@interop/wallet-core 0.44.0 → 0.45.0

package/dist/clients/revocation.d.ts

@@ -62,31 +62,8 @@ import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import { type ClientWebvhUpdateKeys, type PublishedKeyDocument, type RevokedClientKeys, type WebvhIdStore } from '../webvh/index.js';
-import { type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
-/**
- * What the roster's seal backstop reported: `sealed` (the roster log's head
- * still anchored before the document edit, and the backstop append landed),
- * `noop` (already sealed -- the rotation itself was the sealing append, or a
- * re-run found nothing to do), or `failed` (the seal could not run; carried
- * in `error`, never thrown -- the cascade stays a resumable success and the
- * login sweep re-seals).
- */
-export interface RosterSealReport {
-    outcome: 'sealed' | 'noop' | 'failed';
-    error?: unknown;
-}
-/**
- * Where the cascade's collection fan-out gets its work: which encrypted
- * collections exist (only the app knows -- a mobile replica names the
- * collections it replicates, a web wallet also lists the app-provisioned ones
- * remotely) and how each one's descriptor store and encryption declaration are
- * reached.
- */
-export interface CascadeCollections {
-    collectionIds: string[] | (() => Promise<string[]>);
-    storeFor: (collectionId: string) => EncryptionDescriptorStore;
-    isEncrypted?: (collectionId: string) => Promise<boolean>;
-}
+import { type CascadeCollections, type RosterSealReport, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
+export type { CascadeCollections, RosterSealReport };
 /**
  * What a completed cascade reports: whether the roster actually rotated on
  * this run (a re-run of an already-complete revocation reports `false`), the

package/dist/clients/revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAExE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAKL,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;IACrC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACnD,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACzD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA+HlC"}
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqElC"}

package/dist/clients/revocation.js

@@ -1,20 +1,5 @@
-import { webvhResourceLogController } from '../resourceLog/index.js';
 import { revokeWebvhClient } from '../webvh/index.js';
-import { cascadeCollectionsToUserKey, convergeUserKeyRosterToDocument, isSealableDescriptorStore, readUserKeyRoster } from '../keys/index.js';
-/**
- * Resolves the collection ids the fan-out covers, whether they are a fixed set
- * or a listing the app performs.
- *
- * @param options {object}
- * @param options.collections {CascadeCollections}
- * @returns {Promise<string[]>}
- */
-async function collectionIdsOf({ collections }) {
-    const { collectionIds } = collections;
-    return typeof collectionIds === 'function'
-        ? await collectionIds()
-        : collectionIds;
-}
+import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
 /**
  * Runs the whole revocation cascade for one enrolled wallet client. See the
  * module doc for the order and the convergence story. Throws before touching
@@ -87,98 +72,42 @@ export async function revokeAccountClient({ idStore, updateKeys, revokedClient,
         ...(knownLatentHashes ? { knownLatentHashes } : {}),
         ...(expectedDid !== undefined ? { expectedDid } : {})
     });
-    // The post-edit anchoring guarantee: stage 2's roster appends -- and the
-    // seal backstop's removal detection -- must run under a controller view
-    // that includes the edit this call just published, or the rotation anchors
-    // pre-edit and the log stays unsealed with the seal blind to the removal.
-    // Rather than leaving that to the injected store's own controller wiring,
-    // the view built from the edit's post-edit log is set as the store's floor;
-    // a fresher resolved view still wins.
-    if (isSealableDescriptorStore(rosterStore)) {
-        rosterStore.setControllerFloor({
-            controller: webvhResourceLogController({ did, log })
-        });
-    }
-    // 2. The roster rotation, recipients resolved from that same document.
-    // Whether there IS a roster is settled BY the convergence call itself: a
-    // `null` descriptor back means the account has no `key-map/user-key.jsonl`
-    // yet (its collections are not encrypted yet), so there is nothing to
-    // rotate. The document edit has already landed, so the client IS
-    // disconnected -- a completed cascade with nothing rotated, not a failure.
-    // Pairing-free: rather than naming the revoked client's kid, the rotation
-    // retires every current-epoch recipient the post-edit document no longer
-    // keys -- which is exactly the revoked client's entry, plus anything an
-    // earlier torn cascade left behind, in one rotation.
-    const converged = await convergeUserKeyRosterToDocument({
-        store: rosterStore,
-        document: doc
+    // 2-3. The shared roster-and-cascade tail: the roster rotation onto the
+    // post-edit document (with its post-edit controller floor and its seal
+    // backstop), then the collection fan-out onto the fresh key.
+    const tail = await rotateRosterToDocumentAndCascade({
+        rosterStore,
+        did,
+        doc,
+        log,
+        ...(userKey ? { userKey } : {}),
+        clientKeyAgreementKey,
+        pinnedEpochId,
+        ...(onUserKeyAdopted ? { onUserKeyAdopted } : {}),
+        collections
     });
-    if (converged.descriptor === null) {
+    if (!tail.rosterDescriptor || !tail.userKey) {
+        // No roster to rotate: the document edit has landed, so the client IS
+        // disconnected -- a completed cascade with nothing rotated.
         return {
             rotated: false,
-            collections: { outcomes: {}, failed: [] },
+            collections: tail.collections,
             document: doc
         };
     }
-    // The rotation's own verified result is threaded into the adopting read, so
-    // one cascade run acquires the roster once for both halves of stage 2 (the
-    // continuity and possession checks still run on the threaded descriptor).
-    const read = await readUserKeyRoster({
-        store: rosterStore,
-        descriptor: converged.descriptor,
-        ...(userKey ? { userKey } : {}),
-        clientKeyAgreementKey,
-        pinnedEpochId
-    });
-    if (read.rotated) {
-        await onUserKeyAdopted?.({
-            userKey: read.userKey,
-            latestEpochId: read.latestEpochId,
-            descriptor: read.descriptor
-        });
-    }
-    // 2b. The seal backstop: an ordinary rotation is the sealing append by
-    // construction, but a rotation that no-op'd (the revoked client held no
-    // current-epoch wrap -- an orphan client, or any re-run) appended nothing,
-    // leaving the roster log's head anchored before the document edit. Sealing
-    // is best-effort and reported, never thrown: the wallet IS disconnected
-    // (stage 1 landed), and an unsealed log is durable state the login sweep
-    // re-detects and finishes.
-    let rosterSeal;
-    if (isSealableDescriptorStore(rosterStore)) {
-        try {
-            rosterSeal = { outcome: await rosterStore.seal() };
-        }
-        catch (err) {
-            rosterSeal = { outcome: 'failed', error: err };
-        }
-    }
-    // 3. The collection fan-out, in parallel -- run even when this call found
-    // the roster already rotated (a re-run after a crash), because the staleness
-    // rule finds exactly the stranded collections.
-    const cascade = await cascadeCollectionsToUserKey({
-        collectionIds: await collectionIdsOf({ collections }),
-        storeFor: collections.storeFor,
-        ...(collections.isEncrypted
-            ? { isEncrypted: collections.isEncrypted }
-            : {}),
-        rosterDescriptor: read.descriptor,
-        clientKeyAgreementKey,
-        userKey: read.userKey
-    });
     // 4. The recovery re-mints, while the registry is still readable under the
     // session's pre-adoption vault keys.
     const recovery = await remintRecoveryDelegations?.({ document: doc });
-    if (read.rotated) {
-        await onRotationAdopted?.({ userKey: read.userKey });
+    if (tail.rotated) {
+        await onRotationAdopted?.({ userKey: tail.userKey });
     }
     return {
-        rotated: read.rotated,
-        ...(rosterSeal ? { rosterSeal } : {}),
-        collections: cascade,
+        rotated: tail.rotated,
+        ...(tail.rosterSeal ? { rosterSeal: tail.rosterSeal } : {}),
+        collections: tail.collections,
         document: doc,
-        userKey: read.userKey,
-        rosterDescriptor: read.descriptor,
+        userKey: tail.userKey,
+        rosterDescriptor: tail.rosterDescriptor,
         ...(recovery ? { recovery } : {})
     };
 }

