@interop/wallet-core 0.60.0 → 0.62.0

package/dist/clientAnnex/heal.d.ts

@@ -5,15 +5,17 @@
  * The client-annex generation ensure a TRANSIENT visit runs -- a session
  * holding nothing but a standing unlock credential (its ladder seed, its
  * `delegatedClients` sibling delegation, and the standing-client identity
- * derived from the typed secret). Four durable states make the annex
- * unreachable from such a visit: the account document carries no
- * `#DelegatedClients` pointer; the pointed generation's log is gone (GC'd,
- * or never minted); the embedded generation delegation is expired, inside
- * its renewal window, or signed by a key the document no longer lists; the
- * record carries no sibling delegation, or its sibling targets another
- * Space. On a ladder-anchored account -- the ladder VM a document
+ * derived from the typed secret). Five durable states cut such a visit off
+ * from the annex, or from the account log the annex is pointed at: the
+ * account document carries no `#DelegatedClients` pointer; the pointed
+ * generation's log is gone (GC'd, or never minted); the embedded generation
+ * delegation is expired, inside its renewal window, or signed by a key the
+ * document no longer lists; the record carries no sibling delegation, or its
+ * sibling targets another Space; the record's bridge delegation is expired,
+ * inside its renewal window, or signed by a key the document no longer
+ * lists. On a ladder-anchored account -- the ladder VM a document
  * verification method, the ladder's rungs the log's update keys -- the visit
- * itself can mend all four, and this module is the orchestrator: a
+ * itself can mend all five, and this module is the orchestrator: a
  * converging ensure that detects each state from durable state, mends it
  * with the existing annex primitives, and reports what ran.
  *
@@ -38,15 +40,25 @@
  *   ordering exactly (Space under the ladder VM's bare did:key, mint
  *   controller-tier, delegation embed while the Space still answers to the
  *   bootstrap key, controller flip, then the pointer entry).
+ * - The BRIDGE RENEWAL PRECEDES EVERY ARM: the record's bridge delegation is
+ *   the credential's one write path into the account log, so a stale one is
+ *   replaced before any arm runs and the caller's account-log store is built
+ *   over the usable bridge (the `idStoreFor` factory). A pointer entry in
+ *   either minting arm would otherwise ride a delegation the server refuses.
  * - Pointer entries go through the caller's account-log store with
  *   `logOnly: true`: a bridge-delegated writer has no `did.json` projection
  *   rights, and the log is the source of truth.
  *
- * A fresh sibling delegation (minted when the record carries none, or one
- * targeting another Space) is handed back through the REQUIRED
- * `onRebindRecord` seam after the generation and pointer are durable -- the
- * caller re-seals the unlock record with it, and a run torn before that
- * re-seal re-derives everything from the ladder seed at the next visit.
+ * Both renewable record delegations -- the bridge, and the sibling (minted
+ * when the record carries none, when it targets another Space, or when it is
+ * stale) -- are handed back through the REQUIRED `onRebindRecord` seam after
+ * the generation and pointer are durable. The seam always receives BOTH
+ * usable delegations, whichever of them was freshly minted, so the caller
+ * re-seals the unlock record from one pair; a run torn before that re-seal
+ * re-derives everything from the ladder seed at the next visit. A re-seal
+ * that fails is fatal when the sibling was fresh and is reported on the
+ * outcome's `bridgeResealError` when only the bridge was, since the fresh
+ * bridge already served this visit and the next visit re-mints it.
  */
 import type { IZcap } from '@interop/data-integrity-core';
 import type { ZcapClient } from '@interop/ezcap';
@@ -59,16 +71,18 @@ import type { ICapabilityAgent } from '../webvh/zcap.js';
  *
  * `'ladder-vm-not-anchored'`: this credential's ladder VM is not a
  * verification method of the account document, so nothing ladder-signed can
- * verify. Two distinct states land here: an account with enrolled clients
- * and no ladder VM at all (the self-enrollment's add entry removes
- * them; the mender there is the step-up ceremony, not this ensure), and a
- * client-less account anchored on ANOTHER standing credential's ladder --
- * e.g. a passkey visiting an account the passphrase's ladder anchors, whose
- * own VM no ceremony has published.
