@interop/wallet-core 0.52.1 → 0.53.0

package/dist/resourceLog/license.d.ts

@@ -4,11 +4,14 @@
 /**
  * The ceremony-tail license on ladder-signed resource-log appends (clause B
  * of the ladder VM's authority clauses). A ladder-signed append is accepted
- * in exactly two shapes: the log's first entry (creation, never extension --
+ * in exactly two shapes: the log's first entry (creation, not extension --
  * callers admit that shape by not calling this check on a genesis entry),
  * or a rotation that carries an inventory-changing controller document
  * version, one-shot -- refused when the verified log head already carries
- * an entry at that version or later. Everything else, above all a rotation
+ * an entry at that version or later. Both shapes carry a per-entry rule: at
+ * most one of an entry's proofs may be by a ladder key, so a second ladder
+ * key cannot co-sign its way around the one-shot. A rotation co-signed by an
+ * ordinary member stays licensed. Everything else, above all a rotation
  * against an unchanged document (the silent-rekey shape), is refused with
  * {@link ResourceLogLicenseError}. Controller versions compare by position
  * in the controller's verified version history, the structural twin of the
@@ -26,6 +29,14 @@ import type { WebvhResourceLogController } from './controller.js';
  * controller version index (an unversioned controller, where no version
  * exists to license against) is refused fail-closed.
  *
+ * The one-shot is spent per entry, so the entry itself may carry at most one
+ * ladder-key proof: a second ladder key among `proofKeys` refuses, because
+ * every proof of an entry shares one controller version and two ladder
+ * signatures would otherwise spend the same version twice. Proof order does
+ * not matter -- `proofKeys` is read as a set, and the caller's hook runs on
+ * each proof, so the refusal lands on whichever ladder-key proof is admitted
+ * first. A ladder proof co-signed by an ordinary member is untouched.
+ *
  * @param options {object}
  * @param options.controller {object}   the verified controller view's
  *   version list and inventory accessor
@@ -35,11 +46,14 @@ import type { WebvhResourceLogController } from './controller.js';
  * @param options.headControllerVersionIndex {number | null}   the verified
  *   log head's effective controller version index before this append
  *   (`null`: the log has no versioned entries yet)
+ * @param options.proofKeys {string[]}   every signing-key multibase on the
+ *   entry, distinct, read as a set
  * @returns {Promise<void>}
  */
-export declare function assertLadderAppendLicensed({ controller, controllerVersionIndex, headControllerVersionIndex }: {
+export declare function assertLadderAppendLicensed({ controller, controllerVersionIndex, headControllerVersionIndex, proofKeys }: {
     controller: Pick<WebvhResourceLogController, 'versionIds' | 'inventoryAt'>;
     controllerVersionIndex: number | null;
     headControllerVersionIndex: number | null;
+    proofKeys: string[];
 }): Promise<void>;
 //# sourceMappingURL=license.d.ts.map

package/dist/resourceLog/license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAsBjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,UAAU,EACV,sBAAsB,EACtB,0BAA0B,EAC3B,EAAE;IACD,UAAU,EAAE,IAAI,CAAC,0BAA0B,EAAE,YAAY,GAAG,aAAa,CAAC,CAAA;IAC1E,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB"}
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAsBjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,UAAU,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EACV,EAAE;IACD,UAAU,EAAE,IAAI,CAAC,0BAA0B,EAAE,YAAY,GAAG,aAAa,CAAC,CAAA;IAC1E,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDhB"}

package/dist/resourceLog/license.js

@@ -28,6 +28,14 @@ function setsEqual(left, right) {
  * controller version index (an unversioned controller, where no version
  * exists to license against) is refused fail-closed.
  *
+ * The one-shot is spent per entry, so the entry itself may carry at most one
+ * ladder-key proof: a second ladder key among `proofKeys` refuses, because
+ * every proof of an entry shares one controller version and two ladder
+ * signatures would otherwise spend the same version twice. Proof order does
+ * not matter -- `proofKeys` is read as a set, and the caller's hook runs on
+ * each proof, so the refusal lands on whichever ladder-key proof is admitted
+ * first. A ladder proof co-signed by an ordinary member is untouched.
+ *
  * @param options {object}
  * @param options.controller {object}   the verified controller view's
  *   version list and inventory accessor
@@ -37,16 +45,30 @@ function setsEqual(left, right) {
  * @param options.headControllerVersionIndex {number | null}   the verified
  *   log head's effective controller version index before this append
  *   (`null`: the log has no versioned entries yet)
+ * @param options.proofKeys {string[]}   every signing-key multibase on the
+ *   entry, distinct, read as a set
  * @returns {Promise<void>}
  */
-export async function assertLadderAppendLicensed({ controller, controllerVersionIndex, headControllerVersionIndex }) {
+export async function assertLadderAppendLicensed({ controller, controllerVersionIndex, headControllerVersionIndex, proofKeys }) {
     if (controllerVersionIndex === null ||
         controllerVersionIndex < 0 ||
         controllerVersionIndex >= controller.versionIds.length) {
         throw new ResourceLogLicenseError('A ladder-signed append past the genesis entry cannot be licensed ' +
             'without a controller document version to license against.');
     }
-    const current = (await controller.inventoryAt(controller.versionIds[controllerVersionIndex])).inventoryKeys;
+    const inventory = await controller.inventoryAt(controller.versionIds[controllerVersionIndex]);
+    let ladderProofs = 0;
+    for (const key of proofKeys) {
+        if (inventory.ladderKeys.has(key)) {
+            ladderProofs += 1;
+        }
+    }
+    if (ladderProofs > 1) {
+        throw new ResourceLogLicenseError('The append carries more than one ladder-signed proof (at most one ' +
+            'ladder key may sign an entry, so a co-signing ladder key cannot ' +
+            'spend the one-shot twice).');
+    }
+    const current = inventory.inventoryKeys;
     const previous = controllerVersionIndex === 0
         ? new Set()
         : (await controller.inventoryAt(controller.versionIds[controllerVersionIndex - 1])).inventoryKeys;

