@interop/wallet-core 0.51.0 → 0.53.0

package/dist/unlock/retire.d.ts

@@ -6,10 +6,10 @@
  * passphrase" and "remove this passkey", run synchronously in an enrolled
  * client, in dependency order. A standing credential is not a stored string to
  * overwrite -- it holds a wrap in the user key roster and a `keyAgreement`
- * posture in the account's did:webvh document -- so retiring one is a real
+ * inventory in the account's did:webvh document -- so retiring one is a real
  * rotation, on the same stages the client-revocation cascade runs.
  *
- * 1. **The document posture edit** (`removeUnlockKey`): the credential's
+ * 1. **The document inventory edit** (`removeUnlockKey`): the credential's
  *    `keyAgreement` entry (verbatim key or commitment) and its committed
  *    update-key hash leave the document in one log entry. That kills the
  *    credential's latent self-enrollment authority -- with its rung
@@ -26,7 +26,7 @@
  * first means a run torn anywhere after it leaves the roster keying a
  * recipient the document no longer backs -- exactly the state the login-time
  * sweep detects and finishes. Torn the other way around, a rotation with the
- * posture still standing would simply re-escrow the credential and look
+ * inventory still standing would simply re-escrow the credential and look
  * healthy.
  *
  * There is deliberately no recovery-delegation re-mint stage here (the
@@ -36,7 +36,7 @@
  * credential's bridge chains through it.
  *
  * The client annex reach is its own stage (1b, the injected
- * `retireClientAnnexPosture` closure), between the document edit and the
+ * `retireClientAnnexInventory` closure), between the document edit and the
  * roster tail: a standing credential's annex rung-0 key and hash live in
  * the pointed generation's log, kept nowhere the account document edit can
  * reach, so without it a retired credential keeps annex-write authority
@@ -49,12 +49,13 @@
  * `delegatedClients` sibling: no server revocation is possible or needed --
  * the sibling delegation's record dies with the unlock Space the caller
  * deletes, and a swap (or the ordinary GC cadence) retires the generation it
- * targeted. Best-effort by contract: the closure catches its own failures
- * and reports them, so the roster rotation -- the ceremony's essential
- * remedy -- always runs.
+ * targeted. Best-effort by contract, enforced by the ceremony itself: a
+ * throw escaping the closure is caught here and reported as the `failed`
+ * skip, so the roster rotation -- the ceremony's essential remedy -- always
+ * runs.
  *
  * Convergence is the design: every stage detects its own completion from
- * durable state alone -- the posture edit no-ops when the document is already
+ * durable state alone -- the inventory edit no-ops when the document is already
  * settled, the rotation no-ops once every current-epoch recipient is
  * document-backed, and a collection is stale exactly when its current epoch
  * names a non-current user key generation -- so a naive full re-run finishes
@@ -76,7 +77,7 @@ import { type StandingUnlockKeys } from './standingWebvh.js';
  * this run (a re-run of an already-complete retirement reports `false`), the
  * roster's seal-backstop report (present when the roster store is sealable and
  * the roster stage ran), the per-collection fan-out result, the document as
- * the posture edit left it, and the rotated key with the roster descriptor it
+ * the inventory edit left it, and the rotated key with the roster descriptor it
  * was read from.
  */
 export interface UnlockCredentialRetirementResult {
@@ -86,40 +87,40 @@ export interface UnlockCredentialRetirementResult {
     document: object;
     userKey?: UserKey;
     rosterDescriptor?: CollectionEncryption;
-    clientAnnex?: ClientAnnexPostureRetirement;
+    clientAnnex?: ClientAnnexInventoryRetirement;
 }
 /**
- * What the annex-posture stage reports: `struck` (a strike entry dropped
+ * What the annex-inventory stage reports: `struck` (a strike entry dropped
  * the retired rung's key and hash), `swapped` (a fresh generation replaced
- * the old one wholesale), `clean` (the pointed generation held no posture
+ * the old one wholesale), `clean` (the pointed generation held no inventory
  * for the retired credential), or `skipped` with the reason (`no-pointer`:
- * the account has no annex posture; `no-ladder-seed`: the ceremony holds
- * no seed that could strike or swap; `failed`: the closure's best-effort
- * catch).
+ * the account has no annex inventory; `no-ladder-seed`: the ceremony holds
+ * no seed that could strike or swap; `failed`: the closure reported a
+ * failure, or threw and the ceremony caught it).
  */
-export interface ClientAnnexPostureRetirement {
+export interface ClientAnnexInventoryRetirement {
     action: 'struck' | 'swapped' | 'clean' | 'skipped';
     reason?: 'no-pointer' | 'no-ladder-seed' | 'failed';
 }
 /**
  * Retires one standing unlock credential from an account. See the module doc
- * for the order and the convergence story. Once the posture edit lands, a
+ * for the order and the convergence story. Once the inventory edit lands, a
  * thrown later stage leaves durable state a naive re-run -- or the login-time
  * sweep -- converges from.
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
  * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
- *   client's own did:webvh update-key seeds, which sign the posture edit
+ *   client's own did:webvh update-key seeds, which sign the inventory edit
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
- *   public posture (its key-agreement publication and its recorded update
- *   key, which the posture edit treats as a ladder anchor rather than truth
+ *   public inventory (its key-agreement publication and its recorded update
+ *   key, which the inventory edit treats as a ladder anchor rather than truth
  *   -- see `removeUnlockKey`)
  * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
  *   seed, when the ceremony holds the credential's secret; it strengthens the
  *   ladder attribution but is not required
  * @param [options.expectedDid] {string}   the account DID from the caller's
- *   stored account pointer; supplied, the posture edit refuses a `did.jsonl`
+ *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
@@ -134,16 +135,16 @@ export interface ClientAnnexPostureRetirement {
  *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
  *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
- * @param [options.retireClientAnnexPosture] {Function}   `({ document }) =>
- *   Promise<ClientAnnexPostureRetirement>` -- the annex reach (stage 1b in
- *   the module doc), run against the post-edit document; expected to catch
- *   its own failures and report them
+ * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
+ *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
+ *   the module doc), run against the post-edit document; a throw is caught
+ *   and reported as `{ action: 'skipped', reason: 'failed' }`
  * @param [options.onRotationAdopted] {Function}   `({ userKey }) =>
  *   Promise<void>` -- the live-session adoption of a rotated key, run last so
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexPosture, onRotationAdopted }: {
+export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexInventory, onRotationAdopted }: {
     idStore: WebvhIdStore;
     updateKeys: ClientWebvhUpdateKeys;
     unlockKeys: StandingUnlockKeys;
@@ -160,9 +161,9 @@ export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys
         descriptor: CollectionEncryption;
     }) => Promise<void>;
     collections: CascadeCollections;
-    retireClientAnnexPosture?: (options: {
+    retireClientAnnexInventory?: (options: {
         document: object;
-    }) => Promise<ClientAnnexPostureRetirement>;
+    }) => Promise<ClientAnnexInventoryRetirement>;
     onRotationAdopted?: (rotation: {
         userKey: UserKey;
     }) => Promise<void>;

