@interop/wallet-core 0.51.0 → 0.52.1

package/dist/resourceLog/errors.js

@@ -2,77 +2,24 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The resource-log refusal taxonomy, carried over from the roster's WC-1
- * detached-signature design onto the log design. Two adversarial classes plus
- * two admission refusals:
- *
- * - {@link ResourceLogIntegrityError} -- fabrication: the served log fails
- *   verification on its own terms (parse shape, SCID, chain hashes, proofs,
- *   or the external-authorization rule). Whoever produced it could not make a
- *   log the account's clients would have made.
- * - {@link ResourceLogContinuityError} -- a served log that verifies but
- *   conflicts with what this client has already accepted: a rollback behind
- *   the chain-head pin, a fork off the pinned history, or an SCID/method
- *   switch outside a verified handover. The log may be internally consistent;
- *   it is not the continuation of the history this client pinned.
- * - {@link ResourceLogClosedError} -- an append refused because the verified
- *   head is a terminal handover entry. Not an attack: the log's own authors
- *   closed it, and a verifier of this profile must refuse to extend a closed
- *   log even though nothing currently emits terminal entries.
- * - {@link ResourceLogLicenseError} -- a ladder-signed append outside the
- *   ceremony-tail license. An admission refusal, not log corruption: the
- *   append (attempted, or already served) is not licensed, and the same
- *   append can become licensed after a posture-changing controller-document
- *   entry -- callers must not treat it with the reject-the-whole-log
- *   severity of the integrity class.
+ * The one refusal class the resource-log layer still owns after the generic
+ * client side moved to `@interop/vh-resource-log`: the ceremony-tail license
+ * refusal. The generic taxonomy (`ResourceLogIntegrityError`,
+ * `ResourceLogContinuityError`, `ResourceLogClosedError`,
+ * `LogNotConfirmedError`, and the store port's `ResourceLogConflictError`)
+ * is the library's; wallet-core re-exports none of it -- one owner per name.
+ * Like every class in that taxonomy, this one assigns its `name` string
+ * explicitly and is matched by `err.name` across package boundaries (the
+ * WC-64 rule; minified class names do not survive bundling).
  */
-/**
- * A served log failed verification: malformed entries, a non-verifying SCID,
- * a broken hash chain, a failing proof, or a signer the controller document
- * does not back at the entry's anchored version. Fabrication-class: refused
- * as something no enrolled client produced.
- */
-export class ResourceLogIntegrityError extends Error {
-    constructor(message, options) {
-        super(message, options);
-        this.name = 'ResourceLogIntegrityError';
-    }
-}
-/**
- * A served log conflicts with this client's chain-head pin: `rollback` (the
- * served head is behind the pinned head -- possibly replication lag; the pin
- * is never regressed and the caller may retry), `fork` (the served log
- * diverges from the pinned history -- both logs are transferable evidence of
- * equivocation, so the served entries ride along), `scid-switch` /
- * `method-switch` (a different log identity or format under the pinned
- * location, outside a verified handover).
- */
-export class ResourceLogContinuityError extends Error {
-    reason;
-    pinnedHead;
-    /**
-     * On a `fork`, the full served log retained as evidence: every entry is
-     * signed, so a conflicting pair of logs under one SCID is transferable,
-     * independently verifiable proof of equivocation.
-     */
-    servedEntries;
-    constructor({ reason, pinnedHead, servedEntries }) {
-        super(`The served resource log is not a continuation of the pinned history ` +
-            `(${reason}; pinned head ${pinnedHead}).`);
-        this.name = 'ResourceLogContinuityError';
-        this.reason = reason;
-        this.pinnedHead = pinnedHead;
-        this.servedEntries = servedEntries;
-    }
-}
 /**
  * A ladder-signed append outside the ceremony-tail license: it is not the
- * log's first entry, and it does not anchor at a posture-changing controller
- * document version no verified entry already anchors at or past. Above all
+ * log's first entry, and it does not carry an inventory-changing controller
+ * document version no verified entry already carries at or past. Above all
  * this refuses the silent-rekey shape -- a ladder-signed rotation against an
  * unchanged document. Write-time admission class: the log is not corrupt and
  * whoever signed the append genuinely holds the credential; the append is
- * merely unlicensed, and a retry after a posture-changing document entry may
+ * merely unlicensed, and a retry after a inventory-changing document entry may
  * succeed.
  */
 export class ResourceLogLicenseError extends Error {
@@ -81,18 +28,4 @@ export class ResourceLogLicenseError extends Error {
         this.name = 'ResourceLogLicenseError';
     }
 }
-/**
- * An append was refused because the log's verified head is a terminal
- * handover entry: the log is closed and names a successor, and this profile
- * forbids extending a history its authors have closed.
- */
-export class ResourceLogClosedError extends Error {
-    nextLog;
-    constructor({ nextLog }) {
-        super('The resource log is closed by a terminal handover entry; appends must ' +
-            'go to its successor log.');
-        this.name = 'ResourceLogClosedError';
-        this.nextLog = nextLog;
-    }
-}
 //# sourceMappingURL=errors.js.map

