@interop/wallet-core 0.50.0 → 0.52.1

package/dist/resourceLog/index.js

@@ -2,28 +2,23 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/wallet-core/resourceLog` entry: the client side of the
- * Resource Log Profile (App Connect spec `#resource-log-profile`) -- full
- * chain verification against an adversarial host (parse shape, SCID and
- * entry-hash recomputation, entry proofs, the external-authorization rule
- * against the independently verified did:webvh controller document, terminal
- * entries), the ceremony-tail license on ladder-signed appends, the
- * chain-head pin with its continuity rules, the append path (verified-head
- * build, CAS with rebase-and-retry, read-back confirmation), and the sealing
- * sweep (the idempotent backstop append that re-anchors a log's head past
- * the controller's latest membership change).
- * Transport (JSON Lines, the store seam, the projection write) lives in
- * `@interop/was-client/log`; the hashing and proof kernel in
- * `@interop/did-method-webvh`. Kept out of the root export: this subpath
- * pulls the did:webvh and ed25519 dependency graph.
+ * The `@interop/wallet-core/resourceLog` entry: the wallet-domain residue of
+ * the Resource Log Profile's client side after the generic half moved to
+ * `@interop/vh-resource-log` -- the did:webvh controller adapter (the
+ * library's controller port extended with the per-version
+ * credential-inventory view, supplying the mandatory `admitAppend` admission
+ * hook), and the ceremony-tail license the hook carries
+ * (`assertLadderAppendLicensed`, refusing with `ResourceLogLicenseError`).
+ * Everything generic -- the JSON Lines codec, the store port and
+ * `confirmAppend`, chain verification, the chain-head pin
+ * (`ResourceLogPinStore` and `resourceLogPinId`; the named slot-key builders
+ * stay on their owning subpaths: `accountLogPinId` in `webvh`,
+ * `userKeyRosterPinId` in `keys`, `clientAnnexLogPinId` in `clientAnnex`),
+ * the append path, and the sealing sweep -- lives in the library, and this
+ * subpath re-exports none of it: one owner per name. Kept out of the root
+ * export: this subpath pulls the did:webvh and ed25519 dependency graph.
  */
 export { webvhResourceLogController } from './controller.js';
-export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError, ResourceLogLicenseError } from './errors.js';
+export { ResourceLogLicenseError } from './errors.js';
 export { assertLadderAppendLicensed } from './license.js';
-export { buildResourceLogEntry, buildResourceLogGenesis } from './entry.js';
-export { memoryResourceLogPinStore, resourceLogPinId } from './pin.js';
-export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover } from './verify.js';
-export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
-export { latestAssertionRemovalIndex, sealResourceLog } from './seal.js';
-export { vmFragmentOf } from './vmFragment.js';
 //# sourceMappingURL=index.js.map

package/dist/resourceLog/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,0BAA0B,EAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAGjB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,0BAA0B,EAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA"}

package/dist/resourceLog/license.d.ts

@@ -6,39 +6,40 @@
  * of the ladder VM's authority clauses). A ladder-signed append is accepted
  * in exactly two shapes: the log's first entry (creation, never extension --
  * callers admit that shape by not calling this check on a genesis entry),
- * or a rotation anchored at a posture-changing controller-document version,
- * one-shot -- refused when the verified log head already carries an entry
- * anchored at that version or later. Everything else, above all a rotation
+ * or a rotation that carries an inventory-changing controller document
+ * version, one-shot -- refused when the verified log head already carries
+ * an entry at that version or later. Everything else, above all a rotation
  * against an unchanged document (the silent-rekey shape), is refused with
- * {@link ResourceLogLicenseError}. Anchors compare by position in the
- * controller's verified version history, the structural twin of the sealing
- * sweep's `headAnchorIndex >= removalIndex` check.
+ * {@link ResourceLogLicenseError}. Controller versions compare by position
+ * in the controller's verified version history, the structural twin of the
+ * sealing sweep's `headControllerVersionIndex >= removalIndex` check.
  */
-import type { ResourceLogController } from './controller.js';
+import type { WebvhResourceLogController } from './controller.js';
 /**
  * Evaluates the ceremony-tail license's second shape for one ladder-signed
- * append: the append must anchor at a posture-changing document version V --
- * S(V) differs from S(V-1) in either direction, with S(-1) empty for a
- * genesis-version anchor -- and no verified entry may already anchor at V or
- * later (`headAnchorIndex >= anchorIndex` refuses; the license is one-shot,
- * so a torn ceremony's late-arriving tail still passes while a second
- * rotation against the same anchor does not). A `null` anchor index (an
- * unversioned controller, where no anchor exists to license against) is
- * refused fail-closed.
+ * append: the append must carry an inventory-changing document version V --
+ * S(V) differs from S(V-1) in either direction, with S(-1) empty for the
+ * genesis version -- and no verified entry may already carry V or later
+ * (`headControllerVersionIndex >= controllerVersionIndex` refuses; the
+ * license is one-shot, so a torn ceremony's late-arriving tail still passes
+ * while a second rotation against the same version does not). A `null`
+ * controller version index (an unversioned controller, where no version
+ * exists to license against) is refused fail-closed.
  *
  * @param options {object}
- * @param options.controller {ResourceLogController}   the verified controller
- *   view
- * @param options.anchorIndex {number | null}   the append's anchor as an
- *   index into `controller.versionIds` (`null`: unanchored)
- * @param options.headAnchorIndex {number | null}   the verified log head's
- *   effective anchor before this append (`null`: the log has no anchored
- *   entries yet)
+ * @param options.controller {object}   the verified controller view's
+ *   version list and inventory accessor
+ * @param options.controllerVersionIndex {number | null}   the append's
+ *   controller version as an index into `controller.versionIds` (`null`:
+ *   no controller version)
+ * @param options.headControllerVersionIndex {number | null}   the verified
+ *   log head's effective controller version index before this append
+ *   (`null`: the log has no versioned entries yet)
  * @returns {Promise<void>}
  */
-export declare function assertLadderAppendLicensed({ controller, anchorIndex, headAnchorIndex }: {
-    controller: ResourceLogController;
-    anchorIndex: number | null;
-    headAnchorIndex: number | null;
+export declare function assertLadderAppendLicensed({ controller, controllerVersionIndex, headControllerVersionIndex }: {
+    controller: Pick<WebvhResourceLogController, 'versionIds' | 'inventoryAt'>;
+    controllerVersionIndex: number | null;
+    headControllerVersionIndex: number | null;
 }): Promise<void>;
 //# sourceMappingURL=license.d.ts.map

package/dist/resourceLog/license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAsB5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,UAAU,EACV,WAAW,EACX,eAAe,EAChB,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB"}
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAsBjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,UAAU,EACV,sBAAsB,EACtB,0BAA0B,EAC3B,EAAE;IACD,UAAU,EAAE,IAAI,CAAC,0BAA0B,EAAE,YAAY,GAAG,aAAa,CAAC,CAAA;IAC1E,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB"}

