@interop/wallet-core 0.52.1 → 0.54.0

package/dist/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../src/log.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AAeH,MAAM,eAAe,GAAW;IAC9B,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CACnB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAClB,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAClB,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CACnB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;CAC7E,CAAA;AAED,IAAI,MAAM,GAAW,eAAe,CAAA;AAEpC;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAA;IACvB,MAAM,GAAG,IAAI,CAAA;IACb,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAW;IACzB,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IAC7C,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;IAC3C,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;IAC3C,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;CAC9C,CAAA"}

package/dist/recovery/recoveryDelegation.d.ts

@@ -74,14 +74,18 @@ export interface RecoveryDelegationEntry {
  * flags a recorded sibling the pass could not rebuild because the document
  * points at no generation, which stays flagged for the health check),
  * `incomplete-entry` (an entry predating the re-mint fields, skipped until
- * the credential is re-bound), or `failed` (the record could not be read,
+ * the credential is re-bound), `pending-entry` (the entry's recorded
+ * unlock-key members do not match the credential the record at its unlock
+ * Space is sealed to -- a passphrase change torn before its retirement; the
+ * next passphrase login's repair finishes it, and re-minting here would
+ * re-arm the retired credential into the new one's record), or `failed` (the record could not be read,
  * re-sealed, or re-PUT -- `error` carries the cause). A skipped or failed
  * entry is named here so no caller can lose it silently.
  */
 export interface RecordRemintOutcome {
     label: string;
     unlockSpaceId: string;
-    outcome: 'current' | 'reminted' | 'incomplete-entry' | 'failed';
+    outcome: 'current' | 'reminted' | 'incomplete-entry' | 'pending-entry' | 'failed';
     siblingCarriedVerbatim?: boolean;
     error?: unknown;
 }

package/dist/recovery/recoveryDelegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAKhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExE,OAAO,EACL,oBAAoB,EAGrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAClB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,kBAAkB,GAAG,QAAQ,CAAA;IAC/D,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAA0B,EAC1B,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,8BAA8B,CAAC,EAAE,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,KAAK,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAAC,CA2KD"}
+{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAMhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKxE,OAAO,EACL,oBAAoB,EAGrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAClB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EACL,SAAS,GAAG,UAAU,GAAG,kBAAkB,GAAG,eAAe,GAAG,QAAQ,CAAA;IAC1E,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAA0B,EAC1B,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,8BAA8B,CAAC,EAAE,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,KAAK,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAAC,CAuMD"}

package/dist/recovery/recoveryDelegation.js

@@ -45,11 +45,12 @@
  */
 import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
 import { resourcePath, toUrl } from '@interop/was-client/paths';
+import { log } from '../log.js';
 import { DID_LOG_RESOURCE, ID_COLLECTION } from '../space/collections.js';
 import { delegationKeyInDocument } from '../webvh/listClients.js';
 import { vmFragmentOf } from '@interop/vh-resource-log';
 import { getUnlockKeyringWithCapability, putUnlockKeyringWithCapability } from '../keyring/unlockSpace.js';
-import { remintUnlockRecordDelegations } from '../unlock/unlockRecord.js';
+import { remintUnlockRecordDelegations, unlockRecordSealedTo } from '../unlock/unlockRecord.js';
 import { delegationProofKeyId, STANDING_ZCAP_TTL_MS, zcapExpiring } from '../webvh/standingZcap.js';
 /**
  * The recovery delegation's lifetime: the house standing-zcap value
@@ -233,6 +234,29 @@ export async function remintRecoveryDelegations({ doc, entries, pointer, storage
                 spaceId: entry.unlockSpaceId,
                 capability: entry.manageCapability
             });
+            // The pending-shaped guard: the entry's `unlockSpaceId` and
+            // `manageCapability` name one credential while its identity members
+            // name another -- the state a passphrase change torn before its
+            // retirement leaves. Re-minting here would seal a fresh
+            // current-client-signed bridge for the OLD credential into the NEW
+            // credential's record, re-arming the half-retired credential and
+            // bricking the new one's entry paths. Nothing is written; the next
+            // passphrase login's repair is the mender.
+            if (!unlockRecordSealedTo({
+                record: standing,
+                keyAgreementKeyMultibase: entry.unlockKeyAgreementKeyMultibase
+            })) {
+                log.warn('The unlock record at the Space recorded for this entry is ' +
+                    'sealed to another credential (a passphrase change torn before ' +
+                    'its retirement landed); its delegations are not re-minted', { label: entry.label });
+                skipped += 1;
+                outcomes.push({
+                    label: entry.label,
+                    unlockSpaceId: entry.unlockSpaceId,
+                    outcome: 'pending-entry'
+                });
+                continue;
+            }
             const delegation = await delegateLogWrite({
                 zcapClient,
                 pointer,
@@ -253,9 +277,8 @@ export async function remintRecoveryDelegations({ doc, entries, pointer, storage
                 });
                 if (!delegatedClients) {
                     siblingCarriedVerbatim = true;
-                    console.warn(`The account document names no client-annex generation; the ` +
-                        `delegatedClients delegation for "${entry.label}" is carried ` +
-                        'verbatim.');
+                    log.warn('The account document names no client-annex generation; the ' +
+                        'delegatedClients delegation for this entry is carried verbatim', { label: entry.label });
                 }
             }
             // The credential's unlock KAK, public half only -- exactly enough to
@@ -310,7 +333,10 @@ export async function remintRecoveryDelegations({ doc, entries, pointer, storage
             });
         }
         catch (err) {
-            console.warn(`Could not re-mint the recovery delegation for "${entry.label}":`, err);
+            log.warn('Could not re-mint the recovery delegation', {
+                label: entry.label,
+                err
+            });
             skipped += 1;
             outcomes.push({
                 label: entry.label,

