@interop/wallet-core 0.61.0 → 0.62.0

package/dist/recovery/recoveryWebvh.js

@@ -34,8 +34,54 @@
  * with the same key material converges without forking the log.
  */
 import { deriveNextKeyHash, updateDID } from '@interop/did-method-webvh';
-import { assertCanonicalClientKeys, assertCarryOverCommitments, markedVerificationMethodPair, MULTIKEY_VM_TYPE, pinOfLog, putLogResource, readPublishedLog, relationIds, servedHead, updateKeySigner, withLogConflictRetry } from '../webvh/didWebvh.js';
+import { assertCanonicalClientKeys, assertCarryOverCommitments, effectiveParameters, markedVerificationMethodPair, MULTIKEY_VM_TYPE, pinOfLog, putLogResource, readPublishedLog, relationIds, servedHead, updateKeySigner, withLogConflictRetry } from '../webvh/didWebvh.js';
 import { publishUnlockKey, removeUnlockKey } from '../unlock/standingWebvh.js';
+import { ladderVmIds } from '../webvh/listClients.js';
+import { credentialKeyAgreementMethods } from '../webvh/keyAgreement.js';
+// The base-side dependency the lint config pins: the ladder ATTRIBUTION
+// helpers only, never the annex log machinery. The add-and-retire entry
+// resolves each retired credential's standing rungs from the log with them.
+import { assertNextKeyHashesRemain, attributeRetiredCredentialRungs, retiredCredentialRungsBeforeKey } from '../clientAnnex/ladder.js';
+/**
+ * What the add-and-retire entry retired, read back OFF THE LOG -- the resumed
+ * spend's answer to the same question the live run answers from the document
+ * it is editing. A run torn after that entry but before the caller's registry
+ * and unlock-Space teardown resumes into the already-complete branch, and
+ * without this it would be told nothing was retired and leave every other
+ * credential's registry entry standing.
+ *
+ * The entry is located by its own signature on the log: it is the first entry
+ * whose effective `updateKeys` authorize the successor key (the fresh
+ * ladder's rung 0 on the transient continuation, the new client's update key
+ * on the remembered one), which only that entry writes. What it retired is
+ * then the credential-class `keyAgreement` ids its predecessor published and
+ * it does not, less the spent code's own id -- the same exclusion the live
+ * branch makes, since the caller retires that one by name.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the verified account log
+ * @param options.did {string}   the account DID the log resolves to
+ * @param options.successorKeyMultibase {string}   the update key only the
+ *   add-and-retire entry authorizes
+ * @param options.spentVmId {string}   the spent code's key-agreement
+ *   verification-method id, excluded from the result
+ * @returns {string[]}   the retired credentials' key-agreement ids, empty
+ *   when no entry authorizes the successor key or it is the genesis entry
+ */
+export function retiredCredentialVmIdsFromLog({ log, did, successorKeyMultibase, spentVmId }) {
+    const params = effectiveParameters(log);
+    const index = params.findIndex(entry => (entry.updateKeys ?? []).includes(successorKeyMultibase));
+    const previous = index > 0 ? log[index - 1]?.state : undefined;
+    const entryDoc = index > 0 ? log[index]?.state : undefined;
+    if (previous === undefined || entryDoc === undefined) {
+        return [];
+    }
+    const standing = new Set(credentialKeyAgreementMethods({ doc: entryDoc, did }).map(method => method.id));
+    return credentialKeyAgreementMethods({ doc: previous, did })
+        .map(method => method.id)
+        .filter((id) => typeof id === 'string')
+        .filter(id => !standing.has(id) && id !== spentVmId);
+}
 /**
  * The verification-method id a code's key-agreement key publishes under --
  * the ordinary `<did>#<multibase>` form, indistinguishable by id from any
@@ -143,6 +189,9 @@ export async function publishRecoveryKey({ idStore, updateKeys, recovery, expect
             },
             updateKeyMultibase: recovery.updateKeyMultibase
         },
+        // A code carries no ladder: its whole inventory is one key-agreement
+        // method and one committed update key.
