@interop/wallet-core 0.61.0 → 0.65.0

package/dist/clientAnnex/spaceCapability.js

@@ -0,0 +1,152 @@
+import { rootCapabilityId, spacePath, toUrl } from '@interop/was-client/paths';
+/**
+ * The single-verb Space capability's lifetime: ten minutes, long enough for
+ * the request it is minted for and twice `@interop/zcap`'s 300-second clock
+ * skew allowance. A child's `expires` is the earlier of this and its
+ * parent's, since the library refuses a child less restrictive than its
+ * parent with no skew allowance.
+ */
+export const DELETION_ZCAP_TTL_MS = 10 * 60 * 1000;
+/**
+ * The typed refusal of a mint over a parent capability whose own `expires`
+ * has already passed: the child would verify nowhere, so nothing is minted
+ * and nothing is sent. Matched on `name` -- error classes do not survive
+ * crossing package copies. The parent's `expires` and `id` ride the error so
+ * a caller can name the lapsed capability in its own copy without re-reading
+ * the parent.
+ */
+export class ExpiredParentCapabilityError extends Error {
+    parentExpires;
+    parentId;
+    constructor({ message, parentExpires, parentId }) {
+        super(message);
+        this.name = 'ExpiredParentCapabilityError';
+        this.parentExpires = parentExpires;
+        this.parentId = parentId;
+    }
+}
+/**
+ * The child's expiry: `min(now + ttlMs, parent.expires)`. A parent already
+ * expired is refused rather than minted from, since the child would verify
+ * nowhere.
+ *
+ * @param options {object}
+ * @param options.ttlMs {number}
+ * @param [options.parent] {IZcap}   the stored parent capability, absent on
+ *   the root-parented shape (a synthesized root has no expiry)
+ * @param options.now {number}   epoch milliseconds
+ * @returns {Date}
+ */
+function childExpires({ ttlMs, parent, now }) {
+    const requested = now + ttlMs;
+    const parentExpires = Date.parse(parent?.expires ?? '');
+    if (Number.isNaN(parentExpires)) {
+        return new Date(requested);
+    }
+    if (parentExpires <= now) {
+        const expiresIso = new Date(parentExpires).toISOString();
+        throw new ExpiredParentCapabilityError({
+            message: 'single-verb Space capability: the parent capability expired at ' +
+                `${expiresIso}; refusing to mint a child that verifies nowhere.`,
+            parentExpires: expiresIso,
+            parentId: parent?.id
+        });
+    }
+    return new Date(Math.min(requested, parentExpires));
+}
+/**
+ * Refuses a child the parent cannot authorize. A parent's `allowedAction` may
+ * be a single string, a list, or absent (which delegates every action), so
+ * the check normalizes before asking. Refusing locally is what keeps the
+ * failure legible: an unauthorized invocation comes back from the storage
+ * server as a 404, indistinguishable from a Space that is simply gone, so a
+ * child that verifies nowhere must never be minted and sent.
+ *
+ * @param options {object}
+ * @param options.parent {IZcap}
+ * @param options.verb {SpaceCapabilityVerb}
+ * @returns {void}
+ */
+function assertParentAllows({ parent, verb }) {
+    const allowed = parent
+        .allowedAction;
+    if (allowed === undefined) {
+        return;
+    }
+    const actions = Array.isArray(allowed) ? allowed : [allowed];
+    if (actions.length === 0 || actions.includes(verb)) {
+        return;
+    }
+    throw new Error(`single-verb Space capability: the parent capability allows ` +
+        `${actions.join(', ')} and not ${verb}; refusing to mint a child that ` +
+        'verifies nowhere.');
+}
+/**
+ * Mints a single-verb child of a STORED parent capability -- the three-link
+ * shape, used on an unlock Space whose management zcap the account already
+ * holds. The child's `invocationTarget` is the parent's unchanged.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating signer (the ladder
+ *   VM's client on a transient session, an enrolled client's on a remembered
+ *   one)
+ * @param options.parent {IZcap}   the stored parent capability
+ * @param options.verb {SpaceCapabilityVerb}   the child's one allowed action
+ * @param options.controller {string}   the delegatee DID
+ * @param [options.ttlMs] {number}   the child's requested lifetime
+ * @param [options.now] {number}   the clock the child is minted against
+ *   (epoch milliseconds); a caller holding server-relative time passes it
+ *   so the proof's `created` and the child's `expires` come off one clock
+ * @returns {Promise<IZcap>}
+ */
+export async function mintSpaceVerbCapability({ zcapClient, parent, verb, controller, ttlMs = DELETION_ZCAP_TTL_MS, now = Date.now() }) {
+    const invocationTarget = parent
+        .invocationTarget;
+    if (invocationTarget === undefined) {
+        throw new Error('single-verb Space capability: the parent capability names no ' +
+            '`invocationTarget`.');
+    }
+    assertParentAllows({ parent, verb });
+    return (await zcapClient.delegate({
+        capability: parent,
+        invocationTarget,
+        controller,
+        allowedActions: [verb],
+        expires: childExpires({ ttlMs, parent, now }),
+        now
+    }));
+}
+/**
+ * Mints a single-verb child of a Space's SYNTHESIZED ROOT -- the two-link
+ * shape, used on the account Space and an auxiliary annex Space, where the
+ * session holds no stored parent. The child's `invocationTarget` is the bare
+ * Space URL, with no trailing slash, so the deletion child covers the Space
+ * itself rather than its items subtree.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating signer
+ * @param options.storageServerUrl {string}   the Space's storage server
+ * @param options.spaceId {string}
+ * @param options.verb {SpaceCapabilityVerb}   the child's one allowed action
+ * @param options.controller {string}   the delegatee DID
+ * @param [options.ttlMs] {number}   the child's requested lifetime
+ * @param [options.now] {number}   the clock the child is minted against
+ *   (epoch milliseconds); a caller holding server-relative time passes it
+ *   so the proof's `created` and the child's `expires` come off one clock
+ * @returns {Promise<IZcap>}
+ */
+export async function mintSpaceRootVerbCapability({ zcapClient, storageServerUrl, spaceId, verb, controller, ttlMs = DELETION_ZCAP_TTL_MS, now = Date.now() }) {
+    const spaceUrl = toUrl({
+        serverUrl: storageServerUrl,
+        path: spacePath(spaceId)
+    });
+    return (await zcapClient.delegate({
+        capability: rootCapabilityId(spaceUrl),
+        invocationTarget: spaceUrl,
+        controller,
+        allowedActions: [verb],
+        expires: childExpires({ ttlMs, now }),
+        now
+    }));
+}
+//# sourceMappingURL=spaceCapability.js.map