package/dist/recovery/recoveryDelegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAA;AAElC,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAA;AACzE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACb,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,6EAA6E;AAC7E,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAKlB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B,CAAC;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAmD/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAAqB,GAAG,EAAE,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAejB;IAKC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAC3D,CAAA;IACD,4EAA4E;IAC5E,sEAAsE;IACtE,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAW,EAAE,CACvD,uBAAuB,CAAC;QACtB,GAAG;QACH,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;QAC/C,yEAAyE;QACzE,mEAAmE;QACnE,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG;SACJ,CAAC,CAAA;QACF,mEAAmE;QACnE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,eAAe,GACnB,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAA;QAC7C,MAAM,YAAY,GAChB,eAAe;YACf,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC;gBACtC,YAAY,CAAC;oBACX,GAAG,CAAC,KAAK,CAAC,uBAAuB;wBAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,uBAAuB,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG;iBACJ,CAAC,CAAC,CAAA;QACP,IAAI,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,SAAS;aACnB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IACE,CAAC,KAAK,CAAC,iBAAiB;YACxB,CAAC,KAAK,CAAC,uBAAuB;YAC9B,CAAC,KAAK,CAAC,8BAA8B;YACrC,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;YACD,sEAAsE;YACtE,mDAAmD;YACnD,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;gBACpD,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,UAAU;gBACV,OAAO;gBACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAA;YACF,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,uEAAuE;YACvE,sEAAsE;YACtE,SAAS;YACT,IAAI,gBAAmC,CAAA;YACvC,IAAI,sBAAsB,GAAG,KAAK,CAAA;YAClC,IAAI,eAAe,EAAE,CAAC;gBACpB,gBAAgB,GAAG,MAAM,8BAA8B,EAAE,CAAC;oBACxD,UAAU,EAAE,KAAK,CAAC,iBAAiB;iBACpC,CAAC,CAAA;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,sBAAsB,GAAG,IAAI,CAAA;oBAC7B,OAAO,CAAC,IAAI,CACV,6DAA6D;wBAC3D,oCAAoC,KAAK,CAAC,KAAK,eAAe;wBAC9D,WAAW,CACd,CAAA;gBACH,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,MAAM,SAAS,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC;gBACtD,EAAE,EAAE,KAAK,CAAC,uBAAuB;gBACjC,UAAU,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,EAAE,2BAA2B;gBACjC,kBAAkB,EAAE,KAAK,CAAC,8BAA8B;aACzD,CAAC,CAAqB,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;gBAClD,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YACF,MAAM,8BAA8B,CAAC;gBACnC,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;YACxD,MAAM,iBAAiB,GAAI,UAAmC,CAAC,OAAO,CAAA;YACtE,MAAM,qBAAqB,GAAG,gBAAgB;gBAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,uBAAuB,GAAG,gBAAgB;gBAC9C,CAAC,CAAE,gBAAyC,CAAC,OAAO;gBACpD,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF,CAAC,CAAA;YACF,QAAQ,IAAI,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,UAAU;gBACnB,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,kDAAkD,KAAK,CAAC,KAAK,IAAI,EACjE,GAAG,CACJ,CAAA;YACD,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACb,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,6EAA6E;AAC7E,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EAKlB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B,CAAC;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAwD/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAAqB,GAAG,EAAE,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAejB;IAKC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAC3D,CAAA;IACD,4EAA4E;IAC5E,sEAAsE;IACtE,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAW,EAAE,CACvD,uBAAuB,CAAC;QACtB,GAAG;QACH,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;QAC/C,yEAAyE;QACzE,mEAAmE;QACnE,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG;SACJ,CAAC,CAAA;QACF,mEAAmE;QACnE,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,eAAe,GACnB,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAA;QAC7C,MAAM,YAAY,GAChB,eAAe;YACf,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC;gBACtC,YAAY,CAAC;oBACX,GAAG,CAAC,KAAK,CAAC,uBAAuB;wBAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,uBAAuB,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG;iBACJ,CAAC,CAAC,CAAA;QACP,IAAI,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,SAAS;aACnB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IACE,CAAC,KAAK,CAAC,iBAAiB;YACxB,CAAC,KAAK,CAAC,uBAAuB;YAC9B,CAAC,KAAK,CAAC,8BAA8B;YACrC,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;YACD,sEAAsE;YACtE,mDAAmD;YACnD,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;gBACpD,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,4DAA4D;YAC5D,oEAAoE;YACpE,gEAAgE;YAChE,wDAAwD;YACxD,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,2CAA2C;YAC3C,IACE,CAAC,oBAAoB,CAAC;gBACpB,MAAM,EAAE,QAAQ;gBAChB,wBAAwB,EAAE,KAAK,CAAC,8BAA8B;aAC/D,CAAC,EACF,CAAC;gBACD,GAAG,CAAC,IAAI,CACN,4DAA4D;oBAC1D,gEAAgE;oBAChE,2DAA2D,EAC7D,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACD,OAAO,IAAI,CAAC,CAAA;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,UAAU;gBACV,OAAO;gBACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAA;YACF,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,uEAAuE;YACvE,sEAAsE;YACtE,SAAS;YACT,IAAI,gBAAmC,CAAA;YACvC,IAAI,sBAAsB,GAAG,KAAK,CAAA;YAClC,IAAI,eAAe,EAAE,CAAC;gBACpB,gBAAgB,GAAG,MAAM,8BAA8B,EAAE,CAAC;oBACxD,UAAU,EAAE,KAAK,CAAC,iBAAiB;iBACpC,CAAC,CAAA;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,sBAAsB,GAAG,IAAI,CAAA;oBAC7B,GAAG,CAAC,IAAI,CACN,6DAA6D;wBAC3D,gEAAgE,EAClE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,MAAM,SAAS,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC;gBACtD,EAAE,EAAE,KAAK,CAAC,uBAAuB;gBACjC,UAAU,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,EAAE,2BAA2B;gBACjC,kBAAkB,EAAE,KAAK,CAAC,8BAA8B;aACzD,CAAC,CAAqB,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;gBAClD,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YACF,MAAM,8BAA8B,CAAC;gBACnC,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;YACxD,MAAM,iBAAiB,GAAI,UAAmC,CAAC,OAAO,CAAA;YACtE,MAAM,qBAAqB,GAAG,gBAAgB;gBAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,uBAAuB,GAAG,gBAAgB;gBAC9C,CAAC,CAAE,gBAAyC,CAAC,OAAO;gBACpD,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF,CAAC,CAAA;YACF,QAAQ,IAAI,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,UAAU;gBACnB,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;aACJ,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC"}

