@interop/wallet-core 0.5.0 → 0.7.0

package/dist/enrollment/enrollment.d.ts

@@ -0,0 +1,144 @@
+import type { IKeyAgreementKey } from '@interop/data-integrity-core';
+import type { MarkerStore } from '@interop/was-client/edv';
+import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { Puk } from '../keys/puk.js';
+import type { AccountPointer } from '../keyring/record.js';
+/**
+ * The public halves a connect code carries -- the same four multibases
+ * `enrollWebvhClient` publishes into the document, minted by the enrollee and
+ * verified point-to-point by the person running the ceremony.
+ */
+export type EnrollmentRequest = WebvhEnrollmentKeys;
+/**
+ * Thrown by the enrollee's completion step while the enrolling side has not
+ * (yet) published the add entry -- the "not approved yet" state, retried by
+ * completing again once the other client finishes.
+ */
+export declare class EnrollmentPendingError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Encodes an enrollment request as a connect code.
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}
+ * @returns {string}
+ */
+export declare function encodeEnrollmentRequest({ request }: {
+    request: EnrollmentRequest;
+}): string;
+/**
+ * Parses and validates a connect code: the prefix, the payload version, and
+ * the shape of each key (Ed25519 multibase for the signing and update keys,
+ * X25519 for the key-agreement key). Throws on anything malformed -- a code
+ * is typed or scanned, so a clear refusal beats a half-parsed ceremony.
+ *
+ * @param options {object}
+ * @param options.code {string}   the pasted/scanned connect code
+ * @returns {EnrollmentRequest}
+ */
+export declare function parseEnrollmentRequest({ code }: {
+    code: string;
+}): EnrollmentRequest;
+/**
+ * The did:key a connect code's signing key derives -- shown on BOTH screens
+ * so the person running the ceremony can compare them before approving (the
+ * point-to-point verification the wrap and the document VM then inherit).
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}
+ * @returns {string}
+ */
+export declare function enrollmentClientDid({ request }: {
+    request: EnrollmentRequest;
+}): string;
+/**
+ * The kid of the enrollee's roster entry: its key-agreement key's id exactly
+ * as `agentsFromSeed` will derive it at the enrollee's own logins
+ * (`did:key:<ed-multibase>#<x-multibase>`), so the wrap minted here is the
+ * one its first roster read looks for.
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}
+ * @returns {string}
+ */
+export declare function enrollmentRecipientKid({ request }: {
+    request: EnrollmentRequest;
+}): string;
+/**
+ * ENROLLEE, step one: mints the new client's whole key set locally and
+ * returns it alongside the connect code to display. The caller holds the
+ * seeds in memory until the completion step persists them -- nothing is
+ * durable before the ceremony succeeds, so abandoning it leaks at most an
+ * orphan wrap on the enrolling side.
+ *
+ * @returns {Promise<object>}   the in-memory key set, the code, and the
+ *   client did:key to display beside it for comparison
+ */
+export declare function mintEnrollmentRequest(): Promise<{
+    clientSeed: Uint8Array;
+    webvhUpdateKeys: ClientWebvhUpdateKeys;
+    code: string;
+    clientDid: string;
+}>;
+/**
+ * ENROLLING CLIENT: the whole approval, in the push order -- the PUK wrapped
+ * into the roster first (escrow: every epoch, so the new client reads
+ * pre-enrollment history), then the two log entries. Quorum-of-one: this
+ * client's own update key signs both entries. Idempotent at every stage, so
+ * re-approving the same code after any tear converges.
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}   the parsed connect code
+ * @param options.clientWebvhKeys {ClientWebvhUpdateKeys}   the approving
+ *   client's own did:webvh update-key seeds
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   the approving
+ *   client's own (identity) key-agreement key, unwrapping each epoch for
+ *   re-wrapping
+ * @param options.pukRosterStore {MarkerStore}   the account's
+ *   `key-map/puk.json` marker store
+ * @param options.idStore {WebvhIdStore}   the account's `id` collection
+ * @returns {Promise<{ did: string }>}   the account's did:webvh
+ */
+export declare function approveEnrollment({ request, clientWebvhKeys, clientKeyAgreementKey, pukRosterStore, idStore }: {
+    request: EnrollmentRequest;
+    clientWebvhKeys: ClientWebvhUpdateKeys;
+    clientKeyAgreementKey: IKeyAgreementKey;
+    pukRosterStore: MarkerStore;
+    idStore: WebvhIdStore;
+}): Promise<{
+    did: string;
+}>;
+/**
+ * ENROLLEE, step two (after the other client approves): verifies the
+ * enrollment from the world-readable log and performs this client's first
+ * roster read -- signed with its just-published `<did:webvh>#<multibase>`
+ * key -- to obtain the PUK.
+ *
+ * The portable core of the completion step: the caller supplies the account
+ * pointer (from its own keyring lookup) and persists what comes back -- the
+ * PUK, the roster epoch to pin, and the key set itself -- under its own unlock
+ * layer. After that, an ordinary unlock finds an enrolled client.
+ *
+ * Throws `EnrollmentPendingError` while the add entry is not published yet
+ * (complete again once the other client finishes); any integrity failure
+ * (a log that resolves to a different DID than the account pointer names, a
+ * missing roster wrap) throws its own error.
+ *
+ * @param options {object}
+ * @param options.clientSeed {Uint8Array}   from `mintEnrollmentRequest`
+ * @param options.webvhUpdateKeys {ClientWebvhUpdateKeys}   from
+ *   `mintEnrollmentRequest`
+ * @param options.pointer {AccountPointer}   the account pointer the enrollee's
+ *   keyring lookup recovered
+ * @returns {Promise<{ puk: Puk, latestEpochId: string }>}
+ */
+export declare function completeEnrollmentCore({ clientSeed, webvhUpdateKeys, pointer }: {
+    clientSeed: Uint8Array;
+    webvhUpdateKeys: ClientWebvhUpdateKeys;
+    pointer: AccountPointer;
+}): Promise<{
+    puk: Puk;
+    latestEpochId: string;
+}>;
+//# sourceMappingURL=enrollment.d.ts.map