+ * verify. A standing credential's VM stands for as long as the credential
+ * does -- enrollment leaves it alone -- so this is the backstop for a
+ * document that never carried it: a credential whose establishment was torn
+ * before its document entry, or a visit by a credential to an account
+ * another credential's ladder anchors (a passkey visiting an account the
+ * passphrase established).
  *
- * `'update-key-not-attributable'`: a pointer entry is needed, but no current
- * account-log update key is a rung derivable from this ladder seed, so the
- * entry could not be signed.
+ * `'update-key-not-attributable'`: a pointer entry is needed, but the account
+ * log carries no rung of this ladder at all -- no revealed key and no
+ * committed hash -- or the attribution is ambiguous, so the entry could not
+ * be signed. A merely committed rung is not this state: the pointer move
+ * reveals it first.
  */
 export type ClientAnnexGenerationUnavailableReason = 'ladder-vm-not-anchored' | 'update-key-not-attributable';
 /**
@@ -121,6 +135,11 @@ export declare function ladderSignedGenerationDelegationMinter({ accountDid, lad
 export interface ClientAnnexGenerationEnsureOutcome {
     clientAnnexDid: string;
     generationDelegation: IZcap;
+    /**
+     * The usable bridge delegation -- the record's own, or the fresh one
+     * `onRebindRecord` was handed.
+     */
+    delegation: IZcap;
     /**
      * The usable sibling delegation -- the record's own, or the fresh one
      * `onRebindRecord` was handed.
@@ -130,6 +149,13 @@ export interface ClientAnnexGenerationEnsureOutcome {
     spaceMinted: boolean;
     delegationRenewed: boolean;
     siblingReminted: boolean;
+    bridgeReminted: boolean;
+    /**
+     * Set when the re-seal of a renewed bridge failed and nothing else needed
+     * the re-seal; the fresh bridge still served this visit, and the next
+     * visit re-mints.
+     */
+    bridgeResealError?: unknown;
 }
 /**
  * Ensures a transient visit can reach a live client-annex generation with a
@@ -161,13 +187,18 @@ export interface ClientAnnexGenerationEnsureOutcome {
  *   -- the storage client for the fresh-Space arm, signing as the ladder
  *   VM's bare did:key (the caller wires the transport; the agent is derived
  *   here from the ladder seed)
- * @param options.idStore {WebvhIdStore}   the ACCOUNT log's store (a
- *   bridge-delegated one suffices: pointer entries publish with
- *   `logOnly: true`)
+ * @param options.delegation {IZcap}   the record's bridge delegation (PUT on
+ *   the account's `did.jsonl`), renewed here when it is stale
+ * @param options.idStoreFor {Function}
+ *   `({ delegation }) => WebvhIdStore` -- builds the ACCOUNT log's store over
+ *   the usable bridge (a bridge-delegated store suffices: pointer entries
+ *   publish with `logOnly: true`). Called once, after the bridge renewal, so
+ *   a pointer entry never rides a lapsed delegation
  * @param options.onRebindRecord {Function}
- *   `({ delegatedClients }) => Promise<void>` -- REQUIRED: re-seals the
- *   unlock record with the fresh sibling delegation; called whenever one was
- *   minted, after the generation and pointer are durable
+ *   `({ delegation, delegatedClients }) => Promise<void>` -- REQUIRED:
+ *   re-seals the unlock record with the usable bridge and sibling
+ *   delegations; called whenever either was freshly minted, after the
+ *   generation and pointer are durable
  * @param [options.delegatedClients] {IZcap}   the record's sibling
  *   delegation, when the record carries one
  * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins (a
@@ -188,8 +219,12 @@ export declare function ensureCredentialClientAnnexGeneration(options: {
     bootstrapWasFor: (options: {
         keyAgent: ICapabilityAgent;
     }) => WasClient;
-    idStore: WebvhIdStore;
+    delegation: IZcap;
+    idStoreFor: (options: {
+        delegation: IZcap;
+    }) => WebvhIdStore;
     onRebindRecord: (options: {
+        delegation: IZcap;
         delegatedClients: IZcap;
     }) => Promise<void>;
     delegatedClients?: IZcap;

package/dist/clientAnnex/heal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heal.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/heal.