@interop/wallet-core 0.61.0 → 0.65.0

package/dist/space/plaintextCollection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plaintextCollection.d.ts","sourceRoot":"","sources":["../../src/space/plaintextCollection.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAEvE;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACX,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,UAAU,CAIb"}

package/dist/space/plaintextCollection.js

@@ -0,0 +1,17 @@
+/**
+ * A lazy handle to one of the wallet's plaintext system collections. No I/O.
+ *
+ * @param options {object}
+ * @param options.was {WasClient}   the storage client to address it through
+ * @param options.spaceId {string}   the Space holding the collection
+ * @param options.collectionId {string}
+ * @param [options.capability] {IZcap}   an invocation capability every request
+ *   through the handle rides; absent, requests invoke the root capability
+ * @returns {Collection}
+ */
+export function plaintextCollection({ was, spaceId, collectionId, capability }) {
+    return was
+        .space(spaceId)
+        .collection(collectionId, { capability, encryption: 'plaintext' });
+}
+//# sourceMappingURL=plaintextCollection.js.map

package/dist/space/plaintextCollection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plaintextCollection.js","sourceRoot":"","sources":["../../src/space/plaintextCollection.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EAMX;IACC,OAAO,GAAG;SACP,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;AACtE,CAAC"}

package/dist/stages.d.ts

@@ -0,0 +1,23 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The ceremony stage tokens more than one subpath emits, and nothing else.
+ * This module imports nothing, so any layer may take a name from it and a
+ * progress display importing one pulls in no ceremony code. A vocabulary only
+ * one subpath emits stays with that subpath (`clientAnnex/stages.ts`).
+ */
+/**
+ * The KMS-authentication stage, emitted at the join where a genesis waits on
+ * the binding it folds into its entry. Both genesis ceremonies emit it at
+ * that same boundary, which is why the name lives here rather than in either
+ * of them.
+ *
+ * It fires whether or not the caller supplied a thunk, since it is a stage
+ * boundary of the ceremony rather than a report that a key was minted. It
+ * marks the join and not the thunk's own completion: the KMS stage overlaps
+ * Space provisioning, and a thunk that finished first would mark out of
+ * order.
+ */
+export declare const KMS_AUTHENTICATION_STAGE = "kms-authentication";
+//# sourceMappingURL=stages.d.ts.map

package/dist/stages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.d.ts","sourceRoot":"","sources":["../src/stages.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,uBAAuB,CAAA"}

package/dist/stages.js

@@ -0,0 +1,23 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The ceremony stage tokens more than one subpath emits, and nothing else.
+ * This module imports nothing, so any layer may take a name from it and a
+ * progress display importing one pulls in no ceremony code. A vocabulary only
+ * one subpath emits stays with that subpath (`clientAnnex/stages.ts`).
+ */
+/**
+ * The KMS-authentication stage, emitted at the join where a genesis waits on
+ * the binding it folds into its entry. Both genesis ceremonies emit it at
+ * that same boundary, which is why the name lives here rather than in either
+ * of them.
+ *
+ * It fires whether or not the caller supplied a thunk, since it is a stage
+ * boundary of the ceremony rather than a report that a key was minted. It
+ * marks the join and not the thunk's own completion: the KMS stage overlaps
+ * Space provisioning, and a thunk that finished first would mark out of
+ * order.
+ */
+export const KMS_AUTHENTICATION_STAGE = 'kms-authentication';
+//# sourceMappingURL=stages.js.map

package/dist/stages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.js","sourceRoot":"","sources":["../src/stages.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAA"}

package/dist/sync/index.d.ts

@@ -11,6 +11,12 @@
  *   `WasSyncNotFoundError` / `UnknownEpochError` signals) come from
  *   `@interop/was-client/sync` and are re-exported here so an engine consumer
  *   imports one package.
+ * - `isSyncConflictError` / `isSyncNotFoundError` / `isUnknownEpochError` are
+ *   how those three signals are classified. They are raised inside the app's
+ *   own injected seams, which may resolve to a second copy of
+ *   `@interop/was-client`, so they are matched on `err.name`; the engine core
+ *   and both apps share these predicates rather than each writing an
+ *   `instanceof` that a duplicated dependency would silently defeat.
  * - `SyncStore` / `SyncedRow` / `ProjectionAction` / `ResolveConflict` are the
  *   replica-side persistence seam.
  * - `runPull` / `projectionForDoc`, `runPush`, and `SyncEngine` are the pull,
@@ -31,6 +37,7 @@
  */
 export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '@interop/was-client/sync';
 export type { Json, SyncCheckpoint, WireDoc, MasterState, WasSyncPort, DocCipher } from '@interop/was-client/sync';
+export { isSyncConflictError, isSyncNotFoundError, isUnknownEpochError } from './types.js';
 export type { SyncStore, SyncedRow, ProjectionAction, ResolveConflict } from './types.js';
 export { runPull, projectionForDoc } from './pull.js';
 export { runPush, formatEtag } from './push.js';

package/dist/sync/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,YAAY,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7D,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7D,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/sync/index.js

@@ -11,6 +11,12 @@
  *   `WasSyncNotFoundError` / `UnknownEpochError` signals) come from
  *   `@interop/was-client/sync` and are re-exported here so an engine consumer
  *   imports one package.
+ * - `isSyncConflictError` / `isSyncNotFoundError` / `isUnknownEpochError` are
+ *   how those three signals are classified. They are raised inside the app's
+ *   own injected seams, which may resolve to a second copy of
+ *   `@interop/was-client`, so they are matched on `err.name`; the engine core
+ *   and both apps share these predicates rather than each writing an
+ *   `instanceof` that a duplicated dependency would silently defeat.
  * - `SyncStore` / `SyncedRow` / `ProjectionAction` / `ResolveConflict` are the
  *   replica-side persistence seam.
  * - `runPull` / `projectionForDoc`, `runPush`, and `SyncEngine` are the pull,
@@ -30,6 +36,7 @@
  * `push.ts` for why the metadata half is left out of the shared core.
  */
 export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '@interop/was-client/sync';
+export { isSyncConflictError, isSyncNotFoundError, isUnknownEpochError } from './types.js';
 export { runPull, projectionForDoc } from './pull.js';
 export { runPush, formatEtag } from './push.js';
 export { remintPendingEnvelopes } from './remint.js';

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAiBjC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAUjC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAQnB,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,uBAAuB,CAAA"}

package/dist/sync/push.js

@@ -26,7 +26,7 @@
  * optional on the port for the driver that needs it.
  */
 import { formatEtag } from '@interop/was-client/sync';
-import { WasSyncConflictError, WasSyncNotFoundError } from './types.js';
+import { isSyncConflictError, isSyncNotFoundError } from './types.js';
 // Formats a master revision as the quoted strong ETag the server compares
 // `If-Match` against (revision `3` becomes `"3"`). Re-exported so callers keep
 // importing it from here.
@@ -67,7 +67,7 @@ async function pushUpsert({ port, store, row, resolveConflict }) {
         return { conflictResolved: false };
     }
     catch (err) {
-        if (!(err instanceof WasSyncConflictError)) {
+        if (!isSyncConflictError(err)) {
             throw err;
         }
         if (resolveConflict) {
@@ -116,11 +116,11 @@ async function tryDelete({ port, store, id, ifMatch, revision }) {
         return true;
     }
     catch (err) {
-        if (err instanceof WasSyncNotFoundError) {
+        if (isSyncNotFoundError(err)) {
             await store.markDeletedPushed({ id, ...revisionAck });
             return true;
         }
-        if (err instanceof WasSyncConflictError) {
+        if (isSyncConflictError(err)) {
             return false;
         }
         throw err;