package/dist/enrollment/enrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAS1D,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAS7B,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAa1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AASD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,cAAc,EAAE,WAAW,CAAA;IAC3B,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB3B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACR,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;CACxB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CA2E/C"}

package/dist/enrollment/enrollment.js

@@ -0,0 +1,296 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The client enrollment ceremony: connecting a second wallet client (a fresh
+ * browser profile, another app install) to an existing account without any
+ * secret ever leaving either side. The new client mints its whole key set
+ * locally -- client seed, did:webvh update-key seeds -- and only PUBLIC halves
+ * travel, as a compact "connect code" carried point-to-point (pasted between
+ * two browsers in the room today; the same payload renders as a QR for a
+ * camera-holding wallet). Nothing travels back over the channel: the account
+ * pointer comes out of the keyring (the enrollee holds the unlock secret), and
+ * the PUK comes back through the wrap-set roster.
+ *
+ * Push, not pull, in the recovery-anchor order (decryption material before
+ * authorization): the enrolling client wraps the PUK to the new client's
+ * key-agreement key in `key-map/puk.json` FIRST, then writes the two
+ * did:webvh log entries (commit, then add-VMs-and-update-key). No
+ * authorized-but-blind window exists at any point, and both tear points
+ * resume by re-running the ceremony with the same code -- a tear after the
+ * roster write leaves an orphan wrap (invisible to authorization), a tear
+ * between the log entries is detected from the published commitments.
+ *
+ * The new client's first roster read happens post-enrollment, signed with its
+ * `<did:webvh>#<multibase>` key -- the server authorizes it under the
+ * current-key-set rule the moment the add entry publishes. Persisting the key
+ * set under the app's own unlock layer is the caller's job: this module hands
+ * back the PUK and the roster epoch to pin, and stops there.
+ */
+import { readLogFromString, resolveDIDFromLog } from '@interop/did-method-webvh';
+import { base64urlnopad } from '@scure/base';
+import { agentsFromSeed } from '../identity/agents.js';
+import { DID_LOG_RESOURCE, ID_COLLECTION } from '../space/collections.js';
+import { enrollWebvhClient, mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
+import { clientSigningKeyMultibase, isWebvhDid, webvhZcapClient } from '../webvh/zcap.js';
+import { addPukRosterRecipient } from '../keys/pukRoster.js';
+import { readPukRoster } from '../keys/pukRoster.js';
+import { pukRosterMarkerStore } from '../keys/rosterStore.js';
+/**
+ * The connect-code prefix; the payload after it is base64url(JSON) of an
+ * `EnrollmentRequest` plus a `v` version stamp.
+ */
+const CONNECT_CODE_PREFIX = 'freewallet-connect:';
+/**
+ * The connect-code payload version this build mints and accepts.
+ */
+const CONNECT_CODE_VERSION = 1;
+/**
+ * Thrown by the enrollee's completion step while the enrolling side has not
+ * (yet) published the add entry -- the "not approved yet" state, retried by
+ * completing again once the other client finishes.
+ */
+export class EnrollmentPendingError extends Error {
+    constructor(message = 'This browser is not enrolled yet; approve the connect code ' +
