@interop/wallet-core 0.48.0 → 0.50.0

package/dist/clientAnnex/gc.js

@@ -0,0 +1,445 @@
+import { clientAnnexDidParts, clientAnnexLogPinId, clientAnnexLogStore, delegatedClientsPointer, embeddedGenerationDelegation, ensureGenerationDelegationCurrent, GENERATION_ID_PREFIX, mintCredentialClientAnnexGeneration, mintGenerationDelegation, revokeTreatingAlreadyRevokedAsSuccess, setDelegatedClientsPointer } from './log.js';
+import { readPublishedLog } from '../webvh/didWebvh.js';
+import { accountLogPinId } from '../webvh/verifyLog.js';
+/**
+ * The fixed GC cadence: a generation is replaced at the first durable login
+ * 90 days after the current pointer value was established. Wallet GC policy
+ * over the account log's own timestamps, never a stored or wire value.
+ */
+export const GENERATION_GC_PERIOD_MS = 90 * 24 * 60 * 60 * 1000;
+/**
+ * The quiet bound: a generation is GC-quiet when its newest entry's
+ * `versionTime` is over 24 hours old. The bound defers the swap only; it
+ * never expires a session. A visit outliving it merely loses guaranteed
+ * guard protection, and in the rare case a quarterly pass lands on one, the
+ * session's next authorization failure maps to the generation-lapse retry
+ * state.
+ */
+export const GENERATION_QUIET_BOUND_MS = 24 * 60 * 60 * 1000;
+/**
+ * The skew-margin grace floor on the quiet bound: three clocks meet at the
+ * guard check (the enrolling writer's, any prior entry writer's, and the
+ * GC-running client's), and `versionTime` is asserted by the writer's clock,
+ * so the guard compares against the bound plus this margin. An hour is
+ * generous against real-world skew and defers the swap by at most an hour
+ * against a quarterly cadence.
+ */
+export const GENERATION_QUIET_GRACE_MS = 60 * 60 * 1000;
+/**
+ * The `versionTime` of the account-log entry that established the CURRENT
+ * `#DelegatedClients` pointer value: the newest entry whose state names a
+ * different annex DID than the entry before it (or the first entry, when
+ * the pointer has been there since genesis). This is the cadence's clock --
+ * "the pointer-update entry is the record" -- and it is read off the log a
+ * durable login has already verified, so the cadence costs no extra fetch
+ * and every enrolled client agrees on it.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the VERIFIED account log
+ * @returns {string | undefined}   the establishing entry's `versionTime`,
+ *   or undefined when no entry carries a pointer
+ */
+export function delegatedClientsPointerEstablishedAt({ log }) {
+    let establishedAt;
+    let previous;
+    for (const entry of log) {
+        const pointed = delegatedClientsPointer({ doc: entry.state });
+        if (pointed !== undefined && pointed !== previous) {
+            establishedAt = entry.versionTime;
+        }
+        if (pointed === undefined) {
+            // A document with no pointer has no annex posture; a later entry
+            // restoring one establishes afresh.
+            establishedAt = undefined;
+        }
+        previous = pointed;
+    }
+    return establishedAt;
+}
+/**
+ * Whether the quarterly swap is due: the current pointer value was
+ * established {@link GENERATION_GC_PERIOD_MS} or more ago. A log with no
+ * pointer is never due (there is no generation to replace).
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the VERIFIED account log
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {boolean}
+ */
+export function clientAnnexGcDue({ log, now = Date.now() }) {
+    const establishedAt = delegatedClientsPointerEstablishedAt({ log });
+    if (establishedAt === undefined) {
+        return false;
+    }
+    const establishedMs = Date.parse(establishedAt);
+    return (Number.isFinite(establishedMs) &&
+        now - establishedMs >= GENERATION_GC_PERIOD_MS);
+}
+/**
+ * The live-entry guard: whether a generation is GC-quiet -- its newest
+ * entry's `versionTime` is older than the quiet bound plus the skew grace
+ * margin. Applies to the POINTED generation only (an unpointed generation
+ * authorizes nothing under pointer equality, so nothing inside it ever
+ * defers deletion). An unparseable `versionTime` reads as not quiet: the
+ * swap defers rather than abandoning a possibly-live visit.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the pointed generation's VERIFIED annex
+ *   log
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {boolean}
+ */
+export function generationQuiet({ log, now = Date.now() }) {
+    const newest = log[log.length - 1]?.versionTime;
+    if (newest === undefined) {
+        return false;
+    }
+    const newestMs = Date.parse(newest);
+    return (Number.isFinite(newestMs) &&
+        now - newestMs >= GENERATION_QUIET_BOUND_MS + GENERATION_QUIET_GRACE_MS);
+}
+/**
+ * One annex GC pass: the quarterly swap when due and quiet, then the
+ * predicate-driven collect fan-out over every non-pointed `gen-` collection.
+ * See the module header for the stage order and its load-bearing constraints.