package/dist/resourceLog/license.js.map

@@ -1 +1 @@
-{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,UAAU,EACV,sBAAsB,EACtB,0BAA0B,EAK3B;IACC,IACE,sBAAsB,KAAK,IAAI;QAC/B,sBAAsB,GAAG,CAAC;QAC1B,sBAAsB,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE;YACjE,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CACd,MAAM,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAE,CAAC,CAC7E,CAAC,aAAa,CAAA;IACf,MAAM,QAAQ,GACZ,sBAAsB,KAAK,CAAC;QAC1B,CAAC,CAAC,IAAI,GAAG,EAAU;QACnB,CAAC,CAAC,CACE,MAAM,UAAU,CAAC,WAAW,CAC1B,UAAU,CAAC,UAAU,CAAC,sBAAsB,GAAG,CAAC,CAAE,CACnD,CACF,CAAC,aAAa,CAAA;IACrB,IAAI,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YAC/D,sEAAsE;YACtE,wCAAwC,CAC3C,CAAA;IACH,CAAC;IACD,IACE,0BAA0B,KAAK,IAAI;QACnC,0BAA0B,IAAI,sBAAsB,EACpD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YAC/D,gEAAgE,CACnE,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,UAAU,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EAMV;IACC,IACE,sBAAsB,KAAK,IAAI;QAC/B,sBAAsB,GAAG,CAAC;QAC1B,sBAAsB,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EACtD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE;YACjE,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAC5C,UAAU,CAAC,UAAU,CAAC,sBAAsB,CAAE,CAC/C,CAAA;IACD,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,YAAY,IAAI,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAC/B,oEAAoE;YAClE,kEAAkE;YAClE,4BAA4B,CAC/B,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,aAAa,CAAA;IACvC,MAAM,QAAQ,GACZ,sBAAsB,KAAK,CAAC;QAC1B,CAAC,CAAC,IAAI,GAAG,EAAU;QACnB,CAAC,CAAC,CACE,MAAM,UAAU,CAAC,WAAW,CAC1B,UAAU,CAAC,UAAU,CAAC,sBAAsB,GAAG,CAAC,CAAE,CACnD,CACF,CAAC,aAAa,CAAA;IACrB,IAAI,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YAC/D,sEAAsE;YACtE,wCAAwC,CAC3C,CAAA;IACH,CAAC;IACD,IACE,0BAA0B,KAAK,IAAI;QACnC,0BAA0B,IAAI,sBAAsB,EACpD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;YAC/D,gEAAgE,CACnE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/space/activity.d.ts

@@ -153,11 +153,16 @@ export interface ActivityGrant {
  *   the app key was minted on this connect (first run) or matched (returning),
  *   and optionally the connected app's `appUrl` -- the validated App Connect
  *   request's parsed-URL serialization
+ * @param [options.actor] {{ name: string }}   set for a standalone capability
+ *   request that named its requester: the agent's self-declared display name
+ *   (the VPR's `agent.name`), recorded as `object.actor` -- the ActivityStreams
+ *   vocabulary for who acted on the granted object -- so a listing can show
+ *   the name beside the grantee key. Self-declared, never verified.
  * @param [options.id] {string}
  * @param [options.created] {string}
  * @returns {WalletActivity}
  */
-export declare function addHistoryLogin({ user, origin, grants, appConnect, id, created }: {
+export declare function addHistoryLogin({ user, origin, grants, appConnect, actor, id, created }: {
     user: Actor;
     origin: string;
     grants: ActivityGrant[];
@@ -166,6 +171,9 @@ export declare function addHistoryLogin({ user, origin, grants, appConnect, id,
         firstRun: boolean;
         appUrl?: string;
     };
+    actor?: {
+        name: string;
+    };
     id?: string;
     created?: string;
 }): WalletActivity;
@@ -266,6 +274,45 @@ export declare function addHistoryGenerationCollected({ user, generationId, firs
     entryCount?: number;
     created?: string;
 }): WalletActivity;
+/**
+ * The Revoke activity for an agent grant: the user revoked the standalone
+ * storage grants answered from an interaction-URL request (an agent's
+ * `di was request-grant` link), which have no app key and no App Connect
+ * membership. The recorded `controller` is the grantee did:key -- the key the
+ * Applications listing joins its rows on -- and `zcaps` carries the ids of the
+ * capabilities whose revocation was POSTed, the audit trail of what was
+ * retired. `actor` mirrors the Login activity's self-declared agent name when
+ * one was recorded; it is display-only and never evidence of identity.
+ *
+ * @param options {object}
+ * @param options.user {Actor}
+ * @param options.origin {string}   the recorded origin marker the grant was
+ *   answered under
+ * @param options.controller {string}   the grantee did:key
+ * @param [options.zcaps] {Array<{ id: string }>}   the revoked capability ids
+ * @param [options.actor] {{ name: string }}   the agent's self-declared name
+ * @param [options.revoked] {number}   how many grants were revoked
+ * @param [options.skipped] {number}   how many grants needed no revocation
+ *   (already expired, already revoked, or summary-only records)
+ * @param [options.id] {string}
+ * @param [options.created] {string}
+ * @returns {WalletActivity}
+ */
+export declare function addHistoryAgentRevoke({ user, origin, controller, zcaps, actor, revoked, skipped, id, created }: {
+    user: Actor;
+    origin: string;
+    controller: string;
+    zcaps?: Array<{
+        id: string;
+    }>;
+    actor?: {
+        name: string;
+    };
+    revoked?: number;
+    skipped?: number;
+    id?: string;
+    created?: string;
+}): WalletActivity;
 export declare function addHistoryAppRevoke({ user, origin, name, cid, revoked, skipped, id, created }: {
     user: Actor;
     origin: string;