package/dist/sync/push.js.map

@@ -1 +1 @@
-{"version":3,"file":"push.js","sourceRoot":"","sources":["../../src/sync/push.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAErD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEvE,0EAA0E;AAC1E,+EAA+E;AAC/E,0BAA0B;AAC1B,OAAO,EAAE,UAAU,EAAE,CAAA;AAErB;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,UAAU,CAAC,EACxB,IAAI,EACJ,KAAK,EACL,GAAG,EACH,eAAe,EAWhB;IACC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACpC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,GAAG,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBACtC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;SAC3B,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,UAAU,CAAC;YACrB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,OAAO;YACP,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;SAC9D,CAAC,CAAA;QACF,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,CAAA;QACX,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC;gBACpB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAA;YACF,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;QACnC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7C,qEAAqE;QACrE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,KAAK,CAAC,WAAW,CAAC;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC/B,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,WAAW,CAAC;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;aAC7B,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAA;IACpC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAC,EACvB,IAAI,EACJ,KAAK,EACL,EAAE,EACF,OAAO,EACP,QAAQ,EAOT;IACC,MAAM,WAAW,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YACvC,EAAE;YACF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;SAC1C,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,CAAA;QAC9D,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC,CAAA;YACrD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,UAAU,CAAC,EACxB,IAAI,EACJ,KAAK,EACL,GAAG,EAKJ;IACC,MAAM,WAAW,GACf,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,IACE,MAAM,SAAS,CAAC;QACd,IAAI;QACJ,KAAK;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,YAAY;QACrB,GAAG,WAAW;KACf,CAAC,EACF,CAAC;QACD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,sEAAsE;QACtE,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC,CAAA;QAC7D,OAAM;IACR,CAAC;IAED,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,SAAS,CAAC;QACd,IAAI;QACJ,KAAK;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QACnC,GAAG,WAAW;KACf,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAC5B,IAAI,EACJ,KAAK,EACL,eAAe,EACf,MAAM,EAMP;IACC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAA;IACvC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,UAAU,CAAC;gBAC5C,IAAI;gBACJ,KAAK;gBACL,GAAG;gBACH,eAAe;aAChB,CAAC,CAAA;YACF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,iBAAiB,IAAI,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,CAAA;IACb,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;AACtC,CAAC"}
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../src/sync/push.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAErD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErE,0EAA0E;AAC1E,+EAA+E;AAC/E,0BAA0B;AAC1B,OAAO,EAAE,UAAU,EAAE,CAAA;AAErB;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,UAAU,CAAC,EACxB,IAAI,EACJ,KAAK,EACL,GAAG,EACH,eAAe,EAWhB;IACC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACpC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,GAAG,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBACtC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;SAC3B,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,UAAU,CAAC;YACrB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,OAAO;YACP,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;SAC9D,CAAC,CAAA;QACF,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAA;QACX,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,eAAe,CAAC;gBACpB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAA;YACF,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;QACnC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7C,qEAAqE;QACrE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,KAAK,CAAC,WAAW,CAAC;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC/B,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,WAAW,CAAC;gBACtB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;aAC7B,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAA;IACpC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAC,EACvB,IAAI,EACJ,KAAK,EACL,EAAE,EACF,OAAO,EACP,QAAQ,EAOT;IACC,MAAM,WAAW,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;YACvC,EAAE;YACF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;SAC1C,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,CAAA;QAC9D,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC,CAAA;YACrD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,UAAU,CAAC,EACxB,IAAI,EACJ,KAAK,EACL,GAAG,EAKJ;IACC,MAAM,WAAW,GACf,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,IACE,MAAM,SAAS,CAAC;QACd,IAAI;QACJ,KAAK;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,YAAY;QACrB,GAAG,WAAW;KACf,CAAC,EACF,CAAC;QACD,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,sEAAsE;QACtE,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC,CAAA;QAC7D,OAAM;IACR,CAAC;IAED,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,SAAS,CAAC;QACd,IAAI;QACJ,KAAK;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QACnC,GAAG,WAAW;KACf,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAC5B,IAAI,EACJ,KAAK,EACL,eAAe,EACf,MAAM,EAMP;IACC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAA;IACvC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,iBAAiB,GAAG,CAAC,CAAA;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,UAAU,CAAC;gBAC5C,IAAI;gBACJ,KAAK;gBACL,GAAG;gBACH,eAAe;aAChB,CAAC,CAAA;YACF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,iBAAiB,IAAI,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,CAAA;IACb,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;AACtC,CAAC"}

package/dist/sync/remint.js

@@ -1,4 +1,4 @@
-import { UnknownEpochError } from './types.js';
+import { isUnknownEpochError } from './types.js';
 /**
  * How many full re-mint passes are attempted before giving up. A pass that
  * ends with skipped rows (a local write bumped a row's revision between the
@@ -75,7 +75,7 @@ export async function remintPendingEnvelopes({ store, cipher, decryptStale, sign
                 continue;
             }
             catch (err) {
-                if (!(err instanceof UnknownEpochError)) {
+                if (!isUnknownEpochError(err)) {
                     throw err;
                 }
             }