package/dist/resourceLog/license.js

@@ -1,6 +1,6 @@
 import { ResourceLogLicenseError } from './errors.js';
 /**
- * Set equality over posture members.
+ * Set equality over inventory members.
  *
  * @param left {Set<string>}
  * @param right {Set<string>}
@@ -19,45 +19,46 @@ function setsEqual(left, right) {
 }
 /**
  * Evaluates the ceremony-tail license's second shape for one ladder-signed
- * append: the append must anchor at a posture-changing document version V --
- * S(V) differs from S(V-1) in either direction, with S(-1) empty for a
- * genesis-version anchor -- and no verified entry may already anchor at V or
- * later (`headAnchorIndex >= anchorIndex` refuses; the license is one-shot,
- * so a torn ceremony's late-arriving tail still passes while a second
- * rotation against the same anchor does not). A `null` anchor index (an
- * unversioned controller, where no anchor exists to license against) is
- * refused fail-closed.
+ * append: the append must carry an inventory-changing document version V --
+ * S(V) differs from S(V-1) in either direction, with S(-1) empty for the
+ * genesis version -- and no verified entry may already carry V or later
+ * (`headControllerVersionIndex >= controllerVersionIndex` refuses; the
+ * license is one-shot, so a torn ceremony's late-arriving tail still passes
+ * while a second rotation against the same version does not). A `null`
+ * controller version index (an unversioned controller, where no version
+ * exists to license against) is refused fail-closed.
  *
  * @param options {object}
- * @param options.controller {ResourceLogController}   the verified controller
- *   view
- * @param options.anchorIndex {number | null}   the append's anchor as an
- *   index into `controller.versionIds` (`null`: unanchored)
- * @param options.headAnchorIndex {number | null}   the verified log head's
- *   effective anchor before this append (`null`: the log has no anchored
- *   entries yet)
+ * @param options.controller {object}   the verified controller view's
+ *   version list and inventory accessor
+ * @param options.controllerVersionIndex {number | null}   the append's
+ *   controller version as an index into `controller.versionIds` (`null`:
+ *   no controller version)
+ * @param options.headControllerVersionIndex {number | null}   the verified
+ *   log head's effective controller version index before this append
+ *   (`null`: the log has no versioned entries yet)
  * @returns {Promise<void>}
  */
-export async function assertLadderAppendLicensed({ controller, anchorIndex, headAnchorIndex }) {
-    if (anchorIndex === null ||
-        anchorIndex < 0 ||
-        anchorIndex >= controller.versionIds.length) {
+export async function assertLadderAppendLicensed({ controller, controllerVersionIndex, headControllerVersionIndex }) {
+    if (controllerVersionIndex === null ||
+        controllerVersionIndex < 0 ||
+        controllerVersionIndex >= controller.versionIds.length) {
         throw new ResourceLogLicenseError('A ladder-signed append past the genesis entry cannot be licensed ' +
-            'without an anchor into the controller document version history.');
+            'without a controller document version to license against.');
     }
-    const current = (await controller.postureAt(controller.versionIds[anchorIndex])).postureKeys;
-    const previous = anchorIndex === 0
+    const current = (await controller.inventoryAt(controller.versionIds[controllerVersionIndex])).inventoryKeys;
+    const previous = controllerVersionIndex === 0
         ? new Set()
-        : (await controller.postureAt(controller.versionIds[anchorIndex - 1]))
-            .postureKeys;
+        : (await controller.inventoryAt(controller.versionIds[controllerVersionIndex - 1])).inventoryKeys;
     if (setsEqual(current, previous)) {
-        throw new ResourceLogLicenseError('The ladder-signed append anchors at a controller document version ' +
-            'that did not change the credential posture (a rotation against an ' +
+        throw new ResourceLogLicenseError('The ladder-signed append carries a controller document version ' +
+            'that did not change the credential inventory (a rotation against an ' +
             'unchanged document is never licensed).');
     }
-    if (headAnchorIndex !== null && headAnchorIndex >= anchorIndex) {
-        throw new ResourceLogLicenseError('The verified log head already carries an entry anchored at or past ' +
-            'this posture-changing document version (the license is one-shot).');
+    if (headControllerVersionIndex !== null &&
+        headControllerVersionIndex >= controllerVersionIndex) {
+        throw new ResourceLogLicenseError('The verified log head already carries an entry at or past this ' +
+            'inventory-changing document version (the license is one-shot).');
     }
 }
 //# sourceMappingURL=license.js.map

package/dist/resourceLog/license.js.map

@@ -1 +1 @@
-{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,UAAU,EACV,WAAW,EACX,eAAe,EAKhB;IACC,IACE,WAAW,KAAK,IAAI;QACpB,WAAW,GAAG,CAAC;QACf,WAAW,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE;YACjE,iEAAiE,CACpE,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CACd,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAE,CAAC,CAChE,CAAC,WAAW,CAAA;IACb,MAAM,QAAQ,GACZ,WAAW,KAAK,CAAC;QACf,CAAC,CAAC,IAAI,GAAG,EAAU;QACnB,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAE,CAAC,CAAC;aAClE,WAAW,CAAA;IACpB,IAAI,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAC/B,oEAAoE;YAClE,oEAAoE;YACpE,wCAAwC,CAC3C,CAAA;IACH,CAAC;IACD,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,IAAI,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,qEAAqE;YACnE,mEAAmE,CACtE,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,UAAU,EACV,sBAAsB,EACtB,0BAA0B,EAK3B;IACC,IACE,sBAAsB,KAAK,IAAI;QAC/B,sBAAsB,GAAG,CAAC;QAC1B,sBAAsB,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE;YACjE,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CACd,MAAM,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAE,CAAC,CAC7E,CAAC,aAAa,CAAA;IACf,MAAM,QAAQ,GACZ,sBAAsB,KAAK,CAAC;QAC1B,CAAC,CAAC,IAAI,GAAG,EAAU;QACnB,CAAC,CAAC,CACE,MAAM,UAAU,CAAC,WAAW,CAC1B,UAAU,CAAC,UAAU,CAAC,sBAAsB,GAAG,CAAC,CAAE,CACnD,CACF,CAAC,aAAa,CAAA;IACrB,IAAI,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YAC/D,sEAAsE;YACtE,wCAAwC,CAC3C,CAAA;IACH,CAAC;IACD,IACE,0BAA0B,KAAK,IAAI;QACnC,0BAA0B,IAAI,sBAAsB,EACpD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YAC/D,gEAAgE,CACnE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/unlock/index.d.ts

@@ -4,7 +4,7 @@
 /**
  * The `@interop/wallet-core/unlock` subpath: standing unlock credentials --
  * every unlock method (passphrase, passkey PRF, recovery code) as a standing
- * credential in the recovery-code posture, with self-enrolling login. The
+ * credential in the recovery-code configuration, with self-enrolling login. The
  * recovery subpath's spend-on-use flows sit on top of the machinery here.
  *
  * - `standingClientFromUnlockSeed` / `unlockClientIdentityFromSeed` -- the
@@ -16,17 +16,17 @@
  *   client-annex Space `delegatedClients` delegations re-mintable; the ladder
  *   seed sealed and carried verbatim, its `LADDER_SEED_BYTES` size owned by
  *   the record format).
- * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
+ * - `publishUnlockKey` / `removeUnlockKey` -- the merged document inventory
  *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
  *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
  * - `retireUnlockCredential` -- the retirement ceremony behind "change my
- *   passphrase" and "remove this passkey": the posture edit, then the shared
+ *   passphrase" and "remove this passkey": the inventory edit, then the shared
  *   roster rotation and collection fan-out off the retired credential's wrap.
  *
  * The ladder itself, and every ceremony that exercises it (the ladder-anchored
  * genesis, self-enrollment, the forget ceremony), live in
- * `@interop/wallet-core/clientAnnex` -- what stays here is the posture and
- * record machinery every wallet needs regardless of posture.
+ * `@interop/wallet-core/clientAnnex` -- what stays here is the inventory and
+ * record machinery every wallet needs regardless of account configuration.
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * was-client dependency graph (the same isolation pattern as `./keyring`).
@@ -38,5 +38,5 @@ export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, Unlo
 export { publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export type { StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
 export { retireUnlockCredential } from './retire.js';
-export type { ClientAnnexPostureRetirement, UnlockCredentialRetirementResult } from './retire.js';
+export type { ClientAnnexInventoryRetirement, UnlockCredentialRetirementResult } from './retire.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/unlock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,4BAA4B,EAC5B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}