package/dist/recovery/recoveryWebvh.d.ts

@@ -1,5 +1,6 @@
 import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
 import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 /**
  * The verification-method id a code's key-agreement key publishes under --
  * the ordinary `<did>#<multibase>` form, indistinguishable by id from any
@@ -46,11 +47,19 @@ export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdRes
  * @param options.store {RecoveryLogStore}
  * @param [options.expectedDid] {string}   the account DID the log must resolve
  *   to, where the caller holds one
+ * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
+ *   pins; a served log that is a rollback, a fork, or an identity switch
+ *   against the pinned head is refused (`ResourceLogContinuityError`)
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @returns {Promise<PublishedWebvhLog>}
  */
-export declare function readLogOrThrow({ store, expectedDid }: {
+export declare function readLogOrThrow({ store, expectedDid, pinStore, logId }: {
     store: RecoveryLogStore;
     expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
 }): Promise<PublishedWebvhLog>;
 /**
  * Publishes `did.jsonl` through the narrow recovery seam -- the log only,
@@ -87,14 +96,22 @@ export declare function publishLogOnly({ store, log, ifMatch }: {
  * @param options.recovery {RecoveryPublicKeys}   the code's public halves
  * @param [options.expectedDid] {string}   the account DID the log must
  *   resolve to, from the caller's stored account pointer
+ * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
+ *   pins; a served log that is a rollback, a fork, or an identity switch
+ *   against the pinned head is refused (`ResourceLogContinuityError`)
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   the account
  *   DID and the document and log as this call leaves them
  */
-export declare function publishRecoveryKey({ idStore, updateKeys, recovery, expectedDid }: {
+export declare function publishRecoveryKey({ idStore, updateKeys, recovery, expectedDid, pinStore, logId }: {
     idStore: WebvhIdStore;
     updateKeys: ClientWebvhUpdateKeys;
     recovery: RecoveryPublicKeys;
     expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
 }): Promise<{
     did: string;
     doc: DIDDoc;
@@ -112,11 +129,13 @@ export declare function publishRecoveryKey({ idStore, updateKeys, recovery, expe
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
  *   {@link publishRecoveryKey}
  */
-export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expectedDid }: {
+export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expectedDid, pinStore, logId }: {
     idStore: WebvhIdStore;
     updateKeys: ClientWebvhUpdateKeys;
     recovery: RecoveryPublicKeys;
     expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
 }): Promise<{
     did: string;
     doc: DIDDoc;
@@ -150,11 +169,52 @@ export declare function removeRecoveryKey({ idStore, updateKeys, recovery, expec
  *   holds them and can sign the add entry)
  * @param options.replacement {RecoveryPublicKeys}   the replacement code's
  *   public halves, committed and published in the same continuation
+ * @param options.onCommitted {function}
+ *   `(committed: { builtOnHead: { scid, versionId } }) => Promise<void>` --
+ *   the REQUIRED persist-before-publish seam. It runs once per attempt, after
+ *   the reveal-and-commit entry stands (published here, or standing from a
+ *   torn earlier run) and BEFORE the add-and-retire entry -- the ceremony's
+ *   pivot -- is built. The caller durably persists the successor material
+ *   there (the `pending` codec group of `keys/clientKeyRecord.ts`: ceremony
+ *   `'recovery-spend'`, the handed-back `builtOnHead`, the spent code's
+ *   unwrap key, the replacement code's bytes), so the pivot can never retire
+ *   the spent code while its successors exist only in tab memory, per the
+ *   post-pivot derivability rule (`decisions/0010`). Unlike the transient
+ *   continuation's seam it returns nothing into the entry: the durable spend
+ *   has no annex pointer to move. A throw propagates and the add-and-retire
+ *   entry is withheld -- the code stays unspent, and a re-run with the same
+ *   code converges. The seam must be idempotent: the conflict retry invokes
+ *   it again. The caveat to hold on to: the idempotent COMPLETED branch (the
+ *   new client's update key already authorized) returns without ever
+ *   entering the seam. A re-run after a tear here MUST pass the SAME
+ *   `replacement` halves back in, re-derived from the persisted replacement
+ *   code's bytes -- the reveal entry already committed that code's update-key
+ *   hash, and a re-run minting a fresh replacement would leave the first
+ *   one's commitment standing forever with no `keyAgreement` method behind
+ *   it: a code the commitment check accepts but that decrypts nothing. With
+ *   the halves reused, the only residue of a torn or abandoned run is the
+ *   never-published CLIENT's committed hashes, inert orphans in
+ *   `nextKeyHashes` exactly as on the self-enrollment seam (keys of a lost
+ *   random seed; nothing can reveal them)
  * @param [options.expectedDid] {string}   the account DID the log must resolve
  *   to, where the recovering flow already knows it
- * @returns {Promise<{ did: string, webDoc?: object }>}   the account DID and,
- *   when the add entry ran here, the final `did.json` projection for the
- *   recovered session to republish
+ * @param [options.pinStore] {ResourceLogPinStore}   this caller's chain-head
+ *   pins; every read both entries are built on is checked against the pinned
+ *   head (a served prefix is refused before the reveal entry lands, not only
+ *   by a verify that follows both entries), and the pin advances to each
+ *   entry as it publishes
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
+ * @returns {Promise<{ did: string, webDoc?: object, committed: boolean }>}
+ *   the account DID, the final `did.json` projection when the add-and-retire
+ *   entry ran here, and `committed` -- whether THIS call published the pivot
+ *   entry (`false` exactly on the idempotent completed branch, where a torn
+ *   earlier run had already published it). It is an observability signal, not
+ *   a success flag: a returning call means the continuation stands either
+ *   way, so a caller clears its pending state on the RETURN, whatever
+ *   `committed` says. Its absence from a return value is a build skew, which
+ *   is why it is stated rather than inferred
  */
 export declare function recoverWebvhClient(options: {
     store: RecoveryLogStore;
@@ -164,9 +224,18 @@ export declare function recoverWebvhClient(options: {
     newClientKeys: WebvhEnrollmentKeys;
     newClientUpdateSeeds: ClientWebvhUpdateKeys;
     replacement: RecoveryPublicKeys;
+    onCommitted: (committed: {
+        builtOnHead: {
+            scid: string;
+            versionId: string;
+        };
+    }) => Promise<void>;
     expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
 }): Promise<{
     did: string;
     webDoc?: object;
+    committed: boolean;
 }>;
 //# sourceMappingURL=recoveryWebvh.d.ts.map

package/dist/recovery/recoveryWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EAEP,MAAM,2BAA2B,CAAA;AAWlC,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAG7B;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,GAAG,EACH,OAAO,EACR,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAarD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAarD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5C"}
+{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EAEP,MAAM,2BAA2B,CAAA;AAclC,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAGnE;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,GAAG,EACH,OAAO,EACR,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAerD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAerD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAmBhE"}