+        ladderSeed: null,
         ...(expectedDid !== undefined ? { expectedDid } : {}),
         ...(pinStore ? { pinStore } : {}),
         ...(logId !== undefined ? { logId } : {}),
@@ -242,7 +291,7 @@ export async function removeRecoveryKey({ idStore, updateKeys, recovery, expecte
  * @param [options.logId] {string}   the account log's pin slot
  *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
  *   supplied
- * @returns {Promise<{ did: string, webDoc?: object, committed: boolean }>}
+ * @returns {Promise<object>}
  *   the account DID, the final `did.json` projection when the add-and-retire
  *   entry ran here, and `committed` -- whether THIS call published the pivot
  *   entry (`false` exactly on the idempotent completed branch, where a torn
@@ -250,7 +299,12 @@ export async function removeRecoveryKey({ idStore, updateKeys, recovery, expecte
  *   a success flag: a returning call means the continuation stands either
  *   way, so a caller clears its pending state on the RETURN, whatever
  *   `committed` says. Its absence from a return value is a build skew, which
- *   is why it is stated rather than inferred
+ *   is why it is stated rather than inferred.
+ *   `retiredCredentialVmIds` lists the `keyAgreement` verification-method ids
+ *   this entry struck for pre-recovery credentials OTHER than the spent code
+ *   -- what the caller drops registry entries and deletes unlock Spaces for.
+ *   On the completed branch, whose entry already landed, it is derived from
+ *   the log, so a resume reports the same list the first run did
  */
 export async function recoverWebvhClient(options) {
     // The seam is what gets the successor material persisted before the pivot
@@ -274,7 +328,7 @@ export async function recoverWebvhClient(options) {
  * One attempt of {@link recoverWebvhClient}, re-invoked by the conflict retry.
  *
  * @param options {object}   see {@link recoverWebvhClient}
- * @returns {Promise<{ did: string, webDoc?: object, committed: boolean }>}
+ * @returns {Promise<object>}   see {@link recoverWebvhClient}
  */
 async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClientUpdateSeeds, replacement, onCommitted, expectedDid, pinStore, logId }) {
     // Each attempt's own read is what the CAS publish is built on, so the
@@ -289,17 +343,49 @@ async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClien
         ...(expectedDid !== undefined ? { expectedDid } : {}),
         ...pinned
     });
+    // Derived before the completion check, because a resume recomputes the
+    // strike with the same protected sets the first run used.
+    const recoveryHash = await deriveNextKeyHash(recovery.updateKeyMultibase);
+    const newUpdateHash = await deriveNextKeyHash(newClientKeys.updateKeyMultibase);
+    const newStagedHash = await deriveNextKeyHash(newClientKeys.stagedUpdateKeyMultibase);
+    const replacementHash = await deriveNextKeyHash(replacement.updateKeyMultibase);
     // Already complete (a torn earlier run finished the add entry): the new
     // client's update key is authorized, which only the add entry writes. The
     // seam is deliberately NOT entered here -- nothing is about to be
     // published, so there is no pivot to persist ahead of.
     if (published.updateKeys.includes(newClientKeys.updateKeyMultibase)) {
-        return { did: published.did, committed: false };
+        // The add entry already struck the pre-recovery credentials, so the
+        // document names none of them any more. The report is derived from the
+        // log instead ({@link retiredCredentialVmIdsFromLog}), so a resume tells
+        // the caller exactly what the first run told it.
+        const retired = retiredCredentialVmIdsFromLog({
+            log: published.log,
+            did: published.did,
+            successorKeyMultibase: newClientKeys.updateKeyMultibase,
+            spentVmId: recoveryVmId({
+                did: published.did,
+                keyAgreementKeyMultibase: recovery.keyAgreementKeyMultibase
+            })
+        });
+        // The strike is recomputed by re-running it over the log as it stood just
+        // before the add entry, with the same protected sets, so a resume reports
+        // exactly what the first run reported rather than a second definition of
+        // the same question.
+        const strike = await retiredCredentialRungsBeforeKey({
+            log: published.log,
+            authorizedKeyMultibase: newClientKeys.updateKeyMultibase,
+            credentialVmIds: retired,
+            protectedHashes: [newUpdateHash, newStagedHash, replacementHash],
+            protectedKeys: [newClientKeys.updateKeyMultibase]
+        });
+        return {
+            did: published.did,
+            committed: false,
+            retiredCredentialVmIds: retired,
+            struckRungHashes: strike.struckHashes,
+            unclaimedCredentialVmIds: strike.unclaimedCredentialVmIds
+        };
     }
-    const recoveryHash = await deriveNextKeyHash(recovery.updateKeyMultibase);
-    const newUpdateHash = await deriveNextKeyHash(newClientKeys.updateKeyMultibase);
-    const newStagedHash = await deriveNextKeyHash(newClientKeys.stagedUpdateKeyMultibase);
-    const replacementHash = await deriveNextKeyHash(replacement.updateKeyMultibase);
     // The reveal-and-commit entry, skipped when a torn earlier run already
     // published it (the revealed key authorized AND every needed hash
     // committed).