package/dist/unlock/index.js

@@ -4,7 +4,7 @@
 /**
  * The `@interop/wallet-core/unlock` subpath: standing unlock credentials --
  * every unlock method (passphrase, passkey PRF, recovery code) as a standing
- * credential in the recovery-code posture, with self-enrolling login. The
+ * credential in the recovery-code configuration, with self-enrolling login. The
  * recovery subpath's spend-on-use flows sit on top of the machinery here.
  *
  * - `standingClientFromUnlockSeed` / `unlockClientIdentityFromSeed` -- the
@@ -16,17 +16,17 @@
  *   client-annex Space `delegatedClients` delegations re-mintable; the ladder
  *   seed sealed and carried verbatim, its `LADDER_SEED_BYTES` size owned by
  *   the record format).
- * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
+ * - `publishUnlockKey` / `removeUnlockKey` -- the merged document inventory
  *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
  *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
  * - `retireUnlockCredential` -- the retirement ceremony behind "change my
- *   passphrase" and "remove this passkey": the posture edit, then the shared
+ *   passphrase" and "remove this passkey": the inventory edit, then the shared
  *   roster rotation and collection fan-out off the retired credential's wrap.
  *
  * The ladder itself, and every ceremony that exercises it (the ladder-anchored
  * genesis, self-enrollment, the forget ceremony), live in
- * `@interop/wallet-core/clientAnnex` -- what stays here is the posture and
- * record machinery every wallet needs regardless of posture.
+ * `@interop/wallet-core/clientAnnex` -- what stays here is the inventory and
+ * record machinery every wallet needs regardless of account configuration.
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * was-client dependency graph (the same isolation pattern as `./keyring`).