package/dist/clients/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AA+DA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACL,iBAAiB,EAKlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AA6CzB;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,EAC7B,WAAW,EAGZ;IACC,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAA;IACrC,OAAO,OAAO,aAAa,KAAK,UAAU;QACxC,CAAC,CAAC,MAAM,aAAa,EAAE;QACvB,CAAC,CAAC,aAAa,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,iBAAiB,EAsBlB;IACC,IACE,sBAAsB;QACtB,sBAAsB,KAAK,aAAa,CAAC,mBAAmB,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,sCAAsC,CACzC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAChD,OAAO;QACP,UAAU;QACV,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,sCAAsC;IACtC,IAAI,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,WAAW,CAAC,kBAAkB,CAAC;YAC7B,UAAU,EAAE,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACrD,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,iEAAiE;IACjE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;QACtD,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACzC,QAAQ,EAAE,GAAG;SACd,CAAA;IACH,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK,EAAE,WAAW;QAClB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;KACd,CAAC,CAAA;IACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,gBAAgB,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,2BAA2B;IAC3B,IAAI,UAAwC,CAAA;IAC5C,IAAI,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QAChD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,aAAa,EAAE,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;YACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;IAEF,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AA+DA,OAAO,EACL,iBAAiB,EAKlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAqBzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,iBAAiB,EAsBlB;IACC,IACE,sBAAsB;QACtB,sBAAsB,KAAK,aAAa,CAAC,mBAAmB,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,sCAAsC,CACzC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAChD,OAAO;QACP,UAAU;QACV,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,sEAAsE;QACtE,4DAA4D;QAC5D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;SACd,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC"}

package/dist/keys/index.d.ts

@@ -42,6 +42,11 @@
  *   re-epoch that brings an encrypted collection onto the roster's current
  *   user key, and the parallel best-effort fan-out over the collections the wallet
  *   names (also the completion sweep's driver).
+ * - `rotateRosterToDocumentAndCascade` -- the shared roster-and-cascade tail
+ *   every account-membership ceremony ends with (a client disconnected, a
+ *   standing unlock credential retired): the post-edit controller floor, the
+ *   convergence rotation with its seal backstop, and the collection fan-out
+ *   onto the fresh user key.
  * - `ensureWalletSpaceEpochs` -- the provision-time epoch[0] install for the
  *   wallet Space's encrypted collections, the EDV-bearing second step of
  *   `provisionWalletSpace`.
@@ -55,6 +60,8 @@ export type { ClientKeyRecord, ClientKeyRecordJson, EnrolledClientKeyRecord } fr
 export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from './userKeyRoster.js';
 export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
 export type { CollectionUserKeyRotationOutcome, UserKeyCascadeResult } from './userKeyCascade.js';
+export { rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
+export type { CascadeCollections, RosterCascadeResult, RosterSealReport } from './userKeyRosterCascade.js';
 export type { UserKeyRosterReadResult } from './userKeyRoster.js';
 export type { KeyAgreementDocument } from '../webvh/keyAgreement.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';

package/dist/keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AACjE,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAA;AAC5E,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AACjE,YAAY,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/index.js

@@ -42,6 +42,11 @@
  *   re-epoch that brings an encrypted collection onto the roster's current
  *   user key, and the parallel best-effort fan-out over the collections the wallet
  *   names (also the completion sweep's driver).
+ * - `rotateRosterToDocumentAndCascade` -- the shared roster-and-cascade tail
+ *   every account-membership ceremony ends with (a client disconnected, a
+ *   standing unlock credential retired): the post-edit controller floor, the
+ *   convergence rotation with its seal backstop, and the collection fan-out
+ *   onto the fresh user key.
  * - `ensureWalletSpaceEpochs` -- the provision-time epoch[0] install for the
  *   wallet Space's encrypted collections, the EDV-bearing second step of
  *   `provisionWalletSpace`.
@@ -52,6 +57,7 @@ export { mintUserKey, userKeyVaultKeys } from './userKey.js';
 export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, parseClientRecordUserKey, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
 export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from './userKeyRoster.js';
 export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
+export { rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
 export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs } from './spaceEpochs.js';

package/dist/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAQ5B,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAA;AAS5E,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/userKeyRosterCascade.d.ts

@@ -0,0 +1,121 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The shared roster-and-cascade tail every account-membership ceremony ends
+ * with: once a ceremony has published its own did:webvh document edit --
+ * disconnecting an enrolled client, retiring a standing unlock credential --
+ * what remains is the same two stages, and they are the same code.
+ *
+ * 1. **The user key rotation** in the wrap-set roster, recipients resolved
+ *    from the document the edit itself just resolved to (no re-fetch of the
+ *    log the ceremony just extended). On a log-governed roster store this
+ *    function itself guarantees post-edit anchoring: the controller view built
+ *    from the edit's own post-edit log is set as the store's freshness floor
+ *    (`setControllerFloor`) before anything roster-side runs, so the rotation
+ *    and the seal backstop anchor at or past the edit even where the app's
+ *    injected controller resolution still serves a cached pre-edit view. The
+ *    roster delivers, never sources, so the stage names no recipient at all:
+ *    it converges the roster onto that document (the login sweep's own path),
+ *    retiring every current-epoch recipient the document no longer keys in one
+ *    rotation. An account with no roster yet stops here: the document edit has
+ *    landed, so the membership change IS in force, with nothing to rotate. On
+ *    a sealable (log-governed) roster store, the seal backstop follows: a
+ *    rotation that no-op'd appended nothing, so the roster log may still be
+ *    anchored before the document edit -- `seal()` re-anchors it with an
+ *    idempotent no-op entry, best-effort and reported rather than thrown.
+ * 2. **The collection fan-out**: every encrypted collection is re-epoch'd onto
+ *    the fresh key in parallel, so writes stop landing under epochs the
+ *    removed party can still decrypt. Failures are collected per collection
+ *    and never abort the fan-out.
+ *
+ * Convergence is the design: both stages detect their own completion from
+ * durable state alone -- the roster no-ops once every current-epoch recipient
+ * is document-backed, and a collection is stale exactly when its current
+ * epoch names a non-current key generation -- so a mid-cascade crash strands
+ * nothing permanently and a naive full re-run finishes it (the login-time
+ * completion sweep is the standing backstop).
+ */
+import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
+import type { IKeyAgreementKey } from '@interop/data-integrity-core';
+import type { CollectionEncryption } from '@interop/was-client';
+import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import { type UserKeyCascadeResult } from './userKeyCascade.js';
+import type { UserKey } from './userKey.js';
+/**
+ * What the roster's seal backstop reported: `sealed` (the roster log's head
+ * still anchored before the document edit, and the backstop append landed),
+ * `noop` (already sealed -- the rotation itself was the sealing append, or a
+ * re-run found nothing to do), or `failed` (the seal could not run; carried
+ * in `error`, never thrown -- the ceremony stays a resumable success and the
+ * login sweep re-seals).
+ */
+export interface RosterSealReport {
+    outcome: 'sealed' | 'noop' | 'failed';
+    error?: unknown;
+}
+/**
+ * Where the cascade's collection fan-out gets its work: which encrypted
+ * collections exist (only the app knows -- a mobile replica names the
+ * collections it replicates, a web wallet also lists the app-provisioned ones
+ * remotely) and how each one's descriptor store and encryption declaration are
+ * reached.
+ */
+export interface CascadeCollections {
+    collectionIds: string[] | (() => Promise<string[]>);
+    storeFor: (collectionId: string) => EncryptionDescriptorStore;
+    isEncrypted?: (collectionId: string) => Promise<boolean>;
+}
+/**
+ * What the shared tail reports: whether the roster actually rotated on this
+ * run (a re-run of an already-complete ceremony reports `false`), the roster's
+ * seal-backstop report (present when the roster store is sealable and the
+ * roster stage ran), the per-collection fan-out result, and the rotated key
+ * with the roster descriptor it was read from.
+ */
+export interface RosterCascadeResult {
+    rotated: boolean;
+    rosterSeal?: RosterSealReport;
+    collections: UserKeyCascadeResult;
+    userKey?: UserKey;
+    rosterDescriptor?: CollectionEncryption;
+}
+/**
+ * Runs the roster rotation (with its seal backstop) and the collection
+ * fan-out over the document a ceremony's own edit just published. See the
+ * module doc for the order and the convergence story.
+ *
+ * @param options {object}
+ * @param options.rosterStore {EncryptionDescriptorStore}   the
+ *   `key-map/user-key.jsonl` roster store
+ * @param options.did {string}   the account's did:webvh
+ * @param options.doc {DIDDoc}   the document as the ceremony's edit left it
+ * @param options.log {DIDLog}   the post-edit log, which the controller floor
+ *   is built from
+ * @param [options.userKey] {UserKey}   this client's cached user key
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key -- its roster entry
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onUserKeyAdopted] {Function}   persists a rotated key:
+ *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
+ *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @returns {Promise<RosterCascadeResult>}
+ */
+export declare function rotateRosterToDocumentAndCascade({ rosterStore, did, doc, log, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections }: {
+    rosterStore: EncryptionDescriptorStore;
+    did: string;
+    doc: DIDDoc;
+    log: DIDLog;
+    userKey?: UserKey;
+    clientKeyAgreementKey: IKeyAgreementKey;
+    pinnedEpochId?: string | null;
+    onUserKeyAdopted?: (adopted: {
+        userKey: UserKey;
+        latestEpochId: string;
+        descriptor: CollectionEncryption;
+    }) => Promise<void>;
+    collections: CascadeCollections;
+}): Promise<RosterCascadeResult>;
+//# sourceMappingURL=userKeyRosterCascade.d.ts.map

package/dist/keys/userKeyRosterCascade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userKeyRosterCascade.d.ts","sourceRoot":"","sources":["../../src/keys/userKeyRosterCascade.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAExE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;IACrC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACnD,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACzD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAqBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,gCAAgC,CAAC,EACrD,WAAW,EACX,GAAG,EACH,GAAG,EACH,GAAG,EACH,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,WAAW,EAAE,yBAAyB,CAAA;IACtC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqF/B"}