@@ -355,9 +441,12 @@ async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClien
     // above, or a torn earlier run's reveal entry standing already.
     await onCommitted({ builtOnHead: servedHead(published.log) });
     // The add-and-retire entry: the new client's verification methods and
-    // update key in; the spent code's VM, update key, and hash out; the
-    // replacement code's VM in. Signed by the new client's update key, whose
-    // hash the commit entry just committed.
+    // update key in; the replacement code's VM in; every pre-recovery standing
+    // credential fully retired -- the spent code by name, and every other one
+    // by the same structural rule the transient continuation uses (its ladder
+    // VM by the relation asymmetry, its keyAgreement member by the account-DID
+    // controller). Signed by the new client's update key, whose hash the commit
+    // entry just committed.
     const { did, doc } = published;
     const vmId = (publicKeyMultibase) => `${did}#${publicKeyMultibase}`;
     const spentVmId = recoveryVmId({
@@ -389,13 +478,55 @@ async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClien
             publicKeyMultibase: replacement.keyAgreementKeyMultibase
         }
     ];
+    // The full retirement, recognized structurally rather than from a list the
+    // caller supplies: every standing ladder VM, and every keyAgreement member
+    // the account DID controls, less the ids this entry itself adds. Other
+    // unspent recovery codes retire with the rest -- a code's member is
+    // unmarked and verbatim, indistinguishable from a passkey's. Each retired
+    // credential's committed rungs and revealed rungs go in the same entry (see
+    // the strike below and `decisions/0014`), because striking the VM rots only
+    // a ladder-signed bridge and a bridge an enrolled client minted outlives
+    // this entry. The bridge itself stays live but inert; nothing revokes it.
+    // The new client's marked pair and the KMS
+    // convenience key are untouched -- neither is account-DID-controlled
+    // keyAgreement.
+    const ladderVms = ladderVmIds({ doc });
+    const addedVmIds = addedMethods
+        .map(method => method.id)
+        .filter((id) => typeof id === 'string');
+    const struckCredentialVmIds = credentialKeyAgreementMethods({ doc, did })
+        .map(method => method.id)
+        .filter((id) => typeof id === 'string')
+        .filter(id => !addedVmIds.includes(id));
+    const retiredCredentialVmIds = struckCredentialVmIds.filter(id => id !== spentVmId);
+    // Each retired credential's committed rungs and any revealed rung of its own
+    // go in the SAME entry. Striking the ladder VM rots only a ladder-signed
+    // bridge; a bridge an enrolled client minted outlives the strike, and that
+    // client survives this entry, so a committed rung left standing is a reveal
+    // the retired credential could still perform. Anchored from the log alone,
+    // and an unanchorable credential is reported rather than struck.
+    const strike = await attributeRetiredCredentialRungs({
+        log: published.log,
+        credentialVmIds: retiredCredentialVmIds,
+        protectedHashes: [newUpdateHash, newStagedHash, replacementHash],
+        protectedKeys: [newClientKeys.updateKeyMultibase]
+    });
+    const struck = (id) => id !== undefined &&
+        (id === spentVmId ||
+            ladderVms.includes(id) ||
+            struckCredentialVmIds.includes(id));
     const existingMethods = (doc.verificationMethod ?? []);
     const verificationMethods = [
-        ...existingMethods.filter(method => method.id !== spentVmId &&
+        ...existingMethods.filter(method => !struck(method.id) &&
             !addedMethods.some(added => added.id === method.id)),
         ...addedMethods
     ];
-    const withReference = (relation, id) => [...new Set([...relationIds(relation), id])];
+    const withReference = (relation, id) => [
+        ...new Set([
+            ...relationIds(relation).filter(referencedId => !struck(referencedId)),
+            id
+        ])
+    ];
     const signingVmId = vmId(newClientKeys.signingKeyMultibase);
     const signer = await updateKeySigner({
         seed: newClientUpdateSeeds.updateSeed
@@ -406,17 +537,21 @@ async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClien
         alsoKnownAsWeb: true,
         updateKeys: [
             ...new Set([
-                ...published.updateKeys.filter(key => key !== recovery.updateKeyMultibase),
+                ...published.updateKeys.filter(key => key !== recovery.updateKeyMultibase &&
+                    !strike.struckKeys.includes(key)),
                 newClientKeys.updateKeyMultibase
             ])
         ],
-        nextKeyHashes: published.nextKeyHashes.filter(hash => hash !== recoveryHash),
+        nextKeyHashes: assertNextKeyHashesRemain({
+            nextKeyHashes: published.nextKeyHashes.filter(hash => hash !== recoveryHash && !strike.struckHashes.includes(hash)),
+            ceremony: 'the recovery add-and-retire entry'
+        }),
         verificationMethods,
         authentication: withReference(doc.authentication, signingVmId),