package/dist/recovery/recoveryWebvh.js

@@ -34,7 +34,7 @@
  * with the same key material converges without forking the log.
  */
 import { deriveNextKeyHash, updateDID } from '@interop/did-method-webvh';
-import { assertCarryOverCommitments, markedVerificationMethodPair, MULTIKEY_VM_TYPE, putLogResource, readPublishedLog, relationIds, updateKeySigner, withLogConflictRetry } from '../webvh/didWebvh.js';
+import { assertCanonicalClientKeys, assertCarryOverCommitments, markedVerificationMethodPair, MULTIKEY_VM_TYPE, pinOfLog, putLogResource, readPublishedLog, relationIds, servedHead, updateKeySigner, withLogConflictRetry } from '../webvh/didWebvh.js';
 import { publishUnlockKey, removeUnlockKey } from '../unlock/standingWebvh.js';
 /**
  * The verification-method id a code's key-agreement key publishes under --
@@ -70,13 +70,21 @@ export class RecoveryKeyNotCommittedError extends Error {
  * @param options.store {RecoveryLogStore}
  * @param [options.expectedDid] {string}   the account DID the log must resolve
  *   to, where the caller holds one
+ * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
+ *   pins; a served log that is a rollback, a fork, or an identity switch
+ *   against the pinned head is refused (`ResourceLogContinuityError`)
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @returns {Promise<PublishedWebvhLog>}
  */
-export async function readLogOrThrow({ store, expectedDid }) {
+export async function readLogOrThrow({ store, expectedDid, pinStore, logId }) {
     // readPublishedLog only calls getIdResourceRaw, so the narrow seam is safe.
     const published = await readPublishedLog({
         idStore: store,
-        ...(expectedDid !== undefined ? { expectedDid } : {})
+        ...(expectedDid !== undefined ? { expectedDid } : {}),
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {})
     });
     if (!published) {
         throw new Error('did:webvh: did.jsonl is missing; nothing to recover.');
@@ -116,10 +124,16 @@ export async function publishLogOnly({ store, log, ifMatch }) {
  * @param options.recovery {RecoveryPublicKeys}   the code's public halves
  * @param [options.expectedDid] {string}   the account DID the log must
  *   resolve to, from the caller's stored account pointer
+ * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
+ *   pins; a served log that is a rollback, a fork, or an identity switch
+ *   against the pinned head is refused (`ResourceLogContinuityError`)
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   the account
  *   DID and the document and log as this call leaves them
  */
-export async function publishRecoveryKey({ idStore, updateKeys, recovery, expectedDid }) {
+export async function publishRecoveryKey({ idStore, updateKeys, recovery, expectedDid, pinStore, logId }) {
     return publishUnlockKey({
         idStore,
         updateKeys,
@@ -130,6 +144,8 @@ export async function publishRecoveryKey({ idStore, updateKeys, recovery, expect
             updateKeyMultibase: recovery.updateKeyMultibase
         },
         ...(expectedDid !== undefined ? { expectedDid } : {}),
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {}),
         verb: 'issuing a recovery code'
     });
 }
@@ -145,7 +161,7 @@ export async function publishRecoveryKey({ idStore, updateKeys, recovery, expect
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
  *   {@link publishRecoveryKey}
  */
-export async function removeRecoveryKey({ idStore, updateKeys, recovery, expectedDid }) {
+export async function removeRecoveryKey({ idStore, updateKeys, recovery, expectedDid, pinStore, logId }) {
     return removeUnlockKey({
         idStore,
         updateKeys,
@@ -156,6 +172,8 @@ export async function removeRecoveryKey({ idStore, updateKeys, recovery, expecte
             updateKeyMultibase: recovery.updateKeyMultibase
         },
         ...(expectedDid !== undefined ? { expectedDid } : {}),
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {}),
         verb: 'revoking a recovery code'
     });
 }
@@ -187,30 +205,96 @@ export async function removeRecoveryKey({ idStore, updateKeys, recovery, expecte
  *   holds them and can sign the add entry)
  * @param options.replacement {RecoveryPublicKeys}   the replacement code's
  *   public halves, committed and published in the same continuation
+ * @param options.onCommitted {function}
+ *   `(committed: { builtOnHead: { scid, versionId } }) => Promise<void>` --
+ *   the REQUIRED persist-before-publish seam. It runs once per attempt, after
+ *   the reveal-and-commit entry stands (published here, or standing from a
+ *   torn earlier run) and BEFORE the add-and-retire entry -- the ceremony's
+ *   pivot -- is built. The caller durably persists the successor material
+ *   there (the `pending` codec group of `keys/clientKeyRecord.ts`: ceremony
+ *   `'recovery-spend'`, the handed-back `builtOnHead`, the spent code's
+ *   unwrap key, the replacement code's bytes), so the pivot can never retire
+ *   the spent code while its successors exist only in tab memory, per the
+ *   post-pivot derivability rule (`decisions/0010`). Unlike the transient
+ *   continuation's seam it returns nothing into the entry: the durable spend
+ *   has no annex pointer to move. A throw propagates and the add-and-retire
+ *   entry is withheld -- the code stays unspent, and a re-run with the same
+ *   code converges. The seam must be idempotent: the conflict retry invokes
+ *   it again. The caveat to hold on to: the idempotent COMPLETED branch (the
+ *   new client's update key already authorized) returns without ever
+ *   entering the seam. A re-run after a tear here MUST pass the SAME
+ *   `replacement` halves back in, re-derived from the persisted replacement
+ *   code's bytes -- the reveal entry already committed that code's update-key
+ *   hash, and a re-run minting a fresh replacement would leave the first
+ *   one's commitment standing forever with no `keyAgreement` method behind
+ *   it: a code the commitment check accepts but that decrypts nothing. With
+ *   the halves reused, the only residue of a torn or abandoned run is the
+ *   never-published CLIENT's committed hashes, inert orphans in
+ *   `nextKeyHashes` exactly as on the self-enrollment seam (keys of a lost
+ *   random seed; nothing can reveal them)
  * @param [options.expectedDid] {string}   the account DID the log must resolve
  *   to, where the recovering flow already knows it
