@interop/wallet-core 0.61.0 → 0.65.0

package/dist/enrollment/enrollment.js

@@ -1,12 +1,14 @@
 import { decodeMultikey, MultikeyCodec } from '@interop/data-integrity-core/multihash';
 import { base64urlnopad } from '@scure/base';
 import { agentsFromSeed } from '../identity/agents.js';
-import { enrollWebvhClient, keyAgreementTwinMultibase, mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
+import { keyAgreementTwinMultibase, mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
+import { enrollWebvhClient } from '../webvh/enrollClient.js';
 import { clientSigningKeyMultibase, isWebvhDid, webvhZcapClient } from '../webvh/zcap.js';
 import { AccountLogMissingError, verifyAccountLog } from '../webvh/verifyLog.js';
 import { addUserKeyRosterRecipient } from '../keys/userKeyRoster.js';
 import { readUserKeyRoster, rosterRecipientKid, userKeyRosterLogSigner } from '../keys/userKeyRoster.js';
 import { userKeyRosterDescriptorStore } from '../keys/rosterStore.js';
+import { isSealableDescriptorStore } from '../keys/rosterLogStore.js';
 import { memoryResourceLogPinStore } from '@interop/vh-resource-log';
 import { webvhResourceLogController } from '../resourceLog/index.js';
 import { CONNECT_CODE_PREFIX } from './connectCode.js';
@@ -231,21 +233,47 @@ export async function mintEnrollmentRequest() {
     };
 }
 /**
- * ENROLLING CLIENT: the whole approval, in the push order -- the user key
- * wrapped into the roster first (escrow: every epoch, so the new client reads
- * pre-enrollment history), then the two log entries. Quorum-of-one: this
- * client's own update key signs both entries. Idempotent at every stage, so
+ * THE APPROVING SIDE: the whole approval -- the user key wrapped into the
+ * roster (escrow: every epoch, so the new client reads pre-enrollment
+ * history) and the two log entries. Idempotent at every stage, so
  * re-approving the same code after any tear converges. A request whose
  * key-agreement key is not its signing key's canonical twin is refused before
  * anything is written ({@link assertCanonicalEnrollmentKeys}).
  *
+ * The escrow is placed by signer kind (`decisions/0018`). A CLIENT signer
+ * keeps the push order, the escrow first: an enrolled client's roster append
+ * needs no license, so it may precede the entries, and no enrolled client is
+ * ever authorized but blind. Quorum-of-one there: any single enrolled
+ * client's own update key signs both entries.
+ *
+ * A LADDER signer runs commit, add, then escrow, because a ladder-signed
+ * append is licensed only at an inventory-changing version its own ladder
+ * signed, which the add entry is what mints. The one-request window between
+ * the add entry and the append is the ladder branch's stated cost: a client
+ * the add entry published holds `assertionMethod` and its own update key
+ * while holding no wrap. It is bounded three ways -- one request wide on the
+ * happy path, mended by a re-run with the same connect code and by the
+ * escrow-direction convergence of any later ladder-branch ceremony (the
+ * document carries the client's key verbatim), and visible as a row in the
+ * connected-wallets listing, where a disconnect removes it.
+ *
+ * On that branch the escrow must ANCHOR at the add entry's version, and the
+ * ceremony does not leave that to the roster store's own controller wiring:
+ * a store resolving its controller view through a document cached before
+ * the entries (an app's session-verified log) would anchor the append at the
+ * pre-add head, and the license would refuse it after the ceremony's pivot.
+ * So, on a sealable roster store, the view built from the add entry's own
+ * post-add log is set as the store's minimum controller version before the
+ * escrow runs -- the same guarantee `revokeAccountClient` gives its rotation
+ * from its post-edit log. A fresher resolved view still wins.
+ *
  * @param options {object}
  * @param options.request {EnrollmentRequest}   the parsed connect code
- * @param options.clientWebvhKeys {ClientWebvhUpdateKeys}   the approving
- *   client's own did:webvh update-key seeds
+ * @param options.signer {AccountLogSigner}   who signs the two entries: the
+ *   approving client's own did:webvh update-key seeds, or the acting
+ *   credential's ladder seed
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   the approving
- *   client's own (identity) key-agreement key, unwrapping each epoch for
- *   re-wrapping
+ *   party's own key-agreement key, unwrapping each epoch for re-wrapping
  * @param options.userKeyRosterStore {EncryptionDescriptorStore}   the account's
  *   `key-map/user-key.jsonl` descriptor store
  * @param options.idStore {WebvhIdStore}   the account's `id` collection
@@ -254,14 +282,12 @@ export async function mintEnrollmentRequest() {
  *   multibase (the key a label or a listing row is filed under), so the caller
  *   needs no second parse of the connect code
  */
-export async function approveEnrollment({ request, clientWebvhKeys, clientKeyAgreementKey, userKeyRosterStore, idStore }) {
+export async function approveEnrollment({ request, signer, clientKeyAgreementKey, userKeyRosterStore, idStore }) {
     // Re-checked here rather than trusted from the parse: this is the one seam
     // every approval path runs through, and it is what publishes the key under
     // the controller marker.
     assertCanonicalEnrollmentKeys({ request });
-    // Decryption material before authorization: the wrap lands first, so no
-    // enrolled client is ever authorized but blind.
-    await addUserKeyRosterRecipient({
+    const escrow = async () => addUserKeyRosterRecipient({
         store: userKeyRosterStore,
         recipient: {
             id: enrollmentRecipientKid({ request }),
@@ -269,11 +295,22 @@ export async function approveEnrollment({ request, clientWebvhKeys, clientKeyAgr
         },
         ownerKeyAgreementKey: clientKeyAgreementKey
     });
-    const { did } = await enrollWebvhClient({
+    if (signer.kind === 'client') {
+        await escrow();
+    }
+    const { did, log } = await enrollWebvhClient({
         idStore,
-        updateKeys: clientWebvhKeys,
+        signer,
         newClient: request
     });
+    if (signer.kind === 'ladder') {
+        if (isSealableDescriptorStore(userKeyRosterStore)) {
+            userKeyRosterStore.setMinimumControllerVersion({
+                controller: webvhResourceLogController({ did, log })
+            });
+        }
+        await escrow();
+    }
     return {
         did,
         clientDid: enrollmentClientDid({ request }),

