@interop/wallet-core 0.41.0 → 0.43.0

package/dist/keys/userKeyRoster.js

@@ -1,5 +1,6 @@
 import { addRecipient, initRecipients, ownerRecipient, removeRecipient, unwrapEpochSecret } from '@interop/was-client/edv';
 import { vmFragmentOf } from '../resourceLog/index.js';
+import { commitmentMatcher, MULTIKEY_COMMITMENT_VM_TYPE } from '../webvh/didWebvh.js';
 import { resolvedKeyAgreementMethods } from '../webvh/keyAgreement.js';
 import { clientSigningKeyMultibase } from '../webvh/zcap.js';
 /**
@@ -96,36 +97,60 @@ export function rosterRecipientKid({ signingKeyMultibase, keyAgreementKeyMultiba
  * from the fresh epoch and never receives a wrap.
  *
  * The match is over EVERY key-agreement method the document publishes
- * ({@link resolvedKeyAgreementMethods} filtered by nothing more than "carries a
- * public key multibase"), deliberately including the unmarked ones. That is
- * where this predicate parts company with `markedKeyAgreementMethods`, which
- * hard-requires a client's controller marker: a recovery code's key-agreement
+ * ({@link resolvedKeyAgreementMethods}), deliberately including the unmarked
+ * ones. That is where this predicate parts company with
+ * `markedKeyAgreementMethods`, which hard-requires a client's controller
+ * marker: a recovery code's or standing unlock credential's key-agreement
  * method is published unmarked by design, so that client listings and
  * revocations never match it, and it must keep its user key wrap through every
- * rotation. Filtering by the marker here would drop every recovery code from
+ * rotation. Filtering by the marker here would drop every such credential from
  * each rotated epoch.
  *
+ * Two branches back an entry, and a method's `type` selects exactly one. A
+ * method that is not a `MultikeyCommitment` and carries the key verbatim
+ * (`publicKeyMultibase`) matches on the multibase (so a did:key-form kid
+ * matches its `<did:webvh>#<multibase>` VM). A `MultikeyCommitment` method's
+ * hash commitment (`publicKeyCommitment` -- a low-entropy-derived standing
+ * credential, whose key material the document withholds) matches when it
+ * commits to the roster entry's own key: the roster carries the real key, the
+ * document vouches for it, and a server-injected entry can neither meet a
+ * standing commitment nor add one. The type split means a hybrid method
+ * carrying both properties backs at most one recipient -- the flavor its
+ * `type` declares -- never two.
+ *
  * @param options {object}
  * @param options.document {KeyAgreementDocument}   the locally verified
  *   did:webvh document (never a server-supplied roster field)
  * @returns {function}   a `resolveRecipientKey` for `removeRecipient`
  */
 export function userKeyRosterRecipientResolver({ document }) {
-    const keyAgreementMethods = resolvedKeyAgreementMethods({
-        doc: document
-    }).filter(method => typeof method.publicKeyMultibase === 'string');
+    const methods = resolvedKeyAgreementMethods({ doc: document });
+    const verbatimMethods = methods.filter(method => method.type !== MULTIKEY_COMMITMENT_VM_TYPE &&
+        typeof method.publicKeyMultibase === 'string');
+    const commitmentBacked = commitmentMatcher({
+        commitments: methods
+            .filter(method => method.type === MULTIKEY_COMMITMENT_VM_TYPE)
+            .map(method => method.publicKeyCommitment)
+            .filter((value) => typeof value === 'string')
+    });
     return async function resolveRecipientKey(kid) {
         const fragment = vmFragmentOf(kid);
         if (!fragment) {
             return null;
         }
-        const match = keyAgreementMethods.find(method => method.publicKeyMultibase === fragment ||
+        const match = verbatimMethods.find(method => method.publicKeyMultibase === fragment ||
             (typeof method.id === 'string' && vmFragmentOf(method.id) === fragment));
-        if (!match) {
-            // No document verification method backs this roster entry: drop it.
-            return null;
+        if (match) {
+            return { id: kid, publicKeyMultibase: match.publicKeyMultibase };
+        }
+        // The commitment branch: the roster entry's key is document-backed iff a
+        // published `MultikeyCommitment` method commits to it. The matcher
+        // pre-decoded the commitments (a malformed one matches nothing).
+        if (commitmentBacked(fragment)) {
+            return { id: kid, publicKeyMultibase: fragment };
         }
-        return { id: kid, publicKeyMultibase: match.publicKeyMultibase };
+        // No document verification method backs this roster entry: drop it.
+        return null;
     };
 }
 /**