package/dist/keys/userKeyRosterCascade.js

@@ -0,0 +1,125 @@
+import { webvhResourceLogController } from '../resourceLog/index.js';
+import { cascadeCollectionsToUserKey } from './userKeyCascade.js';
+import { isSealableDescriptorStore } from './rosterLogStore.js';
+import { convergeUserKeyRosterToDocument, readUserKeyRoster } from './userKeyRoster.js';
+/**
+ * Resolves the collection ids the fan-out covers, whether they are a fixed set
+ * or a listing the app performs.
+ *
+ * @param options {object}
+ * @param options.collections {CascadeCollections}
+ * @returns {Promise<string[]>}
+ */
+async function collectionIdsOf({ collections }) {
+    const { collectionIds } = collections;
+    return typeof collectionIds === 'function'
+        ? await collectionIds()
+        : collectionIds;
+}
+/**
+ * Runs the roster rotation (with its seal backstop) and the collection
+ * fan-out over the document a ceremony's own edit just published. See the
+ * module doc for the order and the convergence story.
+ *
+ * @param options {object}
+ * @param options.rosterStore {EncryptionDescriptorStore}   the
+ *   `key-map/user-key.jsonl` roster store
+ * @param options.did {string}   the account's did:webvh
+ * @param options.doc {DIDDoc}   the document as the ceremony's edit left it
+ * @param options.log {DIDLog}   the post-edit log, which the controller floor
+ *   is built from
+ * @param [options.userKey] {UserKey}   this client's cached user key
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key -- its roster entry
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onUserKeyAdopted] {Function}   persists a rotated key:
+ *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
+ *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @returns {Promise<RosterCascadeResult>}
+ */
+export async function rotateRosterToDocumentAndCascade({ rosterStore, did, doc, log, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections }) {
+    // The post-edit anchoring guarantee: the roster appends -- and the seal
+    // backstop's removal detection -- must run under a controller view that
+    // includes the edit the ceremony just published, or the rotation anchors
+    // pre-edit and the log stays unsealed with the seal blind to the removal.
+    // Rather than leaving that to the injected store's own controller wiring,
+    // the view built from the edit's post-edit log is set as the store's floor;
+    // a fresher resolved view still wins.
+    if (isSealableDescriptorStore(rosterStore)) {
+        rosterStore.setControllerFloor({
+            controller: webvhResourceLogController({ did, log })
+        });
+    }
+    // The roster rotation, recipients resolved from that same document.
+    // Whether there IS a roster is settled BY the convergence call itself: a
+    // `null` descriptor back means the account has no `key-map/user-key.jsonl`
+    // yet (its collections are not encrypted yet), so there is nothing to
+    // rotate. The document edit has already landed, so the membership change IS
+    // in force -- a completed ceremony with nothing rotated, not a failure.
+    // Pairing-free: rather than naming the removed party's kid, the rotation
+    // retires every current-epoch recipient the post-edit document no longer
+    // keys -- which is exactly that party's entry, plus anything an earlier torn
+    // run left behind, in one rotation.
+    const converged = await convergeUserKeyRosterToDocument({
+        store: rosterStore,
+        document: doc
+    });
+    if (converged.descriptor === null) {
+        return { rotated: false, collections: { outcomes: {}, failed: [] } };
+    }
+    // The rotation's own verified result is threaded into the adopting read, so
+    // one run acquires the roster once for both halves of the stage (the
+    // continuity and possession checks still run on the threaded descriptor).
+    const read = await readUserKeyRoster({
+        store: rosterStore,
+        descriptor: converged.descriptor,
+        ...(userKey ? { userKey } : {}),
+        clientKeyAgreementKey,
+        pinnedEpochId
+    });
+    if (read.rotated) {
+        await onUserKeyAdopted?.({
+            userKey: read.userKey,
+            latestEpochId: read.latestEpochId,
+            descriptor: read.descriptor
+        });
+    }
+    // The seal backstop: an ordinary rotation is the sealing append by
+    // construction, but a rotation that no-op'd (the removed party held no
+    // current-epoch wrap -- an orphan entry, or any re-run) appended nothing,
+    // leaving the roster log's head anchored before the document edit. Sealing
+    // is best-effort and reported, never thrown: the document edit landed, and
+    // an unsealed log is durable state the login sweep re-detects and finishes.
+    let rosterSeal;
+    if (isSealableDescriptorStore(rosterStore)) {
+        try {
+            rosterSeal = { outcome: await rosterStore.seal() };
+        }
+        catch (err) {
+            rosterSeal = { outcome: 'failed', error: err };
+        }
+    }
+    // The collection fan-out, in parallel -- run even when this call found the
+    // roster already rotated (a re-run after a crash), because the staleness
+    // rule finds exactly the stranded collections.
+    const cascade = await cascadeCollectionsToUserKey({
+        collectionIds: await collectionIdsOf({ collections }),
+        storeFor: collections.storeFor,
+        ...(collections.isEncrypted
+            ? { isEncrypted: collections.isEncrypted }
+            : {}),
+        rosterDescriptor: read.descriptor,
+        clientKeyAgreementKey,
+        userKey: read.userKey
+    });
+    return {
+        rotated: read.rotated,
+        ...(rosterSeal ? { rosterSeal } : {}),
+        collections: cascade,
+        userKey: read.userKey,
+        rosterDescriptor: read.descriptor
+    };
+}
+//# sourceMappingURL=userKeyRosterCascade.js.map

package/dist/keys/userKeyRosterCascade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userKeyRosterCascade.js","sourceRoot":"","sources":["../../src/keys/userKeyRosterCascade.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACL,2BAA2B,EAE5B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AA4C3B;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,EAC7B,WAAW,EAGZ;IACC,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAA;IACrC,OAAO,OAAO,aAAa,KAAK,UAAU;QACxC,CAAC,CAAC,MAAM,aAAa,EAAE;QACvB,CAAC,CAAC,aAAa,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,EACrD,WAAW,EACX,GAAG,EACH,GAAG,EACH,GAAG,EACH,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EAeZ;IACC,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,sCAAsC;IACtC,IAAI,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,WAAW,CAAC,kBAAkB,CAAC;YAC7B,UAAU,EAAE,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACrD,CAAC,CAAA;IACJ,CAAC;IAED,oEAAoE;IACpE,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,oCAAoC;IACpC,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;QACtD,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,GAAG;KACd,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAA;IACtE,CAAC;IACD,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK,EAAE,WAAW;QAClB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;KACd,CAAC,CAAA;IACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,gBAAgB,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,UAAwC,CAAA;IAC5C,IAAI,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QAChD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,aAAa,EAAE,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;YACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;KAClC,CAAA;AACH,CAAC"}

package/dist/recovery/recoveryWebvh.d.ts

@@ -1,3 +1,4 @@
+import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
 import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
 /**
  * The verification-method id a code's key-agreement key publishes under --
@@ -55,7 +56,8 @@ export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdRes
  * @param options.recovery {RecoveryPublicKeys}   the code's public halves
  * @param [options.expectedDid] {string}   the account DID the log must
  *   resolve to, from the caller's stored account pointer
- * @returns {Promise<{ did: string }>}
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   the account
+ *   DID and the document and log as this call leaves them
  */
 export declare function publishRecoveryKey({ idStore, updateKeys, recovery, expectedDid }: {
     idStore: WebvhIdStore;
@@ -64,6 +66,8 @@ export declare function publishRecoveryKey({ idStore, updateKeys, recovery, expe
     expectedDid?: string;
 }): Promise<{
     did: string;
+    doc: DIDDoc;
+    log: DIDLog;
 }>;
 /**
  * REVOCATION (run by an enrolled client, root authority): removes a recovery
@@ -74,7 +78,8 @@ export declare function publishRecoveryKey({ idStore, updateKeys, recovery, expe
  * the resolver's document no longer backs the removed entry.
  *
  * @param options {object}   see {@link publishRecoveryKey}
- * @returns {Promise<{ did: string }>}
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
+ *   {@link publishRecoveryKey}
  */
 export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expectedDid }: {
     idStore: WebvhIdStore;
@@ -83,6 +88,8 @@ export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expec
     expectedDid?: string;
 }): Promise<{
     did: string;
+    doc: DIDDoc;
+    log: DIDLog;
 }>;
 /**
  * RECOVERY (run by the code-derived client through the delegated `did.jsonl`

package/dist/recovery/recoveryWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EACV,qBAAqB,EAErB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAsDD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAa3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAa3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5C"}
+{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EAEP,MAAM,2BAA2B,CAAA;AAWlC,OAAO,KAAK,EACV,qBAAqB,EAErB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAsDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAarD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAarD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5C"}