package/dist/space/activity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../../src/space/activity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;CAWhB,CAAA;AAEV;;GAEG;AACH,KAAK,KAAK,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAY5C;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,KAAK,EACL,MAAM,EACN,MAAM,EACN,EAAE,EACF,OAAO,EACR,EAAE;IACD,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAYjB;AAqCD;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,MAAM,EACN,MAAM,EACN,UAAU,EACV,EAAE,EACF,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACjE,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAgBjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,IAAI,EACJ,EAAE,EACF,OAAO,EACR,GAAE;IACD,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,cAAc,CAStB;AAED;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,IAAI,EACJ,mBAAmB,EACnB,KAAK,EACL,OAAO,EACP,MAAM,EACN,EAAE,EACF,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAWjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,IAAI,EACJ,YAAY,EACZ,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CASjB;AAED,wBAAgB,mBAAmB,CAAC,EAClC,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,GAAG,EACH,OAAO,EACP,OAAO,EACP,EAAE,EACF,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAejB"}
+{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../../src/space/activity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;CAWhB,CAAA;AAEV;;GAEG;AACH,KAAK,KAAK,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAY5C;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,KAAK,EACL,MAAM,EACN,MAAM,EACN,EAAE,EACF,OAAO,EACR,EAAE;IACD,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAYjB;AAqCD;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EACR,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,KAAK,CAAA;IACX,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAUjB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,MAAM,EACN,MAAM,EACN,UAAU,EACV,KAAK,EACL,EAAE,EACF,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACjE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAmBjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,IAAI,EACJ,EAAE,EACF,OAAO,EACR,GAAE;IACD,IAAI,CAAC,EAAE,KAAK,CAAA;IACZ,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,cAAc,CAStB;AAED;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,IAAI,EACJ,mBAAmB,EACnB,KAAK,EACL,OAAO,EACP,MAAM,EACN,EAAE,EACF,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,mBAAmB,EAAE,MAAM,CAAA;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAWjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,IAAI,EACJ,YAAY,EACZ,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CASjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,IAAI,EACJ,MAAM,EACN,UAAU,EACV,KAAK,EACL,KAAK,EACL,OAAO,EACP,OAAO,EACP,EAAE,EACF,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7B,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAgBjB;AAED,wBAAgB,mBAAmB,CAAC,EAClC,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,GAAG,EACH,OAAO,EACP,OAAO,EACP,EAAE,EACF,OAAO,EACR,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CAejB"}

package/dist/space/activity.js

@@ -178,11 +178,16 @@ export function addHistoryCredentialUnshared({ cid, title, user, id, created })
  *   the app key was minted on this connect (first run) or matched (returning),
  *   and optionally the connected app's `appUrl` -- the validated App Connect
  *   request's parsed-URL serialization
+ * @param [options.actor] {{ name: string }}   set for a standalone capability
+ *   request that named its requester: the agent's self-declared display name
+ *   (the VPR's `agent.name`), recorded as `object.actor` -- the ActivityStreams
+ *   vocabulary for who acted on the granted object -- so a listing can show
+ *   the name beside the grantee key. Self-declared, never verified.
  * @param [options.id] {string}
  * @param [options.created] {string}
  * @returns {WalletActivity}
  */
-export function addHistoryLogin({ user, origin, grants, appConnect, id, created }) {
+export function addHistoryLogin({ user, origin, grants, appConnect, actor, id, created }) {
     const stamped = stamp(id, created);
     const summary = appConnect
         ? `Connected ${appConnect.name} (${origin}) to wallet` +
@@ -193,9 +198,12 @@ export function addHistoryLogin({ user, origin, grants, appConnect, id, created
         type: [ACTIVITY_TYPE.Login],
         summary,
         actor: { email: user.email },
-        object: appConnect
-            ? { origin, zcaps: grants, appConnect }
-            : { origin, zcaps: grants },
+        object: {
+            origin,
+            zcaps: grants,
+            ...(appConnect !== undefined && { appConnect }),
+            ...(actor !== undefined && { actor })
+        },
         created: stamped.created
     };
 }
@@ -306,6 +314,46 @@ export function addHistoryGenerationCollected({ user, generationId, firstEntry,
         created: created ?? new Date().toISOString()
     };
 }
+/**
+ * The Revoke activity for an agent grant: the user revoked the standalone
+ * storage grants answered from an interaction-URL request (an agent's
+ * `di was request-grant` link), which have no app key and no App Connect
+ * membership. The recorded `controller` is the grantee did:key -- the key the
+ * Applications listing joins its rows on -- and `zcaps` carries the ids of the
+ * capabilities whose revocation was POSTed, the audit trail of what was
+ * retired. `actor` mirrors the Login activity's self-declared agent name when
+ * one was recorded; it is display-only and never evidence of identity.
+ *
+ * @param options {object}
+ * @param options.user {Actor}
+ * @param options.origin {string}   the recorded origin marker the grant was
+ *   answered under
+ * @param options.controller {string}   the grantee did:key
+ * @param [options.zcaps] {Array<{ id: string }>}   the revoked capability ids
+ * @param [options.actor] {{ name: string }}   the agent's self-declared name
+ * @param [options.revoked] {number}   how many grants were revoked
+ * @param [options.skipped] {number}   how many grants needed no revocation
+ *   (already expired, already revoked, or summary-only records)
+ * @param [options.id] {string}
+ * @param [options.created] {string}
+ * @returns {WalletActivity}
+ */
+export function addHistoryAgentRevoke({ user, origin, controller, zcaps, actor, revoked, skipped, id, created }) {
+    const stamped = stamp(id, created);
+    const who = actor?.name ?? controller;
+    const summary = typeof revoked === 'number'
+        ? `Revoked agent access for ${who}: ${revoked} grant(s) revoked` +
+            `${skipped ? `, ${skipped} skipped` : ''}.`
+        : `Revoked agent access for ${who}.`;
+    return {
+        id: stamped.id,
+        type: [ACTIVITY_TYPE.Revoke],
+        summary,
+        actor: { email: user.email },
+        object: { origin, controller, zcaps, actor, revoked, skipped },
+        created: stamped.created
+    };
+}
 export function addHistoryAppRevoke({ user, origin, name, cid, revoked, skipped, id, created }) {
     const stamped = stamp(id, created);
     const summary = typeof revoked === 'number'

package/dist/space/activity.js.map

@@ -1 +1 @@
-{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/space/activity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AAgBH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;IAClC,iBAAiB,EAAE,mBAAmB;IACtC,iBAAiB,EAAE,mBAAmB;CAC9B,CAAA;AAOV;;GAEG;AACH,SAAS,KAAK,CAAC,EAAW,EAAE,OAAgB;IAC1C,OAAO;QACL,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7B,OAAO,EAAE,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7C,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,IAAI,EACJ,EAAE,EACF,OAAO,EAKR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,yCAAyC;QAClD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,KAAK,EACL,MAAM,EACN,MAAM,EACN,EAAE,EACF,OAAO,EAOR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,MAAM;YACb,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,kDAAkD;QACtD,KAAK;QACL,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,EAC1B,GAAG,EACH,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,EAAE,EACF,OAAO,EASR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,OAAO,EAAE,cAAc,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;QAC9C,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE;QAClD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EAOR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG;QACH,KAAK;QACL,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,MAAM;QAC1B,IAAI,EAAE,SAAS;QACf,EAAE;QACF,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EAOR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG;QACH,KAAK;QACL,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,MAAM;QAC1B,IAAI,EAAE,SAAS;QACf,EAAE;QACF,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EAOR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG;QACH,KAAK;QACL,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,KAAK;QACzB,IAAI,EAAE,QAAQ;QACd,EAAE;QACF,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EAOR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG;QACH,KAAK;QACL,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU;QAChB,EAAE;QACF,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAaD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,IAAI,EACJ,MAAM,EACN,MAAM,EACN,UAAU,EACV,EAAE,EACF,OAAO,EAQR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,UAAU;QACxB,CAAC,CAAC,aAAa,UAAU,CAAC,IAAI,KAAK,MAAM,aAAa;YACpD,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,GAAG;QAC5D,CAAC,CAAC,gBAAgB,MAAM,eAAe,CAAA;IACzC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QAC3B,OAAO;QACP,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,UAAU;YAChB,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,IAAI,EACJ,EAAE,EACF,OAAO,KAKL,EAAE;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,sBAAsB;QAC/B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,IAAI,EACJ,mBAAmB,EACnB,KAAK,EACL,OAAO,EACP,MAAM,EACN,EAAE,EACF,OAAO,EASR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,IAAI,mBAAmB,CAAA;IACxC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC;QAClC,OAAO,EAAE,8BAA8B,GAAG,GAAG;QAC7C,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;QACvD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,IAAI,EACJ,YAAY,EACZ,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EAQR;IACC,OAAO;QACL,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC;QACvC,OAAO,EAAE,sCAAsC,YAAY,IAAI;QAC/D,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE;QAC3D,OAAO,EAAE,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,GAAG,EACH,OAAO,EACP,OAAO,EACP,EAAE,EACF,OAAO,EAUR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,WAAW,IAAI,KAAK,MAAM,iBAAiB,OAAO,YAAY;YAC9D,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG;QACpD,CAAC,CAAC,WAAW,IAAI,KAAK,MAAM,eAAe,CAAA;IAC/C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAC5B,OAAO;QACP,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;QAC/D,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC"}
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/space/activity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AAgBH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;IAClC,iBAAiB,EAAE,mBAAmB;IACtC,iBAAiB,EAAE,mBAAmB;CAC9B,CAAA;AAOV;;GAEG;AACH,SAAS,KAAK,CAAC,EAAW,EAAE,OAAgB;IAC1C,OAAO;QACL,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7B,OAAO,EAAE,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7C,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,IAAI,EACJ,EAAE,EACF,OAAO,EAKR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,yCAAyC;QAClD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,KAAK,EACL,MAAM,EACN,MAAM,EACN,EAAE,EACF,OAAO,EAOR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,MAAM;YACb,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,kDAAkD;QACtD,KAAK;QACL,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,EAC1B,GAAG,EACH,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,EAAE,EACF,OAAO,EASR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,OAAO,EAAE,cAAc,IAAI,KAAK,KAAK,IAAI,GAAG,EAAE;QAC9C,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE;QAClD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EAOR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG;QACH,KAAK;QACL,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,MAAM;QAC1B,IAAI,EAAE,SAAS;QACf,EAAE;QACF,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EAOR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG;QACH,KAAK;QACL,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,MAAM;QAC1B,IAAI,EAAE,SAAS;QACf,EAAE;QACF,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EAOR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG;QACH,KAAK;QACL,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,KAAK;QACzB,IAAI,EAAE,QAAQ;QACd,EAAE;QACF,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,GAAG,EACH,KAAK,EACL,IAAI,EACJ,EAAE,EACF,OAAO,EAOR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG;QACH,KAAK;QACL,IAAI;QACJ,IAAI,EAAE,aAAa,CAAC,OAAO;QAC3B,IAAI,EAAE,UAAU;QAChB,EAAE;QACF,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,IAAI,EACJ,MAAM,EACN,MAAM,EACN,UAAU,EACV,KAAK,EACL,EAAE,EACF,OAAO,EASR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,UAAU;QACxB,CAAC,CAAC,aAAa,UAAU,CAAC,IAAI,KAAK,MAAM,aAAa;YACpD,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,GAAG;QAC5D,CAAC,CAAC,gBAAgB,MAAM,eAAe,CAAA;IACzC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QAC3B,OAAO;QACP,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE;YACN,MAAM;YACN,KAAK,EAAE,MAAM;YACb,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;SACtC;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,IAAI,EACJ,EAAE,EACF,OAAO,KAKL,EAAE;IACJ,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,sBAAsB;QAC/B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,IAAI,EACJ,mBAAmB,EACnB,KAAK,EACL,OAAO,EACP,MAAM,EACN,EAAE,EACF,OAAO,EASR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,IAAI,mBAAmB,CAAA;IACxC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC;QAClC,OAAO,EAAE,8BAA8B,GAAG,GAAG;QAC7C,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;QACvD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,IAAI,EACJ,YAAY,EACZ,UAAU,EACV,SAAS,EACT,UAAU,EACV,OAAO,EAQR;IACC,OAAO;QACL,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC;QACvC,OAAO,EAAE,sCAAsC,YAAY,IAAI;QAC/D,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE;QAC3D,OAAO,EAAE,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,IAAI,EACJ,MAAM,EACN,UAAU,EACV,KAAK,EACL,KAAK,EACL,OAAO,EACP,OAAO,EACP,EAAE,EACF,OAAO,EAWR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,IAAI,UAAU,CAAA;IACrC,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,4BAA4B,GAAG,KAAK,OAAO,mBAAmB;YAC9D,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG;QAC7C,CAAC,CAAC,4BAA4B,GAAG,GAAG,CAAA;IACxC,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAC5B,OAAO;QACP,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAC9D,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAClC,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,GAAG,EACH,OAAO,EACP,OAAO,EACP,EAAE,EACF,OAAO,EAUR;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,QAAQ;QACzB,CAAC,CAAC,WAAW,IAAI,KAAK,MAAM,iBAAiB,OAAO,YAAY;YAC9D,UAAU,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG;QACpD,CAAC,CAAC,WAAW,IAAI,KAAK,MAAM,eAAe,CAAA;IAC/C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;QAC5B,OAAO;QACP,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;QAC/D,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC"}

