@interop/wallet-core 0.49.0 → 0.50.0

package/dist/{webvh/companionGc.d.ts → clientAnnex/gc.d.ts}

@@ -2,7 +2,7 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * Companion GC: the quarterly wholesale replacement of the companion
+ * Client-annex GC: the quarterly wholesale replacement of the annex
  * generation, and the collection of everything it leaves behind.
  *
  * The ceremony has two halves with different rhythms:
@@ -54,7 +54,7 @@ import type { DIDLog } from '@interop/did-method-webvh';
 import type { ZcapClient } from '@interop/ezcap';
 import type { WasClient } from '@interop/was-client';
 import type { ResourceLogPinStore } from '../resourceLog/pin.js';
-import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhIdStore } from './didWebvh.js';
+import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
 /**
  * The fixed GC cadence: a generation is replaced at the first durable login
  * 90 days after the current pointer value was established. Wallet GC policy
@@ -82,7 +82,7 @@ export declare const GENERATION_QUIET_GRACE_MS: number;
 /**
  * The `versionTime` of the account-log entry that established the CURRENT
  * `#DelegatedClients` pointer value: the newest entry whose state names a
- * different companion DID than the entry before it (or the first entry, when
+ * different annex DID than the entry before it (or the first entry, when
  * the pointer has been there since genesis). This is the cadence's clock --
  * "the pointer-update entry is the record" -- and it is read off the log a
  * durable login has already verified, so the cadence costs no extra fetch
@@ -106,7 +106,7 @@ export declare function delegatedClientsPointerEstablishedAt({ log }: {
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {boolean}
  */
-export declare function companionGcDue({ log, now }: {
+export declare function clientAnnexGcDue({ log, now }: {
     log: DIDLog;
     now?: number;
 }): boolean;
@@ -119,7 +119,7 @@ export declare function companionGcDue({ log, now }: {
  * swap defers rather than abandoning a possibly-live visit.
  *
  * @param options {object}
- * @param options.log {DIDLog}   the pointed generation's VERIFIED companion
+ * @param options.log {DIDLog}   the pointed generation's VERIFIED annex
  *   log
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {boolean}
@@ -131,23 +131,23 @@ export declare function generationQuiet({ log, now }: {
 /**
  * What the swap half of one GC pass did. `replaced` is the successful swap;
  * `not-due` and `deferred-live` are the two healthy skips (cadence and quiet
- * bound); `no-pointer` means the account has no companion posture (the whole
+ * bound); `no-pointer` means the account has no annex posture (the whole
  * pass no-ops -- without a pointer there is no auxiliary Space to list);
  * `no-ladder-seed` means the swap was due but the login held no ladder seed
  * to mint with (a non-standing record); `failed` means a swap stage threw --
  * reported in `failed` under the pointed generation's id, with the collect
  * fan-out still run.
  */
-export type CompanionGcSwapOutcome = 'replaced' | 'not-due' | 'deferred-live' | 'no-pointer' | 'no-ladder-seed' | 'failed';
+export type ClientAnnexGcSwapOutcome = 'replaced' | 'not-due' | 'deferred-live' | 'no-pointer' | 'no-ladder-seed' | 'failed';
 /**
- * One GC pass's report: the swap outcome, the companion DID the account
+ * One GC pass's report: the swap outcome, the annex DID the account
  * points at after the pass, the generation ids collected (revoked, digested,
  * deleted), and the per-generation failures. A report with `failed` entries
  * is a resumable success -- the next durable login's pass picks up exactly
  * the generations still listed.
  */
-export interface CompanionGcReport {
-    swap: CompanionGcSwapOutcome;
+export interface ClientAnnexGcReport {
+    swap: ClientAnnexGcSwapOutcome;
     pointedDid?: string;
     collected: string[];
     failed: Array<{
@@ -156,7 +156,7 @@ export interface CompanionGcReport {
     }>;
 }
 /**
- * One companion GC pass: the quarterly swap when due and quiet, then the
+ * One annex GC pass: the quarterly swap when due and quiet, then the
  * predicate-driven collect fan-out over every non-pointed `gen-` collection.
  * See the module header for the stage order and its load-bearing constraints.
