@interop/wallet-core 0.62.0 → 0.65.0

package/dist/sync/types.d.ts

@@ -8,7 +8,18 @@
  * `MasterState`, `WasSyncPort`, `DocCipher`, and the `WasSyncConflictError` /
  * `WasSyncNotFoundError` / `UnknownEpochError` signals) come from
  * `@interop/was-client/sync` and are re-exported here so a single import gives
- * a consumer both the wire types and the replica-side seams.
+ * a consumer both the wire types and the replica-side seams. Beside the three
+ * signal classes sit the three predicates that CLASSIFY them
+ * ({@link isSyncConflictError}, {@link isSyncNotFoundError},
+ * {@link isUnknownEpochError}): each is raised inside an app-injected seam --
+ * the port for the two wire signals, the caller's `DocCipher` for the third --
+ * which can resolve to a second copy of `@interop/was-client` (a `link:` dev
+ * setup, a dedupe miss through a dependency tree), so they are matched on
+ * `err.name` and never with `instanceof`. The same rule the resource-log
+ * refusal classes follow, and for the same reason: an `instanceof` miss here
+ * turns every push 412 into a fatal cycle error and makes the create-loss
+ * re-mint rethrow instead of re-minting. Every one of the three classes
+ * assigns its `name` explicitly, which is what makes the string a contract.
  *
  * The local-persistence seam (`SyncStore`, `SyncedRow`, `ProjectionAction`,
  * `ResolveConflict`) is the replica's side of the contract: it stands in for a
@@ -24,6 +35,35 @@
 export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '@interop/was-client/sync';
 export type { Json, SyncCheckpoint, WireDoc, MasterState, WasSyncPort, DocCipher } from '@interop/was-client/sync';
 import type { Json, MasterState, SyncCheckpoint, WireDoc } from '@interop/was-client/sync';
+/**
+ * Whether an error is the replication port's rejected-conditional-write signal
+ * (`WasSyncConflictError`, HTTP 412): a lost-update `If-Match` mismatch, or a
+ * create-if-absent whose target already exists. The push loop's one settle-and-
+ * reconcile branch; everything else propagates to the engine's backoff.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export declare function isSyncConflictError(err: unknown): boolean;
+/**
+ * Whether an error is the replication port's absent-target signal
+ * (`WasSyncNotFoundError`, HTTP 404). On a delete that is a settled outcome
+ * -- already gone, or the write never reached the server -- not a conflict.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export declare function isSyncNotFoundError(err: unknown): boolean;
+/**
+ * Whether an error is the cipher's unknown-epoch signal (`UnknownEpochError`):
+ * an envelope naming recipient key ids whose epoch the descriptor this reader
+ * holds does not list at all. Distinct from a key the reader simply does not
+ * have (`KeyUnwrapError`), which re-reading the descriptor cannot fix.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export declare function isUnknownEpochError(err: unknown): boolean;
 /**
  * A dirty local synced-docs row awaiting push. `data` is the stored body (the
  * EDV envelope on an encrypted collection, or the plaintext JSON on a plaintext

package/dist/sync/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EACV,IAAI,EACJ,WAAW,EACX,cAAc,EACd,OAAO,EACR,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAEpD;;OAEG;IACH,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEpC;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE;QACvB,SAAS,EAAE,OAAO,EAAE,CAAA;QACpB,UAAU,EAAE,cAAc,CAAA;QAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;OASG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,iBAAiB,CAAC,OAAO,EAAE;QACzB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;QAC1B,UAAU,EAAE,gBAAgB,CAAA;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,cAAc,CAAC,CAAC,OAAO,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,IAAI,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EACV,IAAI,EACJ,WAAW,EACX,cAAc,EACd,OAAO,EACR,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAEpD;;OAEG;IACH,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEpC;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE;QACvB,SAAS,EAAE,OAAO,EAAE,CAAA;QACpB,UAAU,EAAE,cAAc,CAAA;QAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;OASG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,iBAAiB,CAAC,OAAO,EAAE;QACzB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;QAC1B,UAAU,EAAE,gBAAgB,CAAA;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,cAAc,CAAC,CAAC,OAAO,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,IAAI,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAClC"}