+        'from an already-connected browser, then try again.') {
+        super(message);
+        this.name = 'EnrollmentPendingError';
+    }
+}
+/**
+ * The multicodec multibase prefixes of the two key types a connect code
+ * carries: Ed25519 (`z6Mk`) and X25519 (`z6LS`) public keys.
+ */
+const ED25519_MULTIBASE_PREFIX = 'z6Mk';
+const X25519_MULTIBASE_PREFIX = 'z6LS';
+/**
+ * Encodes an enrollment request as a connect code.
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}
+ * @returns {string}
+ */
+export function encodeEnrollmentRequest({ request }) {
+    const payload = JSON.stringify({ v: CONNECT_CODE_VERSION, ...request });
+    return `${CONNECT_CODE_PREFIX}${base64urlnopad.encode(new TextEncoder().encode(payload))}`;
+}
+/**
+ * Parses and validates a connect code: the prefix, the payload version, and
+ * the shape of each key (Ed25519 multibase for the signing and update keys,
+ * X25519 for the key-agreement key). Throws on anything malformed -- a code
+ * is typed or scanned, so a clear refusal beats a half-parsed ceremony.
+ *
+ * @param options {object}
+ * @param options.code {string}   the pasted/scanned connect code
+ * @returns {EnrollmentRequest}
+ */
+export function parseEnrollmentRequest({ code }) {
+    const trimmed = code.trim();
+    if (!trimmed.startsWith(CONNECT_CODE_PREFIX)) {
+        throw new Error('Not a wallet connect code.');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(base64urlnopad.decode(trimmed.slice(CONNECT_CODE_PREFIX.length))));
+    }
+    catch (err) {
+        throw new Error('The connect code payload is malformed.', { cause: err });
+    }
+    if (parsed === null || typeof parsed !== 'object') {
+        throw new Error('The connect code payload is malformed.');
+    }
+    const { v, signingKeyMultibase, keyAgreementKeyMultibase, updateKeyMultibase: updateKey, stagedUpdateKeyMultibase } = parsed;
+    if (v !== CONNECT_CODE_VERSION) {
+        throw new Error(`Unsupported connect code version "${String(v)}".`);
+    }
+    const requireKey = (value, prefix, name) => {
+        if (typeof value !== 'string' || !value.startsWith(prefix)) {
+            throw new Error(`The connect code carries a malformed ${name}.`);
+        }
+        return value;
+    };
+    return {
+        signingKeyMultibase: requireKey(signingKeyMultibase, ED25519_MULTIBASE_PREFIX, 'signing key'),
+        keyAgreementKeyMultibase: requireKey(keyAgreementKeyMultibase, X25519_MULTIBASE_PREFIX, 'key-agreement key'),
+        updateKeyMultibase: requireKey(updateKey, ED25519_MULTIBASE_PREFIX, 'update key'),
+        stagedUpdateKeyMultibase: requireKey(stagedUpdateKeyMultibase, ED25519_MULTIBASE_PREFIX, 'staged update key')
+    };
+}
+/**
+ * The did:key a connect code's signing key derives -- shown on BOTH screens
+ * so the person running the ceremony can compare them before approving (the
+ * point-to-point verification the wrap and the document VM then inherit).
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}
+ * @returns {string}
+ */
+export function enrollmentClientDid({ request }) {
+    return `did:key:${request.signingKeyMultibase}`;
+}
+/**
+ * The kid of the enrollee's roster entry: its key-agreement key's id exactly
+ * as `agentsFromSeed` will derive it at the enrollee's own logins
+ * (`did:key:<ed-multibase>#<x-multibase>`), so the wrap minted here is the
+ * one its first roster read looks for.
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}
+ * @returns {string}
+ */
+export function enrollmentRecipientKid({ request }) {
+    return `${enrollmentClientDid({ request })}#${request.keyAgreementKeyMultibase}`;
+}
+/**
+ * ENROLLEE, step one: mints the new client's whole key set locally and
+ * returns it alongside the connect code to display. The caller holds the
+ * seeds in memory until the completion step persists them -- nothing is
+ * durable before the ceremony succeeds, so abandoning it leaks at most an
+ * orphan wrap on the enrolling side.
+ *
+ * @returns {Promise<object>}   the in-memory key set, the code, and the
+ *   client did:key to display beside it for comparison
+ */
+export async function mintEnrollmentRequest() {
+    const clientSeed = crypto.getRandomValues(new Uint8Array(32));
+    const { keyAgent, keyAgreementKey } = await agentsFromSeed({
+        seed: clientSeed
+    });
+    const { publicKeyMultibase: keyAgreementKeyMultibase } = keyAgreementKey;
+    if (!keyAgreementKeyMultibase) {
+        throw new Error('The minted key-agreement key has no public multibase.');
+    }
+    const webvhUpdateKeys = await mintClientWebvhUpdateKeys();
+    const request = {
+        signingKeyMultibase: clientSigningKeyMultibase({ keyAgent }),
+        keyAgreementKeyMultibase,
+        updateKeyMultibase: await updateKeyMultibase({
+            seed: webvhUpdateKeys.updateSeed
+        }),
+        stagedUpdateKeyMultibase: await updateKeyMultibase({
+            seed: webvhUpdateKeys.stagedSeed
+        })
+    };
+    return {
+        clientSeed,
+        webvhUpdateKeys,
+        code: encodeEnrollmentRequest({ request }),
+        clientDid: keyAgent.id
+    };
+}
+/**
+ * ENROLLING CLIENT: the whole approval, in the push order -- the PUK wrapped
+ * into the roster first (escrow: every epoch, so the new client reads
+ * pre-enrollment history), then the two log entries. Quorum-of-one: this
+ * client's own update key signs both entries. Idempotent at every stage, so
+ * re-approving the same code after any tear converges.
+ *
+ * @param options {object}
+ * @param options.request {EnrollmentRequest}   the parsed connect code
+ * @param options.clientWebvhKeys {ClientWebvhUpdateKeys}   the approving
+ *   client's own did:webvh update-key seeds
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   the approving
+ *   client's own (identity) key-agreement key, unwrapping each epoch for
+ *   re-wrapping
+ * @param options.pukRosterStore {MarkerStore}   the account's
+ *   `key-map/puk.json` marker store
+ * @param options.idStore {WebvhIdStore}   the account's `id` collection
+ * @returns {Promise<{ did: string }>}   the account's did:webvh
+ */
+export async function approveEnrollment({ request, clientWebvhKeys, clientKeyAgreementKey, pukRosterStore, idStore }) {
+    // Decryption material before authorization: the wrap lands first, so no
+    // enrolled client is ever authorized but blind.
+    await addPukRosterRecipient({
+        store: pukRosterStore,
+        recipient: {
+            id: enrollmentRecipientKid({ request }),
+            publicKeyMultibase: request.keyAgreementKeyMultibase
+        },
+        ownerKeyAgreementKey: clientKeyAgreementKey
+    });
+    return enrollWebvhClient({
+        idStore,
+        updateKeys: clientWebvhKeys,
+        newClient: request
+    });
+}
+/**
+ * ENROLLEE, step two (after the other client approves): verifies the
+ * enrollment from the world-readable log and performs this client's first
+ * roster read -- signed with its just-published `<did:webvh>#<multibase>`
+ * key -- to obtain the PUK.
+ *
+ * The portable core of the completion step: the caller supplies the account
+ * pointer (from its own keyring lookup) and persists what comes back -- the
+ * PUK, the roster epoch to pin, and the key set itself -- under its own unlock
+ * layer. After that, an ordinary unlock finds an enrolled client.
+ *
+ * Throws `EnrollmentPendingError` while the add entry is not published yet
+ * (complete again once the other client finishes); any integrity failure
+ * (a log that resolves to a different DID than the account pointer names, a
+ * missing roster wrap) throws its own error.
+ *
+ * @param options {object}
+ * @param options.clientSeed {Uint8Array}   from `mintEnrollmentRequest`
+ * @param options.webvhUpdateKeys {ClientWebvhUpdateKeys}   from
+ *   `mintEnrollmentRequest`
+ * @param options.pointer {AccountPointer}   the account pointer the enrollee's
+ *   keyring lookup recovered
+ * @returns {Promise<{ puk: Puk, latestEpochId: string }>}
+ */
+export async function completeEnrollmentCore({ clientSeed, webvhUpdateKeys, pointer }) {
+    const did = pointer.did;
+    if (!did || !isWebvhDid(did)) {
+        throw new Error('The account pointer names no did:webvh; only a promoted account can ' +
+            'enroll additional clients.');
+    }
+    const { keyAgent, keyAgreementKey } = await agentsFromSeed({
+        seed: clientSeed
+    });
+    // Verify the enrollment from the world-readable, self-certifying log: it
+    // must resolve to exactly the DID the account pointer names, and its
+    // document must list this client's keys -- the add entry has published.
+    const logUrl = new URL(`/space/${pointer.spaceId}/${ID_COLLECTION.id}/${DID_LOG_RESOURCE}`, pointer.host);
+    const response = await fetch(logUrl);
+    if (response.status === 404) {
+        throw new EnrollmentPendingError();
+    }
+    if (!response.ok) {
+        throw new Error(`Fetching the account's DID log failed (HTTP ${response.status}).`);
+    }
+    const resolved = await resolveDIDFromLog(readLogFromString(await response.text()));
+    if (resolved.meta.error || !resolved.did || !resolved.doc) {
+        throw new Error(`The account's DID log failed to resolve (${resolved.meta.error}).`);
+    }
+    if (resolved.did !== did) {
+        throw new Error('The published DID log resolves to a different DID than the account ' +
+            'pointer names.');
+    }
+    const signingMultibase = clientSigningKeyMultibase({ keyAgent });
+    const updateKey = await updateKeyMultibase({
+        seed: webvhUpdateKeys.updateSeed
+    });
+    const enrolled = (resolved.doc.verificationMethod ?? []).some(method => method.publicKeyMultibase === signingMultibase) && (resolved.meta.updateKeys ?? []).includes(updateKey);
+    if (!enrolled) {
+        throw new EnrollmentPendingError();
+    }
+    // The first roster read: signed with the `<did:webvh>#<multibase>` keyId
+    // the add entry just published, unwrapping the PUK the enrolling client
+    // escrowed to this client's key-agreement key.
+    const zcapClient = webvhZcapClient({ keyAgent, did });
+    const store = pukRosterMarkerStore({
+        storageServerUrl: pointer.host,
+        zcapClient,
+        spaceId: pointer.spaceId
+    });
+    const read = await readPukRoster({
+        store,
+        clientKeyAgreementKey: keyAgreementKey
+    });
+    if (!read) {
+        throw new Error('The account has no PUK roster; it must finish provisioning before ' +
+            'a client can be enrolled.');
+    }
+    return { puk: read.puk, latestEpochId: read.latestEpochId };
+}
+//# sourceMappingURL=enrollment.js.map

package/dist/enrollment/enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAGhF,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAI7D;;;GAGG;AACH,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAS9B;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YACE,OAAO,GAAG,6DAA6D;QACrE,oDAAoD;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EAGR;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACvE,OAAO,GAAG,mBAAmB,GAAG,cAAc,CAAC,MAAM,CACnD,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,EAAE,CAAA;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,IAAI,EAGL;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACjE,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EACJ,CAAC,EACD,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAAE,SAAS,EAC7B,wBAAwB,EACzB,GAAG,MAAiC,CAAA;IACrC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,MAAc,EAAE,IAAY,EAAU,EAAE;QAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAA;QAClE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IACD,OAAO;QACL,mBAAmB,EAAE,UAAU,CAC7B,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,CACd;QACD,wBAAwB,EAAE,UAAU,CAClC,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,CACpB;QACD,kBAAkB,EAAE,UAAU,CAC5B,SAAS,EACT,wBAAwB,EACxB,YAAY,CACb;QACD,wBAAwB,EAAE,UAAU,CAClC,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,CACpB;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EAGR;IACC,OAAO,WAAW,OAAO,CAAC,mBAAmB,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EAGR;IACC,OAAO,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAA;AAClF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAMzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,yBAAyB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IACD,OAAO;QACL,UAAU;QACV,eAAe;QACf,IAAI,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,SAAS,EAAE,QAAQ,CAAC,EAAE;KACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,OAAO,EAOR;IACC,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,qBAAqB,CAAC;QAC1B,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE;YACT,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC;YACvC,kBAAkB,EAAE,OAAO,CAAC,wBAAwB;SACrD;QACD,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IAEF,OAAO,iBAAiB,CAAC;QACvB,OAAO;QACP,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,OAAO;KACnB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EAKR;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,4BAA4B,CAC/B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,UAAU,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,EAAE,IAAI,gBAAgB,EAAE,EACnE,OAAO,CAAC,IAAI,CACb,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,CAAC,MAAM,IAAI,CACnE,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CACzC,CAAA;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,4CAA4C,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CACpE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gBAAgB,CACnB,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,UAAU;KACjC,CAAC,CAAA;IACF,MAAM,QAAQ,GACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB,CACzD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC;QACjC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC;QAC/B,KAAK;QACL,qBAAqB,EAAE,eAAe;KACvC,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAA;AAC7D,CAAC"}

package/dist/enrollment/index.d.ts

@@ -0,0 +1,20 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/enrollment` subpath: the client enrollment
+ * ceremony -- connecting another wallet client to an existing account with
+ * only public halves travelling, point to point.
+ *
+ * - `mintEnrollmentRequest` / `encodeEnrollmentRequest` /
+ *   `parseEnrollmentRequest` / `enrollmentClientDid` /
+ *   `enrollmentRecipientKid` -- the connect-code channel layer.
+ * - `approveEnrollment` -- the enrolling client's half, in the push order
+ *   (roster wrap, then the two did:webvh log entries).
+ * - `completeEnrollmentCore` -- the enrollee's half: verify from the published
+ *   log, read the roster, hand back the PUK and the epoch to pin. Persisting
+ *   the key set stays with the caller's own unlock layer.
+ */
+export { approveEnrollment, completeEnrollmentCore, encodeEnrollmentRequest, EnrollmentPendingError, enrollmentClientDid, enrollmentRecipientKid, mintEnrollmentRequest, parseEnrollmentRequest } from './enrollment.js';
+export type { EnrollmentRequest } from './enrollment.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/enrollment/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/enrollment/index.js

@@ -0,0 +1,19 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/enrollment` subpath: the client enrollment
+ * ceremony -- connecting another wallet client to an existing account with
+ * only public halves travelling, point to point.
+ *
+ * - `mintEnrollmentRequest` / `encodeEnrollmentRequest` /
+ *   `parseEnrollmentRequest` / `enrollmentClientDid` /
+ *   `enrollmentRecipientKid` -- the connect-code channel layer.
+ * - `approveEnrollment` -- the enrolling client's half, in the push order
+ *   (roster wrap, then the two did:webvh log entries).
+ * - `completeEnrollmentCore` -- the enrollee's half: verify from the published
+ *   log, read the roster, hand back the PUK and the epoch to pin. Persisting
+ *   the key set stays with the caller's own unlock layer.
+ */
+export { approveEnrollment, completeEnrollmentCore, encodeEnrollmentRequest, EnrollmentPendingError, enrollmentClientDid, enrollmentRecipientKid, mintEnrollmentRequest, parseEnrollmentRequest } from './enrollment.js';
+//# sourceMappingURL=index.js.map

package/dist/enrollment/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/enrollment/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA"}

package/dist/identity/index.d.ts

@@ -10,9 +10,6 @@
  *   single-key resolver) under the fixed bootstrap handle / key name.
  * - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
  *   app-side derivations such as a keyring unlock identity).
- * - `deriveCollectionKeys` -- per-collection vault-key (KAK) derivation:
- *   `HKDF-SHA256(master seed, 'kak:v1:<collectionId>')` to a per-collection
- *   seed, then the Ed25519-to-X25519 key-agreement key plus its resolver.
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * x25519 dependency graph (the same isolation pattern as `./request`).
@@ -20,6 +17,4 @@
 export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromSecret, agentsFromSeed } from './agents.js';
 export type { ProfileAgents } from './agents.js';
 export { singleKeyResolver } from './keyResolver.js';
-export { deriveCollectionKeys, DEFAULT_KAK_HANDLE } from './collectionKeys.js';
-export type { CollectionKeys } from './collectionKeys.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC9E,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/identity/index.js

@@ -10,14 +10,10 @@
  *   single-key resolver) under the fixed bootstrap handle / key name.
  * - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
  *   app-side derivations such as a keyring unlock identity).
- * - `deriveCollectionKeys` -- per-collection vault-key (KAK) derivation:
- *   `HKDF-SHA256(master seed, 'kak:v1:<collectionId>')` to a per-collection
- *   seed, then the Ed25519-to-X25519 key-agreement key plus its resolver.
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * x25519 dependency graph (the same isolation pattern as `./request`).
  */
 export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromSecret, agentsFromSeed } from './agents.js';
 export { singleKeyResolver } from './keyResolver.js';
-export { deriveCollectionKeys, DEFAULT_KAK_HANDLE } from './collectionKeys.js';
 //# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/index.d.ts

@@ -16,11 +16,24 @@
  *   `interaction:` URL handling).
  * - `@interop/wallet-core/display` -- pure VC derivation / display helpers and
  *   credential input parsing (raw values out; formatting stays in the UI).
+ * - `@interop/wallet-core/webvh` -- the account's did:webvh identity: the
+ *   hosted DID log, its per-client update-key rotation, the client enrollment
+ *   entries, and ZCap signing under the did:webvh verification-method id.
+ * - `@interop/wallet-core/keys` -- the per-user key (PUK) and its
+ *   `key-map/puk.json` wrap-set roster.
+ * - `@interop/wallet-core/markers` -- collection-encryption marker
+ *   acquisition (fetch / cache / offline fallback) and the unknown-epoch
+ *   refresh policy, including a self-refreshing EDV document cipher.
+ * - `@interop/wallet-core/keyring` -- the unlock layer: the unlock derivation,
+ *   the account-pointer record codec, and the unlock Space.
+ * - `@interop/wallet-core/enrollment` -- the client enrollment ceremony
+ *   (connect code, approval, completion).
  *
  * This root re-exports `sync` and `space` for convenience. `identity`,
- * `request`, and `display` are deliberately NOT re-exported here, so plaintext
- * consumers of the root never pull the signing / KMS / document-loader
- * dependency graph (the was-client subpath-isolation pattern).
+ * `request`, `display`, `webvh`, `keys`, `markers`, `keyring`, and
+ * `enrollment` are deliberately NOT re-exported here, so plaintext consumers
+ * of the root never pull the signing / KMS / document-loader dependency graph
+ * (the was-client subpath-isolation pattern).
  */
 export * from './sync/index.js';
 export * from './space/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/dist/index.js

@@ -16,11 +16,24 @@
  *   `interaction:` URL handling).
  * - `@interop/wallet-core/display` -- pure VC derivation / display helpers and
  *   credential input parsing (raw values out; formatting stays in the UI).
+ * - `@interop/wallet-core/webvh` -- the account's did:webvh identity: the
+ *   hosted DID log, its per-client update-key rotation, the client enrollment
+ *   entries, and ZCap signing under the did:webvh verification-method id.
+ * - `@interop/wallet-core/keys` -- the per-user key (PUK) and its
+ *   `key-map/puk.json` wrap-set roster.
+ * - `@interop/wallet-core/markers` -- collection-encryption marker
+ *   acquisition (fetch / cache / offline fallback) and the unknown-epoch
+ *   refresh policy, including a self-refreshing EDV document cipher.
+ * - `@interop/wallet-core/keyring` -- the unlock layer: the unlock derivation,
+ *   the account-pointer record codec, and the unlock Space.
+ * - `@interop/wallet-core/enrollment` -- the client enrollment ceremony
+ *   (connect code, approval, completion).
  *
  * This root re-exports `sync` and `space` for convenience. `identity`,
- * `request`, and `display` are deliberately NOT re-exported here, so plaintext
- * consumers of the root never pull the signing / KMS / document-loader
- * dependency graph (the was-client subpath-isolation pattern).
+ * `request`, `display`, `webvh`, `keys`, `markers`, `keyring`, and
+ * `enrollment` are deliberately NOT re-exported here, so plaintext consumers
+ * of the root never pull the signing / KMS / document-loader dependency graph
+ * (the was-client subpath-isolation pattern).
  */
 export * from './sync/index.js';
 export * from './space/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/dist/keyring/fetch.d.ts

@@ -0,0 +1,22 @@
+import type { UnlockKdf } from './kdf.js';
+import type { KeyringRecordContents } from './record.js';
+/**
+ * Fetches and unwraps the keyring record an unlock secret addresses, or
+ * resolves `null` when no record exists there (an unknown secret). The derived
+ * unlock Space id is returned alongside the contents -- it is already computed,
+ * and callers key their local state on it.
+ *
+ * @param options {object}
+ * @param options.secret {string | Uint8Array}   the unlock secret
+ * @param [options.kdf] {UnlockKdf}   the unlock method's parameter set
+ * @param options.storageServerUrl {string}   the WAS server origin
+ * @returns {Promise<(KeyringRecordContents & { unlockSpaceId: string }) | null>}
+ */
+export declare function fetchKeyringRecord({ secret, kdf, storageServerUrl }: {
+    secret: string | Uint8Array;
+    kdf?: UnlockKdf;
+    storageServerUrl: string;
+}): Promise<(KeyringRecordContents & {
+    unlockSpaceId: string;
+}) | null>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/keyring/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/keyring/fetch.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAIzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAExD;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,GAAiB,EACjB,gBAAgB,EACjB,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,CAAC,EAAE,SAAS,CAAA;IACf,gBAAgB,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC,CAAC,qBAAqB,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC,CAkBtE"}