+ *
+ * Convergence: every stage detects completion from durable state. A re-run
+ * after a tear re-POSTs the revocation blind (400 already-revoked reads as
+ * success), re-writes the digest (the deterministic payload id collapses the
+ * second row at read time), and re-runs the idempotent delete; a swap torn
+ * before its re-point leaves an unpointed fresh generation the same fan-out
+ * collects.
+ *
+ * @param options {object}
+ * @param options.was {WasClient}   the storage client, signing as an
+ *   enrolled client (root tier on both the account and auxiliary Spaces)
+ * @param options.wasServerUrl {string}   the account pointer's host
+ * @param options.accountSpaceId {string}   the ACCOUNT Space's id (the
+ *   generation delegation's target subtree)
+ * @param options.account {object}   the VERIFIED account log
+ *   (`{ did, doc, log }` -- `verifyAccountLog`'s shape)
+ * @param options.idStore {WebvhIdStore}   the account log's id store, for
+ *   the re-point
+ * @param options.updateKeys {ClientWebvhUpdateKeys}   this enrolled client's
+ *   update keys, signing the re-point entry
+ * @param options.zcapClient {ZcapClient}   signs the fresh generation
+ *   delegation (the promoted account keyId)
+ * @param [options.ladderSeed] {Uint8Array}   the login credential's ladder
+ *   seed; absent, a due swap reports `no-ladder-seed` and only the collect
+ *   fan-out runs
+ * @param options.recordDigest {Function}
+ *   `({ generationId, firstEntry, lastEntry, entryCount }) => Promise<void>`
+ *   -- writes the GenerationCollect wallet-activity row; called before the
+ *   delete, and a throw keeps the generation for the next pass
+ * @param [options.onCollected] {Function}
+ *   `({ generationId }) => Promise<void>` -- local cleanup after a
+ *   generation's delete (the caller's annex pin-slot drop); a throw is
+ *   reported but cannot be retried (the collection is already gone)
+ * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins for the
+ *   account-log re-point and the pointed generation's read
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {Promise<ClientAnnexGcReport>}
+ */
+export async function runClientAnnexGc({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, recordDigest, onCollected, pinStore, now = Date.now() }) {
+    const pointedDid = delegatedClientsPointer({ doc: account.doc });
+    if (pointedDid === undefined) {
+        return { swap: 'no-pointer', collected: [], failed: [] };
+    }
+    const { spaceId } = clientAnnexDidParts({ did: pointedDid });
+    const failed = [];
+    // 1. The swap, when the quarterly cadence is due. Its own failure is
+    // collected under the pointed generation's id rather than aborting the
+    // pass: the collect fan-out below still cleans what it can, and the next
+    // durable login re-attempts the swap from durable state.
+    let swap = 'not-due';
+    let currentDid = pointedDid;
+    if (clientAnnexGcDue({ log: account.log, now })) {
+        swap =
+            ladderSeed === undefined
+                ? 'no-ladder-seed'
+                : await (async () => {
+                    const oldParts = clientAnnexDidParts({ did: pointedDid });
+                    try {
+                        const old = await readClientAnnexGeneration({
+                            was,
+                            spaceId,
+                            generationId: oldParts.generationId,
+                            expectedDid: pointedDid,
+                            pinStore
+                        });
+                        if (old === undefined ||
+                            !generationQuiet({ log: old.log, now })) {
+                            // A missing pointed log is a broken state the collect
+                            // fan-out cannot touch (the pointer still names it); defer
+                            // rather than swap onto a generation this pass could not
+                            // read as quiet.
+                            return old === undefined ? 'failed' : 'deferred-live';
+                        }
+                        currentDid = await replaceClientAnnexGeneration({
+                            was,
+                            wasServerUrl,
+                            accountSpaceId,
+                            account,
+                            idStore,
+                            updateKeys,
+                            zcapClient,
+                            ladderSeed,
+                            clientAnnexSpaceId: spaceId,
+                            oldGeneration: old,
+                            pinStore
+                        });
+                        return 'replaced';
+                    }
+                    catch (err) {
+                        failed.push({ generationId: oldParts.generationId, error: err });
+                        return 'failed';
+                    }
+                })();
+    }
+    // 2. The collect fan-out: every `gen-` collection the (possibly fresh)
+    // pointer does not name. Orphan discovery is a plain prefix match over the
+    // auxiliary Space's collection listing -- no registry of generations
+    // exists anywhere -- and a torn GC's old generation, a torn signup's
+    // orphan, and a double-genesis loser get identical treatment.