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAM7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAoBxD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,sCAAsC,GAChD,wBAAwB,GAAG,6BAA6B,CAAA;AAE1D;;;;GAIG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAC9D,QAAQ,CAAC,MAAM,EAAE,sCAAsC,CAAA;gBAE3C,EACV,MAAM,EACN,OAAO,EACR,EAAE;QACD,MAAM,EAAE,sCAAsC,CAAA;QAC9C,OAAO,EAAE,MAAM,CAAA;KAChB;CAKF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sCAAsC,CAAC,EACrD,UAAU,EACV,UAAU,EACV,YAAY,EACZ,OAAO,EACP,GAAG,EACJ,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,CAAC,OAAO,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAW1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kCAAkC;IACjD,cAAc,EAAE,MAAM,CAAA;IACtB,oBAAoB,EAAE,KAAK,CAAA;IAC3B;;;OAGG;IACH,gBAAgB,EAAE,KAAK,CAAA;IACvB,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,EAAE,OAAO,CAAA;IACpB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,eAAe,EAAE,OAAO,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,qCAAqC,CAAC,OAAO,EAAE;IAC7D,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,UAAU,EAAE,UAAU,CAAA;IACtB,cAAc,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACvD,eAAe,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,gBAAgB,CAAA;KAAE,KAAK,SAAS,CAAA;IACvE,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,gBAAgB,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAU9C;AAiTD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAAG,EACH,gBAAgB,EACjB,EAAE;IACD,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAC7B,gBAAgB,CAAC,EAAE,KAAK,CAAA;CACzB,GAAG;IACF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAeA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,GAAG,EACJ,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAA;CAC9B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8BjC"}
+{"version":3,"file":"heal.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/heal.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAOnE,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAO7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAqBxD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,sCAAsC,GAChD,wBAAwB,GAAG,6BAA6B,CAAA;AAE1D;;;;GAIG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAC9D,QAAQ,CAAC,MAAM,EAAE,sCAAsC,CAAA;gBAE3C,EACV,MAAM,EACN,OAAO,EACR,EAAE;QACD,MAAM,EAAE,sCAAsC,CAAA;QAC9C,OAAO,EAAE,MAAM,CAAA;KAChB;CAKF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sCAAsC,CAAC,EACrD,UAAU,EACV,UAAU,EACV,YAAY,EACZ,OAAO,EACP,GAAG,EACJ,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,CAAC,OAAO,EAAE;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAW1D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kCAAkC;IACjD,cAAc,EAAE,MAAM,CAAA;IACtB,oBAAoB,EAAE,KAAK,CAAA;IAC3B;;;OAGG;IACH,UAAU,EAAE,KAAK,CAAA;IACjB;;;OAGG;IACH,gBAAgB,EAAE,KAAK,CAAA;IACvB,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,EAAE,OAAO,CAAA;IACpB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,eAAe,EAAE,OAAO,CAAA;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAgB,qCAAqC,CAAC,OAAO,EAAE;IAC7D,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAA;IACvD,UAAU,EAAE,UAAU,CAAA;IACtB,cAAc,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACvD,eAAe,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,gBAAgB,CAAA;KAAE,KAAK,SAAS,CAAA;IACvE,UAAU,EAAE,KAAK,CAAA;IACjB,UAAU,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,YAAY,CAAA;IAC5D,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,UAAU,EAAE,KAAK,CAAA;QACjB,gBAAgB,EAAE,KAAK,CAAA;KACxB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAW9C;AAmaD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAAG,EACH,gBAAgB,EACjB,EAAE;IACD,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAC7B,gBAAgB,CAAC,EAAE,KAAK,CAAA;CACzB,GAAG;IACF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAeA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,GAAG,EACJ,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAA;CAC9B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8BjC"}

package/dist/clientAnnex/heal.js

@@ -1,12 +1,14 @@
 import { WasClient } from '@interop/was-client';
-import { effectiveParameters, readPublishedLog } from '../webvh/didWebvh.js';
+import { effectiveParameters, readPublishedLog, WebvhLogConflictError, withLogConflictRetry } from '../webvh/didWebvh.js';
 import { delegationKeyInDocument, ladderVmIds } from '../webvh/listClients.js';
 import { delegationProofKeyId, zcapExpiring } from '../webvh/standingZcap.js';
+import { delegateLogWrite } from '../recovery/recoveryDelegation.js';
 import { accountLogPinId } from '../webvh/verifyLog.js';
 import { mintSpaceId } from '../genesis/accountGenesis.js';
 import { attributeLadderRung, ladderRung, ladderVmKeyMultibase } from './ladder.js';
+import { revealLadderRungWebvh } from './ladderAnchored.js';
 import { ladderVmAgent, ladderVmZcapClient } from './zcap.js';
-import { clientAnnexDidParts, clientAnnexLogPinId, clientAnnexLogStore, delegatedClientsDelegationSpaceId, delegatedClientsPointer, ensureGenerationDelegationCurrent, mintCredentialClientAnnexGeneration, mintDelegatedClientsDelegation, mintGenerationDelegation, setDelegatedClientsPointer } from './log.js';
+import { clientAnnexDidParts, clientAnnexLogPinId, clientAnnexLogStore, delegatedClientsDelegationSpaceId, delegatedClientsPointer, ensureGenerationDelegationCurrent, mintCredentialClientAnnexGeneration, mintDelegatedClientsDelegation, mintGenerationDelegation, setDelegatedClientsPointerOnce } from './log.js';
 /**
  * The typed refusal of {@link ensureCredentialClientAnnexGeneration}: the
  * account is not in a shape this visit can mend, and nothing was written.