package/dist/sync/types.js

@@ -8,7 +8,18 @@
  * `MasterState`, `WasSyncPort`, `DocCipher`, and the `WasSyncConflictError` /
  * `WasSyncNotFoundError` / `UnknownEpochError` signals) come from
  * `@interop/was-client/sync` and are re-exported here so a single import gives
- * a consumer both the wire types and the replica-side seams.
+ * a consumer both the wire types and the replica-side seams. Beside the three
+ * signal classes sit the three predicates that CLASSIFY them
+ * ({@link isSyncConflictError}, {@link isSyncNotFoundError},
+ * {@link isUnknownEpochError}): each is raised inside an app-injected seam --
+ * the port for the two wire signals, the caller's `DocCipher` for the third --
+ * which can resolve to a second copy of `@interop/was-client` (a `link:` dev
+ * setup, a dedupe miss through a dependency tree), so they are matched on
+ * `err.name` and never with `instanceof`. The same rule the resource-log
+ * refusal classes follow, and for the same reason: an `instanceof` miss here
+ * turns every push 412 into a fatal cycle error and makes the create-loss
+ * re-mint rethrow instead of re-minting. Every one of the three classes
+ * assigns its `name` explicitly, which is what makes the string a contract.
  *
  * The local-persistence seam (`SyncStore`, `SyncedRow`, `ProjectionAction`,
  * `ResolveConflict`) is the replica's side of the contract: it stands in for a
@@ -22,4 +33,39 @@
  * Native, against a fake port and an in-memory store.
  */
 export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '@interop/was-client/sync';
+/**
+ * Whether an error is the replication port's rejected-conditional-write signal
+ * (`WasSyncConflictError`, HTTP 412): a lost-update `If-Match` mismatch, or a
+ * create-if-absent whose target already exists. The push loop's one settle-and-
+ * reconcile branch; everything else propagates to the engine's backoff.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export function isSyncConflictError(err) {
+    return err?.name === 'WasSyncConflictError';
+}
+/**
+ * Whether an error is the replication port's absent-target signal
+ * (`WasSyncNotFoundError`, HTTP 404). On a delete that is a settled outcome
+ * -- already gone, or the write never reached the server -- not a conflict.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export function isSyncNotFoundError(err) {
+    return err?.name === 'WasSyncNotFoundError';
+}
+/**
+ * Whether an error is the cipher's unknown-epoch signal (`UnknownEpochError`):
+ * an envelope naming recipient key ids whose epoch the descriptor this reader
+ * holds does not list at all. Distinct from a key the reader simply does not
+ * have (`KeyUnwrapError`), which re-reading the descriptor cannot fix.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+export function isUnknownEpochError(err) {
+    return err?.name === 'UnknownEpochError';
+}
 //# sourceMappingURL=types.js.map

package/dist/sync/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAiBjC;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAQ,GAAiC,EAAE,IAAI,KAAK,sBAAsB,CAAA;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAQ,GAAiC,EAAE,IAAI,KAAK,sBAAsB,CAAA;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAQ,GAAiC,EAAE,IAAI,KAAK,mBAAmB,CAAA;AACzE,CAAC"}

package/dist/unlock/index.d.ts

@@ -22,6 +22,10 @@
  * - `retireUnlockCredential` -- the retirement ceremony behind "change my
  *   passphrase" and "remove this passkey": the inventory edit, then the shared
  *   roster rotation and collection fan-out off the retired credential's wrap.
+ *   It refuses (`UnclaimedLadderVmRetirementError`) when the ladder
+ *   attribution cannot claim the retired credential's ladder VM;
+ *   `preflightUnlockCredentialRetirement` runs that gate read-only, before a
+ *   caller establishes anything.
  *
  * The ladder itself, and every ceremony that exercises it (the ladder-anchored
  * genesis, self-enrollment, the forget ceremony), live in
@@ -35,7 +39,7 @@ export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentit
 export type { StandingUnlockClient, UnlockClientIdentity } from './standingClient.js';
 export { computeUnlockBinding, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
 export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from './unlockRecord.js';
-export { LadderInventoryDriftError, publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { assertLadderVmClaimed, LadderInventoryDriftError, ladderVmClaimOf, preflightUnlockCredentialRetirement, publishUnlockKey, removeUnlockKey, UnclaimedLadderVmRetirementError, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export type { LadderVmRemovalReport, StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
 export { retireUnlockCredential } from './retire.js';
 export type { ClientAnnexInventoryRetirement, UnlockCredentialRetirementResult } from './retire.js';

package/dist/unlock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EACf,mCAAmC,EACnC,gBAAgB,EAChB,eAAe,EACf,gCAAgC,EAChC,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EACV,8BAA8B,EAC9B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}

package/dist/unlock/index.js

@@ -22,6 +22,10 @@
  * - `retireUnlockCredential` -- the retirement ceremony behind "change my
  *   passphrase" and "remove this passkey": the inventory edit, then the shared
  *   roster rotation and collection fan-out off the retired credential's wrap.
+ *   It refuses (`UnclaimedLadderVmRetirementError`) when the ladder
+ *   attribution cannot claim the retired credential's ladder VM;
+ *   `preflightUnlockCredentialRetirement` runs that gate read-only, before a
+ *   caller establishes anything.
  *
  * The ladder itself, and every ceremony that exercises it (the ladder-anchored
  * genesis, self-enrollment, the forget ceremony), live in
@@ -33,6 +37,6 @@
  */
 export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
 export { computeUnlockBinding, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
-export { LadderInventoryDriftError, publishUnlockKey, removeUnlockKey, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { assertLadderVmClaimed, LadderInventoryDriftError, ladderVmClaimOf, preflightUnlockCredentialRetirement, publishUnlockKey, removeUnlockKey, UnclaimedLadderVmRetirementError, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export { retireUnlockCredential } from './retire.js';
 //# sourceMappingURL=index.js.map

package/dist/unlock/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAQ3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EACf,mCAAmC,EACnC,gBAAgB,EAChB,eAAe,EACf,gCAAgC,EAChC,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAQ3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA"}

package/dist/unlock/retire.d.ts

@@ -71,6 +71,21 @@
  * skip, so the roster rotation -- the ceremony's essential remedy -- always
  * runs.
  *
+ * Both stages carry the retirement gate (`decisions/0015`): a credential
+ * retired here carries a ladder, so its ladder VM must be claimed -- by the
+ * seed, or by the log's attribution -- before the edit strikes anything. A
+ * claim that strikes nothing while ladder VMs stand unclaimed refuses with
+ * `UnclaimedLadderVmRetirementError`, at stage 0 before the re-mint pass
+ * writes a sibling record and again inside the edit before its entry
+ * publishes, so the credential still stands and the log is unchanged. The
+ * leftover the gate closes is a retired credential's VM standing under
+ * `capabilityDelegation`, which could still sign a DELETE-only capability on
+ * the account Space. Callers that establish a replacement before retiring
+ * run `preflightUnlockCredentialRetirement` first, so the refusal lands
+ * before establishment rather than in a torn state. The recovery-code
+ * removal shares the edit but not the gate: a code carries no ladder VM to
+ * claim.
+ *
  * Stage 0 and stage 1 each read the log for themselves, and the two reads are
  * tied by a cross-check rather than by luck: stage 0 hands its attributed
  * ladder VM ids to the edit as `expectedLadderVmIds`, and the edit refuses
@@ -96,7 +111,8 @@ import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import { type CascadeCollections, type RosterSealReport, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
-import type { ClientWebvhUpdateKeys, WebvhIdStore } from '../webvh/index.js';
+import type { WebvhIdStore } from '../webvh/index.js';
+import type { AccountLogSigner } from '../webvh/accountEntry.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type LadderVmRemovalReport, type StandingUnlockKeys } from './standingWebvh.js';
 /**
@@ -143,15 +159,23 @@ export interface ClientAnnexInventoryRetirement {
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
- * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
- *   client's own did:webvh update-key seeds, which sign the inventory edit
+ * @param options.signer {AccountLogSigner}   who signs the inventory edit:
+ *   the retiring enrolled client's own did:webvh update-key seeds, or the
+ *   ACTING (surviving or successor) credential's ladder seed
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
  *   public inventory (its key-agreement publication and its recorded update
  *   key, which the inventory edit treats as a ladder anchor rather than truth
  *   -- see `removeUnlockKey`)
  * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
  *   seed, when the ceremony holds the credential's secret; it strengthens the
- *   ladder attribution but is not required
+ *   ladder attribution, and it is what a retry supplies after a seedless run
+ *   refused with `UnclaimedLadderVmRetirementError`
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through, passed straight to the inventory edit: the
+ *   post-strike `did:web` projection is PUT through it immediately before
+ *   that entry publishes, so a ladder-signed retirement does not leave
+ *   `did.json` naming the retired credential. Best-effort, and omitted the
+ *   behavior is unchanged (see `removeUnlockKey`)
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
@@ -181,7 +205,10 @@ export interface ClientAnnexInventoryRetirement {
  *   re-mint (stage 0), run against the PRE-edit document with the ladder VM
  *   ids this retirement is about to strike. Fail-closed: a throw aborts the
  *   retirement before the document edit. Absent, the stage is skipped and no
- *   log read happens for it (the no-WAS path)
+ *   log read happens for it (the no-WAS path). It is also skipped on the
+ *   ladder arm: every unlock record is signed by its own credential's ladder
+ *   VM, so this strike rots no sibling record, and there is nothing to
+ *   re-mint (`decisions/0019`)
  * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
  *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
  *   the module doc), run against the post-edit document; a throw is caught
@@ -191,11 +218,12 @@ export interface ClientAnnexInventoryRetirement {
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export declare function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, pinStore, logId, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintDependentRecords, retireClientAnnexInventory, onRotationAdopted }: {
+export declare function retireUnlockCredential({ idStore, signer, unlockKeys, ladderSeed, projectionStore, expectedDid, pinStore, logId, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintDependentRecords, retireClientAnnexInventory, onRotationAdopted }: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
     unlockKeys: StandingUnlockKeys;
     ladderSeed?: Uint8Array;
+    projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
     logId?: string;

package/dist/unlock/retire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAA;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,8BAA8B,CAAA;IAC5C,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAA;QAChB,qBAAqB,EAAE,MAAM,EAAE,CAAA;KAChC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACtB,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CA0G5C"}
+{"version":3,"file":"retire.d.ts","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyGG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAML,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAA;AAE3B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,WAAW,CAAC,EAAE,8BAA8B,CAAA;IAC5C,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAA;IAClD,MAAM,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,OAAO,EACP,MAAM,EACN,UAAU,EACV,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAA;QAChB,qBAAqB,EAAE,MAAM,EAAE,CAAA;KAChC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACtB,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC7C,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAoI5C"}

package/dist/unlock/retire.js

@@ -1,5 +1,6 @@
 import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
-import { attributeUnlockLadderInventory, readLogOrThrow, removeUnlockKey } from './standingWebvh.js';
+import { readPublishedLogOrThrow } from '../webvh/didWebvh.js';
+import { assertLadderVmClaimed, attributeUnlockLadderInventory, ladderVmClaimOf, removeUnlockKey, unlockKeyVmId } from './standingWebvh.js';
 /**
  * Retires one standing unlock credential from an account. See the module doc
  * for the order and the convergence story. Once the inventory edit lands, a
@@ -8,15 +9,23 @@ import { attributeUnlockLadderInventory, readLogOrThrow, removeUnlockKey } from
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
- * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
- *   client's own did:webvh update-key seeds, which sign the inventory edit
+ * @param options.signer {AccountLogSigner}   who signs the inventory edit:
+ *   the retiring enrolled client's own did:webvh update-key seeds, or the
+ *   ACTING (surviving or successor) credential's ladder seed
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
  *   public inventory (its key-agreement publication and its recorded update
  *   key, which the inventory edit treats as a ladder anchor rather than truth
  *   -- see `removeUnlockKey`)
  * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
  *   seed, when the ceremony holds the credential's secret; it strengthens the
- *   ladder attribution but is not required
+ *   ladder attribution, and it is what a retry supplies after a seedless run
+ *   refused with `UnclaimedLadderVmRetirementError`
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through, passed straight to the inventory edit: the
+ *   post-strike `did:web` projection is PUT through it immediately before
+ *   that entry publishes, so a ladder-signed retirement does not leave
+ *   `did.json` naming the retired credential. Best-effort, and omitted the
+ *   behavior is unchanged (see `removeUnlockKey`)
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
@@ -46,7 +55,10 @@ import { attributeUnlockLadderInventory, readLogOrThrow, removeUnlockKey } from
  *   re-mint (stage 0), run against the PRE-edit document with the ladder VM
  *   ids this retirement is about to strike. Fail-closed: a throw aborts the
  *   retirement before the document edit. Absent, the stage is skipped and no
- *   log read happens for it (the no-WAS path)
+ *   log read happens for it (the no-WAS path). It is also skipped on the
+ *   ladder arm: every unlock record is signed by its own credential's ladder
+ *   VM, so this strike rots no sibling record, and there is nothing to
+ *   re-mint (`decisions/0019`)
  * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
  *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
  *   the module doc), run against the post-edit document; a throw is caught
@@ -56,7 +68,7 @@ import { attributeUnlockLadderInventory, readLogOrThrow, removeUnlockKey } from
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, pinStore, logId, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintDependentRecords, retireClientAnnexInventory, onRotationAdopted }) {
+export async function retireUnlockCredential({ idStore, signer, unlockKeys, ladderSeed, projectionStore, expectedDid, pinStore, logId, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintDependentRecords, retireClientAnnexInventory, onRotationAdopted }) {
     // 0. The dependent-record re-mint, against the PRE-edit document: whatever
     // the doomed ladder VM signed for OTHER credentials is re-signed under a
     // key that outlives the edit. The pass is named the VM ids the attribution
@@ -70,11 +82,17 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
     };
     let dependentRecords;
     let expectedLadderVmIds;
-    if (remintDependentRecords) {
-        const published = await readLogOrThrow({
-            store: idStore,
+    // The stage is the enrolled branch's alone. On the ladder arm a record's
+    // bridge and sibling are signed by its own credential's ladder VM, so this
+    // strike reaches no record but the retired credential's own, which the
+    // caller deletes with its unlock Space (`decisions/0019`).
+    const ranRemint = Boolean(remintDependentRecords) && signer.kind === 'client';
+    if (ranRemint && remintDependentRecords) {
+        const published = await readPublishedLogOrThrow({
+            idStore,
             ...(expectedDid !== undefined ? { expectedDid } : {}),
-            ...pinned
+            ...pinned,
+            missingMessage: 'did:webvh: did.jsonl is missing; nothing to enroll into.'
         });
         const inventory = await attributeUnlockLadderInventory({
             log: published.log,
@@ -82,6 +100,24 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
             unlockKeys,
             ...(ladderSeed ? { ladderSeed } : {})
         });
+        // The gate, before the pass writes anything: a claim that strikes no
+        // ladder VM while VMs stand unclaimed refuses here, with the credential
+        // still standing and no sibling record touched.
+        await assertLadderVmClaimed({
+            log: published.log,
+            doc: published.doc,
+            credentialVmId: unlockKeyVmId({
+                did: published.did,
+                keyAgreement: unlockKeys.keyAgreement
+            }),
+            claim: await ladderVmClaimOf({
+                doc: published.doc,
+                did: published.did,
+                inventory,
+                ...(ladderSeed ? { ladderSeed } : {})
+            }),
+            anchorKeyMultibase: unlockKeys.updateKeyMultibase
+        });
         // What the edit's own attribution must resolve to: the pass below acts on
         // this list, so an edit that resolved a different one would strike
         // something the pass never covered.
@@ -96,10 +132,12 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
     // its remaining recipients from.
     const { did, doc, log, ladderVm } = await removeUnlockKey({
         idStore,
-        updateKeys,
+        signer,
         unlockKeys,
         ...(ladderSeed ? { ladderSeed } : {}),
+        ...(projectionStore ? { projectionStore } : {}),
         ...(expectedLadderVmIds !== undefined ? { expectedLadderVmIds } : {}),
+        requireLadderVmClaim: true,
         ...(expectedDid !== undefined ? { expectedDid } : {}),
         ...pinned,
         ...(verb !== undefined ? { verb } : {})
@@ -119,7 +157,7 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         }
     }
     // 2. The shared roster-and-cascade tail: the roster rotation onto the
-    // post-edit document (with its post-edit controller floor and its seal
+    // post-edit document (with its post-edit minimum controller version and its seal
     // backstop), then the collection fan-out onto the fresh key.
     const tail = await rotateRosterToDocumentAndCascade({
         rosterStore,
@@ -141,7 +179,7 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
             collections: tail.collections,
             document: doc,
             ...(clientAnnex ? { clientAnnex } : {}),
-            ...(remintDependentRecords ? { dependentRecords } : {})
+            ...(ranRemint ? { dependentRecords } : {})
         };
     }
     if (tail.rotated) {
@@ -156,7 +194,7 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         userKey: tail.userKey,
         rosterDescriptor: tail.rosterDescriptor,
         ...(clientAnnex ? { clientAnnex } : {}),
-        ...(remintDependentRecords ? { dependentRecords } : {})
+        ...(ranRemint ? { dependentRecords } : {})
     };
 }
 //# sourceMappingURL=retire.js.map

package/dist/unlock/retire.js.map

@@ -1 +1 @@
-{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAiGA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,8BAA8B,EAC9B,cAAc,EACd,eAAe,EAGhB,MAAM,oBAAoB,CAAA;AAwC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EA4BlB;IACC,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,gBAAyB,CAAA;IAC7B,IAAI,mBAAyC,CAAA;IAC7C,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC;YACrC,KAAK,EAAE,OAAO;YACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,MAAM;SACV,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;YACrD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,UAAU;YACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAA;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,oCAAoC;QACpC,mBAAmB,GAAG,SAAS,CAAC,WAAW,CAAA;QAC3C,gBAAgB,GAAG,MAAM,sBAAsB,CAAC;YAC9C,QAAQ,EAAE,SAAS,CAAC,GAAG;YACvB,qBAAqB,EAAE,SAAS,CAAC,WAAW;SAC7C,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;QACxD,OAAO;QACP,UAAU;QACV,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;QACT,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,WAAuD,CAAA;IAC3D,IAAI,0BAA0B,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,0BAA0B,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;QACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAA;AACH,CAAC"}
+{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAgHA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAIzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,eAAe,EACf,eAAe,EACf,aAAa,EAGd,MAAM,oBAAoB,CAAA;AAwC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,MAAM,EACN,UAAU,EACV,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EA6BlB;IACC,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,gBAAyB,CAAA;IAC7B,IAAI,mBAAyC,CAAA;IAC7C,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;IAC7E,IAAI,SAAS,IAAI,sBAAsB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC;YAC9C,OAAO;YACP,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,MAAM;YACT,cAAc,EAAE,0DAA0D;SAC3E,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;YACrD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,UAAU;YACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAA;QACF,qEAAqE;QACrE,wEAAwE;QACxE,gDAAgD;QAChD,MAAM,qBAAqB,CAAC;YAC1B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,cAAc,EAAE,aAAa,CAAC;gBAC5B,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,YAAY,EAAE,UAAU,CAAC,YAAY;aACtC,CAAC;YACF,KAAK,EAAE,MAAM,eAAe,CAAC;gBAC3B,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,SAAS;gBACT,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC;YACF,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;SAClD,CAAC,CAAA;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,oCAAoC;QACpC,mBAAmB,GAAG,SAAS,CAAC,WAAW,CAAA;QAC3C,gBAAgB,GAAG,MAAM,sBAAsB,CAAC;YAC9C,QAAQ,EAAE,SAAS,CAAC,GAAG;YACvB,qBAAqB,EAAE,SAAS,CAAC,WAAW;SAC7C,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;QACxD,OAAO;QACP,MAAM;QACN,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,oBAAoB,EAAE,IAAI;QAC1B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;QACT,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,WAAuD,CAAA;IAC3D,IAAI,0BAA0B,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,0BAA0B,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;QACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAA;AACH,CAAC"}

package/dist/unlock/standingClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standingClient.d.ts","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,yCAAyC,CAAA;AAI1E;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,aAAa,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;IAChC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgBhC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,aAAa,EAAE,UAAU,CAAA;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkBhC"}
+{"version":3,"file":"standingClient.d.ts","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,yCAAyC,CAAA;AAI1E;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,aAAa,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;IAChC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAmBhC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,aAAa,EAAE,UAAU,CAAA;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkBhC"}

package/dist/unlock/standingClient.js

@@ -22,6 +22,7 @@
  */
 import { hkdf } from '@noble/hashes/hkdf.js';
 import { sha256 } from '@noble/hashes/sha2.js';
+import { rosterRecipientKid } from '../keys/userKeyRoster.js';
 import { agentsFromSeed } from '../identity/agents.js';
 /**
  * The HKDF salt for a standing credential's client-side expansions, and the
@@ -57,7 +58,10 @@ export async function unlockClientIdentityFromSeed({ clientSeed }) {
         clientDid: agents.keyAgent.id,
         signingKeyMultibase: signingKeyMultibase,
         keyAgreementKeyMultibase,
-        recipientKid: `${agents.keyAgent.id}#${keyAgreementKeyMultibase}`
+        recipientKid: rosterRecipientKid({
+            signingKeyMultibase: signingKeyMultibase,
+            keyAgreementKeyMultibase
+        })
     };
 }
 /**

package/dist/unlock/standingClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"standingClient.js","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAA;AAC1E,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAwB/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,MAAM,CAAC,eAA6D,CAAA;IACtE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,CAAC,EAAE,AAAD,EAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO;QACL,UAAU;QACV,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC7B,mBAAmB,EAAE,mBAAoB;QACzC,wBAAwB;QACxB,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,wBAAwB,EAAE;KAClE,CAAA;AACH,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,CAAA;AACvC,CAAC"}
+{"version":3,"file":"standingClient.js","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAA;AAC1E,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAwB/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,MAAM,CAAC,eAA6D,CAAA;IACtE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,CAAC,EAAE,AAAD,EAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO;QACL,UAAU;QACV,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC7B,mBAAmB,EAAE,mBAAoB;QACzC,wBAAwB;QACxB,YAAY,EAAE,kBAAkB,CAAC;YAC/B,mBAAmB,EAAE,mBAAoB;YACzC,wBAAwB;SACzB,CAAC;KACH,CAAA;AACH,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,CAAA;AACvC,CAAC"}