@interop/wallet-core 0.41.0 → 0.43.0

package/dist/webvh/index.js

@@ -19,6 +19,11 @@
  * - `listEnrolledWebvhClients` -- the enrolled-client listing over a
  *   caller-verified log (keyed on `capabilityInvocation`, update keys
  *   recovered by log attribution), for a "your wallets" surface.
+ * - `keyAgreementCommitment` / `commitmentMatchesKey` -- the
+ *   `MultikeyCommitment` wire rule: the bare sha2-256 multihash, base64url
+ *   no-pad, over a key-agreement key's decoded multikey bytes, and the
+ *   decode-based check that verifies a candidate key against a published
+ *   commitment.
  * - `delegationKeyInDocument` -- the current-key-set rule for one recorded
  *   delegation: does the document still publish the key that signed it (a
  *   missing key id reads as "cannot be checked", so: no).
@@ -38,8 +43,8 @@
  * Kept out of the root export: this subpath pulls the did:webvh, ed25519, and
  * ezcap dependency graph (the same isolation pattern as `./identity`).
  */
-export { clientKeyAgreementController, didWebvhControllerTemplate, ensureDidWebvh, enrollWebvhClient, keyAgreementTwinMultibase, markedVerificationMethodPair, mintClientWebvhUpdateKeys, relationIds, repairKeyBindings, rotateWebvhUpdateKey, updateKeyMultibase, WebvhLogConflictError, withLogConflictRetry } from './didWebvh.js';
-export { AccountLogMissingError, verifyAccountLog } from './verifyLog.js';
+export { BYOE_CONTEXT_URL, clientKeyAgreementController, commitmentMatchesKey, didWebvhControllerTemplate, ensureDidWebvh, enrollWebvhClient, keyAgreementCommitment, keyAgreementTwinMultibase, MULTIKEY_COMMITMENT_VM_TYPE, markedVerificationMethodPair, mintClientWebvhUpdateKeys, relationIds, repairKeyBindings, rotateWebvhUpdateKey, updateKeyMultibase, WebvhLogConflictError, withLogConflictRetry } from './didWebvh.js';
+export { accountLogPinId, AccountLogMissingError, verifyAccountLog } from './verifyLog.js';
 export { wasWebvhIdStore } from './wasIdStore.js';
 export { attributeClientUpdateKey, delegationKeyInDocument, documentKeyMultibases, listEnrolledWebvhClients, markedKeyAgreementMethods, markedKeyAgreementMultibases } from './listClients.js';
 export { resolvedKeyAgreementMethods } from './keyAgreement.js';

package/dist/webvh/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webvh/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAW1B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGzC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webvh/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EACL,gBAAgB,EAChB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAW1B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGzC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,MAAM,WAAW,CAAA"}

package/dist/webvh/keyAgreement.d.ts

@@ -26,15 +26,35 @@
 export interface KeyAgreementDocument {
     verificationMethod?: Array<{
         id?: string;
+        type?: string;
         controller?: string;
         publicKeyMultibase?: string;
+        publicKeyCommitment?: string;
     }>;
     keyAgreement?: Array<string | {
         id?: string;
+        type?: string;
         controller?: string;
         publicKeyMultibase?: string;
+        publicKeyCommitment?: string;
     }>;
 }
+/**
+ * The materialized shape {@link resolvedKeyAgreementMethods} returns: a
+ * `keyAgreement` verification method carrying either the key itself
+ * (`publicKeyMultibase`) or, for a low-entropy-derived standing unlock
+ * credential, its hash commitment (`publicKeyCommitment`). The `type` rides
+ * along so a consumer can tell the two published flavors apart (`Multikey` vs
+ * `MultikeyCommitment`) instead of inferring the flavor from which property
+ * happens to be present.
+ */
+export interface ResolvedKeyAgreementMethod {
+    id?: string;
+    type?: string;
+    controller?: string;
+    publicKeyMultibase?: string;
+    publicKeyCommitment?: string;
+}
 /**
  * The `keyAgreement` verification methods a document publishes, materialized:
  * string references resolved against `verificationMethod` (a reference nothing
@@ -44,13 +64,9 @@ export interface KeyAgreementDocument {
  *
  * @param options {object}
  * @param options.doc {KeyAgreementDocument}   a locally verified document
- * @returns {Array<{ id?: string, controller?: string, publicKeyMultibase?: string }>}
+ * @returns {ResolvedKeyAgreementMethod[]}
  */
 export declare function resolvedKeyAgreementMethods({ doc }: {
     doc: KeyAgreementDocument;
-}): Array<{
-    id?: string;
-    controller?: string;
-    publicKeyMultibase?: string;
-}>;
+}): ResolvedKeyAgreementMethod[];
 //# sourceMappingURL=keyAgreement.d.ts.map

package/dist/webvh/keyAgreement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keyAgreement.d.ts","sourceRoot":"","sources":["../../src/webvh/keyAgreement.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,CAAC,EAAE,KAAK,CAAC;QACzB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAClB,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAC3E,CAAA;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;CAC1B,GAAG,KAAK,CAAC;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB3E"}
+{"version":3,"file":"keyAgreement.d.ts","sourceRoot":"","sources":["../../src/webvh/keyAgreement.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,CAAC,EAAE,KAAK,CAAC;QACzB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAChB,MAAM,GACN;QACE,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAC7B,CACJ,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;CAC1B,GAAG,0BAA0B,EAAE,CAe/B"}

package/dist/webvh/keyAgreement.js

@@ -26,7 +26,7 @@
  *
  * @param options {object}
  * @param options.doc {KeyAgreementDocument}   a locally verified document
- * @returns {Array<{ id?: string, controller?: string, publicKeyMultibase?: string }>}
+ * @returns {ResolvedKeyAgreementMethod[]}
  */
 export function resolvedKeyAgreementMethods({ doc }) {
     const byId = new Map();

package/dist/webvh/keyAgreement.js.map

@@ -1 +1 @@
-{"version":3,"file":"keyAgreement.js","sourceRoot":"","sources":["../../src/webvh/keyAgreement.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AAmBH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EAGJ;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAGjB,CAAA;IACH,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAIR,EAAE,CAAA;IACP,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"keyAgreement.js","sourceRoot":"","sources":["../../src/webvh/keyAgreement.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AA6CH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EAGJ;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsC,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAiC,EAAE,CAAA;IAChD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/webvh/verifyLog.d.ts

@@ -1,5 +1,17 @@
 import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
-import type { ResourceLogHeadPin, ResourceLogPinStore } from '../resourceLog/pin.js';
+import { type ResourceLogHeadPin, type ResourceLogPinStore } from '../resourceLog/pin.js';
+/**
+ * The pin-slot key for an account's did:webvh log (`id/did.jsonl`) -- what a
+ * ceremony taking its own read of the log names its pin by, and what
+ * {@link verifyAccountLog} derives internally.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}   the account's Space id
+ * @returns {string}
+ */
+export declare function accountLogPinId({ spaceId }: {
+    spaceId: string;
+}): string;
 /**
  * Thrown when the account has published no DID log at all (the resource is
  * absent). Distinguished from every other failure because it is the one
@@ -59,7 +71,8 @@ export declare function checkAccountLogContinuity({ log, pin }: {
  * @param options.spaceId {string}   the account's Space id
  * @param options.host {string}   the storage server the account lives on
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
- *   pin for the account log
+ *   pins; the account log's slot is keyed by {@link accountLogPinId} over the
+ *   `spaceId` above
  * @returns {Promise<object>}   the resolved document, the raw log, and the
  *   log's effective `updateKeys` / `nextKeyHashes`
  */

package/dist/webvh/verifyLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLog.d.ts","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAI/D,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAE9B;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0C;CAI9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAC/B,GAAG,kBAAkB,CA4CrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB,CAAC,CA4CD"}
+{"version":3,"file":"verifyLog.d.ts","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAI/D,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAA;AAE9B;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAMxE;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0C;CAI9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAC/B,GAAG,kBAAkB,CA4CrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB,CAAC,CA6CD"}

package/dist/webvh/verifyLog.js

@@ -30,6 +30,23 @@ import { readLogFromString, resolveDIDFromLog } from '@interop/did-method-webvh'
 import { resourcePath, toUrl } from '@interop/was-client/paths';
 import { DID_LOG_RESOURCE, ID_COLLECTION } from '../space/collections.js';
 import { ResourceLogContinuityError } from '../resourceLog/errors.js';
+import { resourceLogPinId } from '../resourceLog/pin.js';
+/**
+ * The pin-slot key for an account's did:webvh log (`id/did.jsonl`) -- what a
+ * ceremony taking its own read of the log names its pin by, and what
+ * {@link verifyAccountLog} derives internally.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}   the account's Space id
+ * @returns {string}
+ */
+export function accountLogPinId({ spaceId }) {
+    return resourceLogPinId({
+        spaceId,
+        collectionId: ID_COLLECTION.id,
+        resourceId: DID_LOG_RESOURCE
+    });
+}
 /**
  * Thrown when the account has published no DID log at all (the resource is
  * absent). Distinguished from every other failure because it is the one
@@ -133,7 +150,8 @@ export function checkAccountLogContinuity({ log, pin }) {
  * @param options.spaceId {string}   the account's Space id
  * @param options.host {string}   the storage server the account lives on
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
- *   pin for the account log
+ *   pins; the account log's slot is keyed by {@link accountLogPinId} over the
+ *   `spaceId` above
  * @returns {Promise<object>}   the resolved document, the raw log, and the
  *   log's effective `updateKeys` / `nextKeyHashes`
  */
@@ -159,12 +177,13 @@ export async function verifyAccountLog({ did, spaceId, host, pinStore }) {
             'pointer names.');
     }
     if (pinStore) {
-        const pin = await pinStore.read();
+        const logId = accountLogPinId({ spaceId });
+        const pin = await pinStore.read({ logId });
         const served = checkAccountLogContinuity({ log, pin });
         // Advanced only when the served head is genuinely ahead of the pin: the
         // checks above have already refused everything that is not.
         if (!pin || pin.head !== served.head) {
-            await pinStore.write(served);
+            await pinStore.write({ logId, pin: served });
         }
     }
     return {

package/dist/webvh/verifyLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLog.js","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAEhF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AAMrE;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,uCAAuC;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAA;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EAMT;IAMC,MAAM,GAAG,GAAG,KAAK,CAAC;QAChB,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,CAAC,MAAM,IAAI,CACnE,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,4CACE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,uCACzB,IAAI,CACL,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gBAAgB,CACnB,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,yBAAyB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QACtD,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG;QACH,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE;QAC1C,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE;KACjD,CAAA;AACH,CAAC"}
+{"version":3,"file":"verifyLog.js","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAEhF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,EACL,gBAAgB,EAGjB,MAAM,uBAAuB,CAAA;AAE9B;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,EAAE,OAAO,EAAuB;IAC9D,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,YAAY,EAAE,aAAa,CAAC,EAAE;QAC9B,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,uCAAuC;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAA;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EAMT;IAMC,MAAM,GAAG,GAAG,KAAK,CAAC;QAChB,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,CAAC,MAAM,IAAI,CACnE,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,4CACE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,uCACzB,IAAI,CACL,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gBAAgB,CACnB,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QACtD,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG;QACH,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE;QAC1C,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE;KACjD,CAAA;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/wallet-core",
   "description": "Shared wallet-domain logic (WAS sync engine core and wallet Space layout contracts) for Interop wallet apps.",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -90,6 +90,12 @@
       "import": "./dist/recovery/index.js",
       "default": "./dist/recovery/index.js"
     },
+    "./unlock": {
+      "types": "./dist/unlock/index.d.ts",
+      "react-native": "./dist/unlock/index.js",
+      "import": "./dist/unlock/index.js",
+      "default": "./dist/unlock/index.js"
+    },
     "./keys": {
       "types": "./dist/keys/index.d.ts",
       "react-native": "./dist/keys/index.js",
@@ -132,22 +138,22 @@
   "types": "dist/index.d.ts",
   "sideEffects": false,
   "dependencies": {
-    "@interop/data-integrity-core": "^8.5.0",
+    "@interop/data-integrity-core": "^8.7.1",
     "@interop/data-integrity-proof": "^3.4.3",
-    "@interop/did-method-webvh": "^5.2.0",
+    "@interop/did-method-webvh": "^5.5.0",
     "@interop/ed25519-signature": "^7.1.4",
     "@interop/ed25519-verification-key": "^8.0.3",
     "@interop/ezcap": "^7.4.1",
     "@interop/security-document-loader": "^10.0.0",
     "@interop/social-core": "^0.8.1",
     "@interop/vc": "^11.0.6",
-    "@interop/was-client": "^0.39.0",
+    "@interop/was-client": "^0.39.1",
     "@interop/webkms-client": "^14.7.1",
     "@interop/x25519-key-agreement-key": "^5.2.1",
     "@noble/ciphers": "^2.3.0",
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^2.3.0",
-    "byoe-context": "^0.3.0"
+    "byoe-context": "^0.5.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/dist/recovery/recoveryRecord.d.ts

@@ -1,172 +0,0 @@
-import type { IKeyAgreementKey, IKeyResolver, IZcap } from '@interop/data-integrity-core';
-import type { AccountPointer, RecordSigner, SignedRecord } from '../keyring/record.js';
-/**
- * A recovery record's account binding is absent, malformed, or does not
- * verify under the typed code's binding MAC key. Its own class, distinct from
- * a proof or decrypt failure: this is the refusal that says the record's
- * `{ controller, pointer }` core was not written by a holder of this code --
- * a forged record redirecting recovery at another account, or a record from
- * before the account moved hosts (either way the code cannot recover here
- * and must be re-issued).
- */
-export declare class RecoveryBindingError extends Error {
-    constructor(message: string);
-}
-/**
- * The unwrapped contents of a recovery keyring record: the code-authenticated
- * account binding (controller + pointer) plus the delegation and bind
- * timestamp. `pointer` is required -- a recovery record exists only on WAS
- * deployments (there is nothing to recover toward without a Space).
- */
-export interface RecoveryRecordContents {
-    controller: string;
-    pointer: AccountPointer;
-    delegation: IZcap;
-    createdAt: string;
-}
-/**
- * A stored recovery record: the shared signed frame plus the account-binding
- * tag the frame proof also covers.
- */
-export interface SignedRecoveryRecord extends SignedRecord {
-    binding: string;
-}
-/**
- * Where a recovery record's proof stands after the unwrap: `'verified'` when
- * the code-derived unlock key signed it (checked before decryption), or a
- * pending marker naming the signer the caller must still check against the
- * account's verified did:webvh document -- the re-mint case, where an enrolled
- * client signed on the code's behalf. The pending case is a value the caller
- * cannot ignore by accident: the shell is not trustworthy until
- * `verifyRecordProof` is run against the document-listed keys. The account
- * the document belongs to is the one the code-authenticated pointer names --
- * the binding is verified either way, so the pending state defers the shell's
- * authenticity only, never the account identity.
- */
-export type RecoveryRecordProofState = 'verified' | {
-    pending: {
-        verificationMethod: string;
-        keyMultibase: string;
-    };
-};
-/**
- * Computes the account-binding tag: HMAC-SHA-256 over the binding values
- * under the code-derived binding MAC key, base64url (no pad). Issuance calls
- * it to stamp the record; recovery recomputes it to verify.
- *
- * @param options {object}
- * @param options.bindingMacKey {Uint8Array}   the code-derived MAC key
- * @param options.controller {string}   the account did:key
- * @param options.pointer {AccountPointer}   the account pointer
- * @returns {string}
- */
-export declare function computeRecoveryBinding({ bindingMacKey, controller, pointer }: {
-    bindingMacKey: Uint8Array;
-    controller: string;
-    pointer: AccountPointer;
-}): string;
-/**
- * Reads the `binding` frame member off a stored recovery record without
- * decrypting anything. The re-mint path uses it to carry the tag forward
- * verbatim -- it cannot recompute the tag (no code bytes) and does not need
- * to. Refuses a record with no binding: such a record predates the
- * code-authenticated core and cannot be re-minted -- its code must be
- * re-issued.
- *
- * @param options {object}
- * @param options.record {unknown}   the stored record envelope
- * @returns {string}
- */
-export declare function recoveryRecordBinding({ record }: {
-    record: unknown;
-}): string;
-/**
- * Wraps the recovery record: controller, pointer, and the pre-minted
- * `did.jsonl` PUT delegation, encrypted under the code's unlock KAK via the
- * keyring EDV cipher context, then signed into the same frame the keyring
- * record uses -- with the account-binding tag as one more frame member the
- * proof covers. Issuance passes the code-derived `bindingMacKey` (the tag is
- * computed here) and the code-derived unlock signer; the revocation cascade's
- * re-mint path passes the standing record's `binding` verbatim and an
- * enrolled client's account signer (see this module's header for the policy
- * the reader applies to the two). Exactly one of the two binding inputs must
- * be given.
- *
- * @param options {object}
- * @param options.controller {string}   the account did:key
- * @param options.pointer {AccountPointer}   the account pointer
- * @param options.delegation {IZcap}   the PUT-on-`did.jsonl` delegation to the
- *   code-derived signing DID
- * @param options.keyAgreementKey {IKeyAgreementKey}   the code's unlock KAK --
- *   its public half is all the wrap uses (sealing needs no key-agreement
- *   secret), which is exactly what lets the re-mint path re-seal a record it
- *   can never open
- * @param options.signer {RecordSigner}   the signing key: the code's unlock
- *   key at issuance, an enrolled client's account key on a re-mint
- * @param [options.bindingMacKey] {Uint8Array}   the code-derived binding MAC
- *   key -- the issuance path, which computes the tag
- * @param [options.binding] {string}   the standing record's tag, carried
- *   forward verbatim -- the re-mint path, which cannot recompute it
- * @param [options.createdAt] {string}   the bind timestamp to stamp, as an ISO
- *   string; defaults to now. Supplied by a caller that pins record freshness.
- * @returns {Promise<SignedRecoveryRecord>}
- */
-export declare function wrapRecoveryRecord({ controller, pointer, delegation, keyAgreementKey, signer, bindingMacKey, binding, createdAt }: {
-    controller: string;
-    pointer: AccountPointer;
-    delegation: IZcap;
-    keyAgreementKey: IKeyAgreementKey;
-    signer: RecordSigner;
-    bindingMacKey?: Uint8Array;
-    binding?: string;
-    createdAt?: string;
-}): Promise<SignedRecoveryRecord>;
-/**
- * Unwraps and validates a recovery record: the ordinary keyring-record checks
- * plus the required pointer, delegation, and account binding. A record
- * without a delegation is not a recovery record (an ordinary keyring record
- * found under a code's unlock Space would mean a corrupted issuance) and is
- * refused.
- *
- * The account binding is verified before the contents are returned: the
- * decrypted `{ controller, pointer }` must carry the tag the code-derived
- * MAC key computes over them, or the record is refused as forged
- * ({@link RecoveryBindingError}) -- the check that closes the host-forgery
- * redirect, since the host never holds the MAC key. Nothing downstream may
- * trust the pointer before this returns.
- *
- * Proof verification is mixed-signer and ordered deliberately. A proof by the
- * code's own unlock key is verified BEFORE decryption -- the strong path,
- * where the typed code alone establishes what may have signed the record. A
- * proof by any other key can only be checked after decryption, because the
- * re-minting client is knowable only once the code-authenticated pointer says
- * which account this is and that account's log has been verified; the
- * contents come back with a pending proof state naming the signer, and the
- * caller completes the check with {@link verifyRecordProof} against the
- * document's keys. That second phase is what makes an unexpected signer
- * refuse: a record whose proof belongs to neither class ends in a
- * `RecordProofError` there.
- *
- * @param options {object}
- * @param options.record {unknown}   the stored `{ version, encryption,
- *   wrapped, binding, proof }` envelope
- * @param options.keyAgreementKey {IKeyAgreementKey}   the code's unlock KAK
- * @param options.keyResolver {IKeyResolver}
- * @param options.expectedKeyMultibase {string}   the code-derived unlock
- *   signing key's multibase
- * @param options.bindingMacKey {Uint8Array}   the code-derived binding MAC
- *   key the record's account binding must verify under
- * @returns {Promise<{ contents: RecoveryRecordContents,
- *   proofState: RecoveryRecordProofState }>}
- */
-export declare function unwrapRecoveryRecord({ record, keyAgreementKey, keyResolver, expectedKeyMultibase, bindingMacKey }: {
-    record: unknown;
-    keyAgreementKey: IKeyAgreementKey;
-    keyResolver: IKeyResolver;
-    expectedKeyMultibase: string;
-    bindingMacKey: Uint8Array;
-}): Promise<{
-    contents: RecoveryRecordContents;
-    proofState: RecoveryRecordProofState;
-}>;
-//# sourceMappingURL=recoveryRecord.d.ts.map

package/dist/recovery/recoveryRecord.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"recoveryRecord.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryRecord.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,KAAK,EACN,MAAM,8BAA8B,CAAA;AAcrC,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACb,MAAM,sBAAsB,CAAA;AAQ7B;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACxD,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,wBAAwB,GAClC,UAAU,GAAG;IAAE,OAAO,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AAyBhF;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,aAAa,EACb,UAAU,EACV,OAAO,EACR,EAAE;IACD,aAAa,EAAE,UAAU,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;CACxB,GAAG,MAAM,CAIT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAS7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,UAAU,EACV,OAAO,EACP,UAAU,EACV,eAAe,EACf,MAAM,EACN,aAAa,EACb,OAAO,EACP,SAAS,EACV,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,eAAe,EAAE,gBAAgB,CAAA;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,aAAa,CAAC,EAAE,UAAU,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,aAAa,EACd,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,aAAa,EAAE,UAAU,CAAA;CAC1B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,sBAAsB,CAAA;IAChC,UAAU,EAAE,wBAAwB,CAAA;CACrC,CAAC,CAqFD"}