package/dist/resourceLog/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,MAAM,CAAuD;IAC7D,UAAU,CAAQ;IAClB;;;;OAIG;IACH,aAAa,CAAY;IACzB,YAAY,EACV,MAAM,EACN,UAAU,EACV,aAAa,EAKd;QACC,KAAK,CACH,sEAAsE;YACpE,IAAI,MAAM,iBAAiB,UAAU,IAAI,CAC5C,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,CAAkC;IACzC,YAAY,EAAE,OAAO,EAAiD;QACpE,KAAK,CACH,wEAAwE;YACtE,0BAA0B,CAC7B,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF"}

package/dist/resourceLog/index.d.ts

@@ -2,28 +2,23 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/wallet-core/resourceLog` entry: the client side of the
- * Resource Log Profile (App Connect spec `#resource-log-profile`) -- full
- * chain verification against an adversarial host (parse shape, SCID and
- * entry-hash recomputation, entry proofs, the external-authorization rule
- * against the independently verified did:webvh controller document, terminal
- * entries), the ceremony-tail license on ladder-signed appends, the
- * chain-head pin with its continuity rules, the append path (verified-head
- * build, CAS with rebase-and-retry, read-back confirmation), and the sealing
- * sweep (the idempotent backstop append that re-anchors a log's head past
- * the controller's latest membership change).
- * Transport (JSON Lines, the store seam, the projection write) lives in
- * `@interop/was-client/log`; the hashing and proof kernel in
- * `@interop/did-method-webvh`. Kept out of the root export: this subpath
- * pulls the did:webvh and ed25519 dependency graph.
+ * The `@interop/wallet-core/resourceLog` entry: the wallet-domain residue of
+ * the Resource Log Profile's client side after the generic half moved to
+ * `@interop/vh-resource-log` -- the did:webvh controller adapter (the
+ * library's controller port extended with the per-version
+ * credential-inventory view, supplying the mandatory `admitAppend` admission
+ * hook), and the ceremony-tail license the hook carries
+ * (`assertLadderAppendLicensed`, refusing with `ResourceLogLicenseError`).
+ * Everything generic -- the JSON Lines codec, the store port and
+ * `confirmAppend`, chain verification, the chain-head pin
+ * (`ResourceLogPinStore` and `resourceLogPinId`; the named slot-key builders
+ * stay on their owning subpaths: `accountLogPinId` in `webvh`,
+ * `userKeyRosterPinId` in `keys`, `clientAnnexLogPinId` in `clientAnnex`),
+ * the append path, and the sealing sweep -- lives in the library, and this
+ * subpath re-exports none of it: one owner per name. Kept out of the root
+ * export: this subpath pulls the did:webvh and ed25519 dependency graph.
  */
-export { webvhResourceLogController, type ControllerPosture, type ResourceLogController } from './controller.js';
-export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError, ResourceLogLicenseError } from './errors.js';
+export { webvhResourceLogController, type ControllerInventory, type WebvhResourceLogController } from './controller.js';
+export { ResourceLogLicenseError } from './errors.js';
 export { assertLadderAppendLicensed } from './license.js';
-export { buildResourceLogEntry, buildResourceLogGenesis, type ResourceLogSigner } from './entry.js';
-export { memoryResourceLogPinStore, resourceLogPinId, type ResourceLogHeadPin, type ResourceLogPinStore } from './pin.js';
-export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover, type VerifiedResourceLog } from './verify.js';
-export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
-export { latestAssertionRemovalIndex, sealResourceLog } from './seal.js';
-export { vmFragmentOf } from './vmFragment.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/resourceLog/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAChC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA"}

package/dist/resourceLog/index.js

@@ -2,28 +2,23 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/wallet-core/resourceLog` entry: the client side of the
- * Resource Log Profile (App Connect spec `#resource-log-profile`) -- full
- * chain verification against an adversarial host (parse shape, SCID and
- * entry-hash recomputation, entry proofs, the external-authorization rule
- * against the independently verified did:webvh controller document, terminal
- * entries), the ceremony-tail license on ladder-signed appends, the
- * chain-head pin with its continuity rules, the append path (verified-head
- * build, CAS with rebase-and-retry, read-back confirmation), and the sealing
- * sweep (the idempotent backstop append that re-anchors a log's head past
- * the controller's latest membership change).
- * Transport (JSON Lines, the store seam, the projection write) lives in
- * `@interop/was-client/log`; the hashing and proof kernel in
- * `@interop/did-method-webvh`. Kept out of the root export: this subpath
- * pulls the did:webvh and ed25519 dependency graph.
+ * The `@interop/wallet-core/resourceLog` entry: the wallet-domain residue of
+ * the Resource Log Profile's client side after the generic half moved to
+ * `@interop/vh-resource-log` -- the did:webvh controller adapter (the
+ * library's controller port extended with the per-version
+ * credential-inventory view, supplying the mandatory `admitAppend` admission
+ * hook), and the ceremony-tail license the hook carries
+ * (`assertLadderAppendLicensed`, refusing with `ResourceLogLicenseError`).
+ * Everything generic -- the JSON Lines codec, the store port and
+ * `confirmAppend`, chain verification, the chain-head pin
+ * (`ResourceLogPinStore` and `resourceLogPinId`; the named slot-key builders
+ * stay on their owning subpaths: `accountLogPinId` in `webvh`,
+ * `userKeyRosterPinId` in `keys`, `clientAnnexLogPinId` in `clientAnnex`),
+ * the append path, and the sealing sweep -- lives in the library, and this
+ * subpath re-exports none of it: one owner per name. Kept out of the root
+ * export: this subpath pulls the did:webvh and ed25519 dependency graph.
  */
 export { webvhResourceLogController } from './controller.js';
-export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError, ResourceLogLicenseError } from './errors.js';
+export { ResourceLogLicenseError } from './errors.js';
 export { assertLadderAppendLicensed } from './license.js';
-export { buildResourceLogEntry, buildResourceLogGenesis } from './entry.js';
-export { memoryResourceLogPinStore, resourceLogPinId } from './pin.js';
-export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover } from './verify.js';
-export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
-export { latestAssertionRemovalIndex, sealResourceLog } from './seal.js';
-export { vmFragmentOf } from './vmFragment.js';
 //# sourceMappingURL=index.js.map

package/dist/resourceLog/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,0BAA0B,EAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAGjB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,0BAA0B,EAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA"}

package/dist/resourceLog/license.d.ts

@@ -6,39 +6,40 @@
  * of the ladder VM's authority clauses). A ladder-signed append is accepted
  * in exactly two shapes: the log's first entry (creation, never extension --
  * callers admit that shape by not calling this check on a genesis entry),
- * or a rotation anchored at a posture-changing controller-document version,
- * one-shot -- refused when the verified log head already carries an entry
- * anchored at that version or later. Everything else, above all a rotation
+ * or a rotation that carries an inventory-changing controller document
+ * version, one-shot -- refused when the verified log head already carries
+ * an entry at that version or later. Everything else, above all a rotation
  * against an unchanged document (the silent-rekey shape), is refused with
- * {@link ResourceLogLicenseError}. Anchors compare by position in the
- * controller's verified version history, the structural twin of the sealing
- * sweep's `headAnchorIndex >= removalIndex` check.
+ * {@link ResourceLogLicenseError}. Controller versions compare by position
+ * in the controller's verified version history, the structural twin of the
+ * sealing sweep's `headControllerVersionIndex >= removalIndex` check.
  */
-import type { ResourceLogController } from './controller.js';
+import type { WebvhResourceLogController } from './controller.js';
 /**
  * Evaluates the ceremony-tail license's second shape for one ladder-signed
- * append: the append must anchor at a posture-changing document version V --
- * S(V) differs from S(V-1) in either direction, with S(-1) empty for a
- * genesis-version anchor -- and no verified entry may already anchor at V or
- * later (`headAnchorIndex >= anchorIndex` refuses; the license is one-shot,
- * so a torn ceremony's late-arriving tail still passes while a second
- * rotation against the same anchor does not). A `null` anchor index (an
- * unversioned controller, where no anchor exists to license against) is
- * refused fail-closed.
+ * append: the append must carry an inventory-changing document version V --
+ * S(V) differs from S(V-1) in either direction, with S(-1) empty for the
+ * genesis version -- and no verified entry may already carry V or later
+ * (`headControllerVersionIndex >= controllerVersionIndex` refuses; the
+ * license is one-shot, so a torn ceremony's late-arriving tail still passes
+ * while a second rotation against the same version does not). A `null`
+ * controller version index (an unversioned controller, where no version
+ * exists to license against) is refused fail-closed.
  *
  * @param options {object}
- * @param options.controller {ResourceLogController}   the verified controller
- *   view
- * @param options.anchorIndex {number | null}   the append's anchor as an
- *   index into `controller.versionIds` (`null`: unanchored)
- * @param options.headAnchorIndex {number | null}   the verified log head's
- *   effective anchor before this append (`null`: the log has no anchored
- *   entries yet)
+ * @param options.controller {object}   the verified controller view's
+ *   version list and inventory accessor
+ * @param options.controllerVersionIndex {number | null}   the append's
+ *   controller version as an index into `controller.versionIds` (`null`:
+ *   no controller version)
+ * @param options.headControllerVersionIndex {number | null}   the verified
+ *   log head's effective controller version index before this append
+ *   (`null`: the log has no versioned entries yet)
  * @returns {Promise<void>}
  */
-export declare function assertLadderAppendLicensed({ controller, anchorIndex, headAnchorIndex }: {
-    controller: ResourceLogController;
-    anchorIndex: number | null;
-    headAnchorIndex: number | null;
+export declare function assertLadderAppendLicensed({ controller, controllerVersionIndex, headControllerVersionIndex }: {
+    controller: Pick<WebvhResourceLogController, 'versionIds' | 'inventoryAt'>;
+    controllerVersionIndex: number | null;
+    headControllerVersionIndex: number | null;
 }): Promise<void>;
 //# sourceMappingURL=license.d.ts.map

package/dist/resourceLog/license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAsB5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,UAAU,EACV,WAAW,EACX,eAAe,EAChB,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB"}
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAsBjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,UAAU,EACV,sBAAsB,EACtB,0BAA0B,EAC3B,EAAE;IACD,UAAU,EAAE,IAAI,CAAC,0BAA0B,EAAE,YAAY,GAAG,aAAa,CAAC,CAAA;IAC1E,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB"}

package/dist/resourceLog/license.js

@@ -1,6 +1,6 @@
 import { ResourceLogLicenseError } from './errors.js';
 /**
- * Set equality over posture members.
+ * Set equality over inventory members.
  *
  * @param left {Set<string>}
  * @param right {Set<string>}
@@ -19,45 +19,46 @@ function setsEqual(left, right) {
 }
 /**
  * Evaluates the ceremony-tail license's second shape for one ladder-signed
- * append: the append must anchor at a posture-changing document version V --
- * S(V) differs from S(V-1) in either direction, with S(-1) empty for a
- * genesis-version anchor -- and no verified entry may already anchor at V or
- * later (`headAnchorIndex >= anchorIndex` refuses; the license is one-shot,
- * so a torn ceremony's late-arriving tail still passes while a second
- * rotation against the same anchor does not). A `null` anchor index (an
- * unversioned controller, where no anchor exists to license against) is
- * refused fail-closed.
+ * append: the append must carry an inventory-changing document version V --
+ * S(V) differs from S(V-1) in either direction, with S(-1) empty for the
+ * genesis version -- and no verified entry may already carry V or later
+ * (`headControllerVersionIndex >= controllerVersionIndex` refuses; the
+ * license is one-shot, so a torn ceremony's late-arriving tail still passes
+ * while a second rotation against the same version does not). A `null`
+ * controller version index (an unversioned controller, where no version
+ * exists to license against) is refused fail-closed.
  *
  * @param options {object}
- * @param options.controller {ResourceLogController}   the verified controller
- *   view
- * @param options.anchorIndex {number | null}   the append's anchor as an
- *   index into `controller.versionIds` (`null`: unanchored)
- * @param options.headAnchorIndex {number | null}   the verified log head's
- *   effective anchor before this append (`null`: the log has no anchored
- *   entries yet)
+ * @param options.controller {object}   the verified controller view's
+ *   version list and inventory accessor
+ * @param options.controllerVersionIndex {number | null}   the append's
+ *   controller version as an index into `controller.versionIds` (`null`:
+ *   no controller version)
+ * @param options.headControllerVersionIndex {number | null}   the verified
+ *   log head's effective controller version index before this append
+ *   (`null`: the log has no versioned entries yet)
  * @returns {Promise<void>}
  */
-export async function assertLadderAppendLicensed({ controller, anchorIndex, headAnchorIndex }) {
-    if (anchorIndex === null ||
-        anchorIndex < 0 ||
-        anchorIndex >= controller.versionIds.length) {
+export async function assertLadderAppendLicensed({ controller, controllerVersionIndex, headControllerVersionIndex }) {
+    if (controllerVersionIndex === null ||
+        controllerVersionIndex < 0 ||
+        controllerVersionIndex >= controller.versionIds.length) {
         throw new ResourceLogLicenseError('A ladder-signed append past the genesis entry cannot be licensed ' +
-            'without an anchor into the controller document version history.');
+            'without a controller document version to license against.');
     }
-    const current = (await controller.postureAt(controller.versionIds[anchorIndex])).postureKeys;
-    const previous = anchorIndex === 0
+    const current = (await controller.inventoryAt(controller.versionIds[controllerVersionIndex])).inventoryKeys;
+    const previous = controllerVersionIndex === 0
         ? new Set()
-        : (await controller.postureAt(controller.versionIds[anchorIndex - 1]))
-            .postureKeys;
+        : (await controller.inventoryAt(controller.versionIds[controllerVersionIndex - 1])).inventoryKeys;
     if (setsEqual(current, previous)) {
-        throw new ResourceLogLicenseError('The ladder-signed append anchors at a controller document version ' +
-            'that did not change the credential posture (a rotation against an ' +
+        throw new ResourceLogLicenseError('The ladder-signed append carries a controller document version ' +
+            'that did not change the credential inventory (a rotation against an ' +
             'unchanged document is never licensed).');
     }
-    if (headAnchorIndex !== null && headAnchorIndex >= anchorIndex) {
-        throw new ResourceLogLicenseError('The verified log head already carries an entry anchored at or past ' +
-            'this posture-changing document version (the license is one-shot).');
+    if (headControllerVersionIndex !== null &&
+        headControllerVersionIndex >= controllerVersionIndex) {
+        throw new ResourceLogLicenseError('The verified log head already carries an entry at or past this ' +
+            'inventory-changing document version (the license is one-shot).');
     }
 }
 //# sourceMappingURL=license.js.map

package/dist/resourceLog/license.js.map

@@ -1 +1 @@
-{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,UAAU,EACV,WAAW,EACX,eAAe,EAKhB;IACC,IACE,WAAW,KAAK,IAAI;QACpB,WAAW,GAAG,CAAC;QACf,WAAW,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE;YACjE,iEAAiE,CACpE,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CACd,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAE,CAAC,CAChE,CAAC,WAAW,CAAA;IACb,MAAM,QAAQ,GACZ,WAAW,KAAK,CAAC;QACf,CAAC,CAAC,IAAI,GAAG,EAAU;QACnB,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAE,CAAC,CAAC;aAClE,WAAW,CAAA;IACpB,IAAI,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAC/B,oEAAoE;YAClE,oEAAoE;YACpE,wCAAwC,CAC3C,CAAA;IACH,CAAC;IACD,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,IAAI,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,qEAAqE;YACnE,mEAAmE,CACtE,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,UAAU,EACV,sBAAsB,EACtB,0BAA0B,EAK3B;IACC,IACE,sBAAsB,KAAK,IAAI;QAC/B,sBAAsB,GAAG,CAAC;QAC1B,sBAAsB,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE;YACjE,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CACd,MAAM,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAE,CAAC,CAC7E,CAAC,aAAa,CAAA;IACf,MAAM,QAAQ,GACZ,sBAAsB,KAAK,CAAC;QAC1B,CAAC,CAAC,IAAI,GAAG,EAAU;QACnB,CAAC,CAAC,CACE,MAAM,UAAU,CAAC,WAAW,CAC1B,UAAU,CAAC,UAAU,CAAC,sBAAsB,GAAG,CAAC,CAAE,CACnD,CACF,CAAC,aAAa,CAAA;IACrB,IAAI,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YAC/D,sEAAsE;YACtE,wCAAwC,CAC3C,CAAA;IACH,CAAC;IACD,IACE,0BAA0B,KAAK,IAAI;QACnC,0BAA0B,IAAI,sBAAsB,EACpD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YAC/D,gEAAgE,CACnE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/unlock/index.d.ts