package/dist/recovery/recoveryWebvh.js

@@ -116,7 +116,8 @@ async function publishLogOnly({ store, log, ifMatch }) {
  * @param options.recovery {RecoveryPublicKeys}   the code's public halves
  * @param [options.expectedDid] {string}   the account DID the log must
  *   resolve to, from the caller's stored account pointer
- * @returns {Promise<{ did: string }>}
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   the account
+ *   DID and the document and log as this call leaves them
  */
 export async function publishRecoveryKey({ idStore, updateKeys, recovery, expectedDid }) {
     return publishUnlockKey({
@@ -141,7 +142,8 @@ export async function publishRecoveryKey({ idStore, updateKeys, recovery, expect
  * the resolver's document no longer backs the removed entry.
  *
  * @param options {object}   see {@link publishRecoveryKey}
- * @returns {Promise<{ did: string }>}
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
+ *   {@link publishRecoveryKey}
  */
 export async function removeRecoveryKey({ idStore, updateKeys, recovery, expectedDid }) {
     return removeUnlockKey({

package/dist/recovery/recoveryWebvh.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.js","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAExE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EAIzB;IACC,OAAO,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;AAC7C,CAAC;AAYD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YACE,OAAO,GAAG,4DAA4D;QACpE,4CAA4C;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAYD;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,WAAW,EAIZ;IACC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,GAAG,EACH,OAAO,EAKR;IACC,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EAMZ;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EAMZ;IACC,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI,EAAE,0BAA0B;KACjC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAOxC;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EAQZ;IACC,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;IAC/B,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,wBAAwB,CACvC,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,KAAK,CACrE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC/C,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,aAAa;oBACb,aAAa;oBACb,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;SACxB,CAAC,CAAA;QACF,mDAAmD;QACnD,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,kBAA0B,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,wCAAwC;IACxC,MAAM,YAAY,GAAyB;QACzC,GAAG,4BAA4B,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;SACjE,CAAC;QACF;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;KACF,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CACtD;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,aAAa,GAAG,CACpB,QAAqD,EACrD,EAAU,EACV,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,IAAI,EAAE,oBAAoB,CAAC,UAAU;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,kBAAkB,CAC3C;gBACD,aAAa,CAAC,kBAAkB;aACjC,CAAC;SACH;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAC9B;QACD,mBAAmB;QACnB,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;QAC9D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC;QAChE,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC;gBAC/D,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC;gBAC5C,eAAe;aAChB,CAAC;SACH;QACD,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC1E,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;KAC3E,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;AACrD,CAAC"}
+{"version":3,"file":"recoveryWebvh.js","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EAIzB;IACC,OAAO,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;AAC7C,CAAC;AAYD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YACE,OAAO,GAAG,4DAA4D;QACpE,4CAA4C;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAYD;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,WAAW,EAIZ;IACC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,GAAG,EACH,OAAO,EAKR;IACC,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EAMZ;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EAMZ;IACC,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI,EAAE,0BAA0B;KACjC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAOxC;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EAQZ;IACC,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;IAC/B,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,wBAAwB,CACvC,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,KAAK,CACrE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC/C,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,aAAa;oBACb,aAAa;oBACb,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;SACxB,CAAC,CAAA;QACF,mDAAmD;QACnD,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,kBAA0B,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,wCAAwC;IACxC,MAAM,YAAY,GAAyB;QACzC,GAAG,4BAA4B,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;SACjE,CAAC;QACF;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;KACF,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CACtD;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,aAAa,GAAG,CACpB,QAAqD,EACrD,EAAU,EACV,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,IAAI,EAAE,oBAAoB,CAAC,UAAU;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,kBAAkB,CAC3C;gBACD,aAAa,CAAC,kBAAkB;aACjC,CAAC;SACH;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAC9B;QACD,mBAAmB;QACnB,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;QAC9D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC;QAChE,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC;gBAC/D,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC;gBAC5C,eAAe;aAChB,CAAC;SACH;QACD,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC1E,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;KAC3E,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;AACrD,CAAC"}

package/dist/unlock/index.d.ts

@@ -21,6 +21,9 @@
  * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
  *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
  *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
+ * - `retireUnlockCredential` -- the retirement ceremony behind "change my
+ *   passphrase" and "remove this passkey": the posture edit, then the shared
+ *   roster rotation and collection fan-out off the retired credential's wrap.
  * - `selfEnrollWebvhClient` / `selfEnrollClientCore` -- the self-enrolling
  *   continuation (reveal a rung, add an ordinary client, retire the rung) and
  *   the composed completion a fresh browser runs end to end.
@@ -36,5 +39,7 @@ export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unl
 export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from './unlockRecord.js';
 export { publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export type { StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
+export { retireUnlockCredential } from './retire.js';
+export type { UnlockCredentialRetirementResult } from './retire.js';
 export { selfEnrollClientCore } from './selfEnroll.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/unlock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AAEnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/unlock/index.js

@@ -21,6 +21,9 @@
  * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
  *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
  *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
+ * - `retireUnlockCredential` -- the retirement ceremony behind "change my
+ *   passphrase" and "remove this passkey": the posture edit, then the shared
+ *   roster rotation and collection fan-out off the retired credential's wrap.
  * - `selfEnrollWebvhClient` / `selfEnrollClientCore` -- the self-enrolling
  *   continuation (reveal a rung, add an ordinary client, retire the rung) and
  *   the composed completion a fresh browser runs end to end.
@@ -32,5 +35,6 @@ export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentit
 export { attributeLadderRung, generateLadderSeed, LADDER_MAX_SCAN, LADDER_SEED_BYTES, LadderAttributionError, ladderRung, ladderRungSeed } from './ladder.js';
 export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
 export { publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { retireUnlockCredential } from './retire.js';
 export { selfEnrollClientCore } from './selfEnroll.js';
 //# sourceMappingURL=index.js.map

package/dist/unlock/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/unlock/retire.d.ts

@@ -0,0 +1,126 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Retiring a standing unlock credential: the ceremony behind "change my
+ * passphrase" and "remove this passkey", run synchronously in an enrolled
+ * client, in dependency order. A standing credential is not a stored string to
+ * overwrite -- it holds a wrap in the user key roster and a `keyAgreement`
+ * posture in the account's did:webvh document -- so retiring one is a real
+ * rotation, on the same stages the client-revocation cascade runs.
+ *
+ * 1. **The document posture edit** (`removeUnlockKey`): the credential's
+ *    `keyAgreement` entry (verbatim key or commitment) and its committed
+ *    update-key hash leave the document in one log entry. That kills the
+ *    credential's latent self-enrollment authority -- with its rung
+ *    commitment gone, no reveal entry it could sign verifies -- and it is
+ *    what makes stage 2 converge: the roster resolver, backed by this
+ *    document, no longer keys the credential's entry.
+ * 2. **The roster rotation and the collection fan-out**
+ *    (`rotateRosterToDocumentAndCascade`): the user key rotates off the
+ *    credential's wrap and every encrypted collection re-epochs onto the
+ *    fresh key, so writes stop landing under epochs the retired credential
+ *    could open.
+ *
+ * The order is load-bearing, and in that direction: the document removal
+ * first means a run torn anywhere after it leaves the roster keying a
+ * recipient the document no longer backs -- exactly the state the login-time
+ * sweep detects and finishes. Torn the other way around, a rotation with the
+ * posture still standing would simply re-escrow the credential and look
+ * healthy.
+ *
+ * There is deliberately no recovery-delegation re-mint stage here (the
+ * client-revocation cascade's fourth stage). A retired credential signs no
+ * delegations: its own bridge delegation dies with its unlock Space, which
+ * the app deletes as part of the change-method ceremony, and no other
+ * credential's bridge chains through it.
+ *
+ * Convergence is the design: every stage detects its own completion from
+ * durable state alone -- the posture edit no-ops when the document is already
+ * settled, the rotation no-ops once every current-epoch recipient is
+ * document-backed, and a collection is stale exactly when its current epoch
+ * names a non-current user key generation -- so a naive full re-run finishes
+ * a torn ceremony and a healthy account writes nothing.
+ *
+ * The honest limitation is the cascade's: ciphertext the credential's holder
+ * already fetched and decrypted stays readable, and old epochs stay open to
+ * the user key generations the credential already delivered. Retirement stops
+ * future reads.
+ */
+import type { IKeyAgreementKey } from '@interop/data-integrity-core';
+import type { CollectionEncryption } from '@interop/was-client';
+import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import { type CascadeCollections, type RosterSealReport, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
+import type { ClientWebvhUpdateKeys, WebvhIdStore } from '../webvh/index.js';
+import { type StandingUnlockKeys } from './standingWebvh.js';
+/**
+ * What a completed retirement reports: whether the roster actually rotated on
+ * this run (a re-run of an already-complete retirement reports `false`), the
+ * roster's seal-backstop report (present when the roster store is sealable and
+ * the roster stage ran), the per-collection fan-out result, the document as
+ * the posture edit left it, and the rotated key with the roster descriptor it
+ * was read from.
+ */
+export interface UnlockCredentialRetirementResult {
+    rotated: boolean;
+    rosterSeal?: RosterSealReport;
+    collections: UserKeyCascadeResult;
+    document: object;
+    userKey?: UserKey;
+    rosterDescriptor?: CollectionEncryption;
+}
+/**
+ * Retires one standing unlock credential from an account. See the module doc
+ * for the order and the convergence story. Once the posture edit lands, a
+ * thrown later stage leaves durable state a naive re-run -- or the login-time
+ * sweep -- converges from.
+ *
+ * @param options {object}
+ * @param options.idStore {WebvhIdStore}   the account's `id` collection store
+ * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
+ *   client's own did:webvh update-key seeds, which sign the posture edit
+ * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
+ *   public posture (its key-agreement publication and its committed update
+ *   key)
+ * @param [options.expectedDid] {string}   the account DID from the caller's
+ *   stored account pointer; supplied, the posture edit refuses a `did.jsonl`
+ *   resolving to any other account
+ * @param [options.verb] {string}   what the caller is doing, for the
+ *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
+ * @param options.rosterStore {EncryptionDescriptorStore}   the
+ *   `key-map/user-key.jsonl` roster store
+ * @param [options.userKey] {UserKey}   this client's cached user key
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key -- its roster entry
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onUserKeyAdopted] {Function}   persists a rotated key:
+ *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
+ *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param [options.onRotationAdopted] {Function}   `({ userKey }) =>
+ *   Promise<void>` -- the live-session adoption of a rotated key, run last so
+ *   the session keeps operating without a re-login
+ * @returns {Promise<UnlockCredentialRetirementResult>}
+ */
+export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, onRotationAdopted }: {
+    idStore: WebvhIdStore;
+    updateKeys: ClientWebvhUpdateKeys;
+    unlockKeys: StandingUnlockKeys;
+    expectedDid?: string;
+    verb?: string;
+    rosterStore: EncryptionDescriptorStore;
+    userKey?: UserKey;
+    clientKeyAgreementKey: IKeyAgreementKey;
+    pinnedEpochId?: string | null;
+    onUserKeyAdopted?: (adopted: {
+        userKey: UserKey;
+        latestEpochId: string;
+        descriptor: CollectionEncryption;
+    }) => Promise<void>;
+    collections: CascadeCollections;
+    onRotationAdopted?: (rotation: {
+        userKey: UserKey;
+    }) => Promise<void>;
+}): Promise<UnlockCredentialRetirementResult>;
+//# sourceMappingURL=retire.d.ts.map

package/dist/unlock/retire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAgD5C"}

package/dist/unlock/retire.js

@@ -0,0 +1,83 @@
+import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
+import { removeUnlockKey } from './standingWebvh.js';
+/**
+ * Retires one standing unlock credential from an account. See the module doc
+ * for the order and the convergence story. Once the posture edit lands, a
+ * thrown later stage leaves durable state a naive re-run -- or the login-time
+ * sweep -- converges from.
+ *
+ * @param options {object}
+ * @param options.idStore {WebvhIdStore}   the account's `id` collection store
+ * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
+ *   client's own did:webvh update-key seeds, which sign the posture edit
+ * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
+ *   public posture (its key-agreement publication and its committed update
+ *   key)
+ * @param [options.expectedDid] {string}   the account DID from the caller's
+ *   stored account pointer; supplied, the posture edit refuses a `did.jsonl`
+ *   resolving to any other account
+ * @param [options.verb] {string}   what the caller is doing, for the
+ *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
+ * @param options.rosterStore {EncryptionDescriptorStore}   the
+ *   `key-map/user-key.jsonl` roster store
+ * @param [options.userKey] {UserKey}   this client's cached user key
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key -- its roster entry
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onUserKeyAdopted] {Function}   persists a rotated key:
+ *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
+ *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param [options.onRotationAdopted] {Function}   `({ userKey }) =>
+ *   Promise<void>` -- the live-session adoption of a rotated key, run last so
+ *   the session keeps operating without a re-login
+ * @returns {Promise<UnlockCredentialRetirementResult>}
+ */
+export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, onRotationAdopted }) {
+    // 1. The document posture edit -- the credential's standing, first. It
+    // resolves the document as it now stands, which is what stage 2 resolves
+    // its remaining recipients from.
+    const { did, doc, log } = await removeUnlockKey({
+        idStore,
+        updateKeys,
+        unlockKeys,
+        ...(expectedDid !== undefined ? { expectedDid } : {}),
+        ...(verb !== undefined ? { verb } : {})
+    });
+    // 2. The shared roster-and-cascade tail: the roster rotation onto the
+    // post-edit document (with its post-edit controller floor and its seal
+    // backstop), then the collection fan-out onto the fresh key.
+    const tail = await rotateRosterToDocumentAndCascade({
+        rosterStore,
+        did,
+        doc,
+        log,
+        ...(userKey ? { userKey } : {}),
+        clientKeyAgreementKey,
+        pinnedEpochId,
+        ...(onUserKeyAdopted ? { onUserKeyAdopted } : {}),
+        collections
+    });
+    if (!tail.rosterDescriptor || !tail.userKey) {
+        // No roster to rotate: the posture edit has landed, so the credential IS
+        // retired -- a completed ceremony with nothing rotated.
+        return {
+            rotated: false,
+            collections: tail.collections,
+            document: doc
+        };
+    }
+    if (tail.rotated) {
+        await onRotationAdopted?.({ userKey: tail.userKey });
+    }
+    return {
+        rotated: tail.rotated,
+        ...(tail.rosterSeal ? { rosterSeal: tail.rosterSeal } : {}),
+        collections: tail.collections,
+        document: doc,
+        userKey: tail.userKey,
+        rosterDescriptor: tail.rosterDescriptor
+    };
+}
+//# sourceMappingURL=retire.js.map