package/dist/unlock/retire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,4BAA4B,CAAA;CAC3C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC3C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAyD5C"}
+{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,8BAA8B,CAAA;CAC7C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAiE5C"}

package/dist/unlock/retire.js

@@ -2,23 +2,23 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
 import { removeUnlockKey } from './standingWebvh.js';
 /**
  * Retires one standing unlock credential from an account. See the module doc
- * for the order and the convergence story. Once the posture edit lands, a
+ * for the order and the convergence story. Once the inventory edit lands, a
  * thrown later stage leaves durable state a naive re-run -- or the login-time
  * sweep -- converges from.
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
  * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
- *   client's own did:webvh update-key seeds, which sign the posture edit
+ *   client's own did:webvh update-key seeds, which sign the inventory edit
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
- *   public posture (its key-agreement publication and its recorded update
- *   key, which the posture edit treats as a ladder anchor rather than truth
+ *   public inventory (its key-agreement publication and its recorded update
+ *   key, which the inventory edit treats as a ladder anchor rather than truth
  *   -- see `removeUnlockKey`)
  * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
  *   seed, when the ceremony holds the credential's secret; it strengthens the
  *   ladder attribution but is not required
  * @param [options.expectedDid] {string}   the account DID from the caller's
- *   stored account pointer; supplied, the posture edit refuses a `did.jsonl`
+ *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
@@ -33,17 +33,17 @@ import { removeUnlockKey } from './standingWebvh.js';
  *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
  *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
- * @param [options.retireClientAnnexPosture] {Function}   `({ document }) =>
- *   Promise<ClientAnnexPostureRetirement>` -- the annex reach (stage 1b in
- *   the module doc), run against the post-edit document; expected to catch
- *   its own failures and report them
+ * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
+ *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
+ *   the module doc), run against the post-edit document; a throw is caught
+ *   and reported as `{ action: 'skipped', reason: 'failed' }`
  * @param [options.onRotationAdopted] {Function}   `({ userKey }) =>
  *   Promise<void>` -- the live-session adoption of a rotated key, run last so
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexPosture, onRotationAdopted }) {
-    // 1. The document posture edit -- the credential's standing, first. It
+export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexInventory, onRotationAdopted }) {
+    // 1. The document inventory edit -- the credential's standing, first. It
     // resolves the document as it now stands, which is what stage 2 resolves
     // its remaining recipients from.
     const { did, doc, log } = await removeUnlockKey({
@@ -55,10 +55,19 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         ...(verb !== undefined ? { verb } : {})
     });
     // 1b. The annex reach, against the post-edit document: strike the
-    // retired credential's rung posture out of the pointed generation, or swap
-    // the generation out from under it. Best-effort by the closure's own
-    // contract, so the roster rotation below always runs.
-    const clientAnnex = await retireClientAnnexPosture?.({ document: doc });
+    // retired credential's rung inventory out of the pointed generation, or swap
+    // the generation out from under it. Best-effort by contract, enforced here:
+    // a throw escaping the closure maps to the `failed` skip, so the roster
+    // rotation below always runs.
+    let clientAnnex;
+    if (retireClientAnnexInventory) {
+        try {
+            clientAnnex = await retireClientAnnexInventory({ document: doc });
+        }
+        catch {
+            clientAnnex = { action: 'skipped', reason: 'failed' };
+        }
+    }
     // 2. The shared roster-and-cascade tail: the roster rotation onto the
     // post-edit document (with its post-edit controller floor and its seal
     // backstop), then the collection fan-out onto the fresh key.
@@ -74,7 +83,7 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         collections
     });
     if (!tail.rosterDescriptor || !tail.userKey) {
-        // No roster to rotate: the posture edit has landed, so the credential IS
+        // No roster to rotate: the inventory edit has landed, so the credential IS
         // retired -- a completed ceremony with nothing rotated.
         return {
             rotated: false,

package/dist/unlock/retire.js.map

@@ -1 +1 @@
-{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAsEA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,eAAe,EAA2B,MAAM,oBAAoB,CAAA;AAkC7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAsBlB;IACC,uEAAuE;IACvE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,eAAe,CAAC;QAC9C,OAAO;QACP,UAAU;QACV,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,kEAAkE;IAClE,2EAA2E;IAC3E,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,WAAW,GAAG,MAAM,wBAAwB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAEvE,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,yEAAyE;QACzE,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAA;AACH,CAAC"}
+{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAuEA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,eAAe,EAA2B,MAAM,oBAAoB,CAAA;AAkC7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAsBlB;IACC,yEAAyE;IACzE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,eAAe,CAAC;QAC9C,OAAO;QACP,UAAU;QACV,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,WAAuD,CAAA;IAC3D,IAAI,0BAA0B,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,0BAA0B,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAA;AACH,CAAC"}

package/dist/unlock/standingClient.d.ts

@@ -32,7 +32,7 @@ export interface UnlockClientIdentity {
  * Assembles a client identity from its 32-byte client seed: the one place the
  * agents, multibases, and roster kid are derived, shared by the standing
  * credential derivation here and the recovery code's
- * (`recoveryClientFromCode`), so the two postures can never disagree on how a
+ * (`recoveryClientFromCode`), so the two derivations can never disagree on how a
  * seed becomes an identity.
  *
  * @param options {object}

package/dist/unlock/standingClient.js

@@ -4,8 +4,8 @@
 /**
  * The standing unlock credential's client identity: the deterministic key set
  * every unlock method (a passphrase, a passkey PRF output) derives from its
- * own unlock seed under the standing-credential posture -- the recovery-code
- * posture minus spend-on-use. The credential's key-agreement key holds a
+ * own unlock seed under the standing-credential configuration -- the recovery-code
+ * configuration minus spend-on-use. The credential's key-agreement key holds a
  * standing wrap in the user key roster (escrowed into every epoch, kept alive
  * by rotation fan-out), and its binding MAC key authenticates the unlock
  * record's account core, so a fresh browser holding nothing but the
@@ -37,7 +37,7 @@ const STANDING_BINDING_MAC_INFO = 'binding-mac';
  * Assembles a client identity from its 32-byte client seed: the one place the
  * agents, multibases, and roster kid are derived, shared by the standing
  * credential derivation here and the recovery code's
- * (`recoveryClientFromCode`), so the two postures can never disagree on how a
+ * (`recoveryClientFromCode`), so the two derivations can never disagree on how a
  * seed becomes an identity.
  *
  * @param options {object}