package/dist/clientAnnex/spaceCapability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spaceCapability.js","sourceRoot":"","sources":["../../src/clientAnnex/spaceCapability.ts"],"names":[],"mappings":"AAsCA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAQlD;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,aAAa,CAAQ;IACrB,QAAQ,CAAoB;IAErC,YAAY,EACV,OAAO,EACP,aAAa,EACb,QAAQ,EAKT;QACC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;QAC1C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,MAAM,EACN,GAAG,EAKJ;IACC,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,CAAA;IAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAC7B,MAA+B,EAAE,OAAO,IAAI,EAAE,CAChD,CAAA;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAA;QACxD,MAAM,IAAI,4BAA4B,CAAC;YACrC,OAAO,EACL,iEAAiE;gBACjE,GAAG,UAAU,mDAAmD;YAClE,aAAa,EAAE,UAAU;YACzB,QAAQ,EAAG,MAA0B,EAAE,EAAE;SAC1C,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,EAC1B,MAAM,EACN,IAAI,EAIL;IACC,MAAM,OAAO,GAAI,MAAgD;SAC9D,aAAa,CAAA;IAChB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAM;IACR,CAAC;IACD,MAAM,IAAI,KAAK,CACb,6DAA6D;QAC3D,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,kCAAkC;QACvE,mBAAmB,CACtB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,UAAU,EACV,MAAM,EACN,IAAI,EACJ,UAAU,EACV,KAAK,GAAG,oBAAoB,EAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAQjB;IACC,MAAM,gBAAgB,GAAI,MAAwC;SAC/D,gBAAgB,CAAA;IACnB,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,+DAA+D;YAC7D,qBAAqB,CACxB,CAAA;IACH,CAAC;IACD,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACpC,OAAO,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC;QAChC,UAAU,EAAE,MAAM;QAClB,gBAAgB;QAChB,UAAU;QACV,cAAc,EAAE,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC7C,GAAG;KACJ,CAAC,CAAU,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,IAAI,EACJ,UAAU,EACV,KAAK,GAAG,oBAAoB,EAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EASjB;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC;QACrB,SAAS,EAAE,gBAAgB;QAC3B,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC;KACzB,CAAC,CAAA;IACF,OAAO,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC;QAChC,UAAU,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACtC,gBAAgB,EAAE,QAAQ;QAC1B,UAAU;QACV,cAAc,EAAE,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG;KACJ,CAAC,CAAU,CAAA;AACd,CAAC"}

