KAAK,EACV,qBAAqB,EAErB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAsDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3B;AAkGD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,UAAU,EAAE,UAAU,CAAA;IACtB,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5C"}