package/dist/unlock/retire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAoDA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,eAAe,EAA2B,MAAM,oBAAoB,CAAA;AAmB7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EAkBlB;IACC,uEAAuE;IACvE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,eAAe,CAAC;QAC9C,OAAO;QACP,UAAU;QACV,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,yEAAyE;QACzE,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;SACd,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAA;AACH,CAAC"}

package/dist/unlock/standingWebvh.d.ts

@@ -1,4 +1,4 @@
-import type { VerificationMethod } from '@interop/did-method-webvh';
+import type { DIDDoc, DIDLog, VerificationMethod } from '@interop/did-method-webvh';
 import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
 /**
  * The narrow store seam the self-enrollment continuation writes through: a
@@ -82,7 +82,10 @@ export declare function unlockKeyVerificationMethod({ did, keyAgreement }: {
  *   to, from the caller's stored account pointer
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'issuing a recovery code'`)
- * @returns {Promise<{ did: string }>}
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   the account
+ *   DID and the document and log as this call leaves them (unchanged when the
+ *   posture was already settled), which is what the caller's roster-side half
+ *   converges onto
  */
 export declare function publishUnlockKey(options: {
     idStore: WebvhIdStore;
@@ -92,6 +95,8 @@ export declare function publishUnlockKey(options: {
     verb?: string;
 }): Promise<{
     did: string;
+    doc: DIDDoc;
+    log: DIDLog;
 }>;
 /**
  * REMOVAL (run by an enrolled client, root authority): removes a standing
@@ -102,7 +107,8 @@ export declare function publishUnlockKey(options: {
  * entry.
  *
  * @param options {object}   see {@link publishUnlockKey}
- * @returns {Promise<{ did: string }>}
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
+ *   {@link publishUnlockKey}
  */
 export declare function removeUnlockKey(options: {
     idStore: WebvhIdStore;
@@ -112,6 +118,8 @@ export declare function removeUnlockKey(options: {
     verb?: string;
 }): Promise<{
     did: string;
+    doc: DIDDoc;
+    log: DIDLog;
 }>;
 /**
  * SELF-ENROLLMENT (run by the credential-derived client through the delegated

package/dist/unlock/standingWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAU,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAe3E,OAAO,KAAK,EACV,qBAAqB,EAErB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAsDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3B;AAkGD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,UAAU,EAAE,UAAU,CAAA;IACtB,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5C"}
+{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAelC,OAAO,KAAK,EACV,qBAAqB,EAErB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAsDD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAkGD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,UAAU,EAAE,UAAU,CAAA;IACtB,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5C"}

package/dist/unlock/standingWebvh.js

@@ -150,7 +150,10 @@ async function publishLogOnly({ store, log, ifMatch }) {
  *   to, from the caller's stored account pointer
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'issuing a recovery code'`)
- * @returns {Promise<{ did: string }>}
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   the account
+ *   DID and the document and log as this call leaves them (unchanged when the
+ *   posture was already settled), which is what the caller's roster-side half
+ *   converges onto
  */
 export async function publishUnlockKey(options) {
     return withLogConflictRetry(() => setUnlockKeyPostureOnce({ ...options, polarity: 'publish' }));
@@ -164,7 +167,8 @@ export async function publishUnlockKey(options) {
  * entry.
  *
  * @param options {object}   see {@link publishUnlockKey}
- * @returns {Promise<{ did: string }>}
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
+ *   {@link publishUnlockKey}
  */
 export async function removeUnlockKey(options) {
     return withLogConflictRetry(() => setUnlockKeyPostureOnce({ ...options, polarity: 'remove' }));
@@ -176,7 +180,7 @@ export async function removeUnlockKey(options) {
  * between two copies would be published into an append-only log.
  *
  * @param options {object}   see {@link publishUnlockKey}, plus `polarity`
- * @returns {Promise<{ did: string }>}
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}
  */
 async function setUnlockKeyPostureOnce({ idStore, updateKeys, unlockKeys, expectedDid, verb, polarity }) {
     const published = await readLogOrThrow({
@@ -192,7 +196,7 @@ async function setUnlockKeyPostureOnce({ idStore, updateKeys, unlockKeys, expect
         ? vmPresent && hashCommitted
         : !vmPresent && !hashCommitted;
     if (settled) {
-        return { did };
+        return { did, doc, log: published.log };
     }
     const activeKey = await updateKeyMultibase({ seed: updateKeys.updateSeed });
     if (!published.updateKeys.includes(activeKey)) {
@@ -236,7 +240,7 @@ async function setUnlockKeyPostureOnce({ idStore, updateKeys, unlockKeys, expect
         capabilityDelegation: relationIds(doc.capabilityDelegation)
     });
     await publishUpdatedLog({ idStore, updated, ifMatch: published.etag });
-    return { did: updated.did };
+    return { did: updated.did, doc: updated.doc, log: updated.log };
 }
 /**
  * SELF-ENROLLMENT (run by the credential-derived client through the delegated

