@interop/wallet-core 0.49.0 → 0.51.0

package/dist/unlock/retire.d.ts

@@ -35,6 +35,24 @@
  * the app deletes as part of the change-method ceremony, and no other
  * credential's bridge chains through it.
  *
+ * The client annex reach is its own stage (1b, the injected
+ * `retireClientAnnexPosture` closure), between the document edit and the
+ * roster tail: a standing credential's annex rung-0 key and hash live in
+ * the pointed generation's log, kept nowhere the account document edit can
+ * reach, so without it a retired credential keeps annex-write authority
+ * for the life of the generation. The closure runs strike-or-swap: a
+ * dedicated strike entry signed by a distinct committed rung
+ * (`retireClientAnnexRung`) where the ceremony holds one, else a fresh
+ * generation minted from a surviving credential's seed and re-pointed under
+ * account-log update authority (`swapClientAnnexGeneration`), the retired rung
+ * dying with the old generation. It also owns retiring the credential's
+ * `delegatedClients` sibling: no server revocation is possible or needed --
+ * the sibling delegation's record dies with the unlock Space the caller
+ * deletes, and a swap (or the ordinary GC cadence) retires the generation it
+ * targeted. Best-effort by contract: the closure catches its own failures
+ * and reports them, so the roster rotation -- the ceremony's essential
+ * remedy -- always runs.
+ *
  * Convergence is the design: every stage detects its own completion from
  * durable state alone -- the posture edit no-ops when the document is already
  * settled, the rotation no-ops once every current-epoch recipient is
@@ -68,6 +86,20 @@ export interface UnlockCredentialRetirementResult {
     document: object;
     userKey?: UserKey;
     rosterDescriptor?: CollectionEncryption;
+    clientAnnex?: ClientAnnexPostureRetirement;
+}
+/**
+ * What the annex-posture stage reports: `struck` (a strike entry dropped
+ * the retired rung's key and hash), `swapped` (a fresh generation replaced
+ * the old one wholesale), `clean` (the pointed generation held no posture
+ * for the retired credential), or `skipped` with the reason (`no-pointer`:
+ * the account has no annex posture; `no-ladder-seed`: the ceremony holds
+ * no seed that could strike or swap; `failed`: the closure's best-effort
+ * catch).
+ */
+export interface ClientAnnexPostureRetirement {
+    action: 'struck' | 'swapped' | 'clean' | 'skipped';
+    reason?: 'no-pointer' | 'no-ladder-seed' | 'failed';
 }
 /**
  * Retires one standing unlock credential from an account. See the module doc
@@ -80,8 +112,12 @@ export interface UnlockCredentialRetirementResult {
  * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
  *   client's own did:webvh update-key seeds, which sign the posture edit
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
- *   public posture (its key-agreement publication and its committed update
- *   key)
+ *   public posture (its key-agreement publication and its recorded update
+ *   key, which the posture edit treats as a ladder anchor rather than truth
+ *   -- see `removeUnlockKey`)
+ * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
+ *   seed, when the ceremony holds the credential's secret; it strengthens the
+ *   ladder attribution but is not required
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the posture edit refuses a `did.jsonl`
  *   resolving to any other account
@@ -98,15 +134,20 @@ export interface UnlockCredentialRetirementResult {
  *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
  *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param [options.retireClientAnnexPosture] {Function}   `({ document }) =>
+ *   Promise<ClientAnnexPostureRetirement>` -- the annex reach (stage 1b in
+ *   the module doc), run against the post-edit document; expected to catch
+ *   its own failures and report them
  * @param [options.onRotationAdopted] {Function}   `({ userKey }) =>
  *   Promise<void>` -- the live-session adoption of a rotated key, run last so
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, onRotationAdopted }: {
+export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexPosture, onRotationAdopted }: {
     idStore: WebvhIdStore;
     updateKeys: ClientWebvhUpdateKeys;
     unlockKeys: StandingUnlockKeys;
+    ladderSeed?: Uint8Array;
     expectedDid?: string;
     verb?: string;
     rosterStore: EncryptionDescriptorStore;
@@ -119,6 +160,9 @@ export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys
         descriptor: CollectionEncryption;
     }) => Promise<void>;
     collections: CascadeCollections;
+    retireClientAnnexPosture?: (options: {
+        document: object;
+    }) => Promise<ClientAnnexPostureRetirement>;
     onRotationAdopted?: (rotation: {
         userKey: UserKey;
     }) => Promise<void>;

package/dist/unlock/retire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAgD5C"}
+{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,4BAA4B,CAAA;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC3C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAyD5C"}

package/dist/unlock/retire.js

@@ -11,8 +11,12 @@ import { removeUnlockKey } from './standingWebvh.js';
  * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
  *   client's own did:webvh update-key seeds, which sign the posture edit
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
- *   public posture (its key-agreement publication and its committed update
- *   key)
+ *   public posture (its key-agreement publication and its recorded update
+ *   key, which the posture edit treats as a ladder anchor rather than truth
+ *   -- see `removeUnlockKey`)
+ * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
+ *   seed, when the ceremony holds the credential's secret; it strengthens the
+ *   ladder attribution but is not required
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the posture edit refuses a `did.jsonl`
  *   resolving to any other account
@@ -29,12 +33,16 @@ import { removeUnlockKey } from './standingWebvh.js';
  *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
  *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param [options.retireClientAnnexPosture] {Function}   `({ document }) =>
+ *   Promise<ClientAnnexPostureRetirement>` -- the annex reach (stage 1b in
+ *   the module doc), run against the post-edit document; expected to catch
+ *   its own failures and report them
  * @param [options.onRotationAdopted] {Function}   `({ userKey }) =>
  *   Promise<void>` -- the live-session adoption of a rotated key, run last so
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, onRotationAdopted }) {
+export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexPosture, onRotationAdopted }) {
     // 1. The document posture edit -- the credential's standing, first. It
     // resolves the document as it now stands, which is what stage 2 resolves
     // its remaining recipients from.
@@ -42,9 +50,15 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         idStore,
         updateKeys,
         unlockKeys,
+        ...(ladderSeed ? { ladderSeed } : {}),
         ...(expectedDid !== undefined ? { expectedDid } : {}),
         ...(verb !== undefined ? { verb } : {})
     });
+    // 1b. The annex reach, against the post-edit document: strike the
+    // retired credential's rung posture out of the pointed generation, or swap
+    // the generation out from under it. Best-effort by the closure's own
+    // contract, so the roster rotation below always runs.
+    const clientAnnex = await retireClientAnnexPosture?.({ document: doc });
     // 2. The shared roster-and-cascade tail: the roster rotation onto the
     // post-edit document (with its post-edit controller floor and its seal
     // backstop), then the collection fan-out onto the fresh key.
@@ -65,7 +79,8 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         return {
             rotated: false,
             collections: tail.collections,
-            document: doc
+            document: doc,
+            ...(clientAnnex ? { clientAnnex } : {})
         };
     }
     if (tail.rotated) {
@@ -77,7 +92,8 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         collections: tail.collections,
         document: doc,
         userKey: tail.userKey,
-        rosterDescriptor: tail.rosterDescriptor
+        rosterDescriptor: tail.rosterDescriptor,
+        ...(clientAnnex ? { clientAnnex } : {})
     };
 }
 //# sourceMappingURL=retire.js.map

package/dist/unlock/retire.js.map

@@ -1 +1 @@
-{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAoDA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,eAAe,EAA2B,MAAM,oBAAoB,CAAA;AAmB7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EAkBlB;IACC,uEAAuE;IACvE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,eAAe,CAAC;QAC9C,OAAO;QACP,UAAU;QACV,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,yEAAyE;QACzE,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;SACd,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAA;AACH,CAAC"}
+{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAsEA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,eAAe,EAA2B,MAAM,oBAAoB,CAAA;AAkC7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAsBlB;IACC,uEAAuE;IACvE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,eAAe,CAAC;QAC9C,OAAO;QACP,UAAU;QACV,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,kEAAkE;IAClE,2EAA2E;IAC3E,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,WAAW,GAAG,MAAM,wBAAwB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAEvE,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,yEAAyE;QACzE,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAA;AACH,CAAC"}

