@interop/wallet-core 0.44.0 → 0.46.0

package/dist/resourceLog/verify.js

@@ -8,13 +8,17 @@
  * verification through the did:webvh log kernel, the external-authorization
  * rule (anchor resolution against the independently verified controller
  * document, `assertionMethod` membership at the anchored version, anchor
- * monotonicity), terminal-entry recognition, and continuity against the
- * chain-head pin. Any failure rejects the LOG, not just the failing entry,
- * and nothing served -- a stated head, a digest, a count -- is ever accepted
- * in place of recomputation.
+ * monotonicity), the ceremony-tail license on ladder-signed appends,
+ * terminal-entry recognition, and continuity against the chain-head pin. Any
+ * failure rejects the LOG, not just the failing entry, and nothing served --
+ * a stated head, a digest, a count -- is ever accepted in place of
+ * recomputation; a license refusal keeps its own class
+ * (`ResourceLogLicenseError`) so callers can tell an unlicensed append from
+ * a corrupt log.
  */
 import { buildVersionId, canonicalizeStrict, defaultWebvhLogVerifier, deriveHash, parseAndValidateVersionId, SCID_PLACEHOLDER, verifyEntryProofs } from '@interop/did-method-webvh';
-import { ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
+import { ResourceLogContinuityError, ResourceLogIntegrityError, ResourceLogLicenseError } from './errors.js';
+import { assertLadderAppendLicensed } from './license.js';
 import { vmFragmentOf } from './vmFragment.js';
 /**
  * The five members a log entry carries, exactly.
@@ -219,8 +223,9 @@ function parseAnchoredVm(verificationMethod, ordinal) {
  * recomputation, per-entry proofs, the external-authorization rule with
  * anchor monotonicity, termination, and continuity against the chain-head
  * pin. Throws {@link ResourceLogIntegrityError} on fabrication-class
- * failures, {@link ResourceLogContinuityError} on pin conflicts; any failure
- * rejects the whole log.
+ * failures, {@link ResourceLogContinuityError} on pin conflicts, and
+ * `ResourceLogLicenseError` on a ladder-signed append outside the
+ * ceremony-tail license; any failure rejects the whole log.
  *
  * The controller view is the independently verified controller document --
  * never material served beside the log. An unversioned controller (empty
@@ -325,6 +330,22 @@ export async function verifyResourceLog({ entries, controller, expectedMethod, p
                     `document does not list under assertionMethod at the anchored ` +
                     `version.`);
             }
+            // The ceremony-tail license: a ladder-signed proof (the anchored
+            // version's relation-asymmetry ladder VM) is admitted only on the
+            // genesis entry, or anchored at a posture-changing version no prior
+            // entry anchors at or past. The floor at this point is still the
+            // previous entries' effective anchor -- the verified head this append
+            // extended.
+            if (index > 0) {
+                const posture = await controller.postureAt(anchor);
+                if (posture.ladderKeys.has(keyMultibase)) {
+                    await assertLadderAppendLicensed({
+                        controller,
+                        anchorIndex: versioned ? anchorIndex : null,
+                        headAnchorIndex: anchorFloor
+                    });
+                }
+            }
             entryAnchorIndex = Math.max(entryAnchorIndex, anchorIndex);
         };
         try {
@@ -339,7 +360,8 @@ export async function verifyResourceLog({ entries, controller, expectedMethod, p
             });
         }
         catch (err) {
-            if (err instanceof ResourceLogIntegrityError) {
+            if (err instanceof ResourceLogIntegrityError ||
+                err instanceof ResourceLogLicenseError) {
                 throw err;
             }
             throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} failed proof verification.`, { cause: err });