package/dist/unlock/standingWebvh.js.map

@@ -1 +1 @@
-{"version":3,"file":"standingWebvh.js","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAExE,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAgC7D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EAIb;IACC,MAAM,QAAQ,GACZ,oBAAoB,IAAI,YAAY;QAClC,CAAC,CAAC,YAAY,CAAC,kBAAkB;QACjC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAA;IAC7B,OAAO,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EAIb;IACC,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,IAAI,oBAAoB,IAAI,YAAY,EAAE,CAAC;QACzC,OAAO;YACL,EAAE;YACF,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;SACpD,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,GAAG;QACf,mBAAmB,EAAE,YAAY,CAAC,UAAU;KACvB,CAAA;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,WAAW,EAIZ;IACC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,GAAG,EACH,OAAO,EAKR;IACC,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAMtC;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAC/B,uBAAuB,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAC7D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAMrC;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAC/B,uBAAuB,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAC5D,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB,CAAC,EACrC,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,QAAQ,EAQT;IACC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC;QACrC,KAAK,EAAE,OAAO;QACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAA;IACtE,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;IAE1E,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAC7B,CAAA;IACD,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC/D,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,SAAS,IAAI,aAAa;QAC5B,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,aAAa,CAAA;IAClC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,GAAG,EAAE,CAAA;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,mDAAmD;YACnD,GAAG,IAAI,IAAI,+BAA+B,GAAG,CAChD,CAAA;IACH,CAAC;IACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAE/C,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IACrE,MAAM,aAAa,GACjB,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;IAC9D,MAAM,mBAAmB,GACvB,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC;YACE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;YACvD,2BAA2B,CAAC;gBAC1B,GAAG;gBACH,YAAY,EAAE,UAAU,CAAC,YAAY;aACtC,CAAC;SACH;QACH,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,CAAA;IAC1D,MAAM,YAAY,GAChB,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAA;IAE7D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,qEAAqE;QACrE,wEAAwE;QACxE,mEAAmE;QACnE,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;QACrC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,aAAa;QACb,mBAAmB;QACnB,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC;QAC/C,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;QACjD,YAAY;QACZ,oBAAoB,EAAE,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC3D,oBAAoB,EAAE,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC;KAC5D,CAAC,CAAA;IACF,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IACtE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAM3C;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,KAAK,EACL,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EAOZ;IACC,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;IAC/B,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,6BAA6B;IAC7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;IACxE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,wBAAwB,CACvC,CAAA;IACD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAEnE,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,KAAK,KAAK,UAAU,CAAA;IACrC,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAC1E,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CACvC,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,sEAAsE;YACtE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,QAAQ;oBACR,aAAa;oBACb,aAAa;oBACb,YAAY;iBACb,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1E,mDAAmD;QACnD,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,kBAA0B,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3E,MAAM,YAAY,GAAyB,4BAA4B,CAAC;QACtE,UAAU,EAAE,GAAG;QACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;KACjE,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAC9D;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,aAAa,GAAG,CACpB,QAAqD,EACrD,EAAU,EACV,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,IAAI,EAAE,oBAAoB,CAAC,UAAU;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,YAAY,CAAC;gBAChE,aAAa,CAAC,kBAAkB;aACjC,CAAC;SACH;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC;QACxE,mBAAmB;QACnB,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;QAC9D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC;QAChE,YAAY,EAAE,aAAa,CACzB,GAAG,CAAC,YAAY,EAChB,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAC7C;QACD,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC1E,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;KAC3E,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;AACrD,CAAC"}
+{"version":3,"file":"standingWebvh.js","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,EAC5B,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAgC7D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EAIb;IACC,MAAM,QAAQ,GACZ,oBAAoB,IAAI,YAAY;QAClC,CAAC,CAAC,YAAY,CAAC,kBAAkB;QACjC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAA;IAC7B,OAAO,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EAIb;IACC,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,IAAI,oBAAoB,IAAI,YAAY,EAAE,CAAC;QACzC,OAAO;YACL,EAAE;YACF,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,YAAY,CAAC,kBAAkB;SACpD,CAAA;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,IAAI,EAAE,2BAA2B;QACjC,UAAU,EAAE,GAAG;QACf,mBAAmB,EAAE,YAAY,CAAC,UAAU;KACvB,CAAA;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,WAAW,EAIZ;IACC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,KAAK,EACL,GAAG,EACH,OAAO,EAKR;IACC,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAMtC;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAC/B,uBAAuB,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAC7D,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAMrC;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAC/B,uBAAuB,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAC5D,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,uBAAuB,CAAC,EACrC,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,QAAQ,EAQT;IACC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC;QACrC,KAAK,EAAE,OAAO;QACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAA;IACtE,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;IAE1E,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAC7B,CAAA;IACD,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC/D,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,SAAS,IAAI,aAAa;QAC5B,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,aAAa,CAAA;IAClC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;IACzC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,mDAAmD;YACnD,GAAG,IAAI,IAAI,+BAA+B,GAAG,CAChD,CAAA;IACH,CAAC;IACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAE/C,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IACrE,MAAM,aAAa,GACjB,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAA;IAC9D,MAAM,mBAAmB,GACvB,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC;YACE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC;YACvD,2BAA2B,CAAC;gBAC1B,GAAG;gBACH,YAAY,EAAE,UAAU,CAAC,YAAY;aACtC,CAAC;SACH;QACH,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,CAAA;IAC1D,MAAM,YAAY,GAChB,QAAQ,KAAK,SAAS;QACpB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAAA;IAE7D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,qEAAqE;QACrE,wEAAwE;QACxE,mEAAmE;QACnE,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;QACrC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,aAAa;QACb,mBAAmB;QACnB,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC;QAC/C,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC;QACjD,YAAY;QACZ,oBAAoB,EAAE,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC3D,oBAAoB,EAAE,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC;KAC5D,CAAC,CAAA;IACF,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IACtE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAM3C;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,KAAK,EACL,UAAU,EACV,aAAa,EACb,oBAAoB,EACpB,WAAW,EAOZ;IACC,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;IAC/B,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,6BAA6B;IAC7B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;IACxE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC3D,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,wBAAwB,CACvC,CAAA;IACD,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAEnE,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,KAAK,KAAK,UAAU,CAAA;IACrC,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAC1E,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CACvC,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,sEAAsE;YACtE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,QAAQ;oBACR,aAAa;oBACb,aAAa;oBACb,YAAY;iBACb,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1E,mDAAmD;QACnD,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,kBAA0B,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3E,MAAM,YAAY,GAAyB,4BAA4B,CAAC;QACtE,UAAU,EAAE,GAAG;QACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;QACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;KACjE,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAC9D;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,aAAa,GAAG,CACpB,QAAqD,EACrD,EAAU,EACV,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,IAAI,EAAE,oBAAoB,CAAC,UAAU;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,YAAY,CAAC;gBAChE,aAAa,CAAC,kBAAkB;aACjC,CAAC;SACH;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC;QACxE,mBAAmB;QACnB,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;QAC9D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC;QAChE,YAAY,EAAE,aAAa,CACzB,GAAG,CAAC,YAAY,EAChB,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAC7C;QACD,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC1E,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;KAC3E,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;AACrD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/wallet-core",
   "description": "Shared wallet-domain logic (WAS sync engine core and wallet Space layout contracts) for Interop wallet apps.",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",