@interop/wallet-core 0.62.0 → 0.66.0

package/dist/clientAnnex/recoveryLadderAnchored.js

@@ -12,11 +12,10 @@
  * `recovery/recoveryWebvh.ts`.
  */
 import { deriveNextKeyHash, updateDID } from '@interop/did-method-webvh';
-import { assertCarryOverCommitments, ladderVerificationMethod, MULTIKEY_VM_TYPE, pinOfLog, relationIds, updateKeySigner, withLogConflictRetry } from '../webvh/didWebvh.js';
-import { ladderVmIds } from '../webvh/listClients.js';
-import { credentialKeyAgreementMethods } from '../webvh/keyAgreement.js';
+import { assertCarryOverCommitments, ladderVerificationMethod, MULTIKEY_VM_TYPE, publishEntryPinned, readPublishedLogOrThrow, updateKeySigner, withLogConflictRetry } from '../webvh/didWebvh.js';
+import { credentialKeyAgreementMethods, ladderVmIds, relationIds } from '../resourceLog/document.js';
 import { unlockKeyVerificationMethod, unlockKeyVmId } from '../unlock/standingWebvh.js';
-import { publishLogOnly, readLogOrThrow, RecoveryKeyNotCommittedError, recoveryVmId, retiredCredentialVmIdsFromLog } from '../recovery/recoveryWebvh.js';
+import { RecoveryKeyNotCommittedError, recoveryVmId, retiredCredentialVmIdsFromLog } from '../recovery/recoveryWebvh.js';
 import { assertNextKeyHashesRemain, attributeRetiredCredentialRungs, ladderRung, ladderVmKeyMultibase, retiredCredentialRungsBeforeKey } from './ladder.js';
 import { clientAnnexDidParts, servicesPointedAtClientAnnex } from './log.js';
 /**
@@ -102,8 +101,10 @@ import { clientAnnexDidParts, servicesPointedAtClientAnnex } from './log.js';
  * @param options.credentialKeyAgreement {UnlockKeyAgreementPublication}   the
  *   fresh credential's key-agreement publication (a commitment for a
  *   passphrase-derived key)
- * @param options.replacement {RecoveryPublicKeys}   the replacement code's
- *   public halves, committed and published in the same continuation
+ * @param options.replacement {ReplacementRecoveryPublicKeys}   the
+ *   replacement code's public halves -- its key-agreement key, its rung-0
+ *   update key, and its ladder VM key -- committed and published in the same
+ *   continuation
  * @param [options.expectedDid] {string}   the account DID the log must resolve
  *   to, where the recovering flow already knows it
  * @param options.onCommitted {function}
@@ -153,14 +154,12 @@ async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, cre
     // Each attempt's own read is what the CAS publish is built on, so the
     // continuity check runs here -- and again on a conflict-retry re-run -- not
     // only on the verify that follows both entries.
-    const pinned = {
-        ...(pinStore ? { pinStore } : {}),
-        ...(logId !== undefined ? { logId } : {})
-    };
-    let published = await readLogOrThrow({
-        store,
-        ...(expectedDid !== undefined ? { expectedDid } : {}),
-        ...pinned
+    let published = await readPublishedLogOrThrow({
+        idStore: store,
+        expectedDid,
+        pinStore,
+        logId,
+        missingMessage: 'did:webvh: did.jsonl is missing; nothing to recover.'
     });
     const rung0 = await ladderRung({ ladderSeed, index: 0 });
     const rung1 = await ladderRung({ ladderSeed, index: 1 });
@@ -237,22 +236,23 @@ async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, cre
                 ])
             ]
         });
-        await publishLogOnly({
+        // The publish advances the pin to what the reveal entry just published,
+        // so the re-read below (and any read after a tear here) refuses a host
+        // that rolls the log back behind it.
+        await publishEntryPinned({
             store,
             log: updated.log,
-            ifMatch: published.etag
+            ifMatch: published.etag,
+            pinStore,
+            logId
         });
-        // Advance the pin to what the reveal entry just published, so the re-read
-        // below (and any read after a tear here) refuses a host that rolls the
-        // log back behind it.
-        if (pinStore && logId !== undefined) {
-            await pinStore.write({ logId, pin: pinOfLog(updated.log) });
-        }
         // The same account the reveal entry just extended, under the same pin.
-        published = await readLogOrThrow({
-            store,
+        published = await readPublishedLogOrThrow({
+            idStore: store,
             expectedDid: published.did,
-            ...pinned
+            pinStore,
+            logId,
+            missingMessage: 'did:webvh: did.jsonl is missing; nothing to recover.'
         });
     }
     // The persist-before-publish seam: the replacement code's record and the
@@ -293,7 +293,19 @@ async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, cre
     // controller (an enrolled client's carries the client marker instead), less
     // the ids this entry itself adds. The spent code's own id is reported
     // separately: the caller already retires that one by name.
-    const addedVmIds = [ladderVmId, credentialVmId, replacementVmId];
+    // The replacement code's ladder VM, published beside its key-agreement
+    // member: a code is a standing credential with a ladder, and its own bridge
+    // delegation is signed by this VM, so a replacement without it could never
+    // spend (`decisions/0019`, `decisions/0020`). Its rung-0 hash is already
+    // committed by the reveal-and-commit entry, which this entry carries
+    // through.
+    const replacementLadderVmId = `${did}#${replacement.ladderVmKeyMultibase}`;
+    const addedVmIds = [
+        ladderVmId,
+        credentialVmId,
+        replacementVmId,
+        replacementLadderVmId
+    ];
     const struckCredentialVmIds = credentialKeyAgreementMethods({ doc, did })
         .map(method => method.id)
         .filter((id) => typeof id === 'string')
@@ -320,7 +332,11 @@ async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, cre
             type: MULTIKEY_VM_TYPE,
             controller: did,
             publicKeyMultibase: replacement.keyAgreementKeyMultibase
-        }
+        },
+        ladderVerificationMethod({
+            controller: did,
+            publicKeyMultibase: replacement.ladderVmKeyMultibase
+        })
     ];
     const existingMethods = (doc.verificationMethod ?? []);
     const verificationMethods = [
@@ -365,14 +381,18 @@ async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, cre
         // `capabilityInvocation` -- which is also what keeps it out of every
         // client listing.
         authentication: withoutRemoved(doc.authentication),
-        assertionMethod: withoutRemoved(doc.assertionMethod, [ladderVmId]),
+        assertionMethod: withoutRemoved(doc.assertionMethod, [
+            ladderVmId,
+            replacementLadderVmId
+        ]),
         keyAgreement: withoutRemoved(doc.keyAgreement, [
             credentialVmId,
             replacementVmId
         ]),
         capabilityInvocation: withoutRemoved(doc.capabilityInvocation),
         capabilityDelegation: withoutRemoved(doc.capabilityDelegation, [
-            ladderVmId
+            ladderVmId,
+            replacementLadderVmId
         ]),
         // Atomic with the retirement above: the pointer and the ladder-VM set
         // change in one entry, so no window exists in which the document points
@@ -385,12 +405,13 @@ async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, cre
     });
     // Conditional on the read this entry was built on: the re-read above when
     // the commit entry ran here, the first read when it was skipped.
-    await publishLogOnly({ store, log: updated.log, ifMatch: published.etag });
-    // Advance the pin to what this entry just published, so a host rolling the
-    // log back straight afterwards is refused on the next read.
-    if (pinStore && logId !== undefined) {
-        await pinStore.write({ logId, pin: pinOfLog(updated.log) });
-    }
+    await publishEntryPinned({
+        store,
+        log: updated.log,
+        ifMatch: published.etag,
+        pinStore,
+        logId
+    });
     return {
         did: updated.did,
         doc: updated.doc,