@@ -81,13 +83,18 @@ export function ladderSignedGenerationDelegationMinter({ accountDid, ladderSeed,
  *   -- the storage client for the fresh-Space arm, signing as the ladder
  *   VM's bare did:key (the caller wires the transport; the agent is derived
  *   here from the ladder seed)
- * @param options.idStore {WebvhIdStore}   the ACCOUNT log's store (a
- *   bridge-delegated one suffices: pointer entries publish with
- *   `logOnly: true`)
+ * @param options.delegation {IZcap}   the record's bridge delegation (PUT on
+ *   the account's `did.jsonl`), renewed here when it is stale
+ * @param options.idStoreFor {Function}
+ *   `({ delegation }) => WebvhIdStore` -- builds the ACCOUNT log's store over
+ *   the usable bridge (a bridge-delegated store suffices: pointer entries
+ *   publish with `logOnly: true`). Called once, after the bridge renewal, so
+ *   a pointer entry never rides a lapsed delegation
  * @param options.onRebindRecord {Function}
- *   `({ delegatedClients }) => Promise<void>` -- REQUIRED: re-seals the
- *   unlock record with the fresh sibling delegation; called whenever one was
- *   minted, after the generation and pointer are durable
+ *   `({ delegation, delegatedClients }) => Promise<void>` -- REQUIRED:
+ *   re-seals the unlock record with the usable bridge and sibling
+ *   delegations; called whenever either was freshly minted, after the
+ *   generation and pointer are durable
  * @param [options.delegatedClients] {IZcap}   the record's sibling
  *   delegation, when the record carries one
  * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins (a
@@ -101,7 +108,8 @@ export function ensureCredentialClientAnnexGeneration(options) {
     // into the record would strand the very credential this ensure serves.
     if (typeof options.onRebindRecord !== 'function') {
         throw new TypeError('ensureCredentialClientAnnexGeneration requires onRebindRecord: a ' +
-            'fresh sibling delegation must be re-sealed into the unlock record.');
+            'fresh bridge or sibling delegation must be re-sealed into the ' +
+            'unlock record.');
     }
     return ensureCredentialClientAnnexGenerationChecked(options);
 }
@@ -111,14 +119,17 @@ export function ensureCredentialClientAnnexGeneration(options) {
  * @param options {object}   see {@link ensureCredentialClientAnnexGeneration}
  * @returns {Promise<ClientAnnexGenerationEnsureOutcome>}
  */
-async function ensureCredentialClientAnnexGenerationChecked({ wasServerUrl, spaceId, account, ladderSeed, standingClient, bootstrapWasFor, idStore, onRebindRecord, delegatedClients, pinStore, now }) {
+async function ensureCredentialClientAnnexGenerationChecked({ wasServerUrl, spaceId, account, ladderSeed, standingClient, bootstrapWasFor, delegation, idStoreFor, onRebindRecord, delegatedClients, pinStore, now }) {
     // The gate: everything below signs as the ladder (the delegations as the
     // ladder VM, the annex entries as its per-generation rung), so unless THIS
     // ladder's VM stands in the document under the ladder-VM relation
     // asymmetry (`capabilityDelegation` without `capabilityInvocation` -- the
     // authority the mends actually exercise, which mere key presence says
     // nothing about), every mend is unverifiable. The honest refusal, before
-    // anything is written.