package/dist/space/index.d.ts

@@ -31,7 +31,7 @@ export { WALLET_SPACE_NAME, PRIVATE_CREDENTIALS_COLLECTION, PUBLIC_CREDENTIALS_C
 export { ID_COLLECTION, KEY_MAP_COLLECTION, UNLOCK_METHODS_COLLECTION, KEYRING_COLLECTION, ID_COLLECTION_SPEC, KEY_MAP_COLLECTION_SPEC, UNLOCK_METHODS_COLLECTION_SPEC, DID_DOCUMENT_RESOURCE, DID_LOG_RESOURCE, DID_KEYS_RESOURCE, USER_KEY_ROSTER_LOG_RESOURCE, CLIENT_LABELS_RESOURCE, UNLOCK_METHODS_RESOURCE, KEYRING_RESOURCE } from './collections.js';
 export type { SpaceProvisionSpec, SpaceCollectionSpec } from './collections.js';
 export { provisionWalletSpace } from './provisioning.js';
-export { ACTIVITY_TYPE, addHistoryNewAccount, addHistorySpaceCreated, addHistoryCredentialCreated, addHistoryCredentialDeleted, addHistoryCredentialShared, addHistoryCredentialUnshared, addHistoryLogin, addHistoryWalletLogin, addHistoryAppRevoke, addHistoryClientRevoked, addHistoryGenerationCollected } from './activity.js';
+export { ACTIVITY_TYPE, addHistoryNewAccount, addHistorySpaceCreated, addHistoryCredentialCreated, addHistoryCredentialDeleted, addHistoryCredentialShared, addHistoryCredentialUnshared, addHistoryLogin, addHistoryWalletLogin, addHistoryAppRevoke, addHistoryAgentRevoke, addHistoryClientRevoked, addHistoryGenerationCollected } from './activity.js';
 export type { WalletActivity, ActivityGrant } from './activity.js';
 export { publicCredentialUrl } from './publicLink.js';
 export { encodeWasLinkSecret, buildWasLinkPayload, parseWasLinkPayload } from './wasLink.js';

package/dist/space/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA"}

package/dist/space/index.js

@@ -30,7 +30,7 @@
 export { WALLET_SPACE_NAME, PRIVATE_CREDENTIALS_COLLECTION, PUBLIC_CREDENTIALS_COLLECTION, WALLET_ACTIVITY_COLLECTION, APP_CONNECTIONS_COLLECTION, PRIVATE_CREDENTIALS_COLLECTION_SPEC, PUBLIC_CREDENTIALS_COLLECTION_SPEC, WALLET_ACTIVITY_COLLECTION_SPEC, CONTACTS_SPACE_COLLECTION_SPEC, CONTACTS_HISTORY_SPACE_COLLECTION_SPEC, APP_CONNECTIONS_COLLECTION_SPEC, WALLET_SPACE_SYNCED_SPECS, WALLET_SPACE_SYSTEM_SPECS, WALLET_SPACE_PROVISION_ROSTER } from './collections.js';
 export { ID_COLLECTION, KEY_MAP_COLLECTION, UNLOCK_METHODS_COLLECTION, KEYRING_COLLECTION, ID_COLLECTION_SPEC, KEY_MAP_COLLECTION_SPEC, UNLOCK_METHODS_COLLECTION_SPEC, DID_DOCUMENT_RESOURCE, DID_LOG_RESOURCE, DID_KEYS_RESOURCE, USER_KEY_ROSTER_LOG_RESOURCE, CLIENT_LABELS_RESOURCE, UNLOCK_METHODS_RESOURCE, KEYRING_RESOURCE } from './collections.js';
 export { provisionWalletSpace } from './provisioning.js';
-export { ACTIVITY_TYPE, addHistoryNewAccount, addHistorySpaceCreated, addHistoryCredentialCreated, addHistoryCredentialDeleted, addHistoryCredentialShared, addHistoryCredentialUnshared, addHistoryLogin, addHistoryWalletLogin, addHistoryAppRevoke, addHistoryClientRevoked, addHistoryGenerationCollected } from './activity.js';
+export { ACTIVITY_TYPE, addHistoryNewAccount, addHistorySpaceCreated, addHistoryCredentialCreated, addHistoryCredentialDeleted, addHistoryCredentialShared, addHistoryCredentialUnshared, addHistoryLogin, addHistoryWalletLogin, addHistoryAppRevoke, addHistoryAgentRevoke, addHistoryClientRevoked, addHistoryGenerationCollected } from './activity.js';
 export { publicCredentialUrl } from './publicLink.js';
 export { encodeWasLinkSecret, buildWasLinkPayload, parseWasLinkPayload } from './wasLink.js';
 export { HumanReadableError } from './errors.js';