package/dist/enrollment/enrollment.js.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,cAAc,EACd,aAAa,EACd,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAM7B,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AACrE,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AAGpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAS9B;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YACE,OAAO,GAAG,6DAA6D;QACrE,oDAAoD;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB,CAAC,EAC7B,KAAK,EACL,MAAM,EACN,aAAa,EACb,IAAI,EAML;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,CAAC;QACH,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,EAAE;YAC/D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EAGR;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACvE,OAAO,GAAG,mBAAmB,GAAG,cAAc,CAAC,MAAM,CACnD,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,EAAE,CAAA;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,IAAI,EAGL;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACjE,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EACJ,CAAC,EACD,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAAE,SAAS,EAC7B,wBAAwB,EACzB,GAAG,MAAiC,CAAA;IACrC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,qBAAqB,CAAC;YACzC,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,aAAa;SACpB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,aAAa,CAAC,UAAU;YACvC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;QACF,kBAAkB,EAAE,qBAAqB,CAAC;YACxC,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,YAAY;SACnB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;KACH,CAAA;IACD,6BAA6B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1C,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,OAAO,EAGR;IACC,MAAM,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAA;IACjE,IACE,wBAAwB;QACxB,yBAAyB,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,qEAAqE;YACrE,yDAAyD,CAC5D,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EAGR;IACC,OAAO,WAAW,OAAO,CAAC,mBAAmB,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EAGR;IACC,OAAO,kBAAkB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAMzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,yBAAyB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IACD,OAAO;QACL,UAAU;QACV,eAAe;QACf,IAAI,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,SAAS,EAAE,QAAQ,CAAC,EAAE;KACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EAOR;IACC,2EAA2E;IAC3E,2EAA2E;IAC3E,yBAAyB;IACzB,6BAA6B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE1C,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,yBAAyB,CAAC;QAC9B,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE;YACT,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC;YACvC,kBAAkB,EAAE,OAAO,CAAC,wBAAwB;SACrD;QACD,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACtC,OAAO;QACP,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,OAAO;KACnB,CAAC,CAAA;IACF,OAAO;QACL,GAAG;QACH,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC3C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EAMnB;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,4BAA4B,CAC/B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YAChC,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,UAAU;KACjC,CAAC,CAAA;IACF,MAAM,QAAQ,GACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB,CACzD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACxD,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,eAAe;KACvC,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAA;AACrE,CAAC"}
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,cAAc,EACd,aAAa,EACd,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAO5D,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AAGpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAS9B;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YACE,OAAO,GAAG,6DAA6D;QACrE,oDAAoD;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB,CAAC,EAC7B,KAAK,EACL,MAAM,EACN,aAAa,EACb,IAAI,EAML;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,CAAC;QACH,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,EAAE;YAC/D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EAGR;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACvE,OAAO,GAAG,mBAAmB,GAAG,cAAc,CAAC,MAAM,CACnD,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,EAAE,CAAA;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,IAAI,EAGL;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACjE,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EACJ,CAAC,EACD,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAAE,SAAS,EAC7B,wBAAwB,EACzB,GAAG,MAAiC,CAAA;IACrC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,qBAAqB,CAAC;YACzC,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,aAAa;SACpB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,aAAa,CAAC,UAAU;YACvC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;QACF,kBAAkB,EAAE,qBAAqB,CAAC;YACxC,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,YAAY;SACnB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;KACH,CAAA;IACD,6BAA6B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1C,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,OAAO,EAGR;IACC,MAAM,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAA;IACjE,IACE,wBAAwB;QACxB,yBAAyB,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,qEAAqE;YACrE,yDAAyD,CAC5D,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EAGR;IACC,OAAO,WAAW,OAAO,CAAC,mBAAmB,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EAGR;IACC,OAAO,kBAAkB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAMzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,yBAAyB,EAAE,CAAA;IACzD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IACD,OAAO;QACL,UAAU;QACV,eAAe;QACf,IAAI,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,SAAS,EAAE,QAAQ,CAAC,EAAE;KACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EAOR;IACC,2EAA2E;IAC3E,2EAA2E;IAC3E,yBAAyB;IACzB,6BAA6B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE1C,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CACxB,yBAAyB,CAAC;QACxB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE;YACT,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC;YACvC,kBAAkB,EAAE,OAAO,CAAC,wBAAwB;SACrD;QACD,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IAEJ,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAC3C,OAAO;QACP,MAAM;QACN,SAAS,EAAE,OAAO;KACnB,CAAC,CAAA;IAEF,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,yBAAyB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAClD,kBAAkB,CAAC,2BAA2B,CAAC;gBAC7C,UAAU,EAAE,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;aACrD,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;IACD,OAAO;QACL,GAAG;QACH,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC3C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EAMnB;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,4BAA4B,CAC/B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YAChC,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,UAAU;KACjC,CAAC,CAAA;IACF,MAAM,QAAQ,GACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB,CACzD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACxD,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,eAAe;KACvC,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAA;AACrE,CAAC"}