package/dist/clientAnnex/stages.d.ts

@@ -0,0 +1,63 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The stage vocabulary of the credential-anchored ceremonies: the ordered
+ * tuples their `onStage` notifiers report from, the aliases, and the union
+ * types derived from them. The ceremonies emit from these types, so a
+ * mistyped stage name fails the type check, and a consumer's progress
+ * display derives its step list from the tuples instead of re-declaring the
+ * names as bare strings.
+ *
+ * The vocabulary sits in a leaf module of its own rather than beside the
+ * code that emits it, because a progress display needs the names and none of
+ * the ceremony: an app store importing them from `establish.js` would pull
+ * that whole module graph into its bundle.
+ */
+import { KMS_AUTHENTICATION_STAGE } from '../stages.js';
+export { KMS_AUTHENTICATION_STAGE };
+/**
+ * The controller-promotion stage, emitted by the genesis ceremony when it
+ * promotes and by the establishment when the promotion is deferred to it.
+ * Declared once so the two emitters cannot drift apart.
+ */
+export declare const CONTROLLER_PROMOTION_STAGE = "controller-promotion";
+/**
+ * The stages `ensureCredentialAnchoredAccountGenesis` reports, in the order
+ * they fire, up to but not including the controller promotion (which a
+ * caller may defer -- see {@link CONTROLLER_PROMOTION_STAGE}).
+ */
+export declare const CREDENTIAL_ANCHORED_GENESIS_STAGES: readonly ["space-provisioning", "kms-authentication", "webvh-genesis", "roster-genesis", "collection-epochs"];
+/**
+ * A stage name the credential-anchored genesis may emit.
+ */
+export type CredentialAnchoredGenesisStage = (typeof CREDENTIAL_ANCHORED_GENESIS_STAGES)[number] | typeof CONTROLLER_PROMOTION_STAGE;
+/**
+ * The establishment's stage names in the order they fire: its own marks with
+ * the genesis ceremony's spliced in where that ceremony runs (stage 2).
+ *
+ * Two kinds of name are absent by construction. The stages whose body is a
+ * caller's own closure (`beforePromotion`, `promoteKeystore`) are the
+ * caller's to name and mark, since only the caller knows what its closure
+ * does; and an alias below fires in place of a listed name rather than
+ * beside it.
+ */
+export declare const CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGES: readonly ["interim-bind", "space-provisioning", "kms-authentication", "webvh-genesis", "roster-genesis", "collection-epochs", "account-log-read", "annex-generation", "record-rebind", "controller-promotion"];
+/**
+ * A stage the establishment reports as a step of its own.
+ */
+export type CredentialAnchoredEstablishmentStage = (typeof CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGES)[number];
+/**
+ * Stage names that fire in place of a listed stage rather than beside it,
+ * and the stage each stands in for. The heal branch delivers the collection
+ * epochs off an adopted roster instead of minting them, so its mark closes
+ * the boundary `collection-epochs` closes on a fresh run.
+ */
+export declare const CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGE_ALIASES: {
+    readonly 'roster-delivered-epochs': "collection-epochs";
+};
+/**
+ * Every name the establishment may emit: the stages above plus the aliases.
+ */
+export type CredentialAnchoredEstablishmentStageName = CredentialAnchoredEstablishmentStage | keyof typeof CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGE_ALIASES;
+//# sourceMappingURL=stages.d.ts.map