package/dist/space/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA"}

package/dist/sync/pull.d.ts

@@ -1,25 +1,3 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The pull side of the WAS replication engine core: iterate the `changes` feed
- * from the stored checkpoint, decrypt each document to a projection action
- * OUTSIDE the store transaction, and hand each page to the store to apply
- * atomically.
- *
- * All I/O is through the injected {@link WasSyncPort} and {@link SyncStore};
- * decryption is the injected `decryptDoc`. No environment-specific imports, so
- * the loop runs identically in the browser, Node, and React Native.
- *
- * Cross-replica invariants this loop and the RxDB `createPullHandler` in the web
- * wallet's driver both hold, so the two replicas resume the same feed the same
- * way:
- * - Omit `checkpoint` entirely on the first pull (never send `null`).
- * - Empty page (`checkpoint: null`, "no change") keeps the PRIOR checkpoint --
- *   never overwrite it with `null`, or the feed restarts from the beginning.
- * - A tombstone deletes the projected row; a live document decrypts its `data`
- *   body to the payload to upsert.
- */
 import type { Json, ProjectionAction, SyncStore, WasSyncPort, WireDoc } from './types.js';
 /**
  * Maps one pulled wire document to the projection action for the decrypted

package/dist/sync/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/sync/pull.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EACV,IAAI,EACJ,gBAAgB,EAEhB,SAAS,EACT,WAAW,EACX,OAAO,EACR,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,EAC7C,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,GAC3C,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAqBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,OAAO,CAAC,EAC5B,IAAI,EACJ,KAAK,EACL,SAAS,EACT,UAAU,EACV,eAAe,EACf,MAAM,EACP,EAAE;IACD,IAAI,EAAE,WAAW,CAAA;IACjB,KAAK,EAAE,SAAS,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,CAAA;IAC5C,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAyD/B"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/sync/pull.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EACV,IAAI,EACJ,gBAAgB,EAEhB,SAAS,EACT,WAAW,EACX,OAAO,EACR,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,OAAO,EACZ,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,EAC7C,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,GAC3C,OAAO,CAAC,gBAAgB,CAAC,CAuB3B;AAqBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,OAAO,CAAC,EAC5B,IAAI,EACJ,KAAK,EACL,SAAS,EACT,UAAU,EACV,eAAe,EACf,MAAM,EACP,EAAE;IACD,IAAI,EAAE,WAAW,CAAA;IACjB,KAAK,EAAE,SAAS,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,CAAA;IAC5C,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAyD/B"}

package/dist/sync/pull.js

@@ -1,3 +1,26 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The pull side of the WAS replication engine core: iterate the `changes` feed
+ * from the stored checkpoint, decrypt each document to a projection action
+ * OUTSIDE the store transaction, and hand each page to the store to apply
+ * atomically.
+ *
+ * All I/O is through the injected {@link WasSyncPort} and {@link SyncStore};
+ * decryption is the injected `decryptDoc`. No environment-specific imports, so
+ * the loop runs identically in the browser, Node, and React Native.
+ *
+ * Cross-replica invariants this loop and the RxDB `createPullHandler` in the web
+ * wallet's driver both hold, so the two replicas resume the same feed the same
+ * way:
+ * - Omit `checkpoint` entirely on the first pull (never send `null`).
+ * - Empty page (`checkpoint: null`, "no change") keeps the PRIOR checkpoint --
+ *   never overwrite it with `null`, or the feed restarts from the beginning.
+ * - A tombstone deletes the projected row; a live document decrypts its `data`
+ *   body to the payload to upsert.
+ */
+import { log } from '../log.js';
 /**
  * Maps one pulled wire document to the projection action for the decrypted
  * read-model. A tombstone deletes the projected row; a live document decrypts
@@ -29,13 +52,18 @@ export async function projectionForDoc(doc, decryptDoc, validatePayload) {
     try {
         const payload = await decryptDoc(doc.data);
         if (validatePayload !== undefined && !validatePayload(payload)) {
-            console.warn(`Skipping malformed synced document "${doc.id}" (no projection).`);
+            log.warn('Skipping malformed synced document (no projection)', {
+                id: doc.id
+            });
             return { kind: 'none' };
         }
         return { kind: 'upsert', payload };
     }
     catch (err) {
-        console.warn(`Skipping undecryptable synced document "${doc.id}" (no projection):`, err);
+        log.warn('Skipping undecryptable synced document (no projection)', {
+            id: doc.id,
+            err
+        });
         return { kind: 'none' };
     }
 }

package/dist/sync/pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../src/sync/pull.ts"],"names":[],"mappings":"AA+BA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAY,EACZ,UAA6C,EAC7C,eAA4C;IAE5C,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC3B,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,IAAY,CAAC,CAAA;QAClD,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,IAAI,CACV,uCAAuC,GAAG,CAAC,EAAE,oBAAoB,CAClE,CAAA;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,2CAA2C,GAAG,CAAC,EAAE,oBAAoB,EACrE,GAAG,CACJ,CAAA;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CACrB,IAAgC,EAChC,KAA4B;IAE5B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAA;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAC5B,IAAI,EACJ,KAAK,EACL,SAAS,EACT,UAAU,EACV,eAAe,EACf,MAAM,EAQP;IACC,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,SAAS,CAAC;QACR,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAA;QAC9C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YACvD,gDAAgD;YAChD,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,KAAK,EAAE,SAAS;SACjB,CAAC,CAAA;QAEF,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAK;QACP,CAAC;QAED,2EAA2E;QAC3E,qEAAqE;QACrE,6EAA6E;QAC7E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CACzE,CAAA;QACD,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAE,CAAC,CAAC,CACzD,CAAA;QAED,wEAAwE;QACxE,6EAA6E;QAC7E,+BAA+B;QAC/B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QAED,MAAM,KAAK,CAAC,eAAe,CAAC;YAC1B,SAAS;YACT,UAAU,EAAE,IAAsB;YAClC,WAAW;SACZ,CAAC,CAAA;QACF,OAAO,IAAI,SAAS,CAAC,MAAM,CAAA;QAE3B,yEAAyE;QACzE,2DAA2D;QAC3D,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,yBAAyB;QACzB,IAAI,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;YACrC,MAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAA;AACpB,CAAC"}
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../src/sync/pull.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAU/B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAY,EACZ,UAA6C,EAC7C,eAA4C;IAE5C,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC3B,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,IAAY,CAAC,CAAA;QAClD,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBAC7D,EAAE,EAAE,GAAG,CAAC,EAAE;aACX,CAAC,CAAA;YACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE;YACjE,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG;SACJ,CAAC,CAAA;QACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CACrB,IAAgC,EAChC,KAA4B;IAE5B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAA;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAC5B,IAAI,EACJ,KAAK,EACL,SAAS,EACT,UAAU,EACV,eAAe,EACf,MAAM,EAQP;IACC,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,SAAS,CAAC;QACR,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAA;QAC9C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC;YACvD,gDAAgD;YAChD,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,KAAK,EAAE,SAAS;SACjB,CAAC,CAAA;QAEF,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAK;QACP,CAAC;QAED,2EAA2E;QAC3E,qEAAqE;QACrE,6EAA6E;QAC7E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CACzE,CAAA;QACD,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAE,CAAC,CAAC,CACzD,CAAA;QAED,wEAAwE;QACxE,6EAA6E;QAC7E,+BAA+B;QAC/B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QAED,MAAM,KAAK,CAAC,eAAe,CAAC;YAC1B,SAAS;YACT,UAAU,EAAE,IAAsB;YAClC,WAAW;SACZ,CAAC,CAAA;QACF,OAAO,IAAI,SAAS,CAAC,MAAM,CAAA;QAE3B,yEAAyE;QACzE,2DAA2D;QAC3D,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,yBAAyB;QACzB,IAAI,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;YACrC,MAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAA;AACpB,CAAC"}

package/dist/unlock/index.d.ts

@@ -33,7 +33,7 @@
  */
 export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
 export type { StandingUnlockClient, UnlockClientIdentity } from './standingClient.js';
-export { computeUnlockBinding, LADDER_SEED_BYTES, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
+export { computeUnlockBinding, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
 export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from './unlockRecord.js';
 export { publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export type { StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';

package/dist/unlock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}

package/dist/unlock/index.js

@@ -32,7 +32,7 @@
  * was-client dependency graph (the same isolation pattern as `./keyring`).
  */
 export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
-export { computeUnlockBinding, LADDER_SEED_BYTES, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
+export { computeUnlockBinding, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
 export { publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export { retireUnlockCredential } from './retire.js';
 //# sourceMappingURL=index.js.map

package/dist/unlock/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA"}

package/dist/unlock/unlockRecord.d.ts

@@ -106,6 +106,43 @@ export declare function computeUnlockBinding({ bindingMacKey, controller, pointe
 export declare function unlockRecordBinding({ record }: {
     record: unknown;
 }): string;
+/**
+ * The key-agreement keys a stored unlock record is currently sealed to: the
+ * `kid` fragments of its frame descriptor's current-epoch recipients (a
+ * record's descriptor carries one epoch, minted by
+ * {@link mintRecordEncryption}, so the current epoch is the whole roster).
+ * Public halves only -- nothing here is secret, and reading them decrypts
+ * nothing. A descriptor with no epochs, or whose `currentEpoch` names no
+ * epoch it lists, is refused rather than read as an empty recipient set.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @returns {string[]}   the recipients' key multibases
+ */
+export declare function recordSealedRecipientKeys({ record }: {
+    record: unknown;
+}): string[];
+/**
+ * Whether a stored unlock record is sealed to the named credential's unlock
+ * key-agreement key. The detector behind the pending-shaped registry entry:
+ * a passphrase change torn before its retirement landed leaves an entry whose
+ * `unlockSpaceId` and `manageCapability` are the NEW credential's while its
+ * identity members are the OLD credential's, so the record fetched at that
+ * Space is sealed to a key the entry does not name. Compared on the key
+ * multibase, since a `kid` and a recorded key id may be spelled differently.
+ * Throws on a record whose frame or descriptor is unusable, so a caller
+ * never reads a broken record as a pending-shaped one.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @param options.keyAgreementKeyMultibase {string}   the credential's unlock
+ *   KAK public multibase, as the registry entry records it
+ * @returns {boolean}
+ */
+export declare function unlockRecordSealedTo({ record, keyAgreementKeyMultibase }: {
+    record: unknown;
+    keyAgreementKeyMultibase: string;
+}): boolean;
 /**
  * Wraps an unlock record at bind time: the shell (controller, optional
  * email, pointer, timestamp) sealed to the credential's unlock KAK, the