+    const currentGenerationId = clientAnnexDidParts({
+        did: currentDid
+    }).generationId;
+    const space = was.space(spaceId);
+    const stale = [];
+    for await (const page of space.collectionsPages()) {
+        for (const item of page.items) {
+            if (item.id.startsWith(GENERATION_ID_PREFIX) &&
+                item.id !== currentGenerationId) {
+                stale.push(item.id);
+            }
+        }
+    }
+    const collected = [];
+    await Promise.all(stale.map(async (generationId) => {
+        try {
+            await collectOneGeneration({
+                was,
+                spaceId,
+                generationId,
+                recordDigest,
+                onCollected
+            });
+            collected.push(generationId);
+        }
+        catch (err) {
+            failed.push({ generationId, error: err });
+        }
+    }));
+    return { swap, pointedDid: currentDid, collected, failed };
+}
+/**
+ * Reads and verifies one generation's published annex log, or resolves
+ * undefined when its `did.jsonl` does not exist (a generation that never
+ * finished minting, or whose collection outlived a torn delete).
+ *
+ * @param options {object}
+ * @param options.was {WasClient}
+ * @param options.spaceId {string}   the auxiliary annex Space's id
+ * @param options.generationId {string}
+ * @param [options.expectedDid] {string}
+ * @param [options.pinStore] {ResourceLogPinStore}
+ * @returns {Promise<PublishedWebvhLog | undefined>}
+ */
+async function readClientAnnexGeneration({ was, spaceId, generationId, expectedDid, pinStore }) {
+    const store = clientAnnexLogStore({ was, spaceId, generationId });
+    return readPublishedLog({
+        idStore: store,
+        ...(expectedDid !== undefined ? { expectedDid } : {}),
+        ...(pinStore !== undefined
+            ? { pinStore, logId: clientAnnexLogPinId({ spaceId, generationId }) }
+            : {})
+    });
+}
+/**
+ * The swap's four stages, in the fixed order: mint + genesis; install the
+ * fresh generation's delegation service entry; revoke the old generation's
+ * delegation; re-point the account document. Returns the fresh annex
+ * DID. The digest and the delete are deliberately NOT here -- once the
+ * re-point lands, the old generation is an ordinary non-pointed `gen-`
+ * collection and the standing collect fan-out handles it, which is also
+ * what makes a swap torn after its re-point resume for free.
+ *
+ * @param options {object}   see {@link runClientAnnexGc}, plus:
+ * @param options.clientAnnexSpaceId {string}   the auxiliary Space's id
+ * @param [options.oldGeneration] {PublishedWebvhLog}   the pointed
+ *   generation's verified log, read by the quiet check; absent (an
+ *   off-cadence swap whose pointed log is unreadable), the revoke stage is
+ *   skipped and the old generation's delegation dies with the re-point on a
+ *   conforming server
+ * @returns {Promise<string>}   the fresh annex DID
+ */
+async function replaceClientAnnexGeneration({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, clientAnnexSpaceId, oldGeneration, pinStore }) {
+    // 1. Mint + genesis: a fresh generation in the existing auxiliary Space
+    // (the typed-Space ensure no-ops on it; the controller argument is only
+    // read when the Space does not exist). The genesis commits the minting
+    // credential's rung-0 hash for the fresh generation id.
+    const minted = await mintCredentialClientAnnexGeneration({
+        was,
+        wasServerUrl,
+        spaceId: clientAnnexSpaceId,
+        controller: account.did,
+        ladderSeed
+    });
+    // 2. Install the fresh generation's delegation service entry (the
+    // install-when-absent half of the renew-precedes-mint helper), the
+    // delegation signed by this enrolled client's promoted account key and the
+    // installing annex entry by the credential's rung 0.
+    await ensureGenerationDelegationCurrent({
+        store: clientAnnexLogStore({
+            was,
+            spaceId: clientAnnexSpaceId,
+            generationId: minted.generationId
+        }),
+        ladderSeed,
+        generationId: minted.generationId,
+        mintGenerationDelegation: async ({ clientAnnexDid }) => mintGenerationDelegation({
+            zcapClient,
+            wasServerUrl,
+            spaceId: accountSpaceId,
+            clientAnnexDid
+        }),
+        expectedDid: minted.did,
+        ...(pinStore !== undefined
+            ? {
+                pinStore,
+                logId: clientAnnexLogPinId({
+                    spaceId: clientAnnexSpaceId,
+                    generationId: minted.generationId
+                })
+            }
+            : {})
+    });
+    // 3. Revoke the old generation's delegation, before the re-point (the
+    // revocation POST verifies against the currently resolved document, so it
+    // only chains while the pointer still names the old generation) and
+    // before the delete (the POST needs bytes the delete destroys).
+    const oldDelegation = oldGeneration === undefined
+        ? undefined
+        : embeddedGenerationDelegation({ doc: oldGeneration.doc });
+    if (oldDelegation !== undefined) {
+        await revokeTreatingAlreadyRevokedAsSuccess({
+            revoke: zcap => was.revoke(zcap),
+            delegation: oldDelegation
+        });
+    }
+    // 4. Re-point the account document at the fresh generation. On a
+    // conforming server the pointer equality itself kills the old
+    // generation's delegations; the explicit revoke above covered the
+    // fail-open case.