  *
@@ -190,14 +190,14 @@ export interface CompanionGcReport {
  *   delete, and a throw keeps the generation for the next pass
  * @param [options.onCollected] {Function}
  *   `({ generationId }) => Promise<void>` -- local cleanup after a
- *   generation's delete (the caller's companion pin-slot drop); a throw is
+ *   generation's delete (the caller's annex pin-slot drop); a throw is
  *   reported but cannot be retried (the collection is already gone)
  * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins for the
  *   account-log re-point and the pointed generation's read
  * @param [options.now] {number}   epoch milliseconds, for tests
- * @returns {Promise<CompanionGcReport>}
+ * @returns {Promise<ClientAnnexGcReport>}
  */
-export declare function runCompanionGc({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, recordDigest, onCollected, pinStore, now }: {
+export declare function runClientAnnexGc({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, recordDigest, onCollected, pinStore, now }: {
     was: WasClient;
     wasServerUrl: string;
     accountSpaceId: string;
@@ -217,5 +217,39 @@ export declare function runCompanionGc({ was, wasServerUrl, accountSpaceId, acco
     }) => Promise<void>;
     pinStore?: ResourceLogPinStore;
     now?: number;
-}): Promise<CompanionGcReport>;
-//# sourceMappingURL=companionGc.d.ts.map
+}): Promise<ClientAnnexGcReport>;
+/**
+ * AN OFF-CADENCE GENERATION SWAP: replaces the pointed annex generation
+ * outside the quarterly rhythm -- the credential-rotation ceremony's
+ * fallback when no distinct committed rung can sign a strike entry
+ * (`retireClientAnnexRung`): a fresh generation minted from a SURVIVING
+ * credential's seed commits only that credential's rung-0 hash, so the
+ * retired credential's annex posture dies with the whole generation the
+ * moment the re-point lands. The abandoned generation is an ordinary
+ * non-pointed `gen-` collection the standing collect fan-out picks up at the
+ * next durable login.
+ *
+ * Same four swap stages and ordering as the quarterly GC swap, minus the
+ * cadence and quiet gates (the caller's reason for swapping is authority
+ * removal, not hygiene). The pointed generation's log is read for the revoke
+ * stage's delegation bytes; unreadable, the revoke is skipped and pointer
+ * equality retires the old delegation on a conforming server.
+ *
+ * @param options {object}   see {@link runClientAnnexGc} for the shared
+ *   members ({ was, wasServerUrl, accountSpaceId, account, idStore,
+ *   updateKeys, zcapClient, pinStore }); `ladderSeed` here is the SURVIVING
+ *   credential's seed the fresh generation is minted from
+ * @returns {Promise<string>}   the fresh annex DID
+ */
+export declare function swapClientAnnexGeneration({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, pinStore }: {
+    was: WasClient;
+    wasServerUrl: string;
+    accountSpaceId: string;
+    account: Pick<PublishedWebvhLog, 'did' | 'doc'>;
+    idStore: WebvhIdStore;
+    updateKeys: ClientWebvhUpdateKeys;
+    zcapClient: ZcapClient;
+    ladderSeed: Uint8Array;
+    pinStore?: ResourceLogPinStore;
+}): Promise<string>;
+//# sourceMappingURL=gc.d.ts.map

package/dist/clientAnnex/gc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/gc.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAehE,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,QAA2B,CAAA;AAE/D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAsB,CAAA;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAiB,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oCAAoC,CAAC,EACnD,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,GAAG,SAAS,CAgBrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,GAAG,EACH,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACH,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAUV;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,SAAS,GACT,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,QAAQ,CAAA;AAEZ;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,wBAAwB,CAAA;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,YAAY,EAAE,CAAC,MAAM,EAAE;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmG/B;AA2JD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,CAAC,CAAA;IAC/C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BlB"}

package/dist/{webvh/companionGc.js → clientAnnex/gc.js}

@@ -1,6 +1,6 @@
-import { companionDidParts, companionLogPinId, companionLogStore, delegatedClientsPointer, embeddedGenerationDelegation, ensureGenerationDelegationCurrent, GENERATION_ID_PREFIX, mintCredentialCompanionGeneration, mintGenerationDelegation, setDelegatedClientsPointer } from './companion.js';
-import { readPublishedLog } from './didWebvh.js';
-import { accountLogPinId } from './verifyLog.js';
+import { clientAnnexDidParts, clientAnnexLogPinId, clientAnnexLogStore, delegatedClientsPointer, embeddedGenerationDelegation, ensureGenerationDelegationCurrent, GENERATION_ID_PREFIX, mintCredentialClientAnnexGeneration, mintGenerationDelegation, revokeTreatingAlreadyRevokedAsSuccess, setDelegatedClientsPointer } from './log.js';
+import { readPublishedLog } from '../webvh/didWebvh.js';
+import { accountLogPinId } from '../webvh/verifyLog.js';
 /**
  * The fixed GC cadence: a generation is replaced at the first durable login
  * 90 days after the current pointer value was established. Wallet GC policy
@@ -28,7 +28,7 @@ export const GENERATION_QUIET_GRACE_MS = 60 * 60 * 1000;
 /**
  * The `versionTime` of the account-log entry that established the CURRENT
  * `#DelegatedClients` pointer value: the newest entry whose state names a
- * different companion DID than the entry before it (or the first entry, when
+ * different annex DID than the entry before it (or the first entry, when
  * the pointer has been there since genesis). This is the cadence's clock --
  * "the pointer-update entry is the record" -- and it is read off the log a
  * durable login has already verified, so the cadence costs no extra fetch
@@ -48,7 +48,7 @@ export function delegatedClientsPointerEstablishedAt({ log }) {
             establishedAt = entry.versionTime;
         }
         if (pointed === undefined) {
-            // A document with no pointer has no companion posture; a later entry
+            // A document with no pointer has no annex posture; a later entry
             // restoring one establishes afresh.
             establishedAt = undefined;
         }
@@ -66,7 +66,7 @@ export function delegatedClientsPointerEstablishedAt({ log }) {
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {boolean}
  */
-export function companionGcDue({ log, now = Date.now() }) {
+export function clientAnnexGcDue({ log, now = Date.now() }) {
     const establishedAt = delegatedClientsPointerEstablishedAt({ log });
     if (establishedAt === undefined) {
         return false;
@@ -84,7 +84,7 @@ export function companionGcDue({ log, now = Date.now() }) {
  * swap defers rather than abandoning a possibly-live visit.
  *
  * @param options {object}
- * @param options.log {DIDLog}   the pointed generation's VERIFIED companion
+ * @param options.log {DIDLog}   the pointed generation's VERIFIED annex
  *   log
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {boolean}
@@ -99,7 +99,7 @@ export function generationQuiet({ log, now = Date.now() }) {
         now - newestMs >= GENERATION_QUIET_BOUND_MS + GENERATION_QUIET_GRACE_MS);
 }
 /**
- * One companion GC pass: the quarterly swap when due and quiet, then the
+ * One annex GC pass: the quarterly swap when due and quiet, then the
  * predicate-driven collect fan-out over every non-pointed `gen-` collection.
  * See the module header for the stage order and its load-bearing constraints.
  *
@@ -133,19 +133,19 @@ export function generationQuiet({ log, now = Date.now() }) {
  *   delete, and a throw keeps the generation for the next pass
  * @param [options.onCollected] {Function}
  *   `({ generationId }) => Promise<void>` -- local cleanup after a
- *   generation's delete (the caller's companion pin-slot drop); a throw is
+ *   generation's delete (the caller's annex pin-slot drop); a throw is
  *   reported but cannot be retried (the collection is already gone)
  * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins for the
  *   account-log re-point and the pointed generation's read
  * @param [options.now] {number}   epoch milliseconds, for tests
- * @returns {Promise<CompanionGcReport>}
+ * @returns {Promise<ClientAnnexGcReport>}
  */
-export async function runCompanionGc({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, recordDigest, onCollected, pinStore, now = Date.now() }) {
+export async function runClientAnnexGc({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, recordDigest, onCollected, pinStore, now = Date.now() }) {
     const pointedDid = delegatedClientsPointer({ doc: account.doc });
     if (pointedDid === undefined) {
         return { swap: 'no-pointer', collected: [], failed: [] };
     }
-    const { spaceId } = companionDidParts({ did: pointedDid });
+    const { spaceId } = clientAnnexDidParts({ did: pointedDid });
     const failed = [];
     // 1. The swap, when the quarterly cadence is due. Its own failure is
     // collected under the pointed generation's id rather than aborting the
@@ -153,14 +153,14 @@ export async function runCompanionGc({ was, wasServerUrl, accountSpaceId, accoun
     // durable login re-attempts the swap from durable state.
     let swap = 'not-due';
     let currentDid = pointedDid;
-    if (companionGcDue({ log: account.log, now })) {
+    if (clientAnnexGcDue({ log: account.log, now })) {
         swap =
             ladderSeed === undefined
                 ? 'no-ladder-seed'
                 : await (async () => {
-                    const oldParts = companionDidParts({ did: pointedDid });
+                    const oldParts = clientAnnexDidParts({ did: pointedDid });
                     try {
-                        const old = await readCompanionGeneration({
+                        const old = await readClientAnnexGeneration({
                             was,
                             spaceId,
                             generationId: oldParts.generationId,
@@ -175,7 +175,7 @@ export async function runCompanionGc({ was, wasServerUrl, accountSpaceId, accoun
                             // read as quiet.
                             return old === undefined ? 'failed' : 'deferred-live';
                         }
-                        currentDid = await replaceCompanionGeneration({
+                        currentDid = await replaceClientAnnexGeneration({
                             was,
                             wasServerUrl,
                             accountSpaceId,
@@ -184,7 +184,7 @@ export async function runCompanionGc({ was, wasServerUrl, accountSpaceId, accoun
                             updateKeys,
                             zcapClient,
                             ladderSeed,
-                            companionSpaceId: spaceId,
+                            clientAnnexSpaceId: spaceId,
                             oldGeneration: old,
                             pinStore
                         });
@@ -201,7 +201,7 @@ export async function runCompanionGc({ was, wasServerUrl, accountSpaceId, accoun
     // auxiliary Space's collection listing -- no registry of generations
     // exists anywhere -- and a torn GC's old generation, a torn signup's
     // orphan, and a double-genesis loser get identical treatment.
-    const currentGenerationId = companionDidParts({
+    const currentGenerationId = clientAnnexDidParts({
         did: currentDid
     }).generationId;
     const space = was.space(spaceId);
@@ -233,79 +233,82 @@ export async function runCompanionGc({ was, wasServerUrl, accountSpaceId, accoun
     return { swap, pointedDid: currentDid, collected, failed };
 }
 /**
- * Reads and verifies one generation's published companion log, or resolves
+ * Reads and verifies one generation's published annex log, or resolves
  * undefined when its `did.jsonl` does not exist (a generation that never
  * finished minting, or whose collection outlived a torn delete).