package/dist/sync/remint.js.map

@@ -1 +1 @@
-{"version":3,"file":"remint.js","sourceRoot":"","sources":["../../src/sync/remint.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,KAAK,EACL,MAAM,EACN,YAAY,EACZ,MAAM,EAQP;IACC,IAAI,OAA2B,CAAA;IAC/B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAa,EAAE,CAAA;IAE1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAClE,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAA;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAC7B,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAC9D,CAAA;QACD,OAAO,KAAK,WAAW,CAAC,MAAM,CAAA;QAC9B,OAAO,GAAG,EAAE,CAAA;QAEZ,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAK;YACP,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAY,CAAA;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAClC,SAAQ;YACV,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,iBAAiB,CAAC,EAAE,CAAC;oBACxC,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC5D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;gBACrE,IAAI,EAAE,OAAO;aACd,CAAC,CAAA;YACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;gBAC7C,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;aAC9D,CAAC,CAAA;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,IAAI,CAAC,CAAA;YACf,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5C,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,yBAAyB,mBAAmB,qBAAqB;YAC/D,UAAU,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YACpE,qEAAqE;YACrE,uEAAuE,CAC1E,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"remint.js","sourceRoot":"","sources":["../../src/sync/remint.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,KAAK,EACL,MAAM,EACN,YAAY,EACZ,MAAM,EAQP;IACC,IAAI,OAA2B,CAAA;IAC/B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAa,EAAE,CAAA;IAE1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAClE,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAA;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAC7B,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAC9D,CAAA;QACD,OAAO,KAAK,WAAW,CAAC,MAAM,CAAA;QAC9B,OAAO,GAAG,EAAE,CAAA;QAEZ,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAK;YACP,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAY,CAAA;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAClC,SAAQ;YACV,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC5D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;gBACrE,IAAI,EAAE,OAAO;aACd,CAAC,CAAA;YACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;gBAC7C,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;aAC9D,CAAC,CAAA;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,IAAI,CAAC,CAAA;YACf,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5C,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,yBAAyB,mBAAmB,qBAAqB;YAC/D,UAAU,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YACpE,qEAAqE;YACrE,uEAAuE,CAC1E,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAA;AAC5C,CAAC"}

package/dist/sync/types.d.ts

@@ -8,7 +8,18 @@
  * `MasterState`, `WasSyncPort`, `DocCipher`, and the `WasSyncConflictError` /
  * `WasSyncNotFoundError` / `UnknownEpochError` signals) come from
  * `@interop/was-client/sync` and are re-exported here so a single import gives
- * a consumer both the wire types and the replica-side seams.
+ * a consumer both the wire types and the replica-side seams. Beside the three
+ * signal classes sit the three predicates that CLASSIFY them
+ * ({@link isSyncConflictError}, {@link isSyncNotFoundError},
+ * {@link isUnknownEpochError}): each is raised inside an app-injected seam --
+ * the port for the two wire signals, the caller's `DocCipher` for the third --
+ * which can resolve to a second copy of `@interop/was-client` (a `link:` dev
+ * setup, a dedupe miss through a dependency tree), so they are matched on
+ * `err.name` and never with `instanceof`. The same rule the resource-log
+ * refusal classes follow, and for the same reason: an `instanceof` miss here
+ * turns every push 412 into a fatal cycle error and makes the create-loss
+ * re-mint rethrow instead of re-minting. Every one of the three classes
+ * assigns its `name` explicitly, which is what makes the string a contract.
  *
  * The local-persistence seam (`SyncStore`, `SyncedRow`, `ProjectionAction`,
  * `ResolveConflict`) is the replica's side of the contract: it stands in for a
@@ -24,6 +35,35 @@
 export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '@interop/was-client/sync';
 export type { Json, SyncCheckpoint, WireDoc, MasterState, WasSyncPort, DocCipher } from '@interop/was-client/sync';
 import type { Json, MasterState, SyncCheckpoint, WireDoc } from '@interop/was-client/sync';
+/**
+ * Whether an error is the replication port's rejected-conditional-write signal
+ * (`WasSyncConflictError`, HTTP 412): a lost-update `If-Match` mismatch, or a
+ * create-if-absent whose target already exists. The push loop's one settle-and-
+ * reconcile branch; everything else propagates to the engine's backoff.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export declare function isSyncConflictError(err: unknown): boolean;
+/**
+ * Whether an error is the replication port's absent-target signal
+ * (`WasSyncNotFoundError`, HTTP 404). On a delete that is a settled outcome
+ * -- already gone, or the write never reached the server -- not a conflict.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export declare function isSyncNotFoundError(err: unknown): boolean;
+/**
+ * Whether an error is the cipher's unknown-epoch signal (`UnknownEpochError`):
+ * an envelope naming recipient key ids whose epoch the descriptor this reader
+ * holds does not list at all. Distinct from a key the reader simply does not
+ * have (`KeyUnwrapError`), which re-reading the descriptor cannot fix.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export declare function isUnknownEpochError(err: unknown): boolean;
 /**
  * A dirty local synced-docs row awaiting push. `data` is the stored body (the
  * EDV envelope on an encrypted collection, or the plaintext JSON on a plaintext

package/dist/sync/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EACV,IAAI,EACJ,WAAW,EACX,cAAc,EACd,OAAO,EACR,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAEpD;;OAEG;IACH,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEpC;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE;QACvB,SAAS,EAAE,OAAO,EAAE,CAAA;QACpB,UAAU,EAAE,cAAc,CAAA;QAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;OASG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,iBAAiB,CAAC,OAAO,EAAE;QACzB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;QAC1B,UAAU,EAAE,gBAAgB,CAAA;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,cAAc,CAAC,CAAC,OAAO,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,IAAI,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EACV,IAAI,EACJ,WAAW,EACX,cAAc,EACd,OAAO,EACR,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAEpD;;OAEG;IACH,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEpC;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE;QACvB,SAAS,EAAE,OAAO,EAAE,CAAA;QACpB,UAAU,EAAE,cAAc,CAAA;QAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;OASG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,iBAAiB,CAAC,OAAO,EAAE;QACzB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;QAC1B,UAAU,EAAE,gBAAgB,CAAA;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,cAAc,CAAC,CAAC,OAAO,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,IAAI,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAClC"}

package/dist/sync/types.js

@@ -8,7 +8,18 @@
  * `MasterState`, `WasSyncPort`, `DocCipher`, and the `WasSyncConflictError` /
  * `WasSyncNotFoundError` / `UnknownEpochError` signals) come from
  * `@interop/was-client/sync` and are re-exported here so a single import gives
- * a consumer both the wire types and the replica-side seams.
+ * a consumer both the wire types and the replica-side seams. Beside the three
+ * signal classes sit the three predicates that CLASSIFY them
+ * ({@link isSyncConflictError}, {@link isSyncNotFoundError},
+ * {@link isUnknownEpochError}): each is raised inside an app-injected seam --
+ * the port for the two wire signals, the caller's `DocCipher` for the third --
+ * which can resolve to a second copy of `@interop/was-client` (a `link:` dev
+ * setup, a dedupe miss through a dependency tree), so they are matched on
+ * `err.name` and never with `instanceof`. The same rule the resource-log
+ * refusal classes follow, and for the same reason: an `instanceof` miss here
+ * turns every push 412 into a fatal cycle error and makes the create-loss
+ * re-mint rethrow instead of re-minting. Every one of the three classes
+ * assigns its `name` explicitly, which is what makes the string a contract.
  *
  * The local-persistence seam (`SyncStore`, `SyncedRow`, `ProjectionAction`,
  * `ResolveConflict`) is the replica's side of the contract: it stands in for a
@@ -22,4 +33,39 @@
  * Native, against a fake port and an in-memory store.
  */
 export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '@interop/was-client/sync';
+/**
+ * Whether an error is the replication port's rejected-conditional-write signal
+ * (`WasSyncConflictError`, HTTP 412): a lost-update `If-Match` mismatch, or a
+ * create-if-absent whose target already exists. The push loop's one settle-and-
+ * reconcile branch; everything else propagates to the engine's backoff.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export function isSyncConflictError(err) {
+    return err?.name === 'WasSyncConflictError';
+}
+/**
+ * Whether an error is the replication port's absent-target signal
+ * (`WasSyncNotFoundError`, HTTP 404). On a delete that is a settled outcome
+ * -- already gone, or the write never reached the server -- not a conflict.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export function isSyncNotFoundError(err) {
+    return err?.name === 'WasSyncNotFoundError';
+}
+/**
+ * Whether an error is the cipher's unknown-epoch signal (`UnknownEpochError`):
+ * an envelope naming recipient key ids whose epoch the descriptor this reader
+ * holds does not list at all. Distinct from a key the reader simply does not
+ * have (`KeyUnwrapError`), which re-reading the descriptor cannot fix.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export function isUnknownEpochError(err) {
+    return err?.name === 'UnknownEpochError';
+}
 //# sourceMappingURL=types.js.map