+    await setDelegatedClientsPointer({
+        idStore,
+        updateKeys,
+        clientAnnexDid: minted.did,
+        expectedDid: account.did,
+        ...(pinStore !== undefined
+            ? { pinStore, logId: accountLogPinId({ spaceId: accountSpaceId }) }
+            : {})
+    });
+    return minted.did;
+}
+/**
+ * AN OFF-CADENCE GENERATION SWAP: replaces the pointed annex generation
+ * outside the quarterly rhythm -- the credential-rotation ceremony's
+ * fallback when no distinct committed rung can sign a strike entry
+ * (`retireClientAnnexRung`): a fresh generation minted from a SURVIVING
+ * credential's seed commits only that credential's rung-0 hash, so the
+ * retired credential's annex posture dies with the whole generation the
+ * moment the re-point lands. The abandoned generation is an ordinary
+ * non-pointed `gen-` collection the standing collect fan-out picks up at the
+ * next durable login.
+ *
+ * Same four swap stages and ordering as the quarterly GC swap, minus the
+ * cadence and quiet gates (the caller's reason for swapping is authority
+ * removal, not hygiene). The pointed generation's log is read for the revoke
+ * stage's delegation bytes; unreadable, the revoke is skipped and pointer
+ * equality retires the old delegation on a conforming server.
+ *
+ * @param options {object}   see {@link runClientAnnexGc} for the shared
+ *   members ({ was, wasServerUrl, accountSpaceId, account, idStore,
+ *   updateKeys, zcapClient, pinStore }); `ladderSeed` here is the SURVIVING
+ *   credential's seed the fresh generation is minted from
+ * @returns {Promise<string>}   the fresh annex DID
+ */
+export async function swapClientAnnexGeneration({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, pinStore }) {
+    const pointedDid = delegatedClientsPointer({ doc: account.doc });
+    if (pointedDid === undefined) {
+        throw new Error('clientAnnex: the account document carries no delegated-clients ' +
+            'service entry; no generation exists to swap.');
+    }
+    const { spaceId } = clientAnnexDidParts({ did: pointedDid });
+    const oldGeneration = await readClientAnnexGeneration({
+        was,
+        spaceId,
+        generationId: clientAnnexDidParts({ did: pointedDid }).generationId,
+        expectedDid: pointedDid,
+        ...(pinStore !== undefined ? { pinStore } : {})
+    });
+    return replaceClientAnnexGeneration({
+        was,
+        wasServerUrl,
+        accountSpaceId,
+        account,
+        idStore,
+        updateKeys,
+        zcapClient,
+        ladderSeed,
+        clientAnnexSpaceId: spaceId,
+        ...(oldGeneration !== undefined ? { oldGeneration } : {}),
+        ...(pinStore !== undefined ? { pinStore } : {})
+    });
+}
+/**
+ * Collects one non-pointed generation: revoke its embedded delegation
+ * (blind; the server's 400 already-revoked answer reads as success), write
+ * the digest from its verified log, delete the collection, then the
+ * caller's local cleanup. A generation whose `did.jsonl` does not exist
+ * held no visits and is deleted without a digest row; one whose log exists
+ * but fails verification is kept and reported (deleting it would destroy
+ * the evidence of tampering).
+ *
+ * @param options {object}
+ * @param options.was {WasClient}
+ * @param options.spaceId {string}
+ * @param options.generationId {string}
+ * @param options.recordDigest {Function}   see {@link runClientAnnexGc}
+ * @param [options.onCollected] {Function}   see {@link runClientAnnexGc}
+ * @returns {Promise<void>}
+ */
+async function collectOneGeneration({ was, spaceId, generationId, recordDigest, onCollected }) {
+    // No pin, no expectedDid: an orphan was possibly never pointed from this
+    // client, and its chain-head slot is about to be dropped either way. The
+    // log still fully verifies (hash chain, prerotation, rung signatures) --
+    // the digest quotes only a log that resolves.
+    const published = await readClientAnnexGeneration({
+        was,
+        spaceId,
+        generationId
+    });
+    if (published !== undefined) {
+        const oldDelegation = embeddedGenerationDelegation({ doc: published.doc });
+        if (oldDelegation !== undefined) {
+            await revokeTreatingAlreadyRevokedAsSuccess({
+                revoke: zcap => was.revoke(zcap),
+                delegation: oldDelegation
+            });
+        }
+        // The digest, strictly before the delete: the delete destroys the
+        // owner's only per-entry record of the window's visits, so a digest
+        // that cannot be written keeps the generation for the next pass.
+        await recordDigest({
+            generationId,
+            firstEntry: published.log[0]?.versionTime,
+            lastEntry: published.log[published.log.length - 1]?.versionTime,
+            entryCount: published.log.length
+        });
+    }
+    // Idempotent: a re-run's delete of an already-deleted collection resolves.