  *
  * @param options {object}
  * @param options.was {WasClient}
- * @param options.spaceId {string}   the auxiliary companion Space's id
+ * @param options.spaceId {string}   the auxiliary annex Space's id
  * @param options.generationId {string}
  * @param [options.expectedDid] {string}
  * @param [options.pinStore] {ResourceLogPinStore}
  * @returns {Promise<PublishedWebvhLog | undefined>}
  */
-async function readCompanionGeneration({ was, spaceId, generationId, expectedDid, pinStore }) {
-    const store = companionLogStore({ was, spaceId, generationId });
+async function readClientAnnexGeneration({ was, spaceId, generationId, expectedDid, pinStore }) {
+    const store = clientAnnexLogStore({ was, spaceId, generationId });
     return readPublishedLog({
         idStore: store,
         ...(expectedDid !== undefined ? { expectedDid } : {}),
         ...(pinStore !== undefined
-            ? { pinStore, logId: companionLogPinId({ spaceId, generationId }) }
+            ? { pinStore, logId: clientAnnexLogPinId({ spaceId, generationId }) }
             : {})
     });
 }
 /**
  * The swap's four stages, in the fixed order: mint + genesis; install the
  * fresh generation's delegation service entry; revoke the old generation's
- * delegation; re-point the account document. Returns the fresh companion
+ * delegation; re-point the account document. Returns the fresh annex
  * DID. The digest and the delete are deliberately NOT here -- once the
  * re-point lands, the old generation is an ordinary non-pointed `gen-`
  * collection and the standing collect fan-out handles it, which is also
  * what makes a swap torn after its re-point resume for free.
  *
- * @param options {object}   see {@link runCompanionGc}, plus:
- * @param options.companionSpaceId {string}   the auxiliary Space's id
- * @param options.oldGeneration {PublishedWebvhLog}   the pointed
- *   generation's verified log, read by the quiet check
- * @returns {Promise<string>}   the fresh companion DID
+ * @param options {object}   see {@link runClientAnnexGc}, plus:
+ * @param options.clientAnnexSpaceId {string}   the auxiliary Space's id
+ * @param [options.oldGeneration] {PublishedWebvhLog}   the pointed
+ *   generation's verified log, read by the quiet check; absent (an
+ *   off-cadence swap whose pointed log is unreadable), the revoke stage is
+ *   skipped and the old generation's delegation dies with the re-point on a
+ *   conforming server
+ * @returns {Promise<string>}   the fresh annex DID
  */
-async function replaceCompanionGeneration({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, companionSpaceId, oldGeneration, pinStore }) {
+async function replaceClientAnnexGeneration({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, clientAnnexSpaceId, oldGeneration, pinStore }) {
     // 1. Mint + genesis: a fresh generation in the existing auxiliary Space
     // (the typed-Space ensure no-ops on it; the controller argument is only
     // read when the Space does not exist). The genesis commits the minting
     // credential's rung-0 hash for the fresh generation id.
-    const minted = await mintCredentialCompanionGeneration({
+    const minted = await mintCredentialClientAnnexGeneration({
         was,
         wasServerUrl,
-        spaceId: companionSpaceId,
+        spaceId: clientAnnexSpaceId,
         controller: account.did,
         ladderSeed
     });
     // 2. Install the fresh generation's delegation service entry (the
     // install-when-absent half of the renew-precedes-mint helper), the
     // delegation signed by this enrolled client's promoted account key and the
-    // installing companion entry by the credential's rung 0.
+    // installing annex entry by the credential's rung 0.
     await ensureGenerationDelegationCurrent({
-        store: companionLogStore({
+        store: clientAnnexLogStore({
             was,
-            spaceId: companionSpaceId,
+            spaceId: clientAnnexSpaceId,
             generationId: minted.generationId
         }),
         ladderSeed,
         generationId: minted.generationId,
-        mintGenerationDelegation: async ({ companionDid }) => mintGenerationDelegation({
+        mintGenerationDelegation: async ({ clientAnnexDid }) => mintGenerationDelegation({
             zcapClient,
             wasServerUrl,
             spaceId: accountSpaceId,
-            companionDid
+            clientAnnexDid
         }),
         expectedDid: minted.did,
         ...(pinStore !== undefined
             ? {
                 pinStore,
-                logId: companionLogPinId({
-                    spaceId: companionSpaceId,
+                logId: clientAnnexLogPinId({
+                    spaceId: clientAnnexSpaceId,
                     generationId: minted.generationId
                 })
             }
@@ -315,10 +318,12 @@ async function replaceCompanionGeneration({ was, wasServerUrl, accountSpaceId, a
     // revocation POST verifies against the currently resolved document, so it
     // only chains while the pointer still names the old generation) and
     // before the delete (the POST needs bytes the delete destroys).
-    const oldDelegation = embeddedGenerationDelegation({ doc: oldGeneration.doc });
+    const oldDelegation = oldGeneration === undefined
+        ? undefined
+        : embeddedGenerationDelegation({ doc: oldGeneration.doc });
     if (oldDelegation !== undefined) {
         await revokeTreatingAlreadyRevokedAsSuccess({
-            was,
+            revoke: zcap => was.revoke(zcap),
             delegation: oldDelegation
         });
     }
@@ -329,7 +334,7 @@ async function replaceCompanionGeneration({ was, wasServerUrl, accountSpaceId, a
     await setDelegatedClientsPointer({
         idStore,
         updateKeys,
-        companionDid: minted.did,
+        clientAnnexDid: minted.did,
         expectedDid: account.did,
         ...(pinStore !== undefined
             ? { pinStore, logId: accountLogPinId({ spaceId: accountSpaceId }) }
@@ -337,6 +342,57 @@ async function replaceCompanionGeneration({ was, wasServerUrl, accountSpaceId, a
     });
     return minted.did;
 }
+/**
+ * AN OFF-CADENCE GENERATION SWAP: replaces the pointed annex generation
+ * outside the quarterly rhythm -- the credential-rotation ceremony's
+ * fallback when no distinct committed rung can sign a strike entry
+ * (`retireClientAnnexRung`): a fresh generation minted from a SURVIVING
+ * credential's seed commits only that credential's rung-0 hash, so the
+ * retired credential's annex posture dies with the whole generation the
+ * moment the re-point lands. The abandoned generation is an ordinary
+ * non-pointed `gen-` collection the standing collect fan-out picks up at the
+ * next durable login.
+ *
+ * Same four swap stages and ordering as the quarterly GC swap, minus the
+ * cadence and quiet gates (the caller's reason for swapping is authority
+ * removal, not hygiene). The pointed generation's log is read for the revoke
+ * stage's delegation bytes; unreadable, the revoke is skipped and pointer
+ * equality retires the old delegation on a conforming server.
+ *
+ * @param options {object}   see {@link runClientAnnexGc} for the shared
+ *   members ({ was, wasServerUrl, accountSpaceId, account, idStore,
+ *   updateKeys, zcapClient, pinStore }); `ladderSeed` here is the SURVIVING
+ *   credential's seed the fresh generation is minted from
+ * @returns {Promise<string>}   the fresh annex DID
+ */
+export async function swapClientAnnexGeneration({ was, wasServerUrl, accountSpaceId, account, idStore, updateKeys, zcapClient, ladderSeed, pinStore }) {
+    const pointedDid = delegatedClientsPointer({ doc: account.doc });
+    if (pointedDid === undefined) {
+        throw new Error('clientAnnex: the account document carries no delegated-clients ' +
+            'service entry; no generation exists to swap.');
+    }
+    const { spaceId } = clientAnnexDidParts({ did: pointedDid });
+    const oldGeneration = await readClientAnnexGeneration({
+        was,
+        spaceId,
+        generationId: clientAnnexDidParts({ did: pointedDid }).generationId,
+        expectedDid: pointedDid,
+        ...(pinStore !== undefined ? { pinStore } : {})
+    });
+    return replaceClientAnnexGeneration({
+        was,
+        wasServerUrl,
+        accountSpaceId,
+        account,
+        idStore,
+        updateKeys,
+        zcapClient,
+        ladderSeed,
+        clientAnnexSpaceId: spaceId,
+        ...(oldGeneration !== undefined ? { oldGeneration } : {}),
+        ...(pinStore !== undefined ? { pinStore } : {})
+    });
+}
 /**
  * Collects one non-pointed generation: revoke its embedded delegation
  * (blind; the server's 400 already-revoked answer reads as success), write
@@ -350,8 +406,8 @@ async function replaceCompanionGeneration({ was, wasServerUrl, accountSpaceId, a
  * @param options.was {WasClient}
  * @param options.spaceId {string}
  * @param options.generationId {string}
- * @param options.recordDigest {Function}   see {@link runCompanionGc}
- * @param [options.onCollected] {Function}   see {@link runCompanionGc}
+ * @param options.recordDigest {Function}   see {@link runClientAnnexGc}
+ * @param [options.onCollected] {Function}   see {@link runClientAnnexGc}
  * @returns {Promise<void>}
  */
 async function collectOneGeneration({ was, spaceId, generationId, recordDigest, onCollected }) {
@@ -359,7 +415,7 @@ async function collectOneGeneration({ was, spaceId, generationId, recordDigest,
     // client, and its chain-head slot is about to be dropped either way. The
     // log still fully verifies (hash chain, prerotation, rung signatures) --
     // the digest quotes only a log that resolves.