- * @returns {Promise<{ did: string, webDoc?: object }>}   the account DID and,
- *   when the add entry ran here, the final `did.json` projection for the
- *   recovered session to republish
+ * @param [options.pinStore] {ResourceLogPinStore}   this caller's chain-head
+ *   pins; every read both entries are built on is checked against the pinned
+ *   head (a served prefix is refused before the reveal entry lands, not only
+ *   by a verify that follows both entries), and the pin advances to each
+ *   entry as it publishes
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
+ * @returns {Promise<{ did: string, webDoc?: object, committed: boolean }>}
+ *   the account DID, the final `did.json` projection when the add-and-retire
+ *   entry ran here, and `committed` -- whether THIS call published the pivot
+ *   entry (`false` exactly on the idempotent completed branch, where a torn
+ *   earlier run had already published it). It is an observability signal, not
+ *   a success flag: a returning call means the continuation stands either
+ *   way, so a caller clears its pending state on the RETURN, whatever
+ *   `committed` says. Its absence from a return value is a build skew, which
+ *   is why it is stated rather than inferred
  */
 export async function recoverWebvhClient(options) {
+    // The seam is what makes the successor material durable before the pivot
+    // entry retires the spent code; a call omitting it would silently keep the
+    // window in which the document names successors nothing can re-derive.
+    // Refused before any read, so nothing is published.
+    if (typeof options.onCommitted !== 'function') {
+        throw new TypeError('recoverWebvhClient requires onCommitted: the successor material must ' +
+            'be persisted before the add-and-retire entry retires the spent code.');
+    }
+    // A non-canonical pair could only ever throw at the add-and-retire build,
+    // AFTER the reveal entry published and the seam persisted; refused here, it
+    // costs nothing durable.
+    assertCanonicalClientKeys({
+        signingKeyMultibase: options.newClientKeys.signingKeyMultibase,
+        keyAgreementKeyMultibase: options.newClientKeys.keyAgreementKeyMultibase
+    });
     return withLogConflictRetry(() => recoverWebvhClientOnce(options));
 }
 /**
  * One attempt of {@link recoverWebvhClient}, re-invoked by the conflict retry.
  *
  * @param options {object}   see {@link recoverWebvhClient}
- * @returns {Promise<{ did: string, webDoc?: object }>}
+ * @returns {Promise<{ did: string, webDoc?: object, committed: boolean }>}
  */
-async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClientUpdateSeeds, replacement, expectedDid }) {
+async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClientUpdateSeeds, replacement, onCommitted, expectedDid, pinStore, logId }) {
+    // Each attempt's own read is what the CAS publish is built on, so the
+    // continuity check runs here -- and again on a conflict-retry re-run -- not
+    // only on the verify that follows both entries.
+    const pinned = {
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {})
+    };
     let published = await readLogOrThrow({
         store,
-        ...(expectedDid !== undefined ? { expectedDid } : {})
+        ...(expectedDid !== undefined ? { expectedDid } : {}),
+        ...pinned
     });
     // Already complete (a torn earlier run finished the add entry): the new
-    // client's update key is authorized, which only the add entry writes.
+    // client's update key is authorized, which only the add entry writes. The
+    // seam is deliberately NOT entered here -- nothing is about to be
+    // published, so there is no pivot to persist ahead of.
     if (published.updateKeys.includes(newClientKeys.updateKeyMultibase)) {
-        return { did: published.did };
+        return { did: published.did, committed: false };
     }
     const recoveryHash = await deriveNextKeyHash(recovery.updateKeyMultibase);
     const newUpdateHash = await deriveNextKeyHash(newClientKeys.updateKeyMultibase);
@@ -251,9 +335,25 @@ async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClien
             log: updated.log,
             ifMatch: published.etag
         });
-        // The same account the reveal entry just extended.
-        published = await readLogOrThrow({ store, expectedDid: published.did });
+        // Advance the pin to what the reveal entry just published, so the re-read
+        // below (and any read after a tear here) refuses a host that rolls the
+        // log back behind it.
+        if (pinStore && logId !== undefined) {
+            await pinStore.write({ logId, pin: pinOfLog(updated.log) });
+        }
+        // The same account the reveal entry just extended, under the same pin.
+        published = await readLogOrThrow({
+            store,
+            expectedDid: published.did,
+            ...pinned
+        });
     }
+    // The persist-before-publish seam: the successor material becomes durable
+    // HERE, on the head the add-and-retire entry is about to be built on,
+    // before that entry -- the ceremony's pivot -- retires the spent code.
+    // Reached on both paths into the add entry: the reveal entry just published
+    // above, or a torn earlier run's reveal entry standing already.
+    await onCommitted({ builtOnHead: servedHead(published.log) });
     // The add-and-retire entry: the new client's verification methods and
     // update key in; the spent code's VM, update key, and hash out; the
     // replacement code's VM in. Signed by the new client's update key, whose
@@ -327,6 +427,11 @@ async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClien
     // Conditional on the read this entry was built on: the re-read above when
     // the commit entry ran here, the first read when it was skipped.
     await publishLogOnly({ store, log: updated.log, ifMatch: published.etag });
-    return { did: updated.did, webDoc: updated.webDoc };
+    // Advance the pin to what this entry just published, so a host rolling the
+    // log back straight afterwards is refused on the next read.
+    if (pinStore && logId !== undefined) {
+        await pinStore.write({ logId, pin: pinOfLog(updated.log) });
+    }
+    return { did: updated.did, webDoc: updated.webDoc, committed: true };
 }
 //# sourceMappingURL=recoveryWebvh.js.map