package/dist/unlock/unlockRecord.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlockRecord.d.ts","sourceRoot":"","sources":["../../src/unlock/unlockRecord.ts"],"names":[],"mappings":"AA8DA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAc/D,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAA;AAUnC;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,kBAAkB,CAAA;IAC1B,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;IACrC,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAChC,UAAU,GAAG;IAAE,OAAO,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AA6BhF;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,aAAa,EACb,UAAU,EACV,OAAO,EACP,UAAU,EACX,EAAE;IACD,aAAa,EAAE,UAAU,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,MAAM,CAYT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAS3E;AAoFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,MAAM,EACN,aAAa,EACb,SAAS,EACV,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,EAAE,gBAAgB,CAAA;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,aAAa,EAAE,UAAU,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkD9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,aAAa,EACd,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,aAAa,EAAE,UAAU,CAAA;CAC1B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,UAAU,EAAE,sBAAsB,CAAA;CACnC,CAAC,CAmKD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,MAAM,EACN,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,MAAM,EACP,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,UAAU,EAAE,KAAK,CAAA;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,EAAE,gBAAgB,CAAA;IACjC,MAAM,EAAE,YAAY,CAAA;CACrB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsC9B"}
+{"version":3,"file":"unlockRecord.d.ts","sourceRoot":"","sources":["../../src/unlock/unlockRecord.ts"],"names":[],"mappings":"AA8DA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAe/D,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAA;AAUnC;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,oBAAoB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,kBAAkB,CAAA;IAC1B,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;IACrC,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAChC,UAAU,GAAG;IAAE,OAAO,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAA;AA6BhF;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,aAAa,EACb,UAAU,EACV,OAAO,EACP,UAAU,EACX,EAAE;IACD,aAAa,EAAE,UAAU,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,MAAM,CAYT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAS3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;CAChB,GAAG,MAAM,EAAE,CAqBX;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACN,wBAAwB,EACzB,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,OAAO,CAIV;AAoFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,KAAK,EACL,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,MAAM,EACN,aAAa,EACb,SAAS,EACV,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,KAAK,CAAA;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,EAAE,gBAAgB,CAAA;IACjC,MAAM,EAAE,YAAY,CAAA;IACpB,aAAa,EAAE,UAAU,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkD9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,aAAa,EACd,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,oBAAoB,EAAE,MAAM,CAAA;IAC5B,aAAa,EAAE,UAAU,CAAA;CAC1B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,UAAU,EAAE,sBAAsB,CAAA;CACnC,CAAC,CAmKD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,MAAM,EACN,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,MAAM,EACP,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,UAAU,EAAE,KAAK,CAAA;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,EAAE,gBAAgB,CAAA;IACjC,MAAM,EAAE,YAAY,CAAA;CACrB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsC9B"}

package/dist/unlock/unlockRecord.js

@@ -60,6 +60,7 @@ import { base64urlnopad } from '@scure/base';
 import { equalBytes } from '@noble/ciphers/utils.js';
 import { hmac } from '@noble/hashes/hmac.js';
 import { sha256 } from '@noble/hashes/sha2.js';
+import { vmFragmentOf } from '@interop/vh-resource-log';
 import { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, recordProofKeyMultibase, recordSealCipher, signRecordFrame, verifyRecordProof } from '../keyring/record.js';
 /**
  * The byte length of a ladder seed: 32 random bytes, minted at bind time and
@@ -145,6 +146,58 @@ export function unlockRecordBinding({ record }) {
     }
     return binding;
 }
+/**
+ * The key-agreement keys a stored unlock record is currently sealed to: the
+ * `kid` fragments of its frame descriptor's current-epoch recipients (a
+ * record's descriptor carries one epoch, minted by
+ * {@link mintRecordEncryption}, so the current epoch is the whole roster).
+ * Public halves only -- nothing here is secret, and reading them decrypts
+ * nothing. A descriptor with no epochs, or whose `currentEpoch` names no
+ * epoch it lists, is refused rather than read as an empty recipient set.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @returns {string[]}   the recipients' key multibases
+ */
+export function recordSealedRecipientKeys({ record }) {
+    const { encryption } = parseRecordFrame({ record, label: 'unlock' });
+    const epochs = encryption.epochs ?? [];
+    const epoch = epochs.find(candidate => candidate.id === encryption.currentEpoch);
+    // Fail closed, as the roster read's own integrity refusal does: a
+    // descriptor with no epochs, or whose `currentEpoch` names none of the
+    // epochs it lists, is a broken record, not a record sealed to someone
+    // else. Answering "not sealed to you" would let a host turn a degenerate
+    // descriptor into a caller's benign skip.
+    if (!epoch) {
+        throw new Error("The unlock record's encryption descriptor names no current key " +
+            'epoch among the epochs it lists; the record is unusable.');
+    }
+    return (epoch.recipients ?? [])
+        .map(recipient => recipient?.header?.kid)
+        .filter((kid) => typeof kid === 'string' && kid.length > 0)
+        .map(kid => vmFragmentOf(kid) ?? kid);
+}
+/**
+ * Whether a stored unlock record is sealed to the named credential's unlock
+ * key-agreement key. The detector behind the pending-shaped registry entry:
+ * a passphrase change torn before its retirement landed leaves an entry whose
+ * `unlockSpaceId` and `manageCapability` are the NEW credential's while its
+ * identity members are the OLD credential's, so the record fetched at that
+ * Space is sealed to a key the entry does not name. Compared on the key
+ * multibase, since a `kid` and a recorded key id may be spelled differently.
+ * Throws on a record whose frame or descriptor is unusable, so a caller
+ * never reads a broken record as a pending-shaped one.
+ *
+ * @param options {object}
+ * @param options.record {unknown}   the stored record envelope
+ * @param options.keyAgreementKeyMultibase {string}   the credential's unlock
+ *   KAK public multibase, as the registry entry records it
+ * @returns {boolean}
+ */
+export function unlockRecordSealedTo({ record, keyAgreementKeyMultibase }) {
+    const multibase = vmFragmentOf(keyAgreementKeyMultibase) ?? keyAgreementKeyMultibase;
+    return recordSealedRecipientKeys({ record }).includes(multibase);
+}
 /**
  * Shape-checks a sealed record member (`{ encryption, wrapped }`).
  *