         assertionMethod: withReference(doc.assertionMethod, signingVmId),
         keyAgreement: [
             ...new Set([
-                ...relationIds(doc.keyAgreement).filter(id => id !== spentVmId),
+                ...relationIds(doc.keyAgreement).filter(id => !struck(id)),
                 vmId(newClientKeys.keyAgreementKeyMultibase),
                 replacementVmId
             ])
@@ -432,6 +567,13 @@ async function recoverWebvhClientOnce({ store, recovery, newClientKeys, newClien
     if (pinStore && logId !== undefined) {
         await pinStore.write({ logId, pin: pinOfLog(updated.log) });
     }
-    return { did: updated.did, webDoc: updated.webDoc, committed: true };
+    return {
+        did: updated.did,
+        webDoc: updated.webDoc,
+        committed: true,
+        retiredCredentialVmIds,
+        struckRungHashes: strike.struckHashes,
+        unclaimedCredentialVmIds: strike.unclaimedCredentialVmIds
+    };
 }
 //# sourceMappingURL=recoveryWebvh.js.map

package/dist/recovery/recoveryWebvh.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.js","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,gBAAgB,EAChB,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EAIzB;IACC,OAAO,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;AAC7C,CAAC;AAYD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YACE,OAAO,GAAG,4DAA4D;QACpE,4CAA4C;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACX,QAAQ,EACR,KAAK,EAMN;IACC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,KAAK,EACL,GAAG,EACH,OAAO,EAKR;IACC,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EAQN;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EAQN;IACC,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,0BAA0B;KACjC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAYxC;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,oDAAoD;IACpD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,uEAAuE;YACrE,sEAAsE,CACzE,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,qCAAqC;IACrC,yBAAyB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,aAAa,CAAC,mBAAmB;QAC9D,wBAAwB,EAAE,OAAO,CAAC,aAAa,CAAC,wBAAwB;KACzE,CAAC,CAAA;IACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,KAAK,EAaN;IACC,sEAAsE;IACtE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;KACV,CAAC,CAAA;IAEF,wEAAwE;IACxE,0EAA0E;IAC1E,kEAAkE;IAClE,uDAAuD;IACvD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACjD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,wBAAwB,CACvC,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,KAAK,CACrE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC/C,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,aAAa;oBACb,aAAa;oBACb,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;SACxB,CAAC,CAAA;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,sBAAsB;QACtB,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7D,CAAC;QACD,uEAAuE;QACvE,SAAS,GAAG,MAAM,cAAc,CAAC;YAC/B,KAAK;YACL,WAAW,EAAE,SAAS,CAAC,GAAG;YAC1B,GAAG,MAAM;SACV,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,WAAW,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAE7D,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,kBAA0B,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,wCAAwC;IACxC,MAAM,YAAY,GAAyB;QACzC,GAAG,4BAA4B,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;SACjE,CAAC;QACF;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;KACF,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CACtD;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,aAAa,GAAG,CACpB,QAAqD,EACrD,EAAU,EACV,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,IAAI,EAAE,oBAAoB,CAAC,UAAU;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,kBAAkB,CAC3C;gBACD,aAAa,CAAC,kBAAkB;aACjC,CAAC;SACH;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAC9B;QACD,mBAAmB;QACnB,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;QAC9D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC;QAChE,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC;gBAC/D,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC;gBAC5C,eAAe;aAChB,CAAC;SACH;QACD,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC1E,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;KAC3E,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AACtE,CAAC"}
+{"version":3,"file":"recoveryWebvh.js","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAA;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAChC,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACH,qBAAqB,EACrB,SAAS,EAMV;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACrC,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CACzD,CAAA;IACD,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,6BAA6B,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CACvD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CACpB,CACF,CAAA;IACD,OAAO,6BAA6B,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;SACzD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;SACpD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EAIzB;IACC,OAAO,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;AAC7C,CAAC;AAYD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YACE,OAAO,GAAG,4DAA4D;QACpE,4CAA4C;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACX,QAAQ,EACR,KAAK,EAMN;IACC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,KAAK,EACL,GAAG,EACH,OAAO,EAKR;IACC,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EAQN;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,qEAAqE;QACrE,uCAAuC;QACvC,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,yBAAyB;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,KAAK,EAQN;IACC,OAAO,eAAe,CAAC;QACrB,OAAO;QACP,UAAU;QACV,UAAU,EAAE;YACV,YAAY,EAAE;gBACZ,kBAAkB,EAAE,QAAQ,CAAC,wBAAwB;aACtD;YACD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD;QACD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,0BAA0B;KACjC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAYxC;IAQC,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,oDAAoD;IACpD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,uEAAuE;YACrE,sEAAsE,CACzE,CAAA;IACH,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,qCAAqC;IACrC,yBAAyB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,aAAa,CAAC,mBAAmB;QAC9D,wBAAwB,EAAE,OAAO,CAAC,aAAa,CAAC,wBAAwB;KACzE,CAAC,CAAA;IACF,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,sBAAsB,CAAC,EACpC,KAAK,EACL,QAAQ,EACR,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,KAAK,EAaN;IAQC,sEAAsE;IACtE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;KACV,CAAC,CAAA;IAEF,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAC3C,aAAa,CAAC,wBAAwB,CACvC,CAAA;IACD,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,kEAAkE;IAClE,uDAAuD;IACvD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,iDAAiD;QACjD,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,qBAAqB,EAAE,aAAa,CAAC,kBAAkB;YACvD,SAAS,EAAE,YAAY,CAAC;gBACtB,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;aAC5D,CAAC;SACH,CAAC,CAAA;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;YACnD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,sBAAsB,EAAE,aAAa,CAAC,kBAAkB;YACxD,eAAe,EAAE,OAAO;YACxB,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC;YAChE,aAAa,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC;SAClD,CAAC,CAAA;QACF,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,SAAS,EAAE,KAAK;YAChB,sBAAsB,EAAE,OAAO;YAC/B,gBAAgB,EAAE,MAAM,CAAC,YAAY;YACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;SAC1D,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,KAAK,CACrE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC/C,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,aAAa;oBACb,aAAa;oBACb,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;SACxB,CAAC,CAAA;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,sBAAsB;QACtB,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7D,CAAC;QACD,uEAAuE;QACvE,SAAS,GAAG,MAAM,cAAc,CAAC;YAC/B,KAAK;YACL,WAAW,EAAE,SAAS,CAAC,GAAG;YAC1B,GAAG,MAAM;SACV,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,WAAW,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAE7D,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,wBAAwB;IACxB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,IAAI,GAAG,CAAC,kBAA0B,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,wCAAwC;IACxC,MAAM,YAAY,GAAyB;QACzC,GAAG,4BAA4B,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,wBAAwB,EAAE,aAAa,CAAC,wBAAwB;SACjE,CAAC;QACF;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;KACF,CAAA;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,2CAA2C;IAC3C,qEAAqE;IACrE,gBAAgB;IAChB,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,YAAY;SAC5B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAA;IACvD,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACtE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;SACpD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IACzC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,MAAM,CACzD,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CACvB,CAAA;IACD,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;QACnD,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,eAAe,EAAE,sBAAsB;QACvC,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,CAAC;QAChE,aAAa,EAAE,CAAC,aAAa,CAAC,kBAAkB,CAAC;KAClD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,CAAC,EAAsB,EAAW,EAAE,CACjD,EAAE,KAAK,SAAS;QAChB,CAAC,EAAE,KAAK,SAAS;YACf,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IACvC,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAClB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CACtD;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,aAAa,GAAG,CACpB,QAAqD,EACrD,EAAU,EACV,EAAE,CAAC;QACH,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtE,EAAE;SACH,CAAC;KACH,CAAA;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,IAAI,EAAE,oBAAoB,CAAC,UAAU;KACtC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CACJ,GAAG,KAAK,QAAQ,CAAC,kBAAkB;oBACnC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnC;gBACD,aAAa,CAAC,kBAAkB;aACjC,CAAC;SACH;QACD,aAAa,EAAE,yBAAyB,CAAC;YACvC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrE;YACD,QAAQ,EAAE,mCAAmC;SAC9C,CAAC;QACF,mBAAmB;QACnB,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;QAC9D,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,CAAC;QAChE,YAAY,EAAE;YACZ,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1D,IAAI,CAAC,aAAa,CAAC,wBAAwB,CAAC;gBAC5C,eAAe;aAChB,CAAC;SACH;QACD,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;QAC1E,oBAAoB,EAAE,aAAa,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC;KAC3E,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI;QACf,sBAAsB;QACtB,gBAAgB,EAAE,MAAM,CAAC,YAAY;QACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;KAC1D,CAAA;AACH,CAAC"}