package/dist/recovery/recoveryWebvh.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.js","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAO7B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EAIzB;IACC,OAAO,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;AAC7C,CAAC;AAYD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YACE,OAAO,GAAG,4DAA4D;QACpE,4CAA4C;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAYD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EAIZ;IACC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,KAAK,EACL,GAAG,EACH,OAAO,EAKR;IACC,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EAMZ;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EAMZ;IACC,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,IAAI,EAAE,0BAA0B;KACjC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAOxC;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EAQZ;IACC,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;IAC/B,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,wBAAwB,CACvC,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,KAAK,CACrE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC/C,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,aAAa;oBACb,aAAa;oBACb,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;SACxB,CAAC,CAAA;QACF,mDAAmD;QACnD,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,kBAA0B,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,wCAAwC;IACxC,MAAM,YAAY,GAAyB;QACzC,GAAG,4BAA4B,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;SACjE,CAAC;QACF;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;KACF,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CACtD;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,aAAa,GAAG,CACpB,QAAqD,EACrD,EAAU,EACV,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,IAAI,EAAE,oBAAoB,CAAC,UAAU;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,kBAAkB,CAC3C;gBACD,aAAa,CAAC,kBAAkB;aACjC,CAAC;SACH;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAC9B;QACD,mBAAmB;QACnB,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;QAC9D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC;QAChE,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC;gBAC/D,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC;gBAC5C,eAAe;aAChB,CAAC;SACH;QACD,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC1E,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;KAC3E,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;AACrD,CAAC"}
+{"version":3,"file":"recoveryWebvh.js","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,EAChB,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EAIzB;IACC,OAAO,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;AAC7C,CAAC;AAYD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YACE,OAAO,GAAG,4DAA4D;QACpE,4CAA4C;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACX,QAAQ,EACR,KAAK,EAMN;IACC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,KAAK,EACL,GAAG,EACH,OAAO,EAKR;IACC,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EAQN;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EAQN;IACC,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,0BAA0B;KACjC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAYxC;IACC,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,oDAAoD;IACpD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,uEAAuE;YACrE,sEAAsE,CACzE,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,yBAAyB;IACzB,yBAAyB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,aAAa,CAAC,mBAAmB;QAC9D,wBAAwB,EAAE,OAAO,CAAC,aAAa,CAAC,wBAAwB;KACzE,CAAC,CAAA;IACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,KAAK,EAaN;IACC,sEAAsE;IACtE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;KACV,CAAC,CAAA;IAEF,wEAAwE;IACxE,0EAA0E;IAC1E,kEAAkE;IAClE,uDAAuD;IACvD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACjD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,wBAAwB,CACvC,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,KAAK,CACrE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC/C,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,aAAa;oBACb,aAAa;oBACb,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;SACxB,CAAC,CAAA;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,sBAAsB;QACtB,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7D,CAAC;QACD,uEAAuE;QACvE,SAAS,GAAG,MAAM,cAAc,CAAC;YAC/B,KAAK;YACL,WAAW,EAAE,SAAS,CAAC,GAAG;YAC1B,GAAG,MAAM;SACV,CAAC,CAAA;IACJ,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,WAAW,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAE7D,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,kBAA0B,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,wCAAwC;IACxC,MAAM,YAAY,GAAyB;QACzC,GAAG,4BAA4B,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;SACjE,CAAC;QACF;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;KACF,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CACtD;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,aAAa,GAAG,CACpB,QAAqD,EACrD,EAAU,EACV,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,IAAI,EAAE,oBAAoB,CAAC,UAAU;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,kBAAkB,CAC3C;gBACD,aAAa,CAAC,kBAAkB;aACjC,CAAC;SACH;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAC9B;QACD,mBAAmB;QACnB,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;QAC9D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC;QAChE,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC;gBAC/D,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC;gBAC5C,eAAe;aAChB,CAAC;SACH;QACD,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC1E,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;KAC3E,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AACtE,CAAC"}