+    await was.space(spaceId).collection(generationId).delete();
+    await onCollected?.({ generationId });
+}
+//# sourceMappingURL=gc.js.map

package/dist/clientAnnex/gc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc.js","sourceRoot":"","sources":["../../src/clientAnnex/gc.ts"],"names":[],"mappings":"AAwDA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EACpB,mCAAmC,EACnC,wBAAwB,EACxB,qCAAqC,EACrC,0BAA0B,EAC3B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAMvD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oCAAoC,CAAC,EACnD,GAAG,EAGJ;IACC,IAAI,aAAiC,CAAA;IACrC,IAAI,QAA4B,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAC7D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YAClD,aAAa,GAAG,KAAK,CAAC,WAAW,CAAA;QACnC,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,iEAAiE;YACjE,oCAAoC;YACpC,aAAa,GAAG,SAAS,CAAA;QAC3B,CAAC;QACD,QAAQ,GAAG,OAAO,CAAA;IACpB,CAAC;IACD,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,GAAG,EACH,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAIjB;IACC,MAAM,aAAa,GAAG,oCAAoC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACnE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC/C,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC9B,GAAG,GAAG,aAAa,IAAI,uBAAuB,CAC/C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,GAAG,EACH,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAIjB;IACC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW,CAAA;IAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,GAAG,QAAQ,IAAI,yBAAyB,GAAG,yBAAyB,CACxE,CAAA;AACH,CAAC;AAkCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAmBjB;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAChE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAkC,EAAE,CAAA;IAEhD,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,yDAAyD;IACzD,IAAI,IAAI,GAA6B,SAAS,CAAA;IAC9C,IAAI,UAAU,GAAG,UAAU,CAAA;IAC3B,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAChD,IAAI;YACF,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAuC,EAAE;oBACnD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;oBACzD,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC;4BAC1C,GAAG;4BACH,OAAO;4BACP,YAAY,EAAE,QAAQ,CAAC,YAAY;4BACnC,WAAW,EAAE,UAAU;4BACvB,QAAQ;yBACT,CAAC,CAAA;wBACF,IACE,GAAG,KAAK,SAAS;4BACjB,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EACvC,CAAC;4BACD,sDAAsD;4BACtD,2DAA2D;4BAC3D,yDAAyD;4BACzD,iBAAiB;4BACjB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAA;wBACvD,CAAC;wBACD,UAAU,GAAG,MAAM,4BAA4B,CAAC;4BAC9C,GAAG;4BACH,YAAY;4BACZ,cAAc;4BACd,OAAO;4BACP,OAAO;4BACP,UAAU;4BACV,UAAU;4BACV,UAAU;4BACV,kBAAkB,EAAE,OAAO;4BAC3B,aAAa,EAAE,GAAG;4BAClB,QAAQ;yBACT,CAAC,CAAA;wBACF,OAAO,UAAU,CAAA;oBACnB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;wBAChE,OAAO,QAAQ,CAAA;oBACjB,CAAC;gBACH,CAAC,CAAC,EAAE,CAAA;IACZ,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,qEAAqE;IACrE,qEAAqE;IACrE,8DAA8D;IAC9D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;QAC9C,GAAG,EAAE,UAAU;KAChB,CAAC,CAAC,YAAY,CAAA;IACf,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IACE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC;gBACxC,IAAI,CAAC,EAAE,KAAK,mBAAmB,EAC/B,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,oBAAoB,CAAC;gBACzB,GAAG;gBACH,OAAO;gBACP,YAAY;gBACZ,YAAY;gBACZ,WAAW;aACZ,CAAC,CAAA;YACF,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,WAAW,EACX,QAAQ,EAOT;IACC,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;IACjE,OAAO,gBAAgB,CAAC;QACtB,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,4BAA4B,CAAC,EAC1C,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EAaT;IACC,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;QACvD,GAAG;QACH,YAAY;QACZ,OAAO,EAAE,kBAAkB;QAC3B,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,UAAU;KACX,CAAC,CAAA;IAEF,kEAAkE;IAClE,mEAAmE;IACnE,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,iCAAiC,CAAC;QACtC,KAAK,EAAE,mBAAmB,CAAC;YACzB,GAAG;YACH,OAAO,EAAE,kBAAkB;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,UAAU;QACV,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,wBAAwB,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CACrD,wBAAwB,CAAC;YACvB,UAAU;YACV,YAAY;YACZ,OAAO,EAAE,cAAc;YACvB,cAAc;SACf,CAAC;QACJ,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC;gBACE,QAAQ;gBACR,KAAK,EAAE,mBAAmB,CAAC;oBACzB,OAAO,EAAE,kBAAkB;oBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,sEAAsE;IACtE,0EAA0E;IAC1E,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,aAAa,GACjB,aAAa,