package/dist/unlock/index.d.ts

@@ -35,8 +35,8 @@ export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentit
 export type { StandingUnlockClient, UnlockClientIdentity } from './standingClient.js';
 export { computeUnlockBinding, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
 export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from './unlockRecord.js';
-export { publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
-export type { StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
+export { LadderInventoryDriftError, publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export type { LadderVmRemovalReport, StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
 export { retireUnlockCredential } from './retire.js';
 export type { ClientAnnexInventoryRetirement, UnlockCredentialRetirementResult } from './retire.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/unlock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}

package/dist/unlock/index.js

@@ -33,6 +33,6 @@
  */
 export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
 export { computeUnlockBinding, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
-export { publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { LadderInventoryDriftError, publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export { retireUnlockCredential } from './retire.js';
 //# sourceMappingURL=index.js.map

package/dist/unlock/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAQ3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA"}

package/dist/unlock/retire.d.ts

@@ -9,6 +9,13 @@
  * inventory in the account's did:webvh document -- so retiring one is a real
  * rotation, on the same stages the client-revocation cascade runs.
  *
+ * 0. **The dependent-record re-mint** (the injected `remintDependentRecords`
+ *    closure), against the PRE-edit document: the credential's ladder VM is
+ *    about to be struck, and a struck VM rots every record and bridge
+ *    delegation it signed for OTHER credentials -- the last-client transition
+ *    signs siblings' records with one, and `currentAccountRecordSigners`
+ *    accepts it. The stage names the doomed VM ids to the pass, which
+ *    re-signs those records under a key that outlives the edit.
  * 1. **The document inventory edit** (`removeUnlockKey`): the credential's
  *    `keyAgreement` entry (verbatim key or commitment) and its committed
  *    update-key hash leave the document in one log entry. That kills the
@@ -29,11 +36,21 @@
  * inventory still standing would simply re-escrow the credential and look
  * healthy.
  *
- * There is deliberately no recovery-delegation re-mint stage here (the
- * client-revocation cascade's fourth stage). A retired credential signs no
- * delegations: its own bridge delegation dies with its unlock Space, which
- * the app deletes as part of the change-method ceremony, and no other
- * credential's bridge chains through it.
+ * Stage 0 is the one stage that runs BEFORE the edit, and its placement is
+ * the point. Run after the edit it would leave a window in which every
+ * sibling credential's record is unverifiable, and a run torn there bricks
+ * exactly what the stage exists to protect: a record whose frame proof names
+ * a struck key refuses before decryption, and the credential's own login dies
+ * at that check with no repair arm. Run before it, a tear leaves the sibling
+ * records signed by a key that still stands and the retiring credential still
+ * standing -- the correct resting state, converged by a re-run. So the stage
+ * is fail-closed rather than best-effort: a throw from the closure aborts the
+ * retirement before anything is published, unlike the annex closure at 1b.
+ *
+ * That corrects what this module used to reason. A retired credential's own
+ * bridge delegation does die with its unlock Space, which the app deletes as
+ * part of the change-method ceremony. Its ladder VM is the part that reaches
+ * further: other credentials' records and bridges chain through it.
  *
  * The client annex reach is its own stage (1b, the injected
  * `retireClientAnnexInventory` closure), between the document edit and the
@@ -54,6 +71,15 @@
  * skip, so the roster rotation -- the ceremony's essential remedy -- always
  * runs.
  *
+ * Stage 0 and stage 1 each read the log for themselves, and the two reads are
+ * tied by a cross-check rather than by luck: stage 0 hands its attributed
+ * ladder VM ids to the edit as `expectedLadderVmIds`, and the edit refuses
+ * before writing when its own attribution resolves a different set
+ * (`LadderInventoryDriftError`). So a concurrent ceremony, or a host serving
+ * different log versions to the two reads, cannot leave the strike diverging
+ * from what the re-mint pass acted on. Both reads take the caller's
+ * `pinStore` and `logId`, so both are checked against the same chain head.