package/dist/request/capabilityRequest.d.ts

@@ -24,10 +24,18 @@ import type { ICapabilityQueryDetail, IVPRDetails } from './types.js';
  * @param options.capabilityQueries {ICapabilityQueryDetail[]}
  * @param [options.challenge] {string}   a requester-chosen nonce the wallet
  *   echoes in its response presentation
+ * @param [options.agent] {{ name: string }}   the requester's self-declared
+ *   display name, carried as the VPR's root `agent` member; shown at consent
+ *   as what the agent calls itself, never as verified identity. Validated by
+ *   `normalizeAgentName` (trimmed, 1 to 64 characters, no control
+ *   characters), so a name the wallet would refuse fails here first.
  * @returns {IVPRDetails}
  */
-export declare function composeCapabilityRequest({ capabilityQueries, challenge }: {
+export declare function composeCapabilityRequest({ capabilityQueries, challenge, agent }: {
     capabilityQueries: ICapabilityQueryDetail[];
     challenge?: string;
+    agent?: {
+        name: string;
+    };
 }): IVPRDetails;
 //# sourceMappingURL=capabilityRequest.d.ts.map

package/dist/request/capabilityRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilityRequest.d.ts","sourceRoot":"","sources":["../../src/request/capabilityRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,WAAW,EAGZ,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,iBAAiB,EACjB,SAAS,EACV,EAAE;IACD,iBAAiB,EAAE,sBAAsB,EAAE,CAAA;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,WAAW,CAsBd"}
+{"version":3,"file":"capabilityRequest.d.ts","sourceRoot":"","sources":["../../src/request/capabilityRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,sBAAsB,EACtB,WAAW,EAGZ,MAAM,YAAY,CAAA;AAGnB;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,iBAAiB,EACjB,SAAS,EACT,KAAK,EACN,EAAE;IACD,iBAAiB,EAAE,sBAAsB,EAAE,CAAA;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACzB,GAAG,WAAW,CA2Bd"}

package/dist/request/capabilityRequest.js

@@ -1,3 +1,4 @@
+import { normalizeAgentName } from './classify.js';
 /**
  * REQUESTER: builds the zcap-only VPR details for a set of capability
  * requests. Each detail must name its `controller` (the grantee DID) and its
@@ -9,9 +10,14 @@
  * @param options.capabilityQueries {ICapabilityQueryDetail[]}
  * @param [options.challenge] {string}   a requester-chosen nonce the wallet
  *   echoes in its response presentation
+ * @param [options.agent] {{ name: string }}   the requester's self-declared
+ *   display name, carried as the VPR's root `agent` member; shown at consent
+ *   as what the agent calls itself, never as verified identity. Validated by
+ *   `normalizeAgentName` (trimmed, 1 to 64 characters, no control
+ *   characters), so a name the wallet would refuse fails here first.
  * @returns {IVPRDetails}
  */
-export function composeCapabilityRequest({ capabilityQueries, challenge }) {
+export function composeCapabilityRequest({ capabilityQueries, challenge, agent }) {
     if (capabilityQueries.length === 0) {
         throw new Error('A capability request must ask for at least one zcap.');
     }
@@ -30,6 +36,11 @@ export function composeCapabilityRequest({ capabilityQueries, challenge }) {
         capabilityQuery: capabilityQueries,
         ...(challenge !== undefined && { challenge })
     };
-    return { query: [query] };
+    return {
+        query: [query],
+        ...(agent !== undefined && {
+            agent: { name: normalizeAgentName({ name: agent.name }) }
+        })
+    };
 }
 //# sourceMappingURL=capabilityRequest.js.map

package/dist/request/capabilityRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilityRequest.js","sourceRoot":"","sources":["../../src/request/capabilityRequest.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,iBAAiB,EACjB,SAAS,EAIV;IACC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAA;QACtC,IACE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC;YAC7C,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAe;QACxB,IAAI,EAAE,8BAA8B;QACpC,eAAe,EAAE,iBAAiB;QAClC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,KAAkB,CAAC,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"capabilityRequest.js","sourceRoot":"","sources":["../../src/request/capabilityRequest.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,iBAAiB,EACjB,SAAS,EACT,KAAK,EAKN;IACC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAA;QACtC,IACE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC;YAC7C,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAe;QACxB,IAAI,EAAE,8BAA8B;QACpC,eAAe,EAAE,iBAAiB;QAClC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C,CAAA;IACD,OAAO;QACL,KAAK,EAAE,CAAC,KAAkB,CAAC;QAC3B,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI;YACzB,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE;SAC1D,CAAC;KACH,CAAA;AACH,CAAC"}