package/dist/resourceLog/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/resourceLog/verify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACV,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAMlC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C;;GAEG;AACH,MAAM,aAAa,GAAG;IACpB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,OAAO;IACP,OAAO;CACR,CAAA;AA2BD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAuB;IAChE,OAAO,CACL,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,KAAK,CAAC,UAAU,KAAK,IAAI;QACzB,SAAS,IAAI,KAAK,CAAC,UAAU,CAC9B,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAAc,EACd,OAAe;IAEf,MAAM,SAAS,GAAG,KAA8C,CAAA;IAChE,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,SAAS,CAAC,WAAW,KAAK,gBAAgB;QAC1C,SAAS,CAAC,YAAY,KAAK,iBAAiB;QAC5C,OAAO,SAAS,CAAC,kBAAkB,KAAK,QAAQ;QAChD,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,EACxC,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,yCAAyC;YACpE,sEAAsE,CACzE,CAAA;IACH,CAAC;IACD,OAAO,SAAkC,CAAA;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,KAAuB,EAAE,KAAa;IAC7D,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAA;IACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClC,IACE,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;QACvC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,EAChD,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,wCAAwC;YACnE,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,0CAA0C,EACvE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IACE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,wCAAwC;YACnE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;IACnC,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,sCAAsC,CACpE,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,UAIf,CAAA;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAC9C,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnD,CAAA;QACD,IACE,CAAC,OAAO;YACR,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAClC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAChC,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI;oBAC3B,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;oBACvC,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;oBAC5C,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;oBAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,iEAAiE;gBAC/D,qEAAqE,CACxE,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,oEAAoE;QACpE,qEAAqE;QACrE,0EAA0E;QAC1E,eAAe;QACf,MAAM,QAAQ,GAAG,UAEhB,CAAA;QACD,IACE,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAC7B,QAAQ,CAAC,OAAO,KAAK,SAAS;YAC9B,QAAQ,CAAC,OAAO,KAAK,IAAI;YACzB,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;YACpC,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ;YAC3C,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;YACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,wCAAwC;gBACnE,kEAAkE;gBAClE,0BAA0B,CAC7B,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,EACtD,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,uCAAuC,CACrE,CAAA;IACH,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,uCAAuC;YAClE,gDAAgD,CACnD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,0BAA0B,CACxD,CAAA;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAA;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,KAAuB,EACvB,oBAA4B;IAE5B,OAAO;QACL,SAAS,EAAE,oBAAoB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,kBAA0B,EAC1B,OAAe;IAEf,MAAM,YAAY,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;IACrD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,0CAA0C;YACrE,iBAAiB,CACpB,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CACrC,CAAC,EACD,kBAAkB,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CACpD,CAAA;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IACtC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;IACnD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,cAAc,EACd,GAAG,EAMJ;IACC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,uEAAuE,CACxE,CAAA;IACH,CAAC;IAED,kEAAkE;IAClE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/B,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,0DAA0D;IAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,UAIrC,CAAA;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAA;IAC1C,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,IAAI,yBAAyB,CACjC,qCAAqC,MAAM,sBAAsB;YAC/D,IAAI,cAAc,IAAI,CACzB,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAChC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,gBAAgB,CAAC,EAC1C,IAAI,CACL,CAAA;IACD,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,yBAAyB,CACjC,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,oBAAoB,GAAG,IAAI,CAAA;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC5E,IAAI,KAAK,CAAC,SAAS,KAAK,cAAc,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,KAAK,GAAG,CAAC,8BAA8B;gBAC3D,cAAc,CACjB,CAAA;QACH,CAAC;QACD,oBAAoB,GAAG,KAAK,CAAC,SAAS,CAAA;IACxC,CAAC;IAED,+DAA+D;IAC/D,sCAAsC;IACtC,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAA;QACzB,IAAI,gBAAgB,GAAG,WAAW,CAAA;QAClC,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8C,CAAA;QACpE,MAAM,SAAS,GAAG,CAChB,kBAA0B,EACU,EAAE;YACtC,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,eAAe,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;gBACrD,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;YACxC,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAA;QACD,MAAM,SAAS,GAAG,KAAK,EAAE,KAExB,EAAiB,EAAE;YAClB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,CAC7C,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAC/B,CAAA;YACD,IAAI,GAAG,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC3B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,+BAA+B;oBAC1D,qCAAqC,CACxC,CAAA;YACH,CAAC;YACD,IAAI,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,qCAAqC;oBAChE,gCAAgC,CACnC,CAAA;YACH,CAAC;YACD,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,uCAAuC;oBAClE,aAAa,CAChB,CAAA;YACH,CAAC;YACD,IAAI,WAAW,GAAG,CAAC,CAAA;YACnB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,iCAAiC;wBAC5D,mBAAmB,CACtB,CAAA;gBACH,CAAC;gBACD,WAAW,GAAG,KAAK,CAAA;gBACnB,IAAI,WAAW,GAAG,WAAW,EAAE,CAAC;oBAC9B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,kCAAkC;wBAC7D,2CAA2C,CAC9C,CAAA;gBACH,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;YAC9D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,qCAAqC;oBAChE,+DAA+D;oBAC/D,UAAU,CACb,CAAA;YACH,CAAC;YACD,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAA;QAC5D,CAAC,CAAA;QACD,IAAI,CAAC;YACH,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,iBAAiB,CACrB,KAAgD,EAChD;gBACE,QAAQ,EAAE,uBAAuB;gBACjC,SAAS;gBACT,SAAS,EAAE,KAAK,EAAC,kBAAkB,EAAC,EAAE,CAAC,CAAC;oBACtC,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC,YAAY;iBAC/D,CAAC;aACH,CACF,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,MAAM,GAAG,CAAA;YACX,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,6BAA6B,EAC1D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,WAAW,GAAG,gBAAgB,CAAA;IAChC,CAAC;IAED,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,QAAQ,GAA4C,IAAI,CAAA;IAC5D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACtD,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CACjC,4DAA4D,CAC7D,CAAA;QACH,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,KAAK,CAAA;QAClD,IACE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,kBAAkB,CAAC,gBAAgB,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,uDAAuD;gBACrD,uDAAuD,CAC1D,CAAA;QACH,CAAC;QACD,QAAQ,GACN,KAAK,CAAC,UACP,CAAC,OAAO,CAAA;IACX,CAAC;IAED,+DAA+D;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IACzC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,OAAO;aACvB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,OAAO;aACvB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,MAAM;QACN,IAAI;QACJ,IAAI;QACJ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;QAC3C,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QAC/C,QAAQ;QACR,WAAW,EAAE,iBAAiB,CAAC,WAAW,IAAI,IAAI;KACnD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,KAAK,EACL,SAAS,EAIV;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAAC;YACnC,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;SAC3B,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3D,IACE,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;QACtC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAC1C,SAAS,CAAC,WAAW,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI;QAC1C,WAAW,KAAK,SAAS;QACzB,SAAS,CAAC,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,SAAS,EACpD,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC;YACnC,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;YAC1B,aAAa,EAAE,SAAS,CAAC,OAAO;SACjC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/resourceLog/verify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACV,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAMlC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C;;GAEG;AACH,MAAM,aAAa,GAAG;IACpB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,OAAO;IACP,OAAO;CACR,CAAA;AA2BD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAuB;IAChE,OAAO,CACL,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,KAAK,CAAC,UAAU,KAAK,IAAI;QACzB,SAAS,IAAI,KAAK,CAAC,UAAU,CAC9B,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAAc,EACd,OAAe;IAEf,MAAM,SAAS,GAAG,KAA8C,CAAA;IAChE,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,SAAS,CAAC,WAAW,KAAK,gBAAgB;QAC1C,SAAS,CAAC,YAAY,KAAK,iBAAiB;QAC5C,OAAO,SAAS,CAAC,kBAAkB,KAAK,QAAQ;QAChD,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,EACxC,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,yCAAyC;YACpE,sEAAsE,CACzE,CAAA;IACH,CAAC;IACD,OAAO,SAAkC,CAAA;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,KAAuB,EAAE,KAAa;IAC7D,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAA;IACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClC,IACE,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;QACvC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,EAChD,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,wCAAwC;YACnE,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,0CAA0C,EACvE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IACE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,wCAAwC;YACnE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;IACnC,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,sCAAsC,CACpE,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,UAIf,CAAA;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAC9C,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnD,CAAA;QACD,IACE,CAAC,OAAO;YACR,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAClC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAChC,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI;oBAC3B,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;oBACvC,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;oBAC5C,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;oBAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,iEAAiE;gBAC/D,qEAAqE,CACxE,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,oEAAoE;QACpE,qEAAqE;QACrE,0EAA0E;QAC1E,eAAe;QACf,MAAM,QAAQ,GAAG,UAEhB,CAAA;QACD,IACE,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAC7B,QAAQ,CAAC,OAAO,KAAK,SAAS;YAC9B,QAAQ,CAAC,OAAO,KAAK,IAAI;YACzB,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;YACpC,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ;YAC3C,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;YACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,wCAAwC;gBACnE,kEAAkE;gBAClE,0BAA0B,CAC7B,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,EACtD,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,uCAAuC,CACrE,CAAA;IACH,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,uCAAuC;YAClE,gDAAgD,CACnD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,0BAA0B,CACxD,CAAA;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAA;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,KAAuB,EACvB,oBAA4B;IAE5B,OAAO;QACL,SAAS,EAAE,oBAAoB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,kBAA0B,EAC1B,OAAe;IAEf,MAAM,YAAY,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;IACrD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,0CAA0C;YACrE,iBAAiB,CACpB,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CACrC,CAAC,EACD,kBAAkB,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CACpD,CAAA;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IACtC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;IACnD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,cAAc,EACd,GAAG,EAMJ;IACC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,uEAAuE,CACxE,CAAA;IACH,CAAC;IAED,kEAAkE;IAClE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/B,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,0DAA0D;IAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,UAIrC,CAAA;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAA;IAC1C,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,IAAI,yBAAyB,CACjC,qCAAqC,MAAM,sBAAsB;YAC/D,IAAI,cAAc,IAAI,CACzB,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAChC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,gBAAgB,CAAC,EAC1C,IAAI,CACL,CAAA;IACD,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,yBAAyB,CACjC,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,oBAAoB,GAAG,IAAI,CAAA;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC5E,IAAI,KAAK,CAAC,SAAS,KAAK,cAAc,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,KAAK,GAAG,CAAC,8BAA8B;gBAC3D,cAAc,CACjB,CAAA;QACH,CAAC;QACD,oBAAoB,GAAG,KAAK,CAAC,SAAS,CAAA;IACxC,CAAC;IAED,+DAA+D;IAC/D,sCAAsC;IACtC,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAA;QACzB,IAAI,gBAAgB,GAAG,WAAW,CAAA;QAClC,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8C,CAAA;QACpE,MAAM,SAAS,GAAG,CAChB,kBAA0B,EACU,EAAE;YACtC,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,GAAG,eAAe,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;gBACrD,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;YACxC,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAA;QACD,MAAM,SAAS,GAAG,KAAK,EAAE,KAExB,EAAiB,EAAE;YAClB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,CAC7C,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAC/B,CAAA;YACD,IAAI,GAAG,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC3B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,+BAA+B;oBAC1D,qCAAqC,CACxC,CAAA;YACH,CAAC;YACD,IAAI,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,qCAAqC;oBAChE,gCAAgC,CACnC,CAAA;YACH,CAAC;YACD,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,uCAAuC;oBAClE,aAAa,CAChB,CAAA;YACH,CAAC;YACD,IAAI,WAAW,GAAG,CAAC,CAAA;YACnB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,iCAAiC;wBAC5D,mBAAmB,CACtB,CAAA;gBACH,CAAC;gBACD,WAAW,GAAG,KAAK,CAAA;gBACnB,IAAI,WAAW,GAAG,WAAW,EAAE,CAAC;oBAC9B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,kCAAkC;wBAC7D,2CAA2C,CAC9C,CAAA;gBACH,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;YAC9D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,qCAAqC;oBAChE,+DAA+D;oBAC/D,UAAU,CACb,CAAA;YACH,CAAC;YACD,iEAAiE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,sEAAsE;YACtE,YAAY;YACZ,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBAClD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;oBACzC,MAAM,0BAA0B,CAAC;wBAC/B,UAAU;wBACV,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;wBAC3C,eAAe,EAAE,WAAW;qBAC7B,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;YACD,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAA;QAC5D,CAAC,CAAA;QACD,IAAI,CAAC;YACH,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,iBAAiB,CACrB,KAAgD,EAChD;gBACE,QAAQ,EAAE,uBAAuB;gBACjC,SAAS;gBACT,SAAS,EAAE,KAAK,EAAC,kBAAkB,EAAC,EAAE,CAAC,CAAC;oBACtC,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC,YAAY;iBAC/D,CAAC;aACH,CACF,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,GAAG,YAAY,yBAAyB;gBACxC,GAAG,YAAY,uBAAuB,EACtC,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,6BAA6B,EAC1D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,WAAW,GAAG,gBAAgB,CAAA;IAChC,CAAC;IAED,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,QAAQ,GAA4C,IAAI,CAAA;IAC5D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACtD,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CACjC,4DAA4D,CAC7D,CAAA;QACH,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,KAAK,CAAA;QAClD,IACE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,kBAAkB,CAAC,gBAAgB,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,uDAAuD;gBACrD,uDAAuD,CAC1D,CAAA;QACH,CAAC;QACD,QAAQ,GACN,KAAK,CAAC,UACP,CAAC,OAAO,CAAA;IACX,CAAC;IAED,+DAA+D;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IACzC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,OAAO;aACvB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,OAAO;aACvB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,MAAM;QACN,IAAI;QACJ,IAAI;QACJ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;QAC3C,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QAC/C,QAAQ;QACR,WAAW,EAAE,iBAAiB,CAAC,WAAW,IAAI,IAAI;KACnD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,KAAK,EACL,SAAS,EAIV;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAAC;YACnC,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;SAC3B,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3D,IACE,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;QACtC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAC1C,SAAS,CAAC,WAAW,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI;QAC1C,WAAW,KAAK,SAAS;QACzB,SAAS,CAAC,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,SAAS,EACpD,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC;YACnC,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;YAC1B,aAAa,EAAE,SAAS,CAAC,OAAO;SACjC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/unlock/index.d.ts

@@ -13,14 +13,26 @@
  * - `generateLadderSeed` / `ladderRung` / `attributeLadderRung` -- the
  *   update-key ladder: latent-and-consumed did:webvh update authority from a
  *   random seed carried in the unlock record, current rung recovered from the
- *   log itself, ambiguity failing closed.
- * - `wrapUnlockRecord` / `unwrapUnlockRecord` / `remintUnlockRecordBridge` --
- *   the unlock record codec: the credential-authenticated shell-and-core
- *   layout (controller, email, pointer under the binding MAC; the bridge
- *   delegation re-mintable; the ladder seed sealed and carried verbatim).
+ *   log itself, ambiguity failing closed. `ladderVmKeyMultibase` derives the
+ *   ladder VM (the stable sibling), the document-visible key a client-less
+ *   account anchors on.
+ * - `createClientlessAccountLog` -- the client-less genesis log: an account
+ *   with zero enrolled durable clients, `updateKeys` = [rung 0], the ladder
+ *   VM under `assertionMethod` and `capabilityDelegation` only, and the
+ *   credential's `keyAgreement` posture folded into genesis. The window it
+ *   opens is closed atomically by the first durable self-enrollment's add
+ *   entry.
+ * - `wrapUnlockRecord` / `unwrapUnlockRecord` / `remintUnlockRecordDelegations`
+ *   -- the unlock record codec: the credential-authenticated shell-and-core
+ *   layout (controller, email, pointer under the binding MAC; the bridge and
+ *   companion-Space `delegatedClients` delegations re-mintable; the ladder
+ *   seed sealed and carried verbatim).
  * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
  *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
  *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
+ * - `retireUnlockCredential` -- the retirement ceremony behind "change my
+ *   passphrase" and "remove this passkey": the posture edit, then the shared
+ *   roster rotation and collection fan-out off the retired credential's wrap.
  * - `selfEnrollWebvhClient` / `selfEnrollClientCore` -- the self-enrolling
  *   continuation (reveal a rung, add an ordinary client, retire the rung) and
  *   the composed completion a fresh browser runs end to end.
@@ -30,11 +42,13 @@
  */
 export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
 export type { StandingUnlockClient, UnlockClientIdentity } from './standingClient.js';
-export { attributeLadderRung, generateLadderSeed, LADDER_MAX_SCAN, LADDER_SEED_BYTES, LadderAttributionError, ladderRung, ladderRungSeed } from './ladder.js';
+export { attributeLadderRung, companionRung, companionRungSeed, generateLadderSeed, LADDER_MAX_SCAN, LADDER_SEED_BYTES, LadderAttributionError, ladderRung, ladderRungSeed, ladderVmKeyMultibase, ladderVmSeed } from './ladder.js';
 export type { LadderRung, LadderRungState } from './ladder.js';
-export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
+export { computeUnlockBinding, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
 export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from './unlockRecord.js';
-export { publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { createClientlessAccountLog, publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export type { StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
+export { retireUnlockCredential } from './retire.js';
+export type { UnlockCredentialRetirementResult } from './retire.js';
 export { selfEnrollClientCore } from './selfEnroll.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/unlock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9D,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAA;AAEnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/unlock/index.js

@@ -13,14 +13,26 @@
  * - `generateLadderSeed` / `ladderRung` / `attributeLadderRung` -- the
  *   update-key ladder: latent-and-consumed did:webvh update authority from a
  *   random seed carried in the unlock record, current rung recovered from the
- *   log itself, ambiguity failing closed.
- * - `wrapUnlockRecord` / `unwrapUnlockRecord` / `remintUnlockRecordBridge` --
- *   the unlock record codec: the credential-authenticated shell-and-core
- *   layout (controller, email, pointer under the binding MAC; the bridge
- *   delegation re-mintable; the ladder seed sealed and carried verbatim).
+ *   log itself, ambiguity failing closed. `ladderVmKeyMultibase` derives the
+ *   ladder VM (the stable sibling), the document-visible key a client-less
+ *   account anchors on.
+ * - `createClientlessAccountLog` -- the client-less genesis log: an account
+ *   with zero enrolled durable clients, `updateKeys` = [rung 0], the ladder
+ *   VM under `assertionMethod` and `capabilityDelegation` only, and the
+ *   credential's `keyAgreement` posture folded into genesis. The window it
+ *   opens is closed atomically by the first durable self-enrollment's add
+ *   entry.
+ * - `wrapUnlockRecord` / `unwrapUnlockRecord` / `remintUnlockRecordDelegations`
+ *   -- the unlock record codec: the credential-authenticated shell-and-core
+ *   layout (controller, email, pointer under the binding MAC; the bridge and
+ *   companion-Space `delegatedClients` delegations re-mintable; the ladder
+ *   seed sealed and carried verbatim).
  * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
  *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
  *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
+ * - `retireUnlockCredential` -- the retirement ceremony behind "change my
+ *   passphrase" and "remove this passkey": the posture edit, then the shared
+ *   roster rotation and collection fan-out off the retired credential's wrap.
  * - `selfEnrollWebvhClient` / `selfEnrollClientCore` -- the self-enrolling
  *   continuation (reveal a rung, add an ordinary client, retire the rung) and
  *   the composed completion a fresh browser runs end to end.
@@ -29,8 +41,9 @@
  * was-client dependency graph (the same isolation pattern as `./keyring`).
  */
 export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
-export { attributeLadderRung, generateLadderSeed, LADDER_MAX_SCAN, LADDER_SEED_BYTES, LadderAttributionError, ladderRung, ladderRungSeed } from './ladder.js';
-export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
-export { publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { attributeLadderRung, companionRung, companionRungSeed, generateLadderSeed, LADDER_MAX_SCAN, LADDER_SEED_BYTES, LadderAttributionError, ladderRung, ladderRungSeed, ladderVmKeyMultibase, ladderVmSeed } from './ladder.js';
+export { computeUnlockBinding, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
+export { createClientlessAccountLog, publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { retireUnlockCredential } from './retire.js';
 export { selfEnrollClientCore } from './selfEnroll.js';
 //# sourceMappingURL=index.js.map

package/dist/unlock/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/unlock/ladder.d.ts

@@ -59,6 +59,82 @@ export declare function ladderRung({ ladderSeed, index }: {
     ladderSeed: Uint8Array;
     index: number;
 }): Promise<LadderRung>;
+/**
+ * Derives the 32-byte Ed25519 seed of the ladder VM -- the STABLE SIBLING: a
+ * dedicated key derived once from the ladder seed, distinct from every rung,
+ * published verbatim in the account document (the seed is random, so the
+ * hash-commitment rule permits it) and stable across rung spends, so a
+ * delegation it signed survives every ladder advance. It carries the
+ * client-less window's document-visible authority (`assertionMethod` and
+ * `capabilityDelegation`), while update authority stays on the rungs -- the
+ * two roles never share a key.
+ *
+ * Because the key is derived, removing its verification method is never the
+ * terminal remedy: a later reinstall republishes the same key under the same
+ * id, and any still-unexpired delegation it signed resumes verifying the
+ * moment the method returns. Revoking the delegations themselves (and,
+ * ultimately, rotating the credential) is what actually ends its authority.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @returns {Uint8Array}
+ */
+export declare function ladderVmSeed({ ladderSeed }: {
+    ladderSeed: Uint8Array;
+}): Uint8Array;
+/**
+ * The ladder VM's public key multibase, as the document publishes it (see
+ * {@link ladderVmSeed} for what the key is).
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @returns {Promise<string>}
+ */
+export declare function ladderVmKeyMultibase({ ladderSeed }: {
+    ladderSeed: Uint8Array;
+}): Promise<string>;
+/**
+ * Derives the 32-byte update-key seed of a companion generation's rung 0 --
+ * the credential's STATIC update key on that generation's companion log. The
+ * sequence is domain-separated per generation by the collection segment
+ * (`<segment>/rung/0` under the one {@link LADDER_SALT}): one shared sequence
+ * would hand the storage host, a legitimate reader of the private companion,
+ * a revealed key matching the ACCOUNT log's standing commitment, and a fresh
+ * per-generation sequence is what makes GC replacement self-healing (no rung
+ * index survives the deleted log, and none is needed).
+ *
+ * The segment is trusted here rather than re-validated -- the companion
+ * ceremonies assert the `gen-<random>` shape (`assertGenerationSegment`)
+ * before any derivation, and the label families stay disjoint for any
+ * segment regardless (an account-rung label carries exactly one slash).
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.segment {string}   the generation collection's name
+ * @returns {Uint8Array}
+ */
+export declare function companionRungSeed({ ladderSeed, segment }: {
+    ladderSeed: Uint8Array;
+    segment: string;
+}): Uint8Array;
+/**
+ * Derives a companion generation's rung 0 in full: seed and public multibase.
+ * Deliberately index-free -- the companion chain has length one, so there is
+ * no rung to advance to and no attribution scan to run (see
+ * {@link companionRungSeed}).
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.segment {string}   the generation collection's name
+ * @returns {Promise<{ seed: Uint8Array, keyMultibase: string }>}
+ */
+export declare function companionRung({ ladderSeed, segment }: {
+    ladderSeed: Uint8Array;
+    segment: string;
+}): Promise<{
+    seed: Uint8Array;
+    keyMultibase: string;
+}>;
 /**
  * Where an attributed rung stands in the published log: `'committed'` (the
  * steady state -- only its hash stands in `nextKeyHashes`) or `'revealed'` (a

package/dist/unlock/ladder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ladder.d.ts","sourceRoot":"","sources":["../../src/unlock/ladder.ts"],"names":[],"mappings":"AAiCA;;;GAGG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAA;AAUnC;;;;;GAKG;AACH,eAAO,MAAM,eAAe,MAAM,CAAA;AAElC;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,UAAU,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,UAAU,CAWb;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,EAC/B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,UAAU,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,SAAS,EACT,OAAyB,EAC1B,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BxD"}
+{"version":3,"file":"ladder.d.ts","sourceRoot":"","sources":["../../src/unlock/ladder.ts"],"names":[],"mappings":"AAiCA;;;GAGG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAA;AA8BnC;;;;;GAKG;AACH,eAAO,MAAM,eAAe,MAAM,CAAA;AAElC;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AA6BD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,UAAU,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,UAAU,CAQb;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,EAC/B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,UAAU,CAEb;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,MAAM,CAAC,CAElB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,UAAU,EACV,OAAO,EACR,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,UAAU,CAKb;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACV,OAAO,EACR,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAGtD;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,UAAU,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,SAAS,EACT,OAAyB,EAC1B,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BxD"}

package/dist/unlock/ladder.js

@@ -42,6 +42,24 @@ export const LADDER_SEED_BYTES = 32;
  */
 const LADDER_SALT = 'freewallet/unlock/update-ladder/v1';
 const LADDER_RUNG_INFO_PREFIX = 'rung/';
+/**
+ * The info label of the ladder VM -- the stable sibling key published in the
+ * account document while the account has no enrolled durable client. One salt
+ * for everything ladder-seed-derived, with the info namespace doing the
+ * separation: `vm` can never collide with a `rung/<n>` label. Permanent.
+ */
+const LADDER_VM_INFO = 'vm';
+/**
+ * The info-label suffix of a companion rung: the label is
+ * `<segment>/rung/<k>` where `<segment>` is the generation collection's name
+ * (`gen-<random>`) and `k` is pinned at 0 -- the companion log's update
+ * authority is each standing credential's STATIC rung 0 (chain length one,
+ * never advanced), so only `/rung/0` is ever derived. The three families
+ * under the one salt stay disjoint: `rung/<n>` labels carry exactly one
+ * slash followed by a decimal index, `vm` carries none, and a companion
+ * label always carries two slashes behind its `gen-` segment. Permanent.
+ */
+const COMPANION_RUNG_INFO_SUFFIX = '/rung/0';
 /**
  * How many rungs {@link attributeLadderRung} derives before concluding the
  * log commits none of them. Generous: one rung is consumed per
@@ -70,6 +88,20 @@ export class LadderAttributionError extends Error {
 export function generateLadderSeed() {
     return crypto.getRandomValues(new Uint8Array(LADDER_SEED_BYTES));
 }
+/**
+ * The one HKDF invocation of the ladder derivation family. Every
+ * ladder-seed-derived key (rungs, the ladder VM) comes through here, so the
+ * permanent wire-level triple -- SHA-256, {@link LADDER_SALT}, 32 bytes --
+ * lives in exactly one place and only the info label varies.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.info {string}
+ * @returns {Uint8Array}
+ */
+function ladderDerive({ ladderSeed, info }) {
+    return hkdf(sha256, ladderSeed, new TextEncoder().encode(LADDER_SALT), new TextEncoder().encode(info), 32);
+}
 /**
  * Derives the 32-byte update-key seed of rung `index`.
  *
@@ -82,7 +114,10 @@ export function ladderRungSeed({ ladderSeed, index }) {
     if (!Number.isInteger(index) || index < 0) {
         throw new Error(`Invalid ladder rung index "${String(index)}".`);
     }
-    return hkdf(sha256, ladderSeed, new TextEncoder().encode(LADDER_SALT), new TextEncoder().encode(`${LADDER_RUNG_INFO_PREFIX}${index}`), 32);
+    return ladderDerive({
+        ladderSeed,
+        info: `${LADDER_RUNG_INFO_PREFIX}${index}`
+    });
 }
 /**
  * Derives rung `index` in full: seed and public multibase.
@@ -96,6 +131,81 @@ export async function ladderRung({ ladderSeed, index }) {
     const seed = ladderRungSeed({ ladderSeed, index });
     return { index, seed, keyMultibase: await updateKeyMultibase({ seed }) };
 }
+/**
+ * Derives the 32-byte Ed25519 seed of the ladder VM -- the STABLE SIBLING: a
+ * dedicated key derived once from the ladder seed, distinct from every rung,
+ * published verbatim in the account document (the seed is random, so the
+ * hash-commitment rule permits it) and stable across rung spends, so a
+ * delegation it signed survives every ladder advance. It carries the
+ * client-less window's document-visible authority (`assertionMethod` and
+ * `capabilityDelegation`), while update authority stays on the rungs -- the
+ * two roles never share a key.
+ *
+ * Because the key is derived, removing its verification method is never the
+ * terminal remedy: a later reinstall republishes the same key under the same
+ * id, and any still-unexpired delegation it signed resumes verifying the
+ * moment the method returns. Revoking the delegations themselves (and,
+ * ultimately, rotating the credential) is what actually ends its authority.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @returns {Uint8Array}
+ */
+export function ladderVmSeed({ ladderSeed }) {
+    return ladderDerive({ ladderSeed, info: LADDER_VM_INFO });
+}
+/**
+ * The ladder VM's public key multibase, as the document publishes it (see
+ * {@link ladderVmSeed} for what the key is).
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @returns {Promise<string>}
+ */
+export async function ladderVmKeyMultibase({ ladderSeed }) {
+    return updateKeyMultibase({ seed: ladderVmSeed({ ladderSeed }) });
+}
+/**
+ * Derives the 32-byte update-key seed of a companion generation's rung 0 --
+ * the credential's STATIC update key on that generation's companion log. The
+ * sequence is domain-separated per generation by the collection segment
+ * (`<segment>/rung/0` under the one {@link LADDER_SALT}): one shared sequence
+ * would hand the storage host, a legitimate reader of the private companion,
+ * a revealed key matching the ACCOUNT log's standing commitment, and a fresh
+ * per-generation sequence is what makes GC replacement self-healing (no rung
+ * index survives the deleted log, and none is needed).
+ *
+ * The segment is trusted here rather than re-validated -- the companion
+ * ceremonies assert the `gen-<random>` shape (`assertGenerationSegment`)
+ * before any derivation, and the label families stay disjoint for any
+ * segment regardless (an account-rung label carries exactly one slash).
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.segment {string}   the generation collection's name
+ * @returns {Uint8Array}
+ */
+export function companionRungSeed({ ladderSeed, segment }) {
+    return ladderDerive({
+        ladderSeed,
+        info: `${segment}${COMPANION_RUNG_INFO_SUFFIX}`
+    });
+}
+/**
+ * Derives a companion generation's rung 0 in full: seed and public multibase.
+ * Deliberately index-free -- the companion chain has length one, so there is
+ * no rung to advance to and no attribution scan to run (see
+ * {@link companionRungSeed}).
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.segment {string}   the generation collection's name
+ * @returns {Promise<{ seed: Uint8Array, keyMultibase: string }>}
+ */
+export async function companionRung({ ladderSeed, segment }) {
+    const seed = companionRungSeed({ ladderSeed, segment });
+    return { seed, keyMultibase: await updateKeyMultibase({ seed }) };
+}
 /**
  * Recovers the ladder's current rung from the published log's standing
  * parameters -- the counter recovery that replaces any stored counter. Scans

package/dist/unlock/ladder.js.map

@@ -1 +1 @@
-{"version":3,"file":"ladder.js","sourceRoot":"","sources":["../../src/unlock/ladder.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAEnC;;;;GAIG;AACH,MAAM,WAAW,GAAG,oCAAoC,CAAA;AACxD,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAA;AAElC;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAClE,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EAIN;IACC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,IAAI,CACT,MAAM,EACN,UAAU,EACV,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACrC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,uBAAuB,GAAG,KAAK,EAAE,CAAC,EAC9D,EAAE,CACH,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAC/B,UAAU,EACV,KAAK,EAIN;IACC,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAC1E,CAAC;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,SAAS,EACT,OAAO,GAAG,eAAe,EAK1B;IACC,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAiB,EAAE,CAAA;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC;aAAM,IACL,SAAS,CAAC,aAAa,CAAC,QAAQ,CAC9B,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAC3C,EACD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,sBAAsB,CAC9B,qEAAqE;YACnE,iEAAiE,CACpE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IAClD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IACpD,CAAC;IACD,MAAM,IAAI,sBAAsB,CAC9B,uEAAuE;QACrE,wEAAwE,CAC3E,CAAA;AACH,CAAC"}
+{"version":3,"file":"ladder.js","sourceRoot":"","sources":["../../src/unlock/ladder.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAEnC;;;;GAIG;AACH,MAAM,WAAW,GAAG,oCAAoC,CAAA;AACxD,MAAM,uBAAuB,GAAG,OAAO,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,cAAc,GAAG,IAAI,CAAA;AAE3B;;;;;;;;;GASG;AACH,MAAM,0BAA0B,GAAG,SAAS,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAA;AAElC;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,EACpB,UAAU,EACV,IAAI,EAIL;IACC,OAAO,IAAI,CACT,MAAM,EACN,UAAU,EACV,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EACrC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAC9B,EAAE,CACH,CAAA;AACH,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EAIN;IACC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,UAAU;QACV,IAAI,EAAE,GAAG,uBAAuB,GAAG,KAAK,EAAE;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAC/B,UAAU,EACV,KAAK,EAIN;IACC,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,UAAU,EAGX;IACC,OAAO,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,UAAU,EAGX;IACC,OAAO,kBAAkB,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,UAAU,EACV,OAAO,EAIR;IACC,OAAO,YAAY,CAAC;QAClB,UAAU;QACV,IAAI,EAAE,GAAG,OAAO,GAAG,0BAA0B,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,UAAU,EACV,OAAO,EAIR;IACC,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IACvD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AACnE,CAAC;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,SAAS,EACT,OAAO,GAAG,eAAe,EAK1B;IACC,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAiB,EAAE,CAAA;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC;aAAM,IACL,SAAS,CAAC,aAAa,CAAC,QAAQ,CAC9B,MAAM,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAC3C,EACD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,sBAAsB,CAC9B,qEAAqE;YACnE,iEAAiE,CACpE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IAClD,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IACpD,CAAC;IACD,MAAM,IAAI,sBAAsB,CAC9B,uEAAuE;QACrE,wEAAwE,CAC3E,CAAA;AACH,CAAC"}