-    const published = await readCompanionGeneration({
+    const published = await readClientAnnexGeneration({
         was,
         spaceId,
         generationId
@@ -368,7 +424,7 @@ async function collectOneGeneration({ was, spaceId, generationId, recordDigest,
         const oldDelegation = embeddedGenerationDelegation({ doc: published.doc });
         if (oldDelegation !== undefined) {
             await revokeTreatingAlreadyRevokedAsSuccess({
-                was,
+                revoke: zcap => was.revoke(zcap),
                 delegation: oldDelegation
             });
         }
@@ -386,28 +442,4 @@ async function collectOneGeneration({ was, spaceId, generationId, recordDigest,
     await was.space(spaceId).collection(generationId).delete();
     await onCollected?.({ generationId });
 }
-/**
- * Submits the revocation of a generation delegation, reading the server's
- * 400 answer as success: an already-revoked chain (a resumed GC's blind
- * re-POST) and an expired delegation (which no longer needs revoking) both
- * land there, and the revocation protocol exposes no read endpoint to
- * distinguish them beforehand. Matched on `err.name` -- error classes do not
- * survive crossing package copies.
- *
- * @param options {object}
- * @param options.was {WasClient}
- * @param options.delegation {IZcap}
- * @returns {Promise<void>}
- */
-async function revokeTreatingAlreadyRevokedAsSuccess({ was, delegation }) {
-    try {
-        await was.revoke(delegation);
-    }
-    catch (err) {
-        if (err.name === 'ValidationError') {
-            return;
-        }
-        throw err;
-    }
-}
-//# sourceMappingURL=companionGc.js.map
+//# sourceMappingURL=gc.js.map

package/dist/clientAnnex/gc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc.js","sourceRoot":"","sources":["../../src/clientAnnex/gc.ts"],"names":[],"mappings":"AAwDA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,iCAAiC,EACjC,oBAAoB,EACpB,mCAAmC,EACnC,wBAAwB,EACxB,qCAAqC,EACrC,0BAA0B,EAC3B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAMvD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oCAAoC,CAAC,EACnD,GAAG,EAGJ;IACC,IAAI,aAAiC,CAAA;IACrC,IAAI,QAA4B,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;QAC7D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YAClD,aAAa,GAAG,KAAK,CAAC,WAAW,CAAA;QACnC,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,iEAAiE;YACjE,oCAAoC;YACpC,aAAa,GAAG,SAAS,CAAA;QAC3B,CAAC;QACD,QAAQ,GAAG,OAAO,CAAA;IACpB,CAAC;IACD,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,GAAG,EACH,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAIjB;IACC,MAAM,aAAa,GAAG,oCAAoC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACnE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IAC/C,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC9B,GAAG,GAAG,aAAa,IAAI,uBAAuB,CAC/C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,GAAG,EACH,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAIjB;IACC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW,CAAA;IAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,GAAG,QAAQ,IAAI,yBAAyB,GAAG,yBAAyB,CACxE,CAAA;AACH,CAAC;AAkCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAmBjB;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAChE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAkC,EAAE,CAAA;IAEhD,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,yDAAyD;IACzD,IAAI,IAAI,GAA6B,SAAS,CAAA;IAC9C,IAAI,UAAU,GAAG,UAAU,CAAA;IAC3B,IAAI,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAChD,IAAI;YACF,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAuC,EAAE;oBACnD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;oBACzD,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC;4BAC1C,GAAG;4BACH,OAAO;4BACP,YAAY,EAAE,QAAQ,CAAC,YAAY;4BACnC,WAAW,EAAE,UAAU;4BACvB,QAAQ;yBACT,CAAC,CAAA;wBACF,IACE,GAAG,KAAK,SAAS;4BACjB,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EACvC,CAAC;4BACD,sDAAsD;4BACtD,2DAA2D;4BAC3D,yDAAyD;4BACzD,iBAAiB;4BACjB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAA;wBACvD,CAAC;wBACD,UAAU,GAAG,MAAM,4BAA4B,CAAC;4BAC9C,GAAG;4BACH,YAAY;4BACZ,cAAc;4BACd,OAAO;4BACP,OAAO;4BACP,UAAU;4BACV,UAAU;4BACV,UAAU;4BACV,kBAAkB,EAAE,OAAO;4BAC3B,aAAa,EAAE,GAAG;4BAClB,QAAQ;yBACT,CAAC,CAAA;wBACF,OAAO,UAAU,CAAA;oBACnB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;wBAChE,OAAO,QAAQ,CAAA;oBACjB,CAAC;gBACH,CAAC,CAAC,EAAE,CAAA;IACZ,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,qEAAqE;IACrE,qEAAqE;IACrE,8DAA8D;IAC9D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;QAC9C,GAAG,EAAE,UAAU;KAChB,CAAC,CAAC,YAAY,CAAA;IACf,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IACE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC;gBACxC,IAAI,CAAC,EAAE,KAAK,mBAAmB,EAC/B,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,oBAAoB,CAAC;gBACzB,GAAG;gBACH,OAAO;gBACP,YAAY;gBACZ,YAAY;gBACZ,WAAW;aACZ,CAAC,CAAA;YACF,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,WAAW,EACX,QAAQ,EAOT;IACC,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;IACjE,OAAO,gBAAgB,CAAC;QACtB,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,4BAA4B,CAAC,EAC1C,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,QAAQ,EAaT;IACC,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC;QACvD,GAAG;QACH,YAAY;QACZ,OAAO,EAAE,kBAAkB;QAC3B,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,UAAU;KACX,CAAC,CAAA;IAEF,kEAAkE;IAClE,mEAAmE;IACnE,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,iCAAiC,CAAC;QACtC,KAAK,EAAE,mBAAmB,CAAC;YACzB,GAAG;YACH,OAAO,EAAE,kBAAkB;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,UAAU;QACV,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,wBAAwB,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CACrD,wBAAwB,CAAC;YACvB,UAAU;YACV,YAAY;YACZ,OAAO,EAAE,cAAc;YACvB,cAAc;SACf,CAAC;QACJ,WAAW,EAAE,MAAM,CAAC,GAAG;QACvB,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC;gBACE,QAAQ;gBACR,KAAK,EAAE,mBAAmB,CAAC;oBACzB,OAAO,EAAE,kBAAkB;oBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,sEAAsE;IACtE,0EAA0E;IAC1E,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,aAAa,GACjB,aAAa,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,4BAA4B,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,qCAAqC,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAChC,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;IACJ,CAAC;IAED,iEAAiE;IACjE,8DAA8D;IAC9D,kEAAkE;IAClE,kBAAkB;IAClB,MAAM,0BAA0B,CAAC;QAC/B,OAAO;QACP,UAAU;QACV,cAAc,EAAE,MAAM,CAAC,GAAG;QAC1B,WAAW,EAAE,OAAO,CAAC,GAAG;QACxB,GAAG,CAAC,QAAQ,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,GAAG,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,GAAG,EACH,YAAY,EACZ,cAAc,EACd,OAAO,EACP,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EAWT;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAChE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;IAC5D,MAAM,aAAa,GAAG,MAAM,yBAAyB,CAAC;QACpD,GAAG;QACH,OAAO;QACP,YAAY,EAAE,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY;QACnE,WAAW,EAAE,UAAU;QACvB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAA;IACF,OAAO,4BAA4B,CAAC;QAClC,GAAG;QACH,YAAY;QACZ,cAAc;QACd,OAAO;QACP,OAAO;QACP,UAAU;QACV,UAAU;QACV,UAAU;QACV,kBAAkB,EAAE,OAAO;QAC3B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,oBAAoB,CAAC,EAClC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,WAAW,EAYZ;IACC,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC;QAChD,GAAG;QACH,OAAO;QACP,YAAY;KACb,CAAC,CAAA;IAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,4BAA4B,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QAC1E,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,qCAAqC,CAAC;gBAC1C,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAChC,UAAU,EAAE,aAAa;aAC1B,CAAC,CAAA;QACJ,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,YAAY,CAAC;YACjB,YAAY;YACZ,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW;YACzC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW;YAC/D,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM;SACjC,CAAC,CAAA;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAA;IAC1D,MAAM,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;AACvC,CAAC"}

package/dist/clientAnnex/index.d.ts

@@ -0,0 +1,60 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/clientAnnex` subpath: the client annex -- the
+ * authoring and maintenance surface of everything anchored on a standing
+ * credential's ladder rather than on an enrolled durable client. One boundary
+ * rule holds throughout: this subpath imports from the base subpaths;
+ * nothing in the base imports from it (enforced in the lint pass, with one
+ * pinned exception -- `unlock/standingWebvh.ts` uses the shared ladder
+ * attribution helpers here, never the annex log machinery). The verify-side
+ * halves every wallet needs regardless of posture stay in the base: the
+ * resource-log ladder-append license and `ControllerPosture` ladder-key
+ * computation (`resourceLog`), `ladderVmIds` recognition (`webvh`), the
+ * unlock-record codec with its `ladder` and `delegatedClients` members
+ * (`unlock`), the standing-zcap staleness policy and the generalized log
+ * store seams (`webvh`), and the `GenerationCollect` activity builder
+ * (`space`).
+ *
+ * - The ladder (`ladder.ts`): rung and ladder-VM derivation from the record's
+ *   random seed, and the shared attribution walks (`attributeLadderRung`,
+ *   `attributeLadderPosture`) that recover the ladder's state from the
+ *   published log itself.
+ * - The annex log (`log.ts`) and its GC (`gc.ts`): the disposable sidecar
+ *   did:webvh of GC'd generations holding transient per-visit verification
+ *   methods, the generation delegation, the account document's
+ *   `#DelegatedClients` pointer, and the quarterly swap-and-collect.
+ * - ZCap signing as the ladder VM (`zcap.ts`): `ladderVmZcapClient` and the
+ *   bootstrap `ladderVmAgent`.
+ * - The ladder-anchored account-log ceremonies (`ladderAnchored.ts`):
+ *   ladder-anchored genesis, the self-enrolling continuation, the one-entry
+ *   forget -- plus the composed flows around them (`selfEnroll.ts`,
+ *   `forget.ts`), the credential-anchored account genesis
+ *   (`credentialAnchoredGenesis.ts`), and the transient-recovery
+ *   continuation (`recoveryLadderAnchored.ts`).