+    // anything is written. A standing credential's VM stands whether or not the
+    // account has enrolled clients, so this fires only for a document that
+    // never carried it -- a torn establishment, or another credential's
+    // account.
     const vmKey = await ladderVmKeyMultibase({ ladderSeed });
     if (!ladderVmIds({ doc: account.doc }).includes(`${account.did}#${vmKey}`)) {
         throw new ClientAnnexGenerationUnavailableError({
@@ -144,14 +155,70 @@ async function ensureCredentialClientAnnexGenerationChecked({ wasServerUrl, spac
         spaceId,
         ...(now !== undefined ? { now } : {})
     });
+    // THE BRIDGE RENEWAL, before any arm. The bridge is the credential's one
+    // write path into the account log, and both minting arms end in a pointer
+    // entry that rides it. A stale one is replaced with a ladder-VM-signed
+    // delegation (the gate above proved the VM a document verification
+    // method), and the caller's account-log store is built over whichever
+    // bridge is usable.
+    let bridgeReminted = false;
+    let usableBridge = delegation;
+    if (standingZcapStale({
+        zcap: delegation,
+        doc: account.doc,
+        ...(now !== undefined ? { now } : {})
+    })) {
+        usableBridge = await delegateLogWrite({
+            zcapClient: ladderClient,
+            pointer: { did: account.did, spaceId, host: wasServerUrl },
+            recoveryClientDid: standingClient.did,
+            ...(now !== undefined ? { now } : {})
+        });
+        bridgeReminted = true;
+    }
+    const idStore = idStoreFor({ delegation: usableBridge });
+    /**
+     * The record re-seal, through the required `onRebindRecord` seam: the one
+     * call site for every arm, run once the generation and pointer are
+     * durable. It fires whenever either recorded delegation was freshly
+     * minted, and grades a failure by which one that was. A fresh sibling
+     * nothing re-seals would strand the credential, so that throw propagates.
+     * A bridge-only renewal needs nothing from the re-seal: the fresh bridge
+     * is minted offline and already served this visit, so a lost re-seal
+     * leaves no wrong state behind and the next visit re-mints. It is reported
+     * on the outcome instead.
+     *
+     * @param options {object}
+     * @param options.delegatedClients {IZcap}   the usable sibling delegation
+     * @param options.siblingReminted {boolean}   whether that sibling is fresh
+     * @returns {Promise<object>}   the outcome's `bridgeResealError` member,
+     *   present only when a bridge-only re-seal failed
+     */
+    async function resealRecord({ delegatedClients: usableSibling, siblingReminted }) {
+        if (!siblingReminted && !bridgeReminted) {
+            return {};
+        }
+        try {
+            await onRebindRecord({
+                delegation: usableBridge,
+                delegatedClients: usableSibling
+            });
+        }
+        catch (err) {
+            if (siblingReminted) {
+                throw err;
+            }
+            return { bridgeResealError: err };
+        }
+        return {};
+    }
     if (annexSpaceId === undefined) {
         // THE FRESH-SPACE ARM: neither the pointer nor a sibling names a Space.
-        // The pre-flight attribution runs before anything is minted; the stage
-        // order mirrors the credential-anchored genesis exactly.
-        const updateKeys = await pointerEntryUpdateKeys({
-            ladderSeed,
-            log: account.log
-        });
+        // The pre-flight attribution runs before any generation or Space is
+        // minted (a bridge delegation mint writes nothing durable); the stage
+        // order mirrors the credential-anchored genesis exactly. A rung that is
+        // only committed passes here and is revealed at the pointer entry.