package/dist/genesis/accountGenesis.d.ts

@@ -1,9 +1,10 @@
 import type { CollectionEncryption, WasClient } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
-import { type ClientWebvhUpdateKeys, type DidWebKeyMapV2, type ICapabilityAgent, type WebvhIdStore } from '../webvh/index.js';
+import { type ClientWebvhUpdateKeys, type ICapabilityAgent, type KmsAuthenticationBinding, type PublishedWebvhLog, type WebvhIdStore } from '../webvh/index.js';
 import { type UserKey, type WalletSpaceEpochsResult } from '../keys/index.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
+import { type StageNotifier } from '../log.js';
 /**
  * The complete key set a brand-new account mints locally before anything
  * touches the network: the data Space id, this founding client's identity
@@ -102,7 +103,7 @@ export declare class AccountGenesisSpaceError extends Error {
  * The stages whose failures the ceremony collects instead of throwing (see
  * the module doc for the split).
  */
-export type AccountGenesisStage = 'didWebKeys' | 'roster' | 'epochs' | 'promotion';
+export type AccountGenesisStage = 'kmsAuthentication' | 'roster' | 'epochs' | 'promotion';
 /**
  * What a completed ceremony reports: the account DID, each collected stage's
  * outcome where it ran (the roster descriptor, the per-collection epoch
@@ -113,6 +114,23 @@ export type AccountGenesisStage = 'didWebKeys' | 'roster' | 'epochs' | 'promotio
  */
 export interface AccountGenesisResult {
     did: string;
+    /**
+     * The account log's verified head as the did:webvh stage left it -- the
+     * served head it adopted, or the one it minted paired with its create PUT's
+     * ETag -- for the stage after the ceremony to build on rather than re-read.
+     * Set by the credential-anchored ceremony alone; the plain genesis's
+     * did:webvh stage hands no head back.
+     */
+    published?: PublishedWebvhLog;
+    /**
+     * Whether the did:webvh stage MINTED that head (a fresh signup) rather than
+     * adopting a served one (a heal re-run). A later stage may reuse a minted
+     * head freely -- the account did not exist a moment ago, so no other writer
+     * holds it -- but an adopted head is only a snapshot: its document's
+     * completion tests are unprotected by any ETag and another client may have
+     * moved past them by the time a later stage reads them.
+     */
+    logMinted?: boolean;
     rosterDescriptor?: CollectionEncryption;
     epochs?: WalletSpaceEpochsResult;
     /**
@@ -170,13 +188,19 @@ export interface AccountGenesisResult {
  *   EncryptionDescriptorStore` -- builds the user-key roster's descriptor
  *   store once the account DID is known (the log-governed store's controller
  *   view and chain-head pin are the app's wiring)
- * @param [options.provideDidWebKeys] {Function}   `() =>
- *   Promise<DidWebKeyMapV2 | undefined>` -- the KMS key-map acquisition (a
- *   wallet that keeps a KMS runs its did:web provisioning here, after the
- *   Space exists); absent or resolving `undefined`, the genesis is
- *   client-keys-only and no `keys.json` is ever written. A throw is
- *   collected, not fatal: the genesis proceeds client-keys-only and a later
- *   run heals the document with the convenience key
+ * @param [options.provideKmsAuthentication] {Function}   `({ spaceReady }) =>
+ *   Promise<KmsAuthenticationBinding | undefined>` -- the KMS authentication
+ *   binding's acquisition; absent or resolving `undefined`, the genesis is
+ *   client-keys-only and no `keys.json` is ever written. It is started before
+ *   the Space is awaited and joined before the genesis entry, so its
+ *   `spaceReady` argument is what its own `keys.json` write waits on. A throw
+ *   is collected, not fatal: the genesis proceeds client-keys-only, and the
+ *   document it publishes never gains the key. The thunk's own obligation,
+ *   since this ceremony takes `authentication.vmId` VERBATIM into the
+ *   world-readable genesis entry: a served `keys.json` may be adopted only
+ *   after the multibase in its `vmId` is checked against the session's own
+ *   keystore listing; on a mismatch, or when the keystore cannot be listed,
+ *   the thunk mints instead of adopting
  * @param [options.expectedDid] {string}   the account's did:webvh from the
  *   caller's stored account pointer, when it already names one; the genesis
  *   read then refuses a published log resolving to any other account
@@ -192,9 +216,13 @@ export interface AccountGenesisResult {
  *   pointer write lives outside this call (freewallet's keyring re-bind) --
  *   passes `false` and runs {@link ensurePromotedSpaceController} itself
  *   after that write
+ * @param [options.onStage] {StageNotifier}   observational: called at the
+ *   KMS-authentication join, with {@link KMS_AUTHENTICATION_STAGE} -- the one
+ *   boundary this ceremony names, and the same token the credential-anchored
+ *   genesis emits at the same point
  * @returns {Promise<AccountGenesisResult>}
  */
-export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideDidWebKeys, expectedDid, accountLogPinStore, onDidPublished, promoteController }: {
+export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, accountLogPinStore, onDidPublished, promoteController, onStage }: {
     was: WasClient;
     wasAsClient?: WasClient;
     wasServerUrl: string;
@@ -207,12 +235,15 @@ export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, s
     rosterStoreFor: (options: {
         did: string;
     }) => EncryptionDescriptorStore;
-    provideDidWebKeys?: () => Promise<DidWebKeyMapV2 | undefined>;
+    provideKmsAuthentication?: (options: {
+        spaceReady: Promise<unknown>;
+    }) => Promise<KmsAuthenticationBinding | undefined>;
     expectedDid?: string;
     accountLogPinStore?: ResourceLogPinStore;
     onDidPublished?: (published: {
         did: string;
     }) => Promise<void>;
     promoteController?: boolean;
+    onStage?: StageNotifier;
 }): Promise<AccountGenesisResult>;
 //# sourceMappingURL=accountGenesis.d.ts.map

package/dist/genesis/accountGenesis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accountGenesis.d.ts","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAOnE;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1B,UAAU,EAAE,qBAAqB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAQhE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAqBpC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE;CAQzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC7B,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAA;AAElD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,MAAM,CAAC,EAAE,uBAAuB,CAAA;IAChC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,SAAS,CAAC,EAAE,wBAAwB,CAAA;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,qBAAqB,CAAA;IACjC,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiGhC"}
+{"version":3,"file":"accountGenesis.d.ts","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAQ7D;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1B,UAAU,EAAE,qBAAqB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAQhE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8BpC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE;CAQzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC7B,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,MAAM,CAAC,EAAE,uBAAuB,CAAA;IAChC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,SAAS,CAAC,EAAE,wBAAwB,CAAA;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACxB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,qBAAqB,CAAA;IACjC,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAuIhC"}