package/dist/unlock/retire.d.ts

@@ -6,10 +6,10 @@
  * passphrase" and "remove this passkey", run synchronously in an enrolled
  * client, in dependency order. A standing credential is not a stored string to
  * overwrite -- it holds a wrap in the user key roster and a `keyAgreement`
- * posture in the account's did:webvh document -- so retiring one is a real
+ * inventory in the account's did:webvh document -- so retiring one is a real
  * rotation, on the same stages the client-revocation cascade runs.
  *
- * 1. **The document posture edit** (`removeUnlockKey`): the credential's
+ * 1. **The document inventory edit** (`removeUnlockKey`): the credential's
  *    `keyAgreement` entry (verbatim key or commitment) and its committed
  *    update-key hash leave the document in one log entry. That kills the
  *    credential's latent self-enrollment authority -- with its rung
@@ -26,7 +26,7 @@
  * first means a run torn anywhere after it leaves the roster keying a
  * recipient the document no longer backs -- exactly the state the login-time
  * sweep detects and finishes. Torn the other way around, a rotation with the
- * posture still standing would simply re-escrow the credential and look
+ * inventory still standing would simply re-escrow the credential and look
  * healthy.
  *
  * There is deliberately no recovery-delegation re-mint stage here (the
@@ -36,7 +36,7 @@
  * credential's bridge chains through it.
  *
  * The client annex reach is its own stage (1b, the injected
- * `retireClientAnnexPosture` closure), between the document edit and the
+ * `retireClientAnnexInventory` closure), between the document edit and the
  * roster tail: a standing credential's annex rung-0 key and hash live in
  * the pointed generation's log, kept nowhere the account document edit can
  * reach, so without it a retired credential keeps annex-write authority
@@ -49,12 +49,13 @@
  * `delegatedClients` sibling: no server revocation is possible or needed --
  * the sibling delegation's record dies with the unlock Space the caller
  * deletes, and a swap (or the ordinary GC cadence) retires the generation it
- * targeted. Best-effort by contract: the closure catches its own failures
- * and reports them, so the roster rotation -- the ceremony's essential
- * remedy -- always runs.
+ * targeted. Best-effort by contract, enforced by the ceremony itself: a
+ * throw escaping the closure is caught here and reported as the `failed`
+ * skip, so the roster rotation -- the ceremony's essential remedy -- always
+ * runs.
  *
  * Convergence is the design: every stage detects its own completion from
- * durable state alone -- the posture edit no-ops when the document is already
+ * durable state alone -- the inventory edit no-ops when the document is already
  * settled, the rotation no-ops once every current-epoch recipient is
  * document-backed, and a collection is stale exactly when its current epoch
  * names a non-current user key generation -- so a naive full re-run finishes
@@ -76,7 +77,7 @@ import { type StandingUnlockKeys } from './standingWebvh.js';
  * this run (a re-run of an already-complete retirement reports `false`), the
  * roster's seal-backstop report (present when the roster store is sealable and
  * the roster stage ran), the per-collection fan-out result, the document as
- * the posture edit left it, and the rotated key with the roster descriptor it
+ * the inventory edit left it, and the rotated key with the roster descriptor it
  * was read from.
  */
 export interface UnlockCredentialRetirementResult {
@@ -86,40 +87,40 @@ export interface UnlockCredentialRetirementResult {
     document: object;
     userKey?: UserKey;
     rosterDescriptor?: CollectionEncryption;
-    clientAnnex?: ClientAnnexPostureRetirement;
+    clientAnnex?: ClientAnnexInventoryRetirement;
 }
 /**
- * What the annex-posture stage reports: `struck` (a strike entry dropped
+ * What the annex-inventory stage reports: `struck` (a strike entry dropped
  * the retired rung's key and hash), `swapped` (a fresh generation replaced
- * the old one wholesale), `clean` (the pointed generation held no posture
+ * the old one wholesale), `clean` (the pointed generation held no inventory
  * for the retired credential), or `skipped` with the reason (`no-pointer`:
- * the account has no annex posture; `no-ladder-seed`: the ceremony holds
- * no seed that could strike or swap; `failed`: the closure's best-effort
- * catch).
+ * the account has no annex inventory; `no-ladder-seed`: the ceremony holds
+ * no seed that could strike or swap; `failed`: the closure reported a
+ * failure, or threw and the ceremony caught it).
  */
-export interface ClientAnnexPostureRetirement {
+export interface ClientAnnexInventoryRetirement {
     action: 'struck' | 'swapped' | 'clean' | 'skipped';
     reason?: 'no-pointer' | 'no-ladder-seed' | 'failed';
 }
 /**
  * Retires one standing unlock credential from an account. See the module doc
- * for the order and the convergence story. Once the posture edit lands, a
+ * for the order and the convergence story. Once the inventory edit lands, a
  * thrown later stage leaves durable state a naive re-run -- or the login-time
  * sweep -- converges from.
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
  * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
- *   client's own did:webvh update-key seeds, which sign the posture edit
+ *   client's own did:webvh update-key seeds, which sign the inventory edit
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
- *   public posture (its key-agreement publication and its recorded update
- *   key, which the posture edit treats as a ladder anchor rather than truth
+ *   public inventory (its key-agreement publication and its recorded update
+ *   key, which the inventory edit treats as a ladder anchor rather than truth
  *   -- see `removeUnlockKey`)
  * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
  *   seed, when the ceremony holds the credential's secret; it strengthens the
  *   ladder attribution but is not required
  * @param [options.expectedDid] {string}   the account DID from the caller's
- *   stored account pointer; supplied, the posture edit refuses a `did.jsonl`
+ *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
@@ -134,16 +135,16 @@ export interface ClientAnnexPostureRetirement {
  *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
  *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
- * @param [options.retireClientAnnexPosture] {Function}   `({ document }) =>
- *   Promise<ClientAnnexPostureRetirement>` -- the annex reach (stage 1b in
- *   the module doc), run against the post-edit document; expected to catch
- *   its own failures and report them
+ * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
+ *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
+ *   the module doc), run against the post-edit document; a throw is caught
+ *   and reported as `{ action: 'skipped', reason: 'failed' }`
  * @param [options.onRotationAdopted] {Function}   `({ userKey }) =>
  *   Promise<void>` -- the live-session adoption of a rotated key, run last so
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexPosture, onRotationAdopted }: {
+export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexInventory, onRotationAdopted }: {
     idStore: WebvhIdStore;
     updateKeys: ClientWebvhUpdateKeys;
     unlockKeys: StandingUnlockKeys;
@@ -160,9 +161,9 @@ export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys
         descriptor: CollectionEncryption;
     }) => Promise<void>;
     collections: CascadeCollections;
-    retireClientAnnexPosture?: (options: {
+    retireClientAnnexInventory?: (options: {
         document: object;
-    }) => Promise<ClientAnnexPostureRetirement>;
+    }) => Promise<ClientAnnexInventoryRetirement>;
     onRotationAdopted?: (rotation: {
         userKey: UserKey;
     }) => Promise<void>;