+        await assertPointerEntryAttributable({ ladderSeed, log: account.log });
         const freshSpaceId = mintSpaceId();
         const keyAgent = await ladderVmAgent({ ladderSeed });
         const bootstrapWas = bootstrapWasFor({ keyAgent });
@@ -188,12 +255,11 @@ async function ensureCredentialClientAnnexGenerationChecked({ wasServerUrl, spac
         await bootstrapWas
             .space(freshSpaceId)
             .configure({ controller: account.did, force: true });
-        await setDelegatedClientsPointer({
+        await movePointerAsLadder({
             idStore,
-            updateKeys,
+            ladderSeed,
             clientAnnexDid: minted.did,
-            expectedDid: account.did,
-            logOnly: true,
+            accountDid: account.did,
             ...(pinStore !== undefined
                 ? { pinStore, logId: accountLogPinId({ spaceId }) }
                 : {})
@@ -205,39 +271,39 @@ async function ensureCredentialClientAnnexGenerationChecked({ wasServerUrl, spac
             controller: standingClient.did,
             ...(now !== undefined ? { now } : {})
         });
-        await onRebindRecord({ delegatedClients: sibling });
+        const resealed = await resealRecord({
+            delegatedClients: sibling,
+            siblingReminted: true
+        });
         return {
             clientAnnexDid: minted.did,
             generationDelegation: ensured.delegation,
+            delegation: usableBridge,
             delegatedClients: sibling,
             generationMinted: true,
             spaceMinted: true,
             delegationRenewed: false,
-            siblingReminted: true
+            siblingReminted: true,
+            bridgeReminted,
+            ...resealed
         };
     }
     // THE EXISTING-SPACE ARMS. A usable sibling first: absent, targeting a
     // different Space than the resolved one, or stale on either of the
     // standing-zcap axes -- expiry (past, or inside the renewal window) and
-    // signer death (its proof key no longer in the verified account document,
-    // the current-key-set rule) -- a fresh sibling is minted (local ladder-VM
-    // signing, which verifies because the gate above proved the VM a document
-    // verification method) so every annex request below can ride it.
+    // signer death (its proof key no longer under `capabilityDelegation` in
+    // the verified account document, the current-key-set rule) -- a fresh
+    // sibling is minted (local ladder-VM signing, which verifies because the
+    // gate above proved the VM a document verification method) so every annex
+    // request below can ride it.
     let sibling = delegatedClients;
     let siblingReminted = false;
     const siblingStale = sibling !== undefined &&
-        (zcapExpiring({
-            ...(sibling.expires !== undefined
-                ? { expires: sibling.expires }
-                : {}),
+        standingZcapStale({
+            zcap: sibling,
+            doc: account.doc,
             ...(now !== undefined ? { now } : {})
-        }) ||
-            !delegationKeyInDocument({
-                doc: account.doc,
-                ...(delegationProofKeyId(sibling) !== undefined
-                    ? { delegationKeyId: delegationProofKeyId(sibling) }
-                    : {})
-            }));
+        });
     if (sibling === undefined ||
         siblingSpaceId !== annexSpaceId ||
         siblingStale) {
@@ -289,17 +355,21 @@ async function ensureCredentialClientAnnexGenerationChecked({ wasServerUrl, spac
                     ...annexPin(parts.generationId),
                     ...(now !== undefined ? { now } : {})
                 });
-                if (siblingReminted) {
-                    await onRebindRecord({ delegatedClients: usableSibling });
-                }
+                const resealed = await resealRecord({
+                    delegatedClients: usableSibling,
+                    siblingReminted
+                });
                 return {
                     clientAnnexDid: pointer,
                     generationDelegation: ensured.delegation,
+                    delegation: usableBridge,
                     delegatedClients: usableSibling,
                     generationMinted: false,
                     spaceMinted: false,
                     delegationRenewed: ensured.renewed,
-                    siblingReminted
+                    siblingReminted,
+                    bridgeReminted,
+                    ...resealed
                 };
             }
             catch (err) {
@@ -319,10 +389,7 @@ async function ensureCredentialClientAnnexGenerationChecked({ wasServerUrl, spac
     // rung; other standing credentials' per-generation rungs are re-committed
     // only by their own later ceremonies (a property of every generation
     // swap).
-    const updateKeys = await pointerEntryUpdateKeys({
-        ladderSeed,
-        log: account.log
-    });
+    await assertPointerEntryAttributable({ ladderSeed, log: account.log });
     const minted = await mintCredentialClientAnnexGeneration({
         was: standingWas,
         wasServerUrl,
@@ -346,29 +413,59 @@ async function ensureCredentialClientAnnexGenerationChecked({ wasServerUrl, spac
     // pointer move itself retires it on a conforming server -- the inspector
     // clause compares the delegation's controller against the document's
     // pointer -- and it otherwise rots on its TTL.