package/dist/genesis/accountGenesis.js

@@ -10,7 +10,7 @@
  * collection, and Space-controller promotion.
  *
  * Two callers, one ceremony. A wallet that keeps a KMS (freewallet) supplies
- * `provideDidWebKeys` and gets the KMS-backed did:webvh genesis; a wallet
+ * `provideKmsAuthentication` and gets the KMS-backed did:webvh genesis; a wallet
  * with no KMS anywhere in the path (dcw) supplies nothing and gets the
  * client-keys-only genesis. The keyring bind is deliberately NOT a stage:
  * where an app binds an unlock method (and whether it binds one at all)
@@ -37,6 +37,8 @@ import { base64urlnopad } from '@scure/base';
 import { provisionWalletSpace, WALLET_SPACE_NAME } from '../space/index.js';
 import { clientSigningKeyMultibase, ensureDidWebvh, mintClientWebvhUpdateKeys } from '../webvh/index.js';
 import { ensureUserKeyRoster, ensureWalletSpaceEpochs, mintUserKey } from '../keys/index.js';
+import { stageNotifier } from '../log.js';
+import { KMS_AUTHENTICATION_STAGE } from '../stages.js';
 /**
  * The byte length of a freshly minted data-Space id.
  */
@@ -106,7 +108,13 @@ export async function ensurePromotedSpaceController({ was, wasAsClient, spaceId,
         if (description.controller === did) {
             return 'confirmed';
         }
-        await space.configure({ name: WALLET_SPACE_NAME, controller: did });
+        // The read a statement above is the current Description, so it rides as
+        // `current` and was-client skips its own pre-merge describe.
+        await space.configure({
+            current: description,
+            name: WALLET_SPACE_NAME,
+            controller: did
+        });
         return 'promoted';
     }
     if (!wasAsClient) {
@@ -114,6 +122,9 @@ export async function ensurePromotedSpaceController({ was, wasAsClient, spaceId,
             'identity and no did:key-signed client was supplied to heal a torn ' +
             'controller promotion.');
     }
+    // No `current` here: the null above came from a read under `was`, a
+    // different signing identity than this heal PUT rides, so it is no answer
+    // for what `wasAsClient` can see. was-client reads for itself.
     await wasAsClient
         .space(spaceId)
         .configure({ name: WALLET_SPACE_NAME, controller: did });
@@ -172,13 +183,19 @@ export class AccountGenesisSpaceError extends Error {
  *   EncryptionDescriptorStore` -- builds the user-key roster's descriptor
  *   store once the account DID is known (the log-governed store's controller
  *   view and chain-head pin are the app's wiring)
- * @param [options.provideDidWebKeys] {Function}   `() =>
- *   Promise<DidWebKeyMapV2 | undefined>` -- the KMS key-map acquisition (a
- *   wallet that keeps a KMS runs its did:web provisioning here, after the
- *   Space exists); absent or resolving `undefined`, the genesis is
- *   client-keys-only and no `keys.json` is ever written. A throw is
- *   collected, not fatal: the genesis proceeds client-keys-only and a later
- *   run heals the document with the convenience key
+ * @param [options.provideKmsAuthentication] {Function}   `({ spaceReady }) =>
+ *   Promise<KmsAuthenticationBinding | undefined>` -- the KMS authentication
+ *   binding's acquisition; absent or resolving `undefined`, the genesis is
+ *   client-keys-only and no `keys.json` is ever written. It is started before
+ *   the Space is awaited and joined before the genesis entry, so its
+ *   `spaceReady` argument is what its own `keys.json` write waits on. A throw
+ *   is collected, not fatal: the genesis proceeds client-keys-only, and the
+ *   document it publishes never gains the key. The thunk's own obligation,
+ *   since this ceremony takes `authentication.vmId` VERBATIM into the
+ *   world-readable genesis entry: a served `keys.json` may be adopted only
+ *   after the multibase in its `vmId` is checked against the session's own
+ *   keystore listing; on a mismatch, or when the keystore cannot be listed,
+ *   the thunk mints instead of adopting
  * @param [options.expectedDid] {string}   the account's did:webvh from the
  *   caller's stored account pointer, when it already names one; the genesis
  *   read then refuses a published log resolving to any other account
@@ -194,34 +211,72 @@ export class AccountGenesisSpaceError extends Error {
  *   pointer write lives outside this call (freewallet's keyring re-bind) --
  *   passes `false` and runs {@link ensurePromotedSpaceController} itself