package/dist/unlock/retire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,4BAA4B,CAAA;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC3C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAyD5C"}
+{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,8BAA8B,CAAA;CAC7C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAiE5C"}

package/dist/unlock/retire.js

@@ -2,23 +2,23 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
 import { removeUnlockKey } from './standingWebvh.js';
 /**
  * Retires one standing unlock credential from an account. See the module doc
- * for the order and the convergence story. Once the posture edit lands, a
+ * for the order and the convergence story. Once the inventory edit lands, a
  * thrown later stage leaves durable state a naive re-run -- or the login-time
  * sweep -- converges from.
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
  * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
- *   client's own did:webvh update-key seeds, which sign the posture edit
+ *   client's own did:webvh update-key seeds, which sign the inventory edit
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
- *   public posture (its key-agreement publication and its recorded update
- *   key, which the posture edit treats as a ladder anchor rather than truth
+ *   public inventory (its key-agreement publication and its recorded update
+ *   key, which the inventory edit treats as a ladder anchor rather than truth
  *   -- see `removeUnlockKey`)
  * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
  *   seed, when the ceremony holds the credential's secret; it strengthens the
  *   ladder attribution but is not required
  * @param [options.expectedDid] {string}   the account DID from the caller's
- *   stored account pointer; supplied, the posture edit refuses a `did.jsonl`
+ *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
@@ -33,17 +33,17 @@ import { removeUnlockKey } from './standingWebvh.js';
  *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
  *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
- * @param [options.retireClientAnnexPosture] {Function}   `({ document }) =>
- *   Promise<ClientAnnexPostureRetirement>` -- the annex reach (stage 1b in
- *   the module doc), run against the post-edit document; expected to catch
- *   its own failures and report them
+ * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
+ *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
+ *   the module doc), run against the post-edit document; a throw is caught
+ *   and reported as `{ action: 'skipped', reason: 'failed' }`
  * @param [options.onRotationAdopted] {Function}   `({ userKey }) =>
  *   Promise<void>` -- the live-session adoption of a rotated key, run last so
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexPosture, onRotationAdopted }) {
-    // 1. The document posture edit -- the credential's standing, first. It
+export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexInventory, onRotationAdopted }) {
+    // 1. The document inventory edit -- the credential's standing, first. It
     // resolves the document as it now stands, which is what stage 2 resolves
     // its remaining recipients from.
     const { did, doc, log } = await removeUnlockKey({
@@ -55,10 +55,19 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         ...(verb !== undefined ? { verb } : {})
     });
     // 1b. The annex reach, against the post-edit document: strike the
-    // retired credential's rung posture out of the pointed generation, or swap
-    // the generation out from under it. Best-effort by the closure's own
-    // contract, so the roster rotation below always runs.
-    const clientAnnex = await retireClientAnnexPosture?.({ document: doc });
+    // retired credential's rung inventory out of the pointed generation, or swap
+    // the generation out from under it. Best-effort by contract, enforced here:
+    // a throw escaping the closure maps to the `failed` skip, so the roster
+    // rotation below always runs.
+    let clientAnnex;
+    if (retireClientAnnexInventory) {
+        try {
+            clientAnnex = await retireClientAnnexInventory({ document: doc });
+        }
+        catch {
+            clientAnnex = { action: 'skipped', reason: 'failed' };
+        }
+    }
     // 2. The shared roster-and-cascade tail: the roster rotation onto the
     // post-edit document (with its post-edit controller floor and its seal
     // backstop), then the collection fan-out onto the fresh key.
@@ -74,7 +83,7 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         collections
     });
     if (!tail.rosterDescriptor || !tail.userKey) {
-        // No roster to rotate: the posture edit has landed, so the credential IS
+        // No roster to rotate: the inventory edit has landed, so the credential IS
         // retired -- a completed ceremony with nothing rotated.
         return {
             rotated: false,

package/dist/unlock/retire.js.map

@@ -1 +1 @@
-{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAsEA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,eAAe,EAA2B,MAAM,oBAAoB,CAAA;AAkC7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAsBlB;IACC,uEAAuE;IACvE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,eAAe,CAAC;QAC9C,OAAO;QACP,UAAU;QACV,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,kEAAkE;IAClE,2EAA2E;IAC3E,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,WAAW,GAAG,MAAM,wBAAwB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAEvE,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,yEAAyE;QACzE,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAA;AACH,CAAC"}
+{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAuEA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,eAAe,EAA2B,MAAM,oBAAoB,CAAA;AAkC7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAsBlB;IACC,yEAAyE;IACzE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,eAAe,CAAC;QAC9C,OAAO;QACP,UAAU;QACV,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,WAAuD,CAAA;IAC3D,IAAI,0BAA0B,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,0BAA0B,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAA;AACH,CAAC"}

package/dist/unlock/standingClient.d.ts

@@ -32,7 +32,7 @@ export interface UnlockClientIdentity {
  * Assembles a client identity from its 32-byte client seed: the one place the
  * agents, multibases, and roster kid are derived, shared by the standing
  * credential derivation here and the recovery code's
- * (`recoveryClientFromCode`), so the two postures can never disagree on how a
+ * (`recoveryClientFromCode`), so the two derivations can never disagree on how a
  * seed becomes an identity.
  *
  * @param options {object}

package/dist/unlock/standingClient.js

@@ -4,8 +4,8 @@
 /**
  * The standing unlock credential's client identity: the deterministic key set
  * every unlock method (a passphrase, a passkey PRF output) derives from its
- * own unlock seed under the standing-credential posture -- the recovery-code
- * posture minus spend-on-use. The credential's key-agreement key holds a
+ * own unlock seed under the standing-credential configuration -- the recovery-code
+ * configuration minus spend-on-use. The credential's key-agreement key holds a
  * standing wrap in the user key roster (escrowed into every epoch, kept alive
  * by rotation fan-out), and its binding MAC key authenticates the unlock
  * record's account core, so a fresh browser holding nothing but the
@@ -37,7 +37,7 @@ const STANDING_BINDING_MAC_INFO = 'binding-mac';
  * Assembles a client identity from its 32-byte client seed: the one place the
  * agents, multibases, and roster kid are derived, shared by the standing
  * credential derivation here and the recovery code's
- * (`recoveryClientFromCode`), so the two postures can never disagree on how a
+ * (`recoveryClientFromCode`), so the two derivations can never disagree on how a
  * seed becomes an identity.
  *
  * @param options {object}