package/dist/keys/userKeyRoster.js.map

@@ -1 +1 @@
-{"version":3,"file":"userKeyRoster.js","sourceRoot":"","sources":["../../src/keys/userKeyRoster.ts"],"names":[],"mappings":"AAmDA,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EAGlB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,YAAY,EAA0B,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAEtE,OAAO,EACL,yBAAyB,EAE1B,MAAM,kBAAkB,CAAA;AAGzB;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;IAC3C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,aAAa,CAAQ;IACrB,YAAY,EAAE,aAAa,EAA6B;QACtD,KAAK,CACH,4EAA4E;YAC1E,mCAAmC,CACtC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;QAC1C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,QAAQ,EAGT;IACC,MAAM,YAAY,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,OAAO;QACL,YAAY;QACZ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAwB;YACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7C,uEAAuE;YACvE,qEAAqE;YACrE,OAAO,IAAI,UAAU,CACnB,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CACrB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EAIzB;IACC,OAAO,WAAW,mBAAmB,IAAI,wBAAwB,EAAE,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,8BAA8B,CAAC,EAC7C,QAAQ,EAGT;IACC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;QACtD,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAA;IAClE,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAW;QAEX,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CACpC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,kBAAkB,KAAK,QAAQ;YACtC,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,CAC1E,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,oEAAoE;YACpE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAmB,EAAE,CAAA;IACnE,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,OAAO,EACP,qBAAqB,EAKtB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,UAAU,CAAA;IAC3B,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;KACvD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,SAAS,EACT,oBAAoB,EAKrB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,+CAA+C,CAClD,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;IACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAC3C,CAAA;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,wEAAwE;QACxE,mEAAmE;QACnE,6CAA6C;QAC7C,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,KAAK;QACL,SAAS;QACT,KAAK,EAAE,EAAE,eAAe,EAAE,oBAAoB,EAAE;KACjD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,QAAQ,EACR,iBAAiB,EAKlB;IACC,OAAO,eAAe,CAAC;QACrB,KAAK;QACL,WAAW,EAAE,iBAAiB;QAC9B,mBAAmB,EAAE,8BAA8B,CAAC,EAAE,QAAQ,EAAE,CAAC;QACjE,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KACrB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,KAAK,EACL,QAAQ,EACR,UAAU,EAKX;IAKC,IAAI,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACpE,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAA;IAC1B,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAA;IAC1C,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,cAAc,CACrC,CAAA;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAA;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,8BAA8B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACxE,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAC5B,IAAI,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,2BAA2B,CACnC,0EAA0E;YACxE,mCAAmC,CACtC,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAE;KACzC,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAClE,CAAC;AA8ED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EAAE,eAAe,EAC3B,OAAO,EACP,qBAAqB,EACrB,aAAa,EAOd;IACC,IAAI,UAAU,GAAG,eAAe,CAAA;IAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACjE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY;QAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,CAAA;IACN,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAA;IACH,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,cAAuB,CAAA;IAC3B,IAAI,OAAgB,CAAA;IACpB,IAAI,OAAO,IAAI,UAAU,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACtD,cAAc,GAAG,OAAO,CAAA;QACxB,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,kEAAkE;QAClE,+DAA+D;QAC/D,yCAAyC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAO,CAAC,YAAY,CAAE,CAAC,UAAU,CAAC,IAAI,CAC7D,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,CAC/D,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAChC,oEAAoE,CACrE,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,KAAK;YACL,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,wBAAwB,CAChC,uDAAuD,CACxD,CAAA;QACH,CAAC;QACD,cAAc,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,YAAa,EAAE,MAAM,EAAE,CAAA;QACzD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,OAAO;QACL,UAAU;QACV,OAAO,EAAE,cAAc;QACvB,OAAO;QACP,aAAa,EAAE,UAAU,CAAC,YAAa;KACxC,CAAA;AACH,CAAC"}
+{"version":3,"file":"userKeyRoster.js","sourceRoot":"","sources":["../../src/keys/userKeyRoster.ts"],"names":[],"mappings":"AAmDA,OAAO,EACL,YAAY,EACZ,cAAc,EACd,cAAc,EACd,eAAe,EACf,iBAAiB,EAGlB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,YAAY,EAA0B,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC5B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAEtE,OAAO,EACL,yBAAyB,EAE1B,MAAM,kBAAkB,CAAA;AAGzB;;;;;GAKG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;IAC3C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,aAAa,CAAQ;IACrB,YAAY,EAAE,aAAa,EAA6B;QACtD,KAAK,CACH,4EAA4E;YAC1E,mCAAmC,CACtC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;QAC1C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,QAAQ,EAGT;IACC,MAAM,YAAY,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,OAAO;QACL,YAAY;QACZ,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAwB;YACvC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7C,uEAAuE;YACvE,qEAAqE;YACrE,OAAO,IAAI,UAAU,CACnB,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,CACrB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,mBAAmB,EACnB,wBAAwB,EAIzB;IACC,OAAO,WAAW,mBAAmB,IAAI,wBAAwB,EAAE,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,UAAU,8BAA8B,CAAC,EAC7C,QAAQ,EAGT;IACC,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9D,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,IAAI,KAAK,2BAA2B;QAC3C,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,CAChD,CAAA;IACD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;QACzC,WAAW,EAAE,OAAO;aACjB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,2BAA2B,CAAC;aAC7D,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;aACzC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;KACjE,CAAC,CAAA;IACF,OAAO,KAAK,UAAU,mBAAmB,CACvC,GAAW;QAEX,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAChC,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,kBAAkB,KAAK,QAAQ;YACtC,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,CAC1E,CAAA;QACD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAmB,EAAE,CAAA;QACnE,CAAC;QACD,yEAAyE;QACzE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAA;QAClD,CAAC;QACD,oEAAoE;QACpE,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,OAAO,EACP,qBAAqB,EAKtB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,UAAU,CAAA;IAC3B,CAAC;IACD,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACxE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;KACvD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,SAAS,EACT,oBAAoB,EAKrB;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,+CAA+C,CAClD,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;IACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAC3C,CAAA;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,wEAAwE;QACxE,mEAAmE;QACnE,6CAA6C;QAC7C,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,KAAK;QACL,SAAS;QACT,KAAK,EAAE,EAAE,eAAe,EAAE,oBAAoB,EAAE;KACjD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,QAAQ,EACR,iBAAiB,EAKlB;IACC,OAAO,eAAe,CAAC;QACrB,KAAK;QACL,WAAW,EAAE,iBAAiB;QAC9B,mBAAmB,EAAE,8BAA8B,CAAC,EAAE,QAAQ,EAAE,CAAC;QACjE,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;KACrB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,KAAK,EACL,QAAQ,EACR,UAAU,EAKX;IAKC,IAAI,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACpE,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAA;IAC1B,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAA;IAC1C,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,cAAc,CACrC,CAAA;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAA;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,8BAA8B,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACxE,MAAM,iBAAiB,GAAa,EAAE,CAAA;IACtC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;QAC5B,IAAI,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,2BAA2B,CACnC,0EAA0E;YACxE,mCAAmC,CACtC,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAE;KACzC,CAAC,CAAA;IACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAClE,CAAC;AA8ED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EAAE,eAAe,EAC3B,OAAO,EACP,qBAAqB,EACrB,aAAa,EAOd;IACC,IAAI,UAAU,GAAG,eAAe,CAAA;IAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACjE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY;QAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,CAAA;IACN,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,mEAAmE,CACpE,CAAA;IACH,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACnD,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,YAAY,GAAG,WAAW,EAAE,CAAC;YACrD,MAAM,IAAI,4BAA4B,CAAC,EAAE,aAAa,EAAE,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,cAAuB,CAAA;IAC3B,IAAI,OAAgB,CAAA;IACpB,IAAI,OAAO,IAAI,UAAU,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACtD,cAAc,GAAG,OAAO,CAAA;QACxB,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,kEAAkE;QAClE,+DAA+D;QAC/D,yCAAyC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAO,CAAC,YAAY,CAAE,CAAC,UAAU,CAAC,IAAI,CAC7D,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,CAC/D,CAAA;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,wBAAwB,CAChC,oEAAoE,CACrE,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,KAAK;YACL,eAAe,EAAE,qBAAqB;SACvC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,wBAAwB,CAChC,uDAAuD,CACxD,CAAA;QACH,CAAC;QACD,cAAc,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,YAAa,EAAE,MAAM,EAAE,CAAA;QACzD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,OAAO;QACL,UAAU;QACV,OAAO,EAAE,cAAc;QACvB,OAAO;QACP,aAAa,EAAE,UAAU,CAAC,YAAa;KACxC,CAAA;AACH,CAAC"}

package/dist/recovery/index.d.ts

@@ -12,16 +12,18 @@
  * - `recoveryClientFromCode` -- the deterministic client key set:
  *   unlock identity, client seed (signing + key-agreement pair), and the
  *   single did:webvh update key whose hash stands pre-committed.
- * - `wrapRecoveryRecord` / `unwrapRecoveryRecord` -- the keyring-record
- *   sibling carrying the account pointer plus the pre-minted
- *   PUT-on-`did.jsonl` delegation (never a seed, never a user key wrap),
- *   signed into the same frame under the mixed-signer policy (the code's
- *   unlock key at issuance, an enrolled client's account key on a re-mint),
- *   with the `{ controller, pointer }` core authenticated by a MAC under a
- *   code-derived key (`computeRecoveryBinding` / `recoveryRecordBinding`),
- *   so a storage host can never redirect recovery at another account.
+ * - The record codec lives in `@interop/wallet-core/unlock` now
+ *   (`wrapUnlockRecord` / `unwrapUnlockRecord`, re-exported here): a
+ *   recovery record is an unlock record with no ladder member -- the account
+ *   pointer plus the pre-minted PUT-on-`did.jsonl` bridge delegation (never
+ *   a seed, never a user key wrap), signed under the mixed-signer policy
+ *   (the code's unlock key at issuance, an enrolled client's account key on
+ *   a re-mint), with the account core authenticated by a MAC under a
+ *   code-derived key, so a storage host can never redirect recovery at
+ *   another account.
  * - `publishRecoveryKey` / `removeRecoveryKey` / `recoverWebvhClient` -- the
- *   document half: issuance's split posture, revocation's removal, and the
+ *   document half: issuance's split posture and revocation's removal (thin
+ *   wrappers over the unlock subpath's merged posture core), and the
  *   self-enrolling recovery continuation.
  * - `delegateLogWrite` / `delegationProofKeyId` /
  *   `remintRecoveryDelegations` -- the authorization bridge: the pre-minted
@@ -35,9 +37,9 @@
  */
 export { decodeRecoveryCode, formatRecoveryCode, generateRecoveryCode, normalizeRecoveryCode, RECOVERY_CODE_BYTES, RECOVERY_KDF, RecoveryCodeInvalidError, recoveryClientFromCode } from './recoveryCode.js';
 export type { RecoveryClient } from './recoveryCode.js';
-export { computeRecoveryBinding, RecoveryBindingError, recoveryRecordBinding, unwrapRecoveryRecord, wrapRecoveryRecord } from './recoveryRecord.js';
-export type { RecoveryRecordContents, RecoveryRecordProofState, SignedRecoveryRecord } from './recoveryRecord.js';
-export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, remintRecoveryDelegations } from './recoveryDelegation.js';
+export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from '../unlock/unlockRecord.js';
+export type { SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from '../unlock/unlockRecord.js';
+export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, remintRecoveryDelegations, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
 export type { RecoveryDelegationEntry } from './recoveryDelegation.js';
 export { publishRecoveryKey, recoverWebvhClient, RecoveryKeyNotCommittedError, recoveryVmId, removeRecoveryKey } from './recoveryWebvh.js';
 export type { RecoveryLogStore, RecoveryPublicKeys } from './recoveryWebvh.js';

package/dist/recovery/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAEtE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AAEtE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/recovery/index.js

@@ -12,16 +12,18 @@
  * - `recoveryClientFromCode` -- the deterministic client key set:
  *   unlock identity, client seed (signing + key-agreement pair), and the
  *   single did:webvh update key whose hash stands pre-committed.
- * - `wrapRecoveryRecord` / `unwrapRecoveryRecord` -- the keyring-record
- *   sibling carrying the account pointer plus the pre-minted
- *   PUT-on-`did.jsonl` delegation (never a seed, never a user key wrap),
- *   signed into the same frame under the mixed-signer policy (the code's
- *   unlock key at issuance, an enrolled client's account key on a re-mint),
- *   with the `{ controller, pointer }` core authenticated by a MAC under a
- *   code-derived key (`computeRecoveryBinding` / `recoveryRecordBinding`),
- *   so a storage host can never redirect recovery at another account.
+ * - The record codec lives in `@interop/wallet-core/unlock` now
+ *   (`wrapUnlockRecord` / `unwrapUnlockRecord`, re-exported here): a
+ *   recovery record is an unlock record with no ladder member -- the account
+ *   pointer plus the pre-minted PUT-on-`did.jsonl` bridge delegation (never
+ *   a seed, never a user key wrap), signed under the mixed-signer policy
+ *   (the code's unlock key at issuance, an enrolled client's account key on
+ *   a re-mint), with the account core authenticated by a MAC under a
+ *   code-derived key, so a storage host can never redirect recovery at
+ *   another account.
  * - `publishRecoveryKey` / `removeRecoveryKey` / `recoverWebvhClient` -- the
- *   document half: issuance's split posture, revocation's removal, and the
+ *   document half: issuance's split posture and revocation's removal (thin
+ *   wrappers over the unlock subpath's merged posture core), and the
  *   self-enrolling recovery continuation.
  * - `delegateLogWrite` / `delegationProofKeyId` /
  *   `remintRecoveryDelegations` -- the authorization bridge: the pre-minted
@@ -34,7 +36,7 @@
  * was-client dependency graph (the same isolation pattern as `./keyring`).
  */
 export { decodeRecoveryCode, formatRecoveryCode, generateRecoveryCode, normalizeRecoveryCode, RECOVERY_CODE_BYTES, RECOVERY_KDF, RecoveryCodeInvalidError, recoveryClientFromCode } from './recoveryCode.js';
-export { computeRecoveryBinding, RecoveryBindingError, recoveryRecordBinding, unwrapRecoveryRecord, wrapRecoveryRecord } from './recoveryRecord.js';
-export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, remintRecoveryDelegations } from './recoveryDelegation.js';
+export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from '../unlock/unlockRecord.js';
+export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, remintRecoveryDelegations, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
 export { publishRecoveryKey, recoverWebvhClient, RecoveryKeyNotCommittedError, recoveryVmId, removeRecoveryKey } from './recoveryWebvh.js';
 //# sourceMappingURL=index.js.map

package/dist/recovery/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAO5B,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA"}

package/dist/recovery/recoveryCode.d.ts

@@ -1,5 +1,5 @@
-import type { ProfileAgents } from '../identity/agents.js';
 import type { UnlockKdf } from '../keyring/kdf.js';
+import type { UnlockClientIdentity } from '../unlock/standingClient.js';
 /**
  * The byte length of a recovery code: 16 random bytes is ~128 bits, enough
  * that the unlock derivation is a single expansion rather than a stretched
@@ -73,28 +73,16 @@ export declare function decodeRecoveryCode({ code }: {
  * agents, and the public multibases / ids the issuance and recovery flows
  * publish and look up.
  */
-export interface RecoveryClient {
+export interface RecoveryClient extends UnlockClientIdentity {
     codeBytes: Uint8Array;
-    clientSeed: Uint8Array;
     updateSeed: Uint8Array;
     /**
-     * The symmetric key that MACs the recovery record's account binding
-     * (`{ controller, pointer }`): computed at issuance, verified at recovery
-     * before the pointer is trusted. Derived from the code bytes, so the
-     * storage host never holds it.
+     * The symmetric key that MACs the recovery record's account binding:
+     * computed at issuance, verified at recovery before the pointer is trusted.
+     * Derived from the code bytes, so the storage host never holds it.
      */
     bindingMacKey: Uint8Array;
-    agents: ProfileAgents;
-    clientDid: string;
-    signingKeyMultibase: string;
-    keyAgreementKeyMultibase: string;
     updateKeyMultibase: string;
-    /**
-     * The kid of the code's user-key-roster entry -- its key-agreement key's id
-     * exactly as `agentsFromSeed` derives it (`did:key:<ed>#<x>`), so the wrap
-     * minted at issuance is the one the recovery flow's roster read looks for.
-     */
-    recipientKid: string;
 }
 /**
  * Derives the code's whole client identity from a (possibly formatted) code.

package/dist/recovery/recoveryCode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryCode.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAGlD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAA;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,SAM1B,CAAA;AAoBD;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,SAAuC;CAI3D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAErE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAazE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,UAAU,CAAA;IACrB,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB;;;;;OAKG;IACH,aAAa,EAAE,UAAU,CAAA;IACzB,MAAM,EAAE,aAAa,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;IAC1B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,cAAc,CAAC,CA2C1B"}
+{"version":3,"file":"recoveryCode.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAGvE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAA;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,SAM1B,CAAA;AAoBD;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,SAAuC;CAI3D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAErE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAazE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAe,SAAQ,oBAAoB;IAC1D,SAAS,EAAE,UAAU,CAAA;IACrB,UAAU,EAAE,UAAU,CAAA;IACtB;;;;OAIG;IACH,aAAa,EAAE,UAAU,CAAA;IACzB,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,cAAc,CAAC,CAgC1B"}

package/dist/recovery/recoveryCode.js

@@ -20,7 +20,7 @@
 import { base58 } from '@scure/base';
 import { hkdf } from '@noble/hashes/hkdf.js';
 import { sha256 } from '@noble/hashes/sha2.js';
-import { agentsFromSeed } from '../identity/agents.js';
+import { unlockClientIdentityFromSeed } from '../unlock/standingClient.js';
 import { updateKeyMultibase } from '../webvh/didWebvh.js';
 /**
  * The byte length of a recovery code: 16 random bytes is ~128 bits, enough
@@ -143,23 +143,13 @@ export async function recoveryClientFromCode({ code }) {
     const clientSeed = hkdf(sha256, codeBytes, salt, new TextEncoder().encode(RECOVERY_CLIENT_SEED_INFO), 32);
     const updateSeed = hkdf(sha256, codeBytes, salt, new TextEncoder().encode(RECOVERY_UPDATE_SEED_INFO), 32);
     const bindingMacKey = hkdf(sha256, codeBytes, new TextEncoder().encode(RECOVERY_KDF.salt), new TextEncoder().encode(RECOVERY_BINDING_MAC_INFO), 32);
-    const agents = await agentsFromSeed({ seed: clientSeed });
-    const { publicKeyMultibase: keyAgreementKeyMultibase } = agents.keyAgreementKey;
-    if (!keyAgreementKeyMultibase) {
-        throw new Error('The derived key-agreement key has no public multibase.');
-    }
-    const [, , signingKeyMultibase] = agents.keyAgent.id.split(':');
+    const identity = await unlockClientIdentityFromSeed({ clientSeed });
     return {
+        ...identity,
         codeBytes,
-        clientSeed,
         updateSeed,
         bindingMacKey,
-        agents,
-        clientDid: agents.keyAgent.id,
-        signingKeyMultibase: signingKeyMultibase,
-        keyAgreementKeyMultibase,
-        updateKeyMultibase: await updateKeyMultibase({ seed: updateSeed }),
-        recipientKid: `${agents.keyAgent.id}#${keyAgreementKeyMultibase}`
+        updateKeyMultibase: await updateKeyMultibase({ seed: updateSeed })
     };
 }
 //# sourceMappingURL=recoveryCode.js.map

package/dist/recovery/recoveryCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryCode.js","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAc;IACrC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wBAAwB;CAC/B,CAAA;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,oCAAoC,CAAA;AACjE,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,YAAY,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,wBAAwB,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,oCAAoC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAA;IACjD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,KAAK,EAAqB;IAChE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,oDAAoD;QACpD,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAmCD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAC3C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,MAAM,CAAC,eAA6D,CAAA;IACtE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,CAAC,EAAE,AAAD,EAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO;QACL,SAAS;QACT,UAAU;QACV,UAAU;QACV,aAAa;QACb,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC7B,mBAAmB,EAAE,mBAAoB;QACzC,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,wBAAwB,EAAE;KAClE,CAAA;AACH,CAAC"}
+{"version":3,"file":"recoveryCode.js","sourceRoot":"","sources":["../../src/recovery/recoveryCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAc;IACrC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,wBAAwB;CAC/B,CAAA;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,oCAAoC,CAAA;AACjE,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,YAAY,CAAA;AAE9C;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,wBAAwB,CAAA;AAE1D;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,oCAAoC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAA;IACjD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAE,KAAK,EAAqB;IAChE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAoB;IAC3D,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,oDAAoD;QACpD,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAuBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,SAAS,EACT,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAC3C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO;QACL,GAAG,QAAQ;QACX,SAAS;QACT,UAAU;QACV,aAAa;QACb,kBAAkB,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;KACnE,CAAA;AACH,CAAC"}