  *   after that write
+ * @param [options.onStage] {StageNotifier}   observational: called at the
+ *   KMS-authentication join, with {@link KMS_AUTHENTICATION_STAGE} -- the one
+ *   boundary this ceremony names, and the same token the credential-anchored
+ *   genesis emits at the same point
  * @returns {Promise<AccountGenesisResult>}
  */
-export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideDidWebKeys, expectedDid, accountLogPinStore, onDidPublished, promoteController = true }) {
+export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, accountLogPinStore, onDidPublished, promoteController = true, onStage }) {
     const failed = [];
+    const stage = stageNotifier(onStage);
     // 1. The Space and its collection roster, create-if-absent under this
     // founding client's did:key controller (adopted untouched when it exists).
-    // Raised as the typed refusal so a caller that treats the later stages as
-    // non-fatal can still propagate a Space that never came up.
+    // Started here and awaited below, so stage 2 runs alongside it. Raised as
+    // the typed refusal so a caller that treats the later stages as non-fatal
+    // can still propagate a Space that never came up.
+    const spaceReady = provisionWalletSpace({
+        was,
+        spaceId,
+        controllerDid: keyAgent.id
+    });
+    // 2. The optional KMS authentication binding, started before the Space is
+    // awaited: the keystore and the key mint touch no Space, and the thunk
+    // orders its own `keys.json` write behind `spaceReady`. A throw degrades to
+    // the client-keys-only genesis rather than aborting: every later ceremony
+    // anchors in client keys, and the document simply publishes no
+    // `authentication` relation.
+    // Started inside the same guard the join uses, so a thunk that throws
+    // synchronously is collected like one that rejects.
+    let kmsRun;
+    // The flag rather than the value decides whether the stage is reported, so
+    // a thunk rejecting with `undefined` is still a collected failure.
+    let kmsFailed = false;
+    let kmsFailure;
+    try {
+        kmsRun = provideKmsAuthentication?.({ spaceReady });
+    }
+    catch (err) {
+        kmsFailed = true;
+        kmsFailure = err;
+    }
+    // A Space that never came up returns below while the thunk is still in
+    // flight, so its rejection is claimed here rather than surfacing as an
+    // unhandled one.
+    kmsRun?.catch(() => { });
     try {
-        await provisionWalletSpace({ was, spaceId, controllerDid: keyAgent.id });
+        await spaceReady;
     }
     catch (err) {
         throw new AccountGenesisSpaceError({ spaceId, cause: err });
     }
-    // 2. The optional KMS key map, acquired only once the Space exists (a
-    // KMS-keeping wallet writes keys.json and did.json into it here). A throw
-    // degrades to the client-keys-only genesis rather than aborting: every
-    // later ceremony anchors in client keys, and the first KMS-capable re-run
-    // heals the document with the convenience key.
-    let didWebKeys;
-    if (provideDidWebKeys) {
+    // The join: the genesis entry carries the KMS binding, so it waits on the
+    // whole stage even though the Space no longer does.
+    let kmsAuthentication;
+    if (kmsRun) {
         try {
-            didWebKeys = await provideDidWebKeys();
+            kmsAuthentication = await kmsRun;
         }
         catch (err) {
-            failed.push({ stage: 'didWebKeys', error: err });
+            kmsFailed = true;
+            kmsFailure = err;
         }
     }
+    if (kmsFailed) {
+        failed.push({ stage: 'kmsAuthentication', error: kmsFailure });
+    }
+    stage(KMS_AUTHENTICATION_STAGE);
+    const didWebKeys = kmsAuthentication?.keys;
     // 3. The did:webvh genesis -- probe, adopt, or create-and-publish. Fatal on
     // failure: the account DID is what every remaining stage anchors in.
     const { publicKeyMultibase: keyAgreementKeyMultibase } = clientKeyAgreementKey;
@@ -233,6 +288,9 @@ export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spa
         wasServerUrl,
         spaceId,
         ...(didWebKeys ? { didWebKeys } : {}),
+        ...(kmsAuthentication?.etag !== undefined && {
+            keysJsonEtag: kmsAuthentication.etag
+        }),
         clientKeys: {
             signingKeyMultibase: clientSigningKeyMultibase({ keyAgent }),
             keyAgreementKeyMultibase