package/dist/unlock/standingWebvh.d.ts

@@ -1,5 +1,6 @@
 import type { DIDDoc, DIDLog, VerificationMethod } from '@interop/did-method-webvh';
 import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 /**
  * The narrow store seam the self-enrolling and delegated-bridge ceremonies
  * write through: a public read of the log and the delegated `did.jsonl` PUT.
@@ -20,7 +21,7 @@ export type UnlockKeyAgreementPublication = {
     commitment: string;
 };
 /**
- * A standing credential's public posture as the document and log carry it:
+ * A standing credential's public inventory as the document and log carry it:
  * its key-agreement publication and the update key whose hash stands in
  * `nextKeyHashes` (ladder rung 0 at bind time; a code's single derived key).
  */
@@ -70,18 +71,26 @@ export declare function unlockKeyVerificationMethod({ did, keyAgreement }: {
  * @param options.store {UnlockLogStore}
  * @param [options.expectedDid] {string}   the account DID the log must resolve
  *   to, where the caller holds one
+ * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
+ *   pins; a served log that is a rollback, a fork, or an identity switch
+ *   against the pinned head is refused (`ResourceLogContinuityError`)
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @returns {Promise<PublishedWebvhLog>}
  */
-export declare function readLogOrThrow({ store, expectedDid }: {
+export declare function readLogOrThrow({ store, expectedDid, pinStore, logId }: {
     store: UnlockLogStore;
     expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
 }): Promise<PublishedWebvhLog>;
 /**
  * BIND (run by an enrolled client, root authority): publishes a standing
- * credential's split posture into the document -- one entry adding the
+ * credential's split configuration into the document -- one entry adding the
  * credential's `keyAgreement` entry (verbatim or commitment) and committing
  * its current update key's hash in `nextKeyHashes`. The update key joins
- * `updateKeys` nowhere. Idempotent: a posture already published is a no-op,
+ * `updateKeys` nowhere. Idempotent: an inventory already published is a no-op,
  * so re-running a torn bind converges. The entry publishes conditionally on
  * the log this call read; a race lost to a concurrent ceremony re-runs and
  * rebases on the new head.
@@ -91,14 +100,14 @@ export declare function readLogOrThrow({ store, expectedDid }: {
  * @param options.updateKeys {ClientWebvhUpdateKeys}   the BINDING client's own
  *   did:webvh update-key seeds
  * @param options.unlockKeys {StandingUnlockKeys}   the credential's public
- *   posture
+ *   inventory
  * @param [options.expectedDid] {string}   the account DID the log must resolve
  *   to, from the caller's stored account pointer
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'issuing a recovery code'`)
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   the account
  *   DID and the document and log as this call leaves them (unchanged when the
- *   posture was already settled), which is what the caller's roster-side half
+ *   inventory was already settled), which is what the caller's roster-side half
  *   converges onto
  */
 export declare function publishUnlockKey(options: {
@@ -114,7 +123,7 @@ export declare function publishUnlockKey(options: {
 }>;
 /**
  * REMOVAL (run by an enrolled client, root authority): removes a standing
- * credential's posture from the document -- its `keyAgreement` entry and
+ * credential's inventory from the document -- its `keyAgreement` entry and
  * everything of its ladder that still stands -- in one entry. Idempotent. The
  * roster-side half (rotating the user key epoch off the credential's wrap) is
  * the caller's, and runs after this so the resolver's document no longer
@@ -123,18 +132,27 @@ export declare function publishUnlockKey(options: {
  * The recorded `unlockKeys.updateKeyMultibase` is treated as an ANCHOR, not
  * as truth: a credential that has self-enrolled since its bind advanced its
  * standing commitment past the recorded rung, so the removal resolves the
- * ladder's current footprint from the log itself
- * ({@link attributeLadderPosture}) and strikes all of it -- every committed
+ * ladder's current inventory from the log itself
+ * ({@link attributeLadderInventory}) and strikes all of it -- every committed
  * hash the ladder accounts for AND, for a torn self-enrollment, the revealed
  * rung key still sitting in `updateKeys` (plus the never-claimed hashes its
  * reveal entry committed). Trusting the recorded multibase alone would leave
  * the live rung commitment standing: a latent re-seizure credential via the
  * reveal mechanism. A supplied `ladderSeed` strengthens the attribution (every
  * rung known a priori, independent of the anchor's staleness); without it the
- * log walk alone resolves the footprint. For a single-key credential (a
+ * log walk alone resolves the inventory. For a single-key credential (a
  * recovery code, a never-self-enrolled bind) the resolution degenerates to
  * exactly the recorded key's hash, as before.
  *
+ * The seed also names the credential's LADDER VM -- the stable sibling a
+ * last-client forget's install entry publishes under `assertionMethod` and
+ * `capabilityDelegation`, left standing by a forget torn after that entry --
+ * and the removal strikes it in the same entry, so a retired seed no longer
+ * signs governed-log appends or account delegations. The sibling is derived
+ * from the seed alone, with nothing in the log attributing it to a ladder, so
+ * a removal without the seed leaves it: rotation is the remedy for a leaked
+ * seed exactly when the ceremony holds the credential.
+ *
  * @param options {object}   see {@link publishUnlockKey}, plus
  *   `[ladderSeed]` -- the retired credential's ladder seed, when in hand
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see

package/dist/unlock/standingWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAalC,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAQ7B;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,cAAc,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD"}
+{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAalC,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAYnE;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,cAAc,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD"}