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,4BAA4B,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,qCAAqC,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAChC,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;IACJ,CAAC;IAED,iEAAiE;IACjE,8DAA8D;IAC9D,kEAAkE;IAClE,kBAAkB;IAClB,MAAM,0BAA0B,CAAC;QAC/B,OAAO;QACP,UAAU;QACV,cAAc,EAAE,MAAM,CAAC,GAAG;QAC1B,WAAW,EAAE,OAAO,CAAC,GAAG;QACxB,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,GAAG,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EAWT;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAChE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;IAC5D,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC;QACpD,GAAG;QACH,OAAO;QACP,YAAY,EAAE,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY;QACnE,WAAW,EAAE,UAAU;QACvB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAA;IACF,OAAO,4BAA4B,CAAC;QAClC,GAAG;QACH,YAAY;QACZ,cAAc;QACd,OAAO;QACP,OAAO;QACP,UAAU;QACV,UAAU;QACV,UAAU;QACV,kBAAkB,EAAE,OAAO;QAC3B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,oBAAoB,CAAC,EAClC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,WAAW,EAYZ;IACC,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC;QAChD,GAAG;QACH,OAAO;QACP,YAAY;KACb,CAAC,CAAA;IAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,4BAA4B,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QAC1E,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,qCAAqC,CAAC;gBAC1C,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAChC,UAAU,EAAE,aAAa;aAC1B,CAAC,CAAA;QACJ,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,YAAY,CAAC;YACjB,YAAY;YACZ,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW;YACzC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW;YAC/D,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM;SACjC,CAAC,CAAA;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAA;IAC1D,MAAM,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;AACvC,CAAC"}

package/dist/clientAnnex/index.d.ts

@@ -0,0 +1,60 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/clientAnnex` subpath: the client annex -- the
+ * authoring and maintenance surface of everything anchored on a standing
+ * credential's ladder rather than on an enrolled durable client. One boundary
+ * rule holds throughout: this subpath imports from the base subpaths;
+ * nothing in the base imports from it (enforced in the lint pass, with one
+ * pinned exception -- `unlock/standingWebvh.ts` uses the shared ladder
+ * attribution helpers here, never the annex log machinery). The verify-side
+ * halves every wallet needs regardless of posture stay in the base: the
+ * resource-log ladder-append license and `ControllerPosture` ladder-key
+ * computation (`resourceLog`), `ladderVmIds` recognition (`webvh`), the
+ * unlock-record codec with its `ladder` and `delegatedClients` members
+ * (`unlock`), the standing-zcap staleness policy and the generalized log
+ * store seams (`webvh`), and the `GenerationCollect` activity builder
+ * (`space`).
+ *
+ * - The ladder (`ladder.ts`): rung and ladder-VM derivation from the record's
+ *   random seed, and the shared attribution walks (`attributeLadderRung`,
+ *   `attributeLadderPosture`) that recover the ladder's state from the
+ *   published log itself.
+ * - The annex log (`log.ts`) and its GC (`gc.ts`): the disposable sidecar
+ *   did:webvh of GC'd generations holding transient per-visit verification
+ *   methods, the generation delegation, the account document's
+ *   `#DelegatedClients` pointer, and the quarterly swap-and-collect.
+ * - ZCap signing as the ladder VM (`zcap.ts`): `ladderVmZcapClient` and the
+ *   bootstrap `ladderVmAgent`.
+ * - The ladder-anchored account-log ceremonies (`ladderAnchored.ts`):
+ *   ladder-anchored genesis, the self-enrolling continuation, the one-entry
+ *   forget -- plus the composed flows around them (`selfEnroll.ts`,
+ *   `forget.ts`), the credential-anchored account genesis
+ *   (`credentialAnchoredGenesis.ts`), and the transient-recovery
+ *   continuation (`recoveryLadderAnchored.ts`).
+ *
+ * The subsystem's decision records are the subpath's reading list:
+ * `decisions/0002` (annex log update authority is static rung 0),
+ * `decisions/0003` (generation identity and the ladder HKDF label family),
+ * `decisions/0005` (the `delegatedClients` sealed record member),
+ * `decisions/0006` (generation GC observables and the `GenerationCollect`
+ * digest), and `decisions/0007` (the reveal entry's hash order).
+ */
+export { attributeLadderPosture, attributeLadderRung, clientAnnexRung, clientAnnexRungSeed, generateLadderSeed, LADDER_MAX_SCAN, LadderAttributionError, ladderRung, ladderRungSeed, ladderVmKeyMultibase, ladderVmSeed } from './ladder.js';
+export type { LadderRung, LadderRungState, LadderStandingPosture } from './ladder.js';
+export { assertGenerationId, clampGrantExpires, CLIENT_ANNEX_SPACE_TYPE, clientAnnexDidParts, clientAnnexLogPinId, clientAnnexLogStore, ClientAnnexRungUncommittedError, commitClientAnnexRung, createClientAnnexLog, DELEGATED_CLIENTS_DELEGATION_ACTIONS, DELEGATED_CLIENTS_DELEGATION_TTL_MS, DELEGATED_CLIENTS_SERVICE_TYPE, delegatedClientsDelegationMinter, delegatedClientsDelegationSpaceId, delegatedClientsPointer, delegatedClientsServiceEntry, embeddedGenerationDelegation, enrollClientAnnexTransientClient, enrollTransientClient, ensureClientAnnexSpace, ensureGenerationDelegationCurrent, GENERATION_DELEGATION_ACTIONS, GENERATION_DELEGATION_SERVICE_TYPE, GENERATION_DELEGATION_TTL_MS, GENERATION_ID_PREFIX, generationDelegationHistory, generationDelegationServiceEntry, mintClientAnnexGeneration, mintCredentialClientAnnexGeneration, mintDelegatedClientsDelegation, mintGenerationDelegation, mintGenerationId, retireClientAnnexRung, revokeTreatingAlreadyRevokedAsSuccess, servicesPointedAtClientAnnex, setDelegatedClientsPointer } from './log.js';
+export type { ClientAnnexWriteStore } from './log.js';
+export { clientAnnexGcDue, delegatedClientsPointerEstablishedAt, GENERATION_GC_PERIOD_MS, GENERATION_QUIET_BOUND_MS, GENERATION_QUIET_GRACE_MS, generationQuiet, runClientAnnexGc, swapClientAnnexGeneration } from './gc.js';
+export type { ClientAnnexGcReport, ClientAnnexGcSwapOutcome } from './gc.js';
+export { ladderVmAgent, ladderVmZcapClient } from './zcap.js';
+export { createLadderAnchoredAccountLog, ensureLadderAnchoredDidWebvh, forgetLastWebvhClient, forgetWebvhClient, installLadderVmWebvh, LastDurableClientForgetError, selfEnrollWebvhClient } from './ladderAnchored.js';
+export { selfEnrollClientCore } from './selfEnroll.js';
+export { forgetDurableClient } from './forget.js';
+export type { DurableClientForgetResult } from './forget.js';
+export { forgetLastDurableClient } from './forgetLast.js';
+export type { GenerationDelegationRetirement, LastDurableClientForgetResult, UnlockMethodsRemintReach } from './forgetLast.js';
+export { ensureCredentialAnchoredAccountGenesis, mintCredentialAnchoredAccountKeySet } from './credentialAnchoredGenesis.js';
+export { recoverWebvhLadderAnchored } from './recoveryLadderAnchored.js';
+export { createLadderAnchoredWebvhLog, ladderVerificationMethod } from '../webvh/didWebvh.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/clientAnnex/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,UAAU,EACV,eAAe,EACf,qBAAqB,EACtB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,EACpB,oCAAoC,EACpC,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,iCAAiC,EACjC,uBAAuB,EACvB,4BAA4B,EAC5B,4BAA4B,EAC5B,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,kCAAkC,EAClC,4BAA4B,EAC5B,oBAAoB,EACpB,2BAA2B,EAC3B,gCAAgC,EAChC,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,qCAAqC,EACrC,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAErD,OAAO,EACL,gBAAgB,EAChB,oCAAoC,EACpC,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,SAAS,CAAA;AAChB,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAE5E,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE7D,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACtB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAEtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAE5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,wBAAwB,EACzB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,sCAAsC,EACtC,mCAAmC,EACpC,MAAM,gCAAgC,CAAA;AAEvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAOxE,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACzB,MAAM,sBAAsB,CAAA"}

package/dist/clientAnnex/index.js

@@ -0,0 +1,60 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/clientAnnex` subpath: the client annex -- the
+ * authoring and maintenance surface of everything anchored on a standing
+ * credential's ladder rather than on an enrolled durable client. One boundary
+ * rule holds throughout: this subpath imports from the base subpaths;
+ * nothing in the base imports from it (enforced in the lint pass, with one
+ * pinned exception -- `unlock/standingWebvh.ts` uses the shared ladder
+ * attribution helpers here, never the annex log machinery). The verify-side
+ * halves every wallet needs regardless of posture stay in the base: the
+ * resource-log ladder-append license and `ControllerPosture` ladder-key
+ * computation (`resourceLog`), `ladderVmIds` recognition (`webvh`), the
+ * unlock-record codec with its `ladder` and `delegatedClients` members
+ * (`unlock`), the standing-zcap staleness policy and the generalized log
+ * store seams (`webvh`), and the `GenerationCollect` activity builder
+ * (`space`).
+ *
+ * - The ladder (`ladder.ts`): rung and ladder-VM derivation from the record's
+ *   random seed, and the shared attribution walks (`attributeLadderRung`,
+ *   `attributeLadderPosture`) that recover the ladder's state from the
+ *   published log itself.
+ * - The annex log (`log.ts`) and its GC (`gc.ts`): the disposable sidecar
+ *   did:webvh of GC'd generations holding transient per-visit verification
+ *   methods, the generation delegation, the account document's
+ *   `#DelegatedClients` pointer, and the quarterly swap-and-collect.
+ * - ZCap signing as the ladder VM (`zcap.ts`): `ladderVmZcapClient` and the
+ *   bootstrap `ladderVmAgent`.
+ * - The ladder-anchored account-log ceremonies (`ladderAnchored.ts`):
+ *   ladder-anchored genesis, the self-enrolling continuation, the one-entry
+ *   forget -- plus the composed flows around them (`selfEnroll.ts`,
+ *   `forget.ts`), the credential-anchored account genesis
+ *   (`credentialAnchoredGenesis.ts`), and the transient-recovery
+ *   continuation (`recoveryLadderAnchored.ts`).
+ *
+ * The subsystem's decision records are the subpath's reading list:
+ * `decisions/0002` (annex log update authority is static rung 0),
+ * `decisions/0003` (generation identity and the ladder HKDF label family),
+ * `decisions/0005` (the `delegatedClients` sealed record member),
+ * `decisions/0006` (generation GC observables and the `GenerationCollect`
+ * digest), and `decisions/0007` (the reveal entry's hash order).
+ */
+export { attributeLadderPosture, attributeLadderRung, clientAnnexRung, clientAnnexRungSeed, generateLadderSeed, LADDER_MAX_SCAN, LadderAttributionError, ladderRung, ladderRungSeed, ladderVmKeyMultibase, ladderVmSeed } from './ladder.js';
+export { assertGenerationId, clampGrantExpires, CLIENT_ANNEX_SPACE_TYPE, clientAnnexDidParts, clientAnnexLogPinId, clientAnnexLogStore, ClientAnnexRungUncommittedError, commitClientAnnexRung, createClientAnnexLog, DELEGATED_CLIENTS_DELEGATION_ACTIONS, DELEGATED_CLIENTS_DELEGATION_TTL_MS, DELEGATED_CLIENTS_SERVICE_TYPE, delegatedClientsDelegationMinter, delegatedClientsDelegationSpaceId, delegatedClientsPointer, delegatedClientsServiceEntry, embeddedGenerationDelegation, enrollClientAnnexTransientClient, enrollTransientClient, ensureClientAnnexSpace, ensureGenerationDelegationCurrent, GENERATION_DELEGATION_ACTIONS, GENERATION_DELEGATION_SERVICE_TYPE, GENERATION_DELEGATION_TTL_MS, GENERATION_ID_PREFIX, generationDelegationHistory, generationDelegationServiceEntry, mintClientAnnexGeneration, mintCredentialClientAnnexGeneration, mintDelegatedClientsDelegation, mintGenerationDelegation, mintGenerationId, retireClientAnnexRung, revokeTreatingAlreadyRevokedAsSuccess, servicesPointedAtClientAnnex, setDelegatedClientsPointer } from './log.js';
+export { clientAnnexGcDue, delegatedClientsPointerEstablishedAt, GENERATION_GC_PERIOD_MS, GENERATION_QUIET_BOUND_MS, GENERATION_QUIET_GRACE_MS, generationQuiet, runClientAnnexGc, swapClientAnnexGeneration } from './gc.js';
+export { ladderVmAgent, ladderVmZcapClient } from './zcap.js';
+export { createLadderAnchoredAccountLog, ensureLadderAnchoredDidWebvh, forgetLastWebvhClient, forgetWebvhClient, installLadderVmWebvh, LastDurableClientForgetError, selfEnrollWebvhClient } from './ladderAnchored.js';
+export { selfEnrollClientCore } from './selfEnroll.js';
+export { forgetDurableClient } from './forget.js';
+export { forgetLastDurableClient } from './forgetLast.js';
+export { ensureCredentialAnchoredAccountGenesis, mintCredentialAnchoredAccountKeySet } from './credentialAnchoredGenesis.js';
+export { recoverWebvhLadderAnchored } from './recoveryLadderAnchored.js';
+// The ladder VM's pure document builder and the ladder-anchored genesis log
+// assembly stay defined in `webvh/didWebvh.ts` (the genesis document
+// builder's two-armed clientKeys XOR ladderVm signature is base API, and the
+// ladder arm calls `ladderVerificationMethod` internally), but this subpath
+// is their public home.
+export { createLadderAnchoredWebvhLog, ladderVerificationMethod } from '../webvh/didWebvh.js';
+//# sourceMappingURL=index.js.map

package/dist/clientAnnex/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/clientAnnex/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,aAAa,CAAA;AAOpB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,EACpB,oCAAoC,EACpC,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,iCAAiC,EACjC,uBAAuB,EACvB,4BAA4B,EAC5B,4BAA4B,EAC5B,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,kCAAkC,EAClC,4BAA4B,EAC5B,oBAAoB,EACpB,2BAA2B,EAC3B,gCAAgC,EAChC,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,qCAAqC,EACrC,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,UAAU,CAAA;AAGjB,OAAO,EACL,gBAAgB,EAChB,oCAAoC,EACpC,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,SAAS,CAAA;AAGhB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE7D,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACtB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAEtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAGjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAOzD,OAAO,EACL,sCAAsC,EACtC,mCAAmC,EACpC,MAAM,gCAAgC,CAAA;AAEvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAExE,4EAA4E;AAC5E,qEAAqE;AACrE,6EAA6E;AAC7E,4EAA4E;AAC5E,wBAAwB;AACxB,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACzB,MAAM,sBAAsB,CAAA"}