-    await setDelegatedClientsPointer({
+    await movePointerAsLadder({
         idStore,
-        updateKeys,
+        ladderSeed,
         clientAnnexDid: minted.did,
-        expectedDid: account.did,
-        logOnly: true,
+        accountDid: account.did,
         ...(pinStore !== undefined
             ? { pinStore, logId: accountLogPinId({ spaceId }) }
             : {})
     });
-    if (siblingReminted) {
-        await onRebindRecord({ delegatedClients: usableSibling });
-    }
+    const resealed = await resealRecord({
+        delegatedClients: usableSibling,
+        siblingReminted
+    });
     return {
         clientAnnexDid: minted.did,
         generationDelegation: ensured.delegation,
+        delegation: usableBridge,
         delegatedClients: usableSibling,
         generationMinted: true,
         spaceMinted: false,
         delegationRenewed: false,
-        siblingReminted
+        siblingReminted,
+        bridgeReminted,
+        ...resealed
     };
 }
+/**
+ * The one staleness predicate for the standing recorded delegations this
+ * ensure may renew: the record's bridge delegation and its `delegatedClients`
+ * sibling. Two axes, the established pair -- expiry (past, or inside the
+ * renewal window) and signer death (the proof's verification method no longer
+ * under `capabilityDelegation` in the verified account document, the
+ * current-key-set rule). One helper rather than a copy per delegation, so the
+ * two can never drift onto different rules.
+ *
+ * @param options {object}
+ * @param options.zcap {IZcap}   the recorded delegation
+ * @param options.doc {object}   the VERIFIED account document
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {boolean}
+ */
+function standingZcapStale({ zcap, doc, now }) {
+    const { expires } = zcap;
+    const delegationKeyId = delegationProofKeyId(zcap);
+    return (zcapExpiring({
+        ...(expires !== undefined ? { expires } : {}),
+        ...(now !== undefined ? { now } : {})
+    }) ||
+        !delegationKeyInDocument({
+            doc: doc,
+            ...(delegationKeyId !== undefined ? { delegationKeyId } : {})
+        }));
+}
 /**
  * The annex Space, in the settled resolution order: the account document's
  * `#DelegatedClients` pointer names it; else the record's sibling
@@ -445,4 +542,145 @@ export async function pointerEntryUpdateKeys({ ladderSeed, log }) {
     });
     return { updateSeed: attributed.rung.seed, stagedSeed: staged.seed };
 }
+/**
+ * The pre-flight the pointer-moving arms run before minting anything: this
+ * ladder has a rung the pointer entry will be able to sign with, either
+ * standing in `updateKeys` already or committed in `nextKeyHashes` and
+ * revealable by {@link movePointerAsLadder}. A ladder the log carries no rung
+ * of at all, and an ambiguous attribution, refuse here with
+ * {@link ClientAnnexGenerationUnavailableError} before a generation or a
+ * Space is minted.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.log {DIDLog}   the VERIFIED account log
+ * @returns {Promise<void>}
+ */
+async function assertPointerEntryAttributable({ ladderSeed, log }) {
+    const params = effectiveParameters(log);
+    const current = params[params.length - 1] ?? {
+        updateKeys: [],
+        nextKeyHashes: []
+    };
+    try {
+        await attributeLadderRung({ ladderSeed, published: current });
+    }
+    catch (err) {
+        if (err.name === 'LadderAttributionError') {
+            throw new ClientAnnexGenerationUnavailableError({
+                reason: 'update-key-not-attributable',
+                message: "The account log carries no rung of this credential's ladder, or " +
+                    'the attribution is ambiguous; the pointer entry could not be ' +
+                    'signed, so nothing is minted.'
+            });
+        }
+        throw err;
+    }
+}
+/**
+ * The `#DelegatedClients` pointer move as a credential-only visit makes it:
+ * reveal this ladder's rung when only its hash stands committed, re-read, and
+ * write the pointer entry signed by the now-revealed rung.
+ *
+ * A self-enrollment's add entry spends the revealed rung, so on any account
+ * that has ever self-enrolled the rung is merely committed and the reveal is
+ * what makes the pointer entry signable at all.