package/dist/clientAnnex/stages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/stages.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD,OAAO,EAAE,wBAAwB,EAAE,CAAA;AAEnC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,+GAMrC,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,8BAA8B,GACtC,CAAC,OAAO,kCAAkC,CAAC,CAAC,MAAM,CAAC,GACnD,OAAO,0BAA0B,CAAA;AAErC;;;;;;;;;GASG;AACH,eAAO,MAAM,wCAAwC,gNAO3C,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,oCAAoC,GAC9C,CAAC,OAAO,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAA;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,+CAA+C;;CAEa,CAAA;AAEzE;;GAEG;AACH,MAAM,MAAM,wCAAwC,GAChD,oCAAoC,GACpC,MAAM,OAAO,+CAA+C,CAAA"}

package/dist/clientAnnex/stages.js

@@ -0,0 +1,64 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The stage vocabulary of the credential-anchored ceremonies: the ordered
+ * tuples their `onStage` notifiers report from, the aliases, and the union
+ * types derived from them. The ceremonies emit from these types, so a
+ * mistyped stage name fails the type check, and a consumer's progress
+ * display derives its step list from the tuples instead of re-declaring the
+ * names as bare strings.
+ *
+ * The vocabulary sits in a leaf module of its own rather than beside the
+ * code that emits it, because a progress display needs the names and none of
+ * the ceremony: an app store importing them from `establish.js` would pull
+ * that whole module graph into its bundle.
+ */
+import { KMS_AUTHENTICATION_STAGE } from '../stages.js';
+export { KMS_AUTHENTICATION_STAGE };
+/**
+ * The controller-promotion stage, emitted by the genesis ceremony when it
+ * promotes and by the establishment when the promotion is deferred to it.
+ * Declared once so the two emitters cannot drift apart.
+ */
+export const CONTROLLER_PROMOTION_STAGE = 'controller-promotion';
+/**
+ * The stages `ensureCredentialAnchoredAccountGenesis` reports, in the order
+ * they fire, up to but not including the controller promotion (which a
+ * caller may defer -- see {@link CONTROLLER_PROMOTION_STAGE}).
+ */
+export const CREDENTIAL_ANCHORED_GENESIS_STAGES = [
+    'space-provisioning',
+    KMS_AUTHENTICATION_STAGE,
+    'webvh-genesis',
+    'roster-genesis',
+    'collection-epochs'
+];
+/**
+ * The establishment's stage names in the order they fire: its own marks with
+ * the genesis ceremony's spliced in where that ceremony runs (stage 2).
+ *
+ * Two kinds of name are absent by construction. The stages whose body is a
+ * caller's own closure (`beforePromotion`, `promoteKeystore`) are the
+ * caller's to name and mark, since only the caller knows what its closure
+ * does; and an alias below fires in place of a listed name rather than
+ * beside it.
+ */
+export const CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGES = [
+    'interim-bind',
+    ...CREDENTIAL_ANCHORED_GENESIS_STAGES,
+    'account-log-read',
+    'annex-generation',
+    'record-rebind',
+    CONTROLLER_PROMOTION_STAGE
+];
+/**
+ * Stage names that fire in place of a listed stage rather than beside it,
+ * and the stage each stands in for. The heal branch delivers the collection
+ * epochs off an adopted roster instead of minting them, so its mark closes
+ * the boundary `collection-epochs` closes on a fresh run.
+ */
+export const CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGE_ALIASES = {
+    'roster-delivered-epochs': 'collection-epochs'
+};
+//# sourceMappingURL=stages.js.map

package/dist/clientAnnex/stages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.js","sourceRoot":"","sources":["../../src/clientAnnex/stages.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD,OAAO,EAAE,wBAAwB,EAAE,CAAA;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAA;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,oBAAoB;IACpB,wBAAwB;IACxB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;CACX,CAAA;AASV;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,cAAc;IACd,GAAG,kCAAkC;IACrC,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,0BAA0B;CAClB,CAAA;AAQV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D,yBAAyB,EAAE,mBAAmB;CACyB,CAAA"}