package/dist/genesis/accountGenesis.js.map

@@ -1 +1 @@
-{"version":3,"file":"accountGenesis.js","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAK5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,yBAAyB,EAK1B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AAGzB;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AAkBzB;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,cAAc,CAAC,MAAM,CAC1B,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO;QACL,OAAO,EAAE,WAAW,EAAE;QACtB,UAAU;QACV,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,UAAU,EAAE,MAAM,yBAAyB,EAAE;KAC9C,CAAA;AACH,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EAMJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACnC,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;QACnE,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,oEAAoE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IACD,MAAM,WAAW;SACd,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAA4C;QACtD,KAAK,CACH,kCAAkC,OAAO,CAAC,OAAO,YAAY;YAC3D,+CAA+C,EACjD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAAG,IAAI,EAiBzB;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IAEjD,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,4DAA4D;IAC5D,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,UAAsC,CAAA;IAC1C,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,qBAAmE,CAAA;IACrE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QACnC,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,UAAU,EAAE;YACV,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC5D,wBAAwB;SACzB;QACD,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,MAA2C,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,SAA+C,CAAA;IACnD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"accountGenesis.js","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAK5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,yBAAyB,EAM1B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,aAAa,EAAsB,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AAkBzB;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,cAAc,CAAC,MAAM,CAC1B,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO;QACL,OAAO,EAAE,WAAW,EAAE;QACtB,UAAU;QACV,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,UAAU,EAAE,MAAM,yBAAyB,EAAE;KAC9C,CAAA;AACH,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EAMJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACnC,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;QACF,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,oEAAoE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,WAAW;SACd,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAA4C;QACtD,KAAK,CACH,kCAAkC,OAAO,CAAC,OAAO,YAAY;YAC3D,+CAA+C,EACjD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAoDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAAG,IAAI,EACxB,OAAO,EAoBR;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,aAAa,CAAkC,OAAO,CAAC,CAAA;IAErE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,GAAG;QACH,OAAO;QACP,aAAa,EAAE,QAAQ,CAAC,EAAE;KAC3B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,6BAA6B;IAC7B,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,MAAiE,CAAA;IACrE,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,UAAmB,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,wBAAwB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,GAAG,IAAI,CAAA;QAChB,UAAU,GAAG,GAAG,CAAA;IAClB,CAAC;IACD,uEAAuE;IACvE,uEAAuE;IACvE,iBAAiB;IACjB,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAEvB,IAAI,CAAC;QACH,MAAM,UAAU,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,iBAAuD,CAAA;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,iBAAiB,GAAG,MAAM,MAAM,CAAA;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,IAAI,CAAA;YAChB,UAAU,GAAG,GAAG,CAAA;QAClB,CAAC;IACH,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,iBAAiB,EAAE,IAAI,CAAA;IAE1C,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,qBAAmE,CAAA;IACrE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QACnC,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,iBAAiB,EAAE,IAAI,KAAK,SAAS,IAAI;YAC3C,YAAY,EAAE,iBAAiB,CAAC,IAAI;SACrC,CAAC;QACF,UAAU,EAAE;YACV,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC5D,wBAAwB;SACzB;QACD,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,IAAI,MAA2C,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,SAA+C,CAAA;IACnD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/genesis/index.d.ts

@@ -10,7 +10,8 @@
  *   complete key set (Space id, client identity seed, user key, did:webvh
  *   update keys), before anything touches the network.
  * - `ensureAccountGenesis` -- the ceremony itself: Space provisioning, the
- *   optional KMS key-map acquisition, did:webvh genesis, user-key roster
+ *   optional KMS authentication binding (acquired alongside it), did:webvh
+ *   genesis, user-key roster
  *   genesis, epoch[0] on every encrypted roster collection, and
  *   Space-controller promotion; idempotent end to end, so a torn run heals
  *   by re-running.
@@ -23,5 +24,6 @@
  * ceremonies.
  */
 export { AccountGenesisSpaceError, ensureAccountGenesis, ensurePromotedSpaceController, mintAccountKeySet, mintSpaceId } from './accountGenesis.js';
+export { KMS_AUTHENTICATION_STAGE } from '../stages.js';
 export type { AccountGenesisResult, AccountGenesisStage, AccountKeySet, SpaceControllerPromotion } from './accountGenesis.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/genesis/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/genesis/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,iBAAiB,EACjB,WAAW,EACZ,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACzB,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/genesis/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,iBAAiB,EACjB,WAAW,EACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AACvD,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACzB,MAAM,qBAAqB,CAAA"}

package/dist/genesis/index.js

@@ -10,7 +10,8 @@
  *   complete key set (Space id, client identity seed, user key, did:webvh
  *   update keys), before anything touches the network.
  * - `ensureAccountGenesis` -- the ceremony itself: Space provisioning, the
- *   optional KMS key-map acquisition, did:webvh genesis, user-key roster
+ *   optional KMS authentication binding (acquired alongside it), did:webvh
+ *   genesis, user-key roster
  *   genesis, epoch[0] on every encrypted roster collection, and
  *   Space-controller promotion; idempotent end to end, so a torn run heals
  *   by re-running.
@@ -23,4 +24,5 @@
  * ceremonies.
  */
 export { AccountGenesisSpaceError, ensureAccountGenesis, ensurePromotedSpaceController, mintAccountKeySet, mintSpaceId } from './accountGenesis.js';
+export { KMS_AUTHENTICATION_STAGE } from '../stages.js';
 //# sourceMappingURL=index.js.map

package/dist/genesis/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/genesis/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,iBAAiB,EACjB,WAAW,EACZ,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/genesis/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,6BAA6B,EAC7B,iBAAiB,EACjB,WAAW,EACZ,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA"}

package/dist/identity/agents.d.ts

@@ -19,7 +19,7 @@
  */
 import { CapabilityAgent } from '@interop/webkms-client';
 import { ZcapClient } from '@interop/ezcap';
-import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+import type { IKeyAgreementKey, IKeyResolver, ISigner } from '@interop/data-integrity-core';
 /**
  * The load-bearing `CapabilityAgent` derivation names (see the module doc:
  * the typo in the key name can never be fixed without stranding wallets).
@@ -38,6 +38,22 @@ export interface ProfileAgents {
     keyAgreementKey: IKeyAgreementKey;
     keyResolver: IKeyResolver;
 }
+/**
+ * A `ZcapClient` signing invocations and delegations alike with one signer,
+ * under `eddsa-jcs-2022` -- the suite every zcap this library mints is signed
+ * with. This is that construction's one site: the suite is hard-coded rather
+ * than threaded as a caller option, and a wrong setting would surface only as
+ * an interop failure at the server, so a second copy is a setting someone has
+ * to remember. Callers that sign under a different key id (the did:webvh
+ * verification method, the ladder VM) build the signer and hand it here.
+ *
+ * @param options {object}
+ * @param options.signer {ISigner}   signs invocations and delegations alike
+ * @returns {ZcapClient}
+ */
+export declare function zcapClientForSigner({ signer }: {
+    signer: ISigner;
+}): ZcapClient;
 /**
  * Derives the WAS agents from an already-derived 32-byte seed, skipping the
  * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed

package/dist/identity/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAGrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,eAAe,CAAA;CAC1B,GAAG,aAAa,CAyBhB"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACR,MAAM,8BAA8B,CAAA;AAGrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;CAChB,GAAG,UAAU,CAMb;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,eAAe,CAAA;CAC1B,GAAG,aAAa,CAqBhB"}

package/dist/identity/agents.js

@@ -18,7 +18,7 @@
  * returning user, on any device, decrypts the same envelopes.
  */
 import { CapabilityAgent } from '@interop/webkms-client';
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
+import { EddsaJcs2022 } from '@interop/ed25519-signature/eddsa-jcs-2022';
 import { ZcapClient } from '@interop/ezcap';
 import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
 import { singleKeyResolver } from './keyResolver.js';
@@ -28,6 +28,26 @@ import { singleKeyResolver } from './keyResolver.js';
  */
 export const BOOTSTRAP_HANDLE = 'bootstrap';
 export const BOOTSTRAP_KEY_NAME = 'boostrap-key';
+/**
+ * A `ZcapClient` signing invocations and delegations alike with one signer,
+ * under `eddsa-jcs-2022` -- the suite every zcap this library mints is signed
+ * with. This is that construction's one site: the suite is hard-coded rather
+ * than threaded as a caller option, and a wrong setting would surface only as
+ * an interop failure at the server, so a second copy is a setting someone has
+ * to remember. Callers that sign under a different key id (the did:webvh
+ * verification method, the ladder VM) build the signer and hand it here.
+ *
+ * @param options {object}
+ * @param options.signer {ISigner}   signs invocations and delegations alike
+ * @returns {ZcapClient}
+ */
+export function zcapClientForSigner({ signer }) {
+    return new ZcapClient({
+        SuiteClass: EddsaJcs2022,
+        invocationSigner: signer,
+        delegationSigner: signer
+    });
+}
 /**
  * Derives the WAS agents from an already-derived 32-byte seed, skipping the
  * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
@@ -80,13 +100,9 @@ export async function agentsFromSecret({ secret }) {
  */
 export function agentsFromKeyAgent({ keyAgent }) {
     const signer = keyAgent.getSigner();
-    const zcapClient = new ZcapClient({
-        SuiteClass: Ed25519Signature2020,
-        invocationSigner: signer,
-        // The root key also signs delegations (sharing grants, app capability
-        // grants).
-        delegationSigner: signer
-    });
+    // The root key also signs delegations (sharing grants, app capability
+    // grants).
+    const zcapClient = zcapClientForSigner({ signer });
     const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
         keyPair: keyAgent.getVerificationKeyPair()
     });

package/dist/identity/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAehD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EAGL;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EAGP;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC;QAChD,MAAM;QACN,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,QAAQ,EAGT;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,sEAAsE;QACtE,WAAW;QACX,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IAEF,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAE1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,mEAAmE;QACnE,iEAAiE;QACjE,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAM7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAehD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EAGP;IACC,OAAO,IAAI,UAAU,CAAC;QACpB,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EAGL;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EAGP;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC;QAChD,MAAM;QACN,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,QAAQ,EAGT;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,sEAAsE;IACtE,WAAW;IACX,MAAM,UAAU,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAElD,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAE1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,mEAAmE;QACnE,iEAAiE;QACjE,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}