@@ -4,7 +4,7 @@
 /**
  * The `@interop/wallet-core/unlock` subpath: standing unlock credentials --
  * every unlock method (passphrase, passkey PRF, recovery code) as a standing
- * credential in the recovery-code posture, with self-enrolling login. The
+ * credential in the recovery-code configuration, with self-enrolling login. The
  * recovery subpath's spend-on-use flows sit on top of the machinery here.
  *
  * - `standingClientFromUnlockSeed` / `unlockClientIdentityFromSeed` -- the
@@ -16,17 +16,17 @@
  *   client-annex Space `delegatedClients` delegations re-mintable; the ladder
  *   seed sealed and carried verbatim, its `LADDER_SEED_BYTES` size owned by
  *   the record format).
- * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
+ * - `publishUnlockKey` / `removeUnlockKey` -- the merged document inventory
  *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
  *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
  * - `retireUnlockCredential` -- the retirement ceremony behind "change my
- *   passphrase" and "remove this passkey": the posture edit, then the shared
+ *   passphrase" and "remove this passkey": the inventory edit, then the shared
  *   roster rotation and collection fan-out off the retired credential's wrap.
  *
  * The ladder itself, and every ceremony that exercises it (the ladder-anchored
  * genesis, self-enrollment, the forget ceremony), live in
- * `@interop/wallet-core/clientAnnex` -- what stays here is the posture and
- * record machinery every wallet needs regardless of posture.
+ * `@interop/wallet-core/clientAnnex` -- what stays here is the inventory and
+ * record machinery every wallet needs regardless of account configuration.
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * was-client dependency graph (the same isolation pattern as `./keyring`).
@@ -38,5 +38,5 @@ export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, Unlo
 export { publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export type { StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
 export { retireUnlockCredential } from './retire.js';
-export type { ClientAnnexPostureRetirement, UnlockCredentialRetirementResult } from './retire.js';
+export type { ClientAnnexInventoryRetirement, UnlockCredentialRetirementResult } from './retire.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/unlock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,4BAA4B,EAC5B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}

package/dist/unlock/index.js

@@ -4,7 +4,7 @@
 /**
  * The `@interop/wallet-core/unlock` subpath: standing unlock credentials --
  * every unlock method (passphrase, passkey PRF, recovery code) as a standing
- * credential in the recovery-code posture, with self-enrolling login. The
+ * credential in the recovery-code configuration, with self-enrolling login. The
  * recovery subpath's spend-on-use flows sit on top of the machinery here.
  *
  * - `standingClientFromUnlockSeed` / `unlockClientIdentityFromSeed` -- the
@@ -16,17 +16,17 @@
  *   client-annex Space `delegatedClients` delegations re-mintable; the ladder
  *   seed sealed and carried verbatim, its `LADDER_SEED_BYTES` size owned by
  *   the record format).
- * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
+ * - `publishUnlockKey` / `removeUnlockKey` -- the merged document inventory
  *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
  *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
  * - `retireUnlockCredential` -- the retirement ceremony behind "change my
- *   passphrase" and "remove this passkey": the posture edit, then the shared
+ *   passphrase" and "remove this passkey": the inventory edit, then the shared
  *   roster rotation and collection fan-out off the retired credential's wrap.
  *
  * The ladder itself, and every ceremony that exercises it (the ladder-anchored
  * genesis, self-enrollment, the forget ceremony), live in
- * `@interop/wallet-core/clientAnnex` -- what stays here is the posture and
- * record machinery every wallet needs regardless of posture.
+ * `@interop/wallet-core/clientAnnex` -- what stays here is the inventory and
+ * record machinery every wallet needs regardless of account configuration.
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * was-client dependency graph (the same isolation pattern as `./keyring`).