+ *
  * Convergence is the design: every stage detects its own completion from
  * durable state alone -- the inventory edit no-ops when the document is already
  * settled, the rotation no-ops once every current-epoch recipient is
@@ -71,23 +97,30 @@ import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import { type CascadeCollections, type RosterSealReport, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
 import type { ClientWebvhUpdateKeys, WebvhIdStore } from '../webvh/index.js';
-import { type StandingUnlockKeys } from './standingWebvh.js';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
+import { type LadderVmRemovalReport, type StandingUnlockKeys } from './standingWebvh.js';
 /**
  * What a completed retirement reports: whether the roster actually rotated on
  * this run (a re-run of an already-complete retirement reports `false`), the
  * roster's seal-backstop report (present when the roster store is sealable and
  * the roster stage ran), the per-collection fan-out result, the document as
- * the inventory edit left it, and the rotated key with the roster descriptor it
- * was read from.
+ * the inventory edit left it, the rotated key with the roster descriptor it
+ * was read from, whatever the dependent-record re-mint pass returned
+ * (`dependentRecords`, absent when no closure was supplied), and the
+ * inventory edit's ladder VM report (`ladderVm`: what the edit struck, and
+ * what stands unclaimed after it -- a seedless strike that claimed nothing
+ * reports its credential's VM there rather than reading as clean).
  */
 export interface UnlockCredentialRetirementResult {
     rotated: boolean;
+    ladderVm: LadderVmRemovalReport;
     rosterSeal?: RosterSealReport;
     collections: UserKeyCascadeResult;
     document: object;
     userKey?: UserKey;
     rosterDescriptor?: CollectionEncryption;
     clientAnnex?: ClientAnnexInventoryRetirement;
+    dependentRecords?: unknown;
 }
 /**
  * What the annex-inventory stage reports: `struck` (a strike entry dropped
@@ -122,6 +155,14 @@ export interface ClientAnnexInventoryRetirement {
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins, threaded to BOTH account-log reads the ceremony makes -- stage 0's
+ *   attribution read and the inventory edit's own read inside its
+ *   conflict-retry loop -- so a served rollback or fork is refused before
+ *   anything is published
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
  * @param options.rosterStore {EncryptionDescriptorStore}   the
@@ -135,6 +176,12 @@ export interface ClientAnnexInventoryRetirement {
  *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
  *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param [options.remintDependentRecords] {Function}   `({ document,
+ *   retiringKeyMultibases }) => Promise<unknown>` -- the dependent-record
+ *   re-mint (stage 0), run against the PRE-edit document with the ladder VM
+ *   ids this retirement is about to strike. Fail-closed: a throw aborts the
+ *   retirement before the document edit. Absent, the stage is skipped and no
+ *   log read happens for it (the no-WAS path)
  * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
  *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
  *   the module doc), run against the post-edit document; a throw is caught
@@ -144,12 +191,14 @@ export interface ClientAnnexInventoryRetirement {
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexInventory, onRotationAdopted }: {
+export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, pinStore, logId, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintDependentRecords, retireClientAnnexInventory, onRotationAdopted }: {
     idStore: WebvhIdStore;
     updateKeys: ClientWebvhUpdateKeys;
     unlockKeys: StandingUnlockKeys;
     ladderSeed?: Uint8Array;
     expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
     verb?: string;
     rosterStore: EncryptionDescriptorStore;
     userKey?: UserKey;
@@ -161,6 +210,10 @@ export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys
         descriptor: CollectionEncryption;
     }) => Promise<void>;
     collections: CascadeCollections;
+    remintDependentRecords?: (options: {
+        document: object;
+        retiringKeyMultibases: string[];
+    }) => Promise<unknown>;
     retireClientAnnexInventory?: (options: {
         document: object;
     }) => Promise<ClientAnnexInventoryRetirement>;

package/dist/unlock/retire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,8BAA8B,CAAA;CAC7C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAiE5C"}
+{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAA;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,8BAA8B,CAAA;IAC5C,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAA;QAChB,qBAAqB,EAAE,MAAM,EAAE,CAAA;KAChC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACtB,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CA0G5C"}

package/dist/unlock/retire.js

@@ -1,5 +1,5 @@
 import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
-import { removeUnlockKey } from './standingWebvh.js';
+import { attributeUnlockLadderInventory, readLogOrThrow, removeUnlockKey } from './standingWebvh.js';