+ *
+ * The subsystem's decision records are the subpath's reading list:
+ * `decisions/0002` (annex log update authority is static rung 0),
+ * `decisions/0003` (generation identity and the ladder HKDF label family),
+ * `decisions/0005` (the `delegatedClients` sealed record member),
+ * `decisions/0006` (generation GC observables and the `GenerationCollect`
+ * digest), and `decisions/0007` (the reveal entry's hash order).
+ */
+export { attributeLadderPosture, attributeLadderRung, clientAnnexRung, clientAnnexRungSeed, generateLadderSeed, LADDER_MAX_SCAN, LadderAttributionError, ladderRung, ladderRungSeed, ladderVmKeyMultibase, ladderVmSeed } from './ladder.js';
+export type { LadderRung, LadderRungState, LadderStandingPosture } from './ladder.js';
+export { assertGenerationId, clampGrantExpires, CLIENT_ANNEX_SPACE_TYPE, clientAnnexDidParts, clientAnnexLogPinId, clientAnnexLogStore, ClientAnnexRungUncommittedError, commitClientAnnexRung, createClientAnnexLog, DELEGATED_CLIENTS_DELEGATION_ACTIONS, DELEGATED_CLIENTS_DELEGATION_TTL_MS, DELEGATED_CLIENTS_SERVICE_TYPE, delegatedClientsDelegationMinter, delegatedClientsDelegationSpaceId, delegatedClientsPointer, delegatedClientsServiceEntry, embeddedGenerationDelegation, enrollClientAnnexTransientClient, enrollTransientClient, ensureClientAnnexSpace, ensureGenerationDelegationCurrent, GENERATION_DELEGATION_ACTIONS, GENERATION_DELEGATION_SERVICE_TYPE, GENERATION_DELEGATION_TTL_MS, GENERATION_ID_PREFIX, generationDelegationHistory, generationDelegationServiceEntry, mintClientAnnexGeneration, mintCredentialClientAnnexGeneration, mintDelegatedClientsDelegation, mintGenerationDelegation, mintGenerationId, retireClientAnnexRung, revokeTreatingAlreadyRevokedAsSuccess, servicesPointedAtClientAnnex, setDelegatedClientsPointer } from './log.js';
+export type { ClientAnnexWriteStore } from './log.js';
+export { clientAnnexGcDue, delegatedClientsPointerEstablishedAt, GENERATION_GC_PERIOD_MS, GENERATION_QUIET_BOUND_MS, GENERATION_QUIET_GRACE_MS, generationQuiet, runClientAnnexGc, swapClientAnnexGeneration } from './gc.js';
+export type { ClientAnnexGcReport, ClientAnnexGcSwapOutcome } from './gc.js';
+export { ladderVmAgent, ladderVmZcapClient } from './zcap.js';
+export { createLadderAnchoredAccountLog, ensureLadderAnchoredDidWebvh, forgetLastWebvhClient, forgetWebvhClient, installLadderVmWebvh, LastDurableClientForgetError, selfEnrollWebvhClient } from './ladderAnchored.js';
+export { selfEnrollClientCore } from './selfEnroll.js';
+export { forgetDurableClient } from './forget.js';
+export type { DurableClientForgetResult } from './forget.js';
+export { forgetLastDurableClient } from './forgetLast.js';
+export type { GenerationDelegationRetirement, LastDurableClientForgetResult, UnlockMethodsRemintReach } from './forgetLast.js';
+export { ensureCredentialAnchoredAccountGenesis, mintCredentialAnchoredAccountKeySet } from './credentialAnchoredGenesis.js';
+export { recoverWebvhLadderAnchored } from './recoveryLadderAnchored.js';
+export { createLadderAnchoredWebvhLog, ladderVerificationMethod } from '../webvh/didWebvh.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/clientAnnex/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,UAAU,EACV,eAAe,EACf,qBAAqB,EACtB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,+BAA+B,EAC/B,qBAAqB,EACrB,oBAAoB,EACpB,oCAAoC,EACpC,mCAAmC,EACnC,8BAA8B,EAC9B,gCAAgC,EAChC,iCAAiC,EACjC,uBAAuB,EACvB,4BAA4B,EAC5B,4BAA4B,EAC5B,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,kCAAkC,EAClC,4BAA4B,EAC5B,oBAAoB,EACpB,2BAA2B,EAC3B,gCAAgC,EAChC,yBAAyB,EACzB,mCAAmC,EACnC,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,qCAAqC,EACrC,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AAErD,OAAO,EACL,gBAAgB,EAChB,oCAAoC,EACpC,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,SAAS,CAAA;AAChB,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAE5E,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE7D,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACtB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAEtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAE5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,YAAY,EACV,8BAA8B,EAC9B,6BAA6B,EAC7B,wBAAwB,EACzB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,sCAAsC,EACtC,mCAAmC,EACpC,MAAM,gCAAgC,CAAA;AAEvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAOxE,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACzB,MAAM,sBAAsB,CAAA"}