package/dist/sync/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAiBjC;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAQ,GAAiC,EAAE,IAAI,KAAK,sBAAsB,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAQ,GAAiC,EAAE,IAAI,KAAK,sBAAsB,CAAA;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAQ,GAAiC,EAAE,IAAI,KAAK,mBAAmB,CAAA;AACzE,CAAC"}

package/dist/unlock/index.d.ts

@@ -22,6 +22,10 @@
  * - `retireUnlockCredential` -- the retirement ceremony behind "change my
  *   passphrase" and "remove this passkey": the inventory edit, then the shared
  *   roster rotation and collection fan-out off the retired credential's wrap.
+ *   It refuses (`UnclaimedLadderVmRetirementError`) when the ladder
+ *   attribution cannot claim the retired credential's ladder VM;
+ *   `preflightUnlockCredentialRetirement` runs that gate read-only, before a
+ *   caller establishes anything.
  *
  * The ladder itself, and every ceremony that exercises it (the ladder-anchored
  * genesis, self-enrollment, the forget ceremony), live in
@@ -35,8 +39,8 @@ export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentit
 export type { StandingUnlockClient, UnlockClientIdentity } from './standingClient.js';
 export { computeUnlockBinding, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
 export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from './unlockRecord.js';
-export { publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
-export type { StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
+export { assertLadderVmClaimed, LadderInventoryDriftError, ladderVmClaimOf, preflightUnlockCredentialRetirement, publishUnlockKey, removeUnlockKey, UnclaimedLadderVmRetirementError, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export type { LadderVmRemovalReport, StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
 export { retireUnlockCredential } from './retire.js';
 export type { ClientAnnexInventoryRetirement, UnlockCredentialRetirementResult } from './retire.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/unlock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EACf,mCAAmC,EACnC,gBAAgB,EAChB,eAAe,EACf,gCAAgC,EAChC,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}

package/dist/unlock/index.js

@@ -22,6 +22,10 @@
  * - `retireUnlockCredential` -- the retirement ceremony behind "change my
  *   passphrase" and "remove this passkey": the inventory edit, then the shared
  *   roster rotation and collection fan-out off the retired credential's wrap.
+ *   It refuses (`UnclaimedLadderVmRetirementError`) when the ladder
+ *   attribution cannot claim the retired credential's ladder VM;
+ *   `preflightUnlockCredentialRetirement` runs that gate read-only, before a
+ *   caller establishes anything.
  *
  * The ladder itself, and every ceremony that exercises it (the ladder-anchored
  * genesis, self-enrollment, the forget ceremony), live in
@@ -33,6 +37,6 @@
  */
 export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
 export { computeUnlockBinding, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
-export { publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { assertLadderVmClaimed, LadderInventoryDriftError, ladderVmClaimOf, preflightUnlockCredentialRetirement, publishUnlockKey, removeUnlockKey, UnclaimedLadderVmRetirementError, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export { retireUnlockCredential } from './retire.js';
 //# sourceMappingURL=index.js.map

package/dist/unlock/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EACf,mCAAmC,EACnC,gBAAgB,EAChB,eAAe,EACf,gCAAgC,EAChC,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAQ3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA"}

package/dist/unlock/retire.d.ts

@@ -9,6 +9,13 @@
  * inventory in the account's did:webvh document -- so retiring one is a real
  * rotation, on the same stages the client-revocation cascade runs.
  *
+ * 0. **The dependent-record re-mint** (the injected `remintDependentRecords`
+ *    closure), against the PRE-edit document: the credential's ladder VM is
+ *    about to be struck, and a struck VM rots every record and bridge
+ *    delegation it signed for OTHER credentials -- the last-client transition
+ *    signs siblings' records with one, and `currentAccountRecordSigners`
+ *    accepts it. The stage names the doomed VM ids to the pass, which
+ *    re-signs those records under a key that outlives the edit.
  * 1. **The document inventory edit** (`removeUnlockKey`): the credential's
  *    `keyAgreement` entry (verbatim key or commitment) and its committed
  *    update-key hash leave the document in one log entry. That kills the
@@ -29,11 +36,21 @@
  * inventory still standing would simply re-escrow the credential and look
  * healthy.
  *
- * There is deliberately no recovery-delegation re-mint stage here (the
- * client-revocation cascade's fourth stage). A retired credential signs no
- * delegations: its own bridge delegation dies with its unlock Space, which
- * the app deletes as part of the change-method ceremony, and no other
- * credential's bridge chains through it.
+ * Stage 0 is the one stage that runs BEFORE the edit, and its placement is
+ * the point. Run after the edit it would leave a window in which every
+ * sibling credential's record is unverifiable, and a run torn there bricks
+ * exactly what the stage exists to protect: a record whose frame proof names
+ * a struck key refuses before decryption, and the credential's own login dies
+ * at that check with no repair arm. Run before it, a tear leaves the sibling
+ * records signed by a key that still stands and the retiring credential still
+ * standing -- the correct resting state, converged by a re-run. So the stage
+ * is fail-closed rather than best-effort: a throw from the closure aborts the
+ * retirement before anything is published, unlike the annex closure at 1b.
+ *
+ * That corrects what this module used to reason. A retired credential's own
+ * bridge delegation does die with its unlock Space, which the app deletes as
+ * part of the change-method ceremony. Its ladder VM is the part that reaches
+ * further: other credentials' records and bridges chain through it.
  *
  * The client annex reach is its own stage (1b, the injected
  * `retireClientAnnexInventory` closure), between the document edit and the
@@ -54,6 +71,30 @@
  * skip, so the roster rotation -- the ceremony's essential remedy -- always
  * runs.
  *
+ * Both stages carry the retirement gate (`decisions/0015`): a credential
+ * retired here carries a ladder, so its ladder VM must be claimed -- by the
+ * seed, or by the log's attribution -- before the edit strikes anything. A
+ * claim that strikes nothing while ladder VMs stand unclaimed refuses with
+ * `UnclaimedLadderVmRetirementError`, at stage 0 before the re-mint pass
+ * writes a sibling record and again inside the edit before its entry
+ * publishes, so the credential still stands and the log is unchanged. The
+ * leftover the gate closes is a retired credential's VM standing under
+ * `capabilityDelegation`, which could still sign a DELETE-only capability on
+ * the account Space. Callers that establish a replacement before retiring
+ * run `preflightUnlockCredentialRetirement` first, so the refusal lands
+ * before establishment rather than in a torn state. The recovery-code
+ * removal shares the edit but not the gate: a code carries no ladder VM to
+ * claim.
+ *
+ * Stage 0 and stage 1 each read the log for themselves, and the two reads are
+ * tied by a cross-check rather than by luck: stage 0 hands its attributed
+ * ladder VM ids to the edit as `expectedLadderVmIds`, and the edit refuses
+ * before writing when its own attribution resolves a different set
+ * (`LadderInventoryDriftError`). So a concurrent ceremony, or a host serving
+ * different log versions to the two reads, cannot leave the strike diverging
+ * from what the re-mint pass acted on. Both reads take the caller's
+ * `pinStore` and `logId`, so both are checked against the same chain head.
+ *
  * Convergence is the design: every stage detects its own completion from
  * durable state alone -- the inventory edit no-ops when the document is already
  * settled, the rotation no-ops once every current-epoch recipient is
@@ -70,24 +111,32 @@ import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import { type CascadeCollections, type RosterSealReport, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
-import type { ClientWebvhUpdateKeys, WebvhIdStore } from '../webvh/index.js';
-import { type StandingUnlockKeys } from './standingWebvh.js';
+import type { WebvhIdStore } from '../webvh/index.js';
+import type { AccountLogSigner } from '../webvh/accountEntry.js';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
+import { type LadderVmRemovalReport, type StandingUnlockKeys } from './standingWebvh.js';
 /**
  * What a completed retirement reports: whether the roster actually rotated on
  * this run (a re-run of an already-complete retirement reports `false`), the
  * roster's seal-backstop report (present when the roster store is sealable and
  * the roster stage ran), the per-collection fan-out result, the document as
- * the inventory edit left it, and the rotated key with the roster descriptor it
- * was read from.
+ * the inventory edit left it, the rotated key with the roster descriptor it
+ * was read from, whatever the dependent-record re-mint pass returned
+ * (`dependentRecords`, absent when no closure was supplied), and the
+ * inventory edit's ladder VM report (`ladderVm`: what the edit struck, and
+ * what stands unclaimed after it -- a seedless strike that claimed nothing
+ * reports its credential's VM there rather than reading as clean).
  */
 export interface UnlockCredentialRetirementResult {
     rotated: boolean;
+    ladderVm: LadderVmRemovalReport;
     rosterSeal?: RosterSealReport;
     collections: UserKeyCascadeResult;
     document: object;
     userKey?: UserKey;
     rosterDescriptor?: CollectionEncryption;
     clientAnnex?: ClientAnnexInventoryRetirement;
+    dependentRecords?: unknown;
 }
 /**
  * What the annex-inventory stage reports: `struck` (a strike entry dropped
@@ -110,18 +159,34 @@ export interface ClientAnnexInventoryRetirement {
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
- * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
- *   client's own did:webvh update-key seeds, which sign the inventory edit
+ * @param options.signer {AccountLogSigner}   who signs the inventory edit:
+ *   the retiring enrolled client's own did:webvh update-key seeds, or the
+ *   ACTING (surviving or successor) credential's ladder seed
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
  *   public inventory (its key-agreement publication and its recorded update
  *   key, which the inventory edit treats as a ladder anchor rather than truth
  *   -- see `removeUnlockKey`)
  * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
  *   seed, when the ceremony holds the credential's secret; it strengthens the
- *   ladder attribution but is not required
+ *   ladder attribution, and it is what a retry supplies after a seedless run
+ *   refused with `UnclaimedLadderVmRetirementError`
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through, passed straight to the inventory edit: the
+ *   post-strike `did:web` projection is PUT through it immediately before
+ *   that entry publishes, so a ladder-signed retirement does not leave
+ *   `did.json` naming the retired credential. Best-effort, and omitted the
+ *   behavior is unchanged (see `removeUnlockKey`)
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins, threaded to BOTH account-log reads the ceremony makes -- stage 0's
+ *   attribution read and the inventory edit's own read inside its
+ *   conflict-retry loop -- so a served rollback or fork is refused before
+ *   anything is published
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @param [options.verb] {string}   what the caller is doing, for the
  *   pending-rotation refusal message (e.g. `'changing your passphrase'`)
  * @param options.rosterStore {EncryptionDescriptorStore}   the
@@ -135,6 +200,15 @@ export interface ClientAnnexInventoryRetirement {
  *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
  *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
+ * @param [options.remintDependentRecords] {Function}   `({ document,
+ *   retiringKeyMultibases }) => Promise<unknown>` -- the dependent-record
+ *   re-mint (stage 0), run against the PRE-edit document with the ladder VM
+ *   ids this retirement is about to strike. Fail-closed: a throw aborts the
+ *   retirement before the document edit. Absent, the stage is skipped and no
+ *   log read happens for it (the no-WAS path). It is also skipped on the
+ *   ladder arm: every unlock record is signed by its own credential's ladder
+ *   VM, so this strike rots no sibling record, and there is nothing to
+ *   re-mint (`decisions/0019`)
  * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
  *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
  *   the module doc), run against the post-edit document; a throw is caught
@@ -144,12 +218,15 @@ export interface ClientAnnexInventoryRetirement {
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, retireClientAnnexInventory, onRotationAdopted }: {
+export declare function retireUnlockCredential({ idStore, signer, unlockKeys, ladderSeed, projectionStore, expectedDid, pinStore, logId, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintDependentRecords, retireClientAnnexInventory, onRotationAdopted }: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
     unlockKeys: StandingUnlockKeys;
     ladderSeed?: Uint8Array;
+    projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
     verb?: string;
     rosterStore: EncryptionDescriptorStore;
     userKey?: UserKey;
@@ -161,6 +238,10 @@ export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys
         descriptor: CollectionEncryption;
     }) => Promise<void>;
     collections: CascadeCollections;
+    remintDependentRecords?: (options: {
+        document: object;
+        retiringKeyMultibases: string[];
+    }) => Promise<unknown>;
     retireClientAnnexInventory?: (options: {
         document: object;
     }) => Promise<ClientAnnexInventoryRetirement>;

package/dist/unlock/retire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE7E;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,8BAA8B,CAAA;CAC7C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAiE5C"}
+{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAML,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAA;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,8BAA8B,CAAA;IAC5C,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,MAAM,EACN,UAAU,EACV,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAA;QAChB,qBAAqB,EAAE,MAAM,EAAE,CAAA;KAChC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACtB,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAoI5C"}