+ *
+ * ACCEPTED CONSEQUENCE (design FW-356, finding R3): the reveal retires
+ * nothing, and the pointer entry re-states `updateKeys` verbatim, so the
+ * acting rung stands in the account log's `updateKeys` afterwards. The price
+ * of a pointer move is therefore a standing account update key in the
+ * credential's hand -- direct document-edit authority through the bridge with
+ * no further reveal -- retired at that credential's next self-enrollment
+ * (whose add entry drops the attributed rung) or at its retirement. This is
+ * documented rather than prevented.
+ *
+ * Both entries run inside ONE conflict retry, and every attempt re-reads the
+ * head and re-attributes the rung from it, so a racing ceremony that consumes
+ * the rung climbs to the winner's committed rung instead of refusing
+ * `update-key-not-attributable` on a rung that is no longer current.
+ *
+ * Three things make that hold. A rung the winner consumed between this
+ * attempt's reveal and its re-read reads back as
+ * `update-key-not-attributable`, which inside this loop is staleness rather
+ * than a refusal -- the pre-flight already found a rung -- so it is raised as
+ * a conflict and the next attempt reveals the winner's committed rung. The pointer entry runs as
+ * {@link setDelegatedClientsPointerOnce} rather than through its retrying
+ * wrapper: the wrapper's inner loop would re-invoke the attempt with the
+ * attribution's stale `updateKeys`, and a rung the racing winner consumed
+ * cannot become authorized by re-reading, so the attempt would end on the
+ * plain not-authorized refusal, which the outer loop does not retry. And the
+ * attempt is handed the very head this attempt attributed against, so a
+ * racing entry landing between the attribution and the PUT loses the CAS and
+ * surfaces as a `WebvhLogConflictError` -- the refusal the outer loop
+ * re-attributes from. The pre-flight guard
+ * ({@link assertPointerEntryAttributable}) therefore cannot fire from
+ * staleness here: it runs on the caller's snapshot before anything is minted,
+ * while every entry this function publishes is built on a head it read
+ * itself.
+ *
+ * @param options {object}
+ * @param options.idStore {WebvhIdStore}   the account log's store, from the
+ *   record's bridge delegation
+ * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
+ * @param options.clientAnnexDid {string}   the generation to point at
+ * @param options.accountDid {string}   the account DID the log must resolve to
+ * @param [options.pinStore] {ResourceLogPinStore}   the visit's chain-head pins
+ * @param [options.logId] {string}   the account log's pin slot; required
+ *   whenever a `pinStore` is supplied
+ * @returns {Promise<void>}
+ */
+async function movePointerAsLadder({ idStore, ladderSeed, clientAnnexDid, accountDid, pinStore, logId }) {
+    const pin = pinStore !== undefined && logId !== undefined ? { pinStore, logId } : {};
+    await withLogConflictRetry(async () => {
+        await revealLadderRungWebvh({
+            store: idStore,
+            ladderSeed,
+            expectedDid: accountDid,
+            ...pin
+        });
+        // The head the reveal entry just published (or the unchanged head, when
+        // the rung was revealed already), under the same pin.
+        const published = await readPublishedLog({
+            idStore,
+            expectedDid: accountDid,
+            ...pin
+        });
+        if (published === undefined) {
+            throw new Error('did:webvh: did.jsonl is missing; nothing to point at a client annex.');
+        }
+        // A racing ceremony that consumed the rung between this reveal and this
+        // read leaves the ladder committed-only again, which the attribution
+        // reports as `update-key-not-attributable`. Inside this loop that is a
+        // staleness signal rather than a refusal -- the pre-flight already found
+        // a rung, and a fresh reveal is exactly what the next attempt does -- so
+        // it becomes a conflict for the retry to re-run.
+        let updateKeys;
+        try {
+            updateKeys = await pointerEntryUpdateKeys({
+                ladderSeed,
+                log: published.log
+            });
+        }
+        catch (err) {
+            if (err.name ===
+                'ClientAnnexGenerationUnavailableError' &&
+                err.reason ===
+                    'update-key-not-attributable') {
+                throw new WebvhLogConflictError('did:webvh: a concurrent ceremony consumed the rung this pointer ' +
+                    'move just revealed; the move re-runs from a fresh reveal.', { cause: err });
+            }
+            throw err;
+        }
+        await setDelegatedClientsPointerOnce({
+            idStore,
+            updateKeys,
+            clientAnnexDid,
+            expectedDid: accountDid,
+            logOnly: true,
+            published,
+            ...pin
+        });
+    });
+}
 //# sourceMappingURL=heal.js.map