package/dist/clientAnnex/zcap.d.ts

@@ -1,4 +1,4 @@
-import { ZcapClient } from '@interop/ezcap';
+import type { ZcapClient } from '@interop/ezcap';
 import type { ICapabilityAgent } from '../webvh/zcap.js';
 /**
  * A ZcapClient signing with the account ladder's document-visible

package/dist/clientAnnex/zcap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zcap.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EACX,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4B5B"}
+{"version":3,"file":"zcap.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAgDxD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EACX,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkB5B"}

package/dist/clientAnnex/zcap.js

@@ -8,10 +8,45 @@
  * only the credential-anchored flows (a ladder-anchored account, a transient
  * session holding nothing but the unlock credential) ever sign as the ladder.
  */
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
 import { Ed25519VerificationKey } from '@interop/ed25519-verification-key';
-import { ZcapClient } from '@interop/ezcap';
+import { zcapClientForSigner } from '../identity/agents.js';
 import { ladderVmSeed } from './ladder.js';
+/**
+ * The ladder VM's key pair as a signer under the DID it is presented as, the
+ * one derivation both entry points below share (`Ed25519VerificationKey`
+ * generated over `ladderVmSeed`), so the bare did:key bootstrap identity and
+ * the document-published ladder VM are one key. The controller is all the two
+ * differ in, and the verification-method id is `<controller>#<multibase>` in
+ * both shapes.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
+ * @param [options.accountDid] {string}   the DID the key is presented under;
+ *   omitted, the key stands under its own bare did:key
+ * @returns {Promise<object>}   `{ publicKeyMultibase, controller, signer }`
+ */
+async function ladderVmSigner({ ladderSeed, accountDid }) {
+    const keyPair = await Ed25519VerificationKey.generate({
+        seed: ladderVmSeed({ ladderSeed })
+    });
+    const { publicKeyMultibase } = keyPair;
+    const controller = accountDid ?? `did:key:${publicKeyMultibase}`;
+    const id = `${controller}#${publicKeyMultibase}`;
+    // The key pair refuses to hand out a signer without an id; set the
+    // verification-method id before asking.
+    keyPair.id = id;
+    keyPair.controller = controller;
+    const keySigner = keyPair.signer();
+    return {
+        publicKeyMultibase,
+        controller,
+        signer: {
+            id,
+            type: 'Ed25519VerificationKey2020',
+            sign: keySigner.sign.bind(keySigner)
+        }
+    };
+}
 /**
  * A ZcapClient signing with the account ladder's document-visible
  * verification method -- the ladder VM, derived from the credential's ladder
@@ -40,24 +75,8 @@ import { ladderVmSeed } from './ladder.js';
  * @returns {Promise<ZcapClient>}
  */
 export async function ladderVmZcapClient({ accountDid, ladderSeed }) {
-    const keyPair = await Ed25519VerificationKey.generate({
-        seed: ladderVmSeed({ ladderSeed })
-    });
-    const { publicKeyMultibase } = keyPair;
-    // The key pair refuses to hand out a signer without an id; set the
-    // document's verification-method id before asking.
-    keyPair.id = `${accountDid}#${publicKeyMultibase}`;
-    const keySigner = keyPair.signer();
-    const signer = {
-        id: `${accountDid}#${publicKeyMultibase}`,
-        type: 'Ed25519VerificationKey2020',
-        sign: keySigner.sign.bind(keySigner)
-    };
-    return new ZcapClient({
-        SuiteClass: Ed25519Signature2020,
-        invocationSigner: signer,
-        delegationSigner: signer
-    });
+    const { signer } = await ladderVmSigner({ ladderSeed, accountDid });
+    return zcapClientForSigner({ signer });
 }
 /**
  * The account ladder VM's key pair presented as a plain did:key agent -- the
@@ -78,21 +97,9 @@ export async function ladderVmZcapClient({ accountDid, ladderSeed }) {
  * @returns {Promise<ICapabilityAgent>}
  */
 export async function ladderVmAgent({ ladderSeed }) {
-    const keyPair = await Ed25519VerificationKey.generate({
-        seed: ladderVmSeed({ ladderSeed })
-    });
-    const { publicKeyMultibase } = keyPair;
-    const did = `did:key:${publicKeyMultibase}`;
-    // The key pair refuses to hand out a signer without an id; the did:key
-    // verification-method form is what the server's did:key resolver expects.
-    keyPair.id = `${did}#${publicKeyMultibase}`;
-    keyPair.controller = did;
-    const keySigner = keyPair.signer();
-    const signer = {
-        id: `${did}#${publicKeyMultibase}`,
-        type: 'Ed25519VerificationKey2020',
-        sign: keySigner.sign.bind(keySigner)
-    };
+    // No account DID: the key stands under its own bare did:key, the
+    // verification-method form the server's did:key resolver expects.
+    const { publicKeyMultibase, controller: did, signer } = await ladderVmSigner({ ladderSeed });
     return {
         id: did,
         handle: 'ladder-vm',

package/dist/clientAnnex/zcap.js.map

@@ -1 +1 @@
-{"version":3,"file":"zcap.js","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EAIX;IACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;KACnC,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAA;IACtC,mEAAmE;IACnE,mDAAmD;IACnD,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,IAAI,kBAAkB,EAAE,CAAA;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,GAAG,UAAU,IAAI,kBAAkB,EAAE;QACzC,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAEV;KAC1B,CAAA;IACD,OAAO,IAAI,UAAU,CAAC;QACpB,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,UAAU,EAGX;IACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;KACnC,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAA;IACtC,MAAM,GAAG,GAAG,WAAW,kBAAkB,EAAE,CAAA;IAC3C,uEAAuE;IACvE,0EAA0E;IAC1E,OAAO,CAAC,EAAE,GAAG,GAAG,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC3C,OAAO,CAAC,UAAU,GAAG,GAAG,CAAA;IACxB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG;QACb,EAAE,EAAE,GAAG,GAAG,IAAI,kBAAkB,EAAE;QAClC,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAEV;KAC1B,CAAA;IACD,OAAO;QACL,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,4BAA4B;YAClC,UAAU,EAAE,GAAG;YACf,kBAAkB;SACnB,CAAC;KACH,CAAA;AACH,CAAC"}
+{"version":3,"file":"zcap.js","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,UAAU,EACV,UAAU,EAIX;IACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;KACnC,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAA;IACtC,MAAM,UAAU,GAAG,UAAU,IAAI,WAAW,kBAAkB,EAAE,CAAA;IAChE,MAAM,EAAE,GAAG,GAAG,UAAU,IAAI,kBAAkB,EAAE,CAAA;IAChD,mEAAmE;IACnE,wCAAwC;IACxC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAA;IACf,OAAO,CAAC,UAAU,GAAG,UAAU,CAAA;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;IAClC,OAAO;QACL,kBAAkB;QAClB,UAAU;QACV,MAAM,EAAE;YACN,EAAE;YACF,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAEV;SAC1B;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EAIX;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,UAAU,EAGX;IACC,iEAAiE;IACjE,kEAAkE;IAClE,MAAM,EACJ,kBAAkB,EAClB,UAAU,EAAE,GAAG,EACf,MAAM,EACP,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACxC,OAAO;QACL,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,4BAA4B;YAClC,UAAU,EAAE,GAAG;YACf,kBAAkB;SACnB,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/clients/policy.d.ts

@@ -21,6 +21,15 @@
  *   different client's authority, so the row is disabled rather than guessed
  *   at.
  *
+ * Two of the three are properties of the acting signer rather than of the
+ * account, so they lift on the ladder branch (`decisions/0017`). A standing
+ * credential's rung signs the removal entry, so it has no self to refuse, and
+ * removing the last client abandons no update authority: the account lands
+ * ladder-anchored, the shape a credential-anchored signup produces, and the
+ * credential's own ladder extends the log from there. The row's confirm copy
+ * states that transition. The unattributed-update-key refusal is a property
+ * of the log and stands on both branches.
+ *
  * And one non-failure: a cascade whose collection fan-out left failures
  * behind is a **resumable success**. The wallet IS disconnected -- the
  * document edit landed first and is the pull axis everywhere -- and the
@@ -44,11 +53,16 @@ export type DisconnectRefusal = 'self' | 'last-client' | 'unattributed-update-ke
  * @param options.client {AccountClientView}   the row in question
  * @param options.clients {AccountClientView[]}   the whole listing (the
  *   last-client rule is a property of the account, not of the row)
+ * @param [options.signerKind] {string}   who would sign the removal entry:
+ *   `'client'` (the default, an enrolled client's update keys) or `'ladder'`
+ *   (a standing credential's rung), which lifts the self and last-client
+ *   refusals -- see the module doc
  * @returns {{ allowed: boolean, refusal?: DisconnectRefusal }}
  */
-export declare function disconnectEligibility({ client, clients }: {
+export declare function disconnectEligibility({ client, clients, signerKind }: {
     client: AccountClientView;
     clients: AccountClientView[];
+    signerKind?: 'client' | 'ladder';
 }): {
     allowed: boolean;
     refusal?: DisconnectRefusal;

package/dist/clients/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAC3B,MAAM,GAAG,aAAa,GAAG,yBAAyB,CAAA;AAEpD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAC7B,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAWpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iBAAiB,CAWpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EACX,EAAE;IACD,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAC9B,GAAG,UAAU,GAAG,SAAS,CAIzB"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAC3B,MAAM,GAAG,aAAa,GAAG,yBAAyB,CAAA;AAEpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACP,UAAqB,EACtB,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CACjC,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAapD;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iBAAiB,CAWpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EACX,EAAE;IACD,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAC9B,GAAG,UAAU,GAAG,SAAS,CAIzB"}

package/dist/clients/policy.js

@@ -6,14 +6,20 @@
  * @param options.client {AccountClientView}   the row in question
  * @param options.clients {AccountClientView[]}   the whole listing (the
  *   last-client rule is a property of the account, not of the row)
+ * @param [options.signerKind] {string}   who would sign the removal entry:
+ *   `'client'` (the default, an enrolled client's update keys) or `'ladder'`
+ *   (a standing credential's rung), which lifts the self and last-client
+ *   refusals -- see the module doc
  * @returns {{ allowed: boolean, refusal?: DisconnectRefusal }}
  */
-export function disconnectEligibility({ client, clients }) {
-    if (client.isCurrent) {
-        return { allowed: false, refusal: 'self' };
-    }
-    if (clients.length <= 1) {
-        return { allowed: false, refusal: 'last-client' };
+export function disconnectEligibility({ client, clients, signerKind = 'client' }) {
+    if (signerKind === 'client') {
+        if (client.isCurrent) {
+            return { allowed: false, refusal: 'self' };
+        }
+        if (clients.length <= 1) {
+            return { allowed: false, refusal: 'last-client' };
+        }
     }
     if (!client.updateKeyMultibase) {
         return { allowed: false, refusal: 'unattributed-update-key' };

package/dist/clients/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAyCA;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EAIX;IACC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACP,UAAU,GAAG,QAAQ,EAKtB;IACC,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;QACnD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EAIX;IACC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}

package/dist/clients/revocation.d.ts

@@ -20,11 +20,11 @@
  *    from the document the edit itself just resolved to (no re-fetch of the
  *    log this call just extended). On a log-governed roster store the
  *    orchestrator itself guarantees post-edit anchoring: the controller view
- *    built from the edit's own post-edit log is set as the store's freshness
- *    floor (`setControllerFloor`) before anything roster-side runs, so the
- *    rotation and the seal backstop anchor at or past the edit even where the
- *    app's injected controller resolution still serves a cached pre-edit
- *    view. The roster delivers, never sources, so the
+ *    built from the edit's own post-edit log is set as the store's minimum
+ *    controller version (`setMinimumControllerVersion`) before anything
+ *    roster-side runs, so the rotation and the seal backstop anchor at or
+ *    past the edit even where the app's injected controller resolution still
+ *    serves a cached pre-edit view. The roster delivers, never sources, so the
  *    stage names no client at all: it converges the roster onto that document
  *    (the login sweep's own path), retiring every current-epoch recipient the
  *    document no longer keys in one rotation. Nothing here has to pair a
@@ -72,7 +72,7 @@
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
-import { type ClientWebvhUpdateKeys, type PublishedKeyDocument, type RevokedClientKeys, type WebvhIdStore } from '../webvh/index.js';
+import { type AccountLogSigner, type PublishedKeyDocument, type RevokedClientKeys, type WebvhIdStore } from '../webvh/index.js';
 import { type CascadeCollections, type RosterSealReport, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
 export type { CascadeCollections, RosterSealReport };
 /**
@@ -125,11 +125,18 @@ export interface ClientRevocationResult {
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
- * @param options.updateKeys {ClientWebvhUpdateKeys}   THIS client's did:webvh
- *   update-key seeds, which sign the document edit
+ * @param options.signer {AccountLogSigner}   who signs the document edit:
+ *   THIS client's did:webvh update-key seeds, or the acting credential's
+ *   ladder seed
  * @param options.revokedClient {RevokedClientKeys}   the revoked client's
  *   public halves (its two verification-method multibases and its active
  *   update key)
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through, passed straight to the document edit: the
+ *   post-removal `did:web` projection is PUT through it immediately before
+ *   that entry publishes, so a ladder-signed disconnect does not leave
+ *   `did.json` naming the revoked client. Best-effort, and omitted the
+ *   behavior is unchanged (see `revokeWebvhClient`)
  * @param [options.knownLatentHashes] {string[]}   the standing recovery codes'
  *   update-key hashes, so the document edit can tell the revoked client's
  *   staged commitment apart from a latent recovery commitment (the one
@@ -164,9 +171,10 @@ export interface ClientRevocationResult {
  *   keeps operating without a re-login
  * @returns {Promise<ClientRevocationResult>}
  */
-export declare function revokeAccountClient({ idStore, updateKeys, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }: {
+export declare function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
+    projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     revokedClient: RevokedClientKeys;
     knownLatentHashes?: string[];
     expectedDid?: string;

package/dist/clients/revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACrD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,UAAU,CAAC,EAAE,0BAA0B,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACzC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA8ElC"}
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACrD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,UAAU,CAAC,EAAE,0BAA0B,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACzC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA+ElC"}

package/dist/clients/revocation.js

@@ -17,11 +17,18 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
- * @param options.updateKeys {ClientWebvhUpdateKeys}   THIS client's did:webvh
- *   update-key seeds, which sign the document edit
+ * @param options.signer {AccountLogSigner}   who signs the document edit:
+ *   THIS client's did:webvh update-key seeds, or the acting credential's
+ *   ladder seed
  * @param options.revokedClient {RevokedClientKeys}   the revoked client's
  *   public halves (its two verification-method multibases and its active
  *   update key)
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through, passed straight to the document edit: the
+ *   post-removal `did:web` projection is PUT through it immediately before
+ *   that entry publishes, so a ladder-signed disconnect does not leave
+ *   `did.json` naming the revoked client. Best-effort, and omitted the
+ *   behavior is unchanged (see `revokeWebvhClient`)
  * @param [options.knownLatentHashes] {string[]}   the standing recovery codes'
  *   update-key hashes, so the document edit can tell the revoked client's
  *   staged commitment apart from a latent recovery commitment (the one
@@ -56,7 +63,7 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
  *   keeps operating without a re-login
  * @returns {Promise<ClientRevocationResult>}
  */
-export async function revokeAccountClient({ idStore, updateKeys, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }) {
+export async function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }) {
     if (ownSigningKeyMultibase &&
         ownSigningKeyMultibase === revokedClient.signingKeyMultibase) {
         throw new Error('This wallet cannot disconnect itself; use another enrolled wallet ' +
@@ -71,13 +78,14 @@ export async function revokeAccountClient({ idStore, updateKeys, revokedClient,
     // recipients from.
     const { did, doc, log } = await revokeWebvhClient({
         idStore,
-        updateKeys,
+        signer,
+        ...(projectionStore ? { projectionStore } : {}),
         revokedClient,
         ...(knownLatentHashes ? { knownLatentHashes } : {}),
         ...(expectedDid !== undefined ? { expectedDid } : {})
     });
     // 2-3. The shared roster-and-cascade tail: the roster rotation onto the
-    // post-edit document (with its post-edit controller floor and its seal
+    // post-edit document (with its post-edit minimum controller version and its seal
     // backstop), then the collection fan-out onto the fresh key.
     const tail = await rotateRosterToDocumentAndCascade({
         rosterStore,