package/dist/unlock/retire.d.ts

@@ -0,0 +1,126 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Retiring a standing unlock credential: the ceremony behind "change my
+ * passphrase" and "remove this passkey", run synchronously in an enrolled
+ * client, in dependency order. A standing credential is not a stored string to
+ * overwrite -- it holds a wrap in the user key roster and a `keyAgreement`
+ * posture in the account's did:webvh document -- so retiring one is a real
+ * rotation, on the same stages the client-revocation cascade runs.
+ *
+ * 1. **The document posture edit** (`removeUnlockKey`): the credential's
+ *    `keyAgreement` entry (verbatim key or commitment) and its committed
+ *    update-key hash leave the document in one log entry. That kills the
+ *    credential's latent self-enrollment authority -- with its rung
+ *    commitment gone, no reveal entry it could sign verifies -- and it is
+ *    what makes stage 2 converge: the roster resolver, backed by this
+ *    document, no longer keys the credential's entry.
+ * 2. **The roster rotation and the collection fan-out**
+ *    (`rotateRosterToDocumentAndCascade`): the user key rotates off the
+ *    credential's wrap and every encrypted collection re-epochs onto the
+ *    fresh key, so writes stop landing under epochs the retired credential
+ *    could open.
+ *
+ * The order is load-bearing, and in that direction: the document removal
+ * first means a run torn anywhere after it leaves the roster keying a
+ * recipient the document no longer backs -- exactly the state the login-time
+ * sweep detects and finishes. Torn the other way around, a rotation with the
+ * posture still standing would simply re-escrow the credential and look
+ * healthy.
+ *
+ * There is deliberately no recovery-delegation re-mint stage here (the
+ * client-revocation cascade's fourth stage). A retired credential signs no
+ * delegations: its own bridge delegation dies with its unlock Space, which
+ * the app deletes as part of the change-method ceremony, and no other
+ * credential's bridge chains through it.
+ *
+ * Convergence is the design: every stage detects its own completion from
+ * durable state alone -- the posture edit no-ops when the document is already
+ * settled, the rotation no-ops once every current-epoch recipient is
+ * document-backed, and a collection is stale exactly when its current epoch
+ * names a non-current user key generation -- so a naive full re-run finishes
+ * a torn ceremony and a healthy account writes nothing.
+ *
+ * The honest limitation is the cascade's: ciphertext the credential's holder
+ * already fetched and decrypted stays readable, and old epochs stay open to
+ * the user key generations the credential already delivered. Retirement stops
+ * future reads.
+ */
+import type { IKeyAgreementKey } from '@interop/data-integrity-core';
+import type { CollectionEncryption } from '@interop/was-client';
+import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import { type CascadeCollections, type RosterSealReport, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
+import type { ClientWebvhUpdateKeys, WebvhIdStore } from '../webvh/index.js';
+import { type StandingUnlockKeys } from './standingWebvh.js';
+/**
+ * What a completed retirement reports: whether the roster actually rotated on
+ * this run (a re-run of an already-complete retirement reports `false`), the
+ * roster's seal-backstop report (present when the roster store is sealable and
+ * the roster stage ran), the per-collection fan-out result, the document as
+ * the posture edit left it, and the rotated key with the roster descriptor it
+ * was read from.
+ */
+export interface UnlockCredentialRetirementResult {
+    rotated: boolean;
+    rosterSeal?: RosterSealReport;
+    collections: UserKeyCascadeResult;
+    document: object;
+    userKey?: UserKey;
+    rosterDescriptor?: CollectionEncryption;
+}
+/**
+ * Retires one standing unlock credential from an account. See the module doc
+ * for the order and the convergence story. Once the posture edit lands, a
+ * thrown later stage leaves durable state a naive re-run -- or the login-time
+ * sweep -- converges from.
+ *
+ * @param options {object}
+ * @param options.idStore {WebvhIdStore}   the account's `id` collection store
+ * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
+ *   client's own did:webvh update-key seeds, which sign the posture edit
+ * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
+ *   public posture (its key-agreement publication and its committed update
+ *   key)
+ * @param [options.expectedDid] {string}   the account DID from the caller's
+ *   stored account pointer; supplied, the posture edit refuses a `did.jsonl`
+ *   resolving to any other account
+ * @param [options.verb] {string}   what the caller is doing, for the
+ *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
+ * @param options.rosterStore {EncryptionDescriptorStore}   the
+ *   `key-map/user-key.jsonl` roster store
+ * @param [options.userKey] {UserKey}   this client's cached user key
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
+ *   (identity) key-agreement key -- its roster entry
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onUserKeyAdopted] {Function}   persists a rotated key:
+ *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
+ *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param [options.onRotationAdopted] {Function}   `({ userKey }) =>
+ *   Promise<void>` -- the live-session adoption of a rotated key, run last so
+ *   the session keeps operating without a re-login
+ * @returns {Promise<UnlockCredentialRetirementResult>}
+ */
+export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, onRotationAdopted }: {
+    idStore: WebvhIdStore;
+    updateKeys: ClientWebvhUpdateKeys;
+    unlockKeys: StandingUnlockKeys;
+    expectedDid?: string;
+    verb?: string;
+    rosterStore: EncryptionDescriptorStore;
+    userKey?: UserKey;
+    clientKeyAgreementKey: IKeyAgreementKey;
+    pinnedEpochId?: string | null;
+    onUserKeyAdopted?: (adopted: {
+        userKey: UserKey;
+        latestEpochId: string;
+        descriptor: CollectionEncryption;
+    }) => Promise<void>;
+    collections: CascadeCollections;
+    onRotationAdopted?: (rotation: {
+        userKey: UserKey;
+    }) => Promise<void>;
+}): Promise<UnlockCredentialRetirementResult>;
+//# sourceMappingURL=retire.d.ts.map

package/dist/unlock/retire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAgD5C"}