package/dist/recovery/recoveryDelegation.d.ts

@@ -3,15 +3,45 @@ import type { ZcapClient } from '@interop/ezcap';
 import type { PublishedKeyDocument } from '../webvh/listClients.js';
 import type { AccountPointer, RecordSigner } from '../keyring/record.js';
 /**
- * The recovery delegation's lifetime: ten years. Deliberately long-lived: a
- * recovery code must work years after issuance, and the delegation's scope is
- * one resource (the world-readable DID log), whose worst-case abuse is a log
- * write that still has to verify against the published hash chain and
- * prerotation commitments to resolve. The login-time recovery health check
- * watches for delegation rot (the signing client's verification method
- * leaving the document) rather than expiry.
+ * The recovery delegation's lifetime: one year, following NIST SP 800-57's
+ * one-to-two-year cryptoperiod guidance for private signature keys. The
+ * delegation's scope stays narrow (PUT on the one world-readable DID log
+ * resource, whose worst-case abuse is a log write that still has to verify
+ * against the published hash chain and prerotation commitments to resolve),
+ * but a standing bearer artifact should not outlive its signing key's
+ * recommended cryptoperiod. A code must keep working past the year, so
+ * expiry is watched rather than terminal: the registry entry records the
+ * delegation's `expires`, {@link zcapExpiring} treats the
+ * renewal window before it as stale, the re-mint refreshes a stale
+ * delegation, and the login-time recovery health check flags one the same
+ * way it flags rot (the signing client's verification method leaving the
+ * document).
  */
 export declare const RECOVERY_DELEGATION_TTL_MS: number;
+/**
+ * How long before its `expires` a standing recorded zcap counts as stale:
+ * thirty days, so a refresh (a re-mint, a login-time re-delegation) or a
+ * regenerate nudge lands well before the zcap actually lapses.
+ */
+export declare const ZCAP_RENEWAL_WINDOW_MS: number;
+/**
+ * Whether a recorded zcap expiry is past or inside the renewal window -- the
+ * expiry half of the staleness predicate for every long-lived zcap a wallet
+ * records beside its registry entries (the recovery `did.jsonl` delegation,
+ * an unlock Space's management zcap). The re-mint and the wallets'
+ * login-time checks all ask this one predicate. A record carrying no expiry
+ * (or an unparseable one) is uncheckable and therefore not assumed healthy,
+ * matching the rot check's treatment of a missing `delegationKeyId`.
+ *
+ * @param options {object}
+ * @param [options.expires] {string}   the recorded ISO 8601 expiry
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {boolean}
+ */
+export declare function zcapExpiring({ expires, now }: {
+    expires?: string;
+    now?: number;
+}): boolean;
 /**
  * Delegates the narrow log-write bridge to a code-derived client: PUT on the
  * one `did.jsonl` resource, {@link RECOVERY_DELEGATION_TTL_MS} lifetime. The
@@ -42,8 +72,9 @@ export declare function delegationProofKeyId(delegation: IZcap): string | undefi
 /**
  * The members of a recovery-code registry entry the re-mint reads: where the
  * code's unlock Space and record are (`unlockSpaceId`, `manageCapability`),
- * which key signed the recorded delegation (`delegationKeyId` -- absent on an
- * entry predating the field, which the rot check conservatively flags), and
+ * which key signed the recorded delegation and when it expires
+ * (`delegationKeyId` / `delegationExpires` -- either absent on an entry
+ * predating its field, which the staleness checks conservatively flag), and
  * the re-mint fields: the code-derived signing DID the fresh delegation names
  * and the unlock KAK public half the record is re-wrapped to. Structural on
  * purpose -- an app's richer registry entry satisfies it, and the re-mint
@@ -55,6 +86,7 @@ export interface RecoveryDelegationEntry {
     unlockSpaceId: string;
     manageCapability?: IZcap;
     delegationKeyId?: string;
+    delegationExpires?: string;
     recoveryClientDid?: string;
     unlockKeyAgreementKeyId?: string;
     unlockKeyAgreementKeyMultibase?: string;
@@ -64,13 +96,15 @@ export interface RecoveryDelegationEntry {
  * the recovery-code delta riding the revocation cascade (see the module doc
  * for the mechanism and the skip policy).
  *
- * The record's code-authenticated account binding is preserved verbatim: the
+ * The record's credential-authenticated core is preserved verbatim: the
  * re-mint reads the standing record through the entry's management zcap and
- * carries its `binding` frame member forward (the tag rides in the clear; it
- * cannot be recomputed without the code, and does not need to be). A re-mint
- * therefore can never change the pointer or controller the code was issued
- * against -- and after a host migration the tag no longer matches the moved
- * pointer, so codes must be re-issued when the account moves hosts.
+ * replaces only its bridge member ({@link remintUnlockRecordBridge}) -- the
+ * shell, the ladder member (where one rides), and the binding tag all travel
+ * untouched, since the re-mint can decrypt none of them and does not need to.
+ * A re-mint therefore can never change the pointer or controller the
+ * credential was bound against -- and after a host migration the tag no
+ * longer matches the moved pointer, so credentials must be rebound (codes
+ * re-issued) when the account moves hosts.
  *
  * The re-mint holds the code's KAK public half but not its signing key, so
  * every record it re-PUTs is signed with the acting client's own account key
@@ -86,8 +120,6 @@ export interface RecoveryDelegationEntry {
  * @param options.entries {RecoveryDelegationEntry[]}   the registry's
  *   recovery-code entries, as the app's registry read returned them
  * @param options.pointer {AccountPointer}
- * @param options.controller {string}   the account controller to stamp into
- *   re-wrapped records (an identity label, as at issuance)
  * @param options.storageServerUrl {string}   the unlock Spaces' storage server
  * @param options.zcapClient {ZcapClient}   the acting client's promoted
  *   signer, which mints the fresh delegations
@@ -99,11 +131,10 @@ export interface RecoveryDelegationEntry {
  *   persists one updated registry entry (matching on the app's entry key)
  * @returns {Promise<{ reminted: number; skipped: number }>}
  */
-export declare function remintRecoveryDelegations<Entry extends RecoveryDelegationEntry>({ doc, entries, pointer, controller, storageServerUrl, zcapClient, recordSigner, managementZcapClient, recordEntry }: {
+export declare function remintRecoveryDelegations<Entry extends RecoveryDelegationEntry>({ doc, entries, pointer, storageServerUrl, zcapClient, recordSigner, managementZcapClient, recordEntry }: {
     doc: PublishedKeyDocument;
     entries: Entry[];
     pointer: AccountPointer;
-    controller: string;
     storageServerUrl: string;
     zcapClient: ZcapClient;
     recordSigner: RecordSigner;

package/dist/recovery/recoveryDelegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGxE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,QAAiC,CAAA;AAiBxE;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAClB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAU1E;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACZ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAyFjD"}
+{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGxE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B,QAA4B,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAE9D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,EAC3B,OAAO,EACP,GAAgB,EACjB,EAAE;IACD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CASV;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAClB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAU1E;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACZ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA+FjD"}