package/dist/unlock/standingWebvh.d.ts

@@ -1,9 +1,10 @@
 import type { DIDDoc, DIDLog, VerificationMethod } from '@interop/did-method-webvh';
-import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
 /**
- * The narrow store seam the self-enrollment continuation writes through: a
- * public read of the log and the delegated `did.jsonl` PUT. A subset of
- * {@link WebvhIdStore}, so an app's remote-store class satisfies it too.
+ * The narrow store seam the self-enrolling and delegated-bridge ceremonies
+ * write through: a public read of the log and the delegated `did.jsonl` PUT.
+ * A subset of {@link WebvhIdStore}, so an app's remote-store class satisfies
+ * it too.
  */
 export type UnlockLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
 /**
@@ -63,44 +64,18 @@ export declare function unlockKeyVerificationMethod({ did, keyAgreement }: {
     keyAgreement: UnlockKeyAgreementPublication;
 }): VerificationMethod;
 /**
- * CLIENT-LESS GENESIS: assembles the one-entry did:webvh log of an account
- * with zero enrolled durable clients, anchored on the minting credential's
- * ladder alone. Everything derives from the ladder seed: rung 0 is the sole
- * `updateKeys` member and signs the entry, `nextKeyHashes` commits rung 0's
- * own carry-over hash plus rung 1 (the staged rung) -- the carry-over hash is
- * what the first durable self-enrollment's reveal-and-commit entry,
- * re-stating `updateKeys` containing rung 0, requires --
- * and the ladder VM (the stable sibling) is published under `assertionMethod`
- * and `capabilityDelegation` only. The credential's `keyAgreement` posture
- * entry is FOLDED INTO GENESIS -- no enrolled client exists to run the
- * separate bind entry ({@link publishUnlockKey}) -- so the genesis
- * `keyAgreement` array holds only the credential's entry.
- *
- * The client-less window this opens is closed by the credential's first
- * durable self-enrollment ({@link selfEnrollWebvhClient}), whose add entry
- * atomically publishes the client, retires rung 0, and removes the ladder VM.
- *
- * The caller owns publication (conditional, create-only) and the pointer
- * write that follows; this assembles and signs the log only.
+ * Reads and resolves the published log through the narrow store seam.
  *
  * @param options {object}
- * @param options.wasServerUrl {string}
- * @param options.spaceId {string}
- * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
- * @param options.keyAgreement {UnlockKeyAgreementPublication}   the
- *   credential's key-agreement publication (commitment or verbatim)
- * @returns {Promise<{ log: DIDLog, webDoc: object, did: string }>}
+ * @param options.store {UnlockLogStore}
+ * @param [options.expectedDid] {string}   the account DID the log must resolve
+ *   to, where the caller holds one
+ * @returns {Promise<PublishedWebvhLog>}
  */
-export declare function createClientlessAccountLog({ wasServerUrl, spaceId, ladderSeed, keyAgreement }: {
-    wasServerUrl: string;
-    spaceId: string;
-    ladderSeed: Uint8Array;
-    keyAgreement: UnlockKeyAgreementPublication;
-}): Promise<{
-    log: DIDLog;
-    webDoc: object;
-    did: string;
-}>;
+export declare function readLogOrThrow({ store, expectedDid }: {
+    store: UnlockLogStore;
+    expectedDid?: string;
+}): Promise<PublishedWebvhLog>;
 /**
  * BIND (run by an enrolled client, root authority): publishes a standing
  * credential's split posture into the document -- one entry adding the
@@ -139,13 +114,29 @@ export declare function publishUnlockKey(options: {
 }>;
 /**
  * REMOVAL (run by an enrolled client, root authority): removes a standing
- * credential's posture from the document -- its `keyAgreement` entry and its
- * committed update-key hash -- in one entry. Idempotent. The roster-side half
- * (rotating the user key epoch off the credential's wrap) is the caller's,
- * and runs after this so the resolver's document no longer backs the removed
- * entry.
+ * credential's posture from the document -- its `keyAgreement` entry and
+ * everything of its ladder that still stands -- in one entry. Idempotent. The
+ * roster-side half (rotating the user key epoch off the credential's wrap) is
+ * the caller's, and runs after this so the resolver's document no longer
+ * backs the removed entry.
+ *
+ * The recorded `unlockKeys.updateKeyMultibase` is treated as an ANCHOR, not
+ * as truth: a credential that has self-enrolled since its bind advanced its
+ * standing commitment past the recorded rung, so the removal resolves the
+ * ladder's current footprint from the log itself
+ * ({@link attributeLadderPosture}) and strikes all of it -- every committed
+ * hash the ladder accounts for AND, for a torn self-enrollment, the revealed
+ * rung key still sitting in `updateKeys` (plus the never-claimed hashes its
+ * reveal entry committed). Trusting the recorded multibase alone would leave
+ * the live rung commitment standing: a latent re-seizure credential via the
+ * reveal mechanism. A supplied `ladderSeed` strengthens the attribution (every
+ * rung known a priori, independent of the anchor's staleness); without it the
+ * log walk alone resolves the footprint. For a single-key credential (a
+ * recovery code, a never-self-enrolled bind) the resolution degenerates to
+ * exactly the recorded key's hash, as before.
  *
- * @param options {object}   see {@link publishUnlockKey}
+ * @param options {object}   see {@link publishUnlockKey}, plus
+ *   `[ladderSeed]` -- the retired credential's ladder seed, when in hand
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
  *   {@link publishUnlockKey}
  */
@@ -153,6 +144,7 @@ export declare function removeUnlockKey(options: {
     idStore: WebvhIdStore;
     updateKeys: ClientWebvhUpdateKeys;
     unlockKeys: StandingUnlockKeys;
+    ladderSeed?: Uint8Array;
     expectedDid?: string;
     verb?: string;
 }): Promise<{
@@ -160,41 +152,4 @@ export declare function removeUnlockKey(options: {
     doc: DIDDoc;
     log: DIDLog;
 }>;
-/**
- * SELF-ENROLLMENT (run by the credential-derived client through the delegated
- * `did.jsonl` PUT): writes the standing continuation described in the module
- * doc -- the reveal-and-commit entry signed by the attributed ladder rung,
- * then the add entry signed by the new ordinary client's update key, which
- * also retires the spent rung. Resumable from durable state alone: a
- * completed continuation is detected by the new client's update key already
- * being authorized (no-op), a torn one by the attribution finding the rung
- * already revealed. Both entries publish conditionally on the read they were
- * built on, and a race lost to a concurrent ceremony re-runs from the top --
- * re-attributing, which is exactly the retry-up-the-ladder resolution.
- *
- * @param options {object}
- * @param options.store {UnlockLogStore}   public log read + delegated PUT
- * @param options.ladderSeed {Uint8Array}   the credential's ladder seed, from
- *   its unlock record
- * @param options.newClientKeys {WebvhEnrollmentKeys}   the new ordinary
- *   client's public halves
- * @param options.newClientUpdateSeeds {ClientWebvhUpdateKeys}   the new
- *   client's update-key seeds (minted by the self-enrolling flow, which
- *   therefore holds them and can sign the add entry)
- * @param [options.expectedDid] {string}   the account DID the log must resolve
- *   to, from the credential-authenticated pointer
- * @returns {Promise<{ did: string, webDoc?: object }>}   the account DID and,
- *   when the add entry ran here, the final `did.json` projection for the
- *   enrolled session to republish
- */
-export declare function selfEnrollWebvhClient(options: {
-    store: UnlockLogStore;
-    ladderSeed: Uint8Array;
-    newClientKeys: WebvhEnrollmentKeys;
-    newClientUpdateSeeds: ClientWebvhUpdateKeys;
-    expectedDid?: string;
-}): Promise<{
-    did: string;
-    webDoc?: object;
-}>;
 //# sourceMappingURL=standingWebvh.d.ts.map

package/dist/unlock/standingWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAmBlC,OAAO,KAAK,EACV,qBAAqB,EAErB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAO7B;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACb,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBxD;AAsDD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAkGD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,UAAU,EAAE,UAAU,CAAA;IACtB,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5C"}
+{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAalC,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAQ7B;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,cAAc,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD"}