 /**
  * Retires one standing unlock credential from an account. See the module doc
  * for the order and the convergence story. Once the inventory edit lands, a
@@ -20,6 +20,14 @@ import { removeUnlockKey } from './standingWebvh.js';
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins, threaded to BOTH account-log reads the ceremony makes -- stage 0's
+ *   attribution read and the inventory edit's own read inside its
+ *   conflict-retry loop -- so a served rollback or fork is refused before
+ *   anything is published
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
  * @param options.rosterStore {EncryptionDescriptorStore}   the
@@ -33,6 +41,12 @@ import { removeUnlockKey } from './standingWebvh.js';
  *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
  *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param [options.remintDependentRecords] {Function}   `({ document,
+ *   retiringKeyMultibases }) => Promise<unknown>` -- the dependent-record
+ *   re-mint (stage 0), run against the PRE-edit document with the ladder VM
+ *   ids this retirement is about to strike. Fail-closed: a throw aborts the
+ *   retirement before the document edit. Absent, the stage is skipped and no
+ *   log read happens for it (the no-WAS path)
  * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
  *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
  *   the module doc), run against the post-edit document; a throw is caught
@@ -42,16 +56,52 @@ import { removeUnlockKey } from './standingWebvh.js';
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexInventory, onRotationAdopted }) {
+export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, pinStore, logId, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintDependentRecords, retireClientAnnexInventory, onRotationAdopted }) {
+    // 0. The dependent-record re-mint, against the PRE-edit document: whatever
+    // the doomed ladder VM signed for OTHER credentials is re-signed under a
+    // key that outlives the edit. The pass is named the VM ids the attribution
+    // claims for this credential, and it runs even when that list is empty:
+    // the pass has an expiry axis of its own, and a near-lapse sibling bridge
+    // is worth refreshing in the same window. Fail-closed -- a throw aborts
+    // here, with the credential still standing.
+    const pinned = {
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {})
+    };
+    let dependentRecords;
+    let expectedLadderVmIds;
+    if (remintDependentRecords) {
+        const published = await readLogOrThrow({
+            store: idStore,
+            ...(expectedDid !== undefined ? { expectedDid } : {}),
+            ...pinned
+        });
+        const inventory = await attributeUnlockLadderInventory({
+            log: published.log,
+            did: published.did,
+            unlockKeys,
+            ...(ladderSeed ? { ladderSeed } : {})
+        });
+        // What the edit's own attribution must resolve to: the pass below acts on
+        // this list, so an edit that resolved a different one would strike
+        // something the pass never covered.
+        expectedLadderVmIds = inventory.ladderVmIds;
+        dependentRecords = await remintDependentRecords({
+            document: published.doc,
+            retiringKeyMultibases: inventory.ladderVmIds
+        });
+    }
     // 1. The document inventory edit -- the credential's standing, first. It
     // resolves the document as it now stands, which is what stage 2 resolves
     // its remaining recipients from.
-    const { did, doc, log } = await removeUnlockKey({
+    const { did, doc, log, ladderVm } = await removeUnlockKey({
         idStore,
         updateKeys,
         unlockKeys,
         ...(ladderSeed ? { ladderSeed } : {}),
+        ...(expectedLadderVmIds !== undefined ? { expectedLadderVmIds } : {}),
         ...(expectedDid !== undefined ? { expectedDid } : {}),
+        ...pinned,
         ...(verb !== undefined ? { verb } : {})
     });
     // 1b. The annex reach, against the post-edit document: strike the
@@ -87,9 +137,11 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         // retired -- a completed ceremony with nothing rotated.
         return {
             rotated: false,
+            ladderVm,
             collections: tail.collections,
             document: doc,
-            ...(clientAnnex ? { clientAnnex } : {})
+            ...(clientAnnex ? { clientAnnex } : {}),
+            ...(remintDependentRecords ? { dependentRecords } : {})
         };
     }
     if (tail.rotated) {
@@ -97,12 +149,14 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
     }
     return {
         rotated: tail.rotated,
+        ladderVm,
         ...(tail.rosterSeal ? { rosterSeal: tail.rosterSeal } : {}),
         collections: tail.collections,
         document: doc,
         userKey: tail.userKey,
         rosterDescriptor: tail.rosterDescriptor,
-        ...(clientAnnex ? { clientAnnex } : {})
+        ...(clientAnnex ? { clientAnnex } : {}),
+        ...(remintDependentRecords ? { dependentRecords } : {})
     };
 }
 //# sourceMappingURL=retire.js.map