package/dist/clientAnnex/recoveryLadderAnchored.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryLadderAnchored.js","sourceRoot":"","sources":["../../src/clientAnnex/recoveryLadderAnchored.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAA;AACxE,OAAO,EACL,2BAA2B,EAC3B,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,YAAY,EACZ,6BAA6B,EAG9B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,UAAU,EACV,oBAAoB,EACpB,+BAA+B,EAChC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8GG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAUhD;IASC,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,6DAA6D;IAC7D,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,mEAAmE;YACjE,oEAAoE;YACpE,oCAAoC,CACvC,CAAA;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,8BAA8B,CAAC,EAC5C,KAAK,EACL,QAAQ,EACR,UAAU,EACV,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,KAAK,EAWN;IASC,sEAAsE;IACtE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;KACV,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC9D,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,6CAA6C;QAC7C,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,SAAS,EAAE,YAAY,CAAC;gBACtB,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;aAC5D,CAAC;SACH,CAAC,CAAA;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;YACnD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,sBAAsB,EAAE,KAAK,CAAC,YAAY;YAC1C,eAAe,EAAE,OAAO;YACxB,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC;YACxD,aAAa,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;SACpC,CAAC,CAAA;QACF,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,sBAAsB,EAAE,OAAO;YAC/B,gBAAgB,EAAE,MAAM,CAAC,YAAY;YACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;SAC1D,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CACrE,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CACvC,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,SAAS;oBACT,SAAS;oBACT,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;SACxB,CAAC,CAAA;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,sBAAsB;QACtB,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7D,CAAC;QACD,uEAAuE;QACvE,SAAS,GAAG,MAAM,cAAc,CAAC;YAC/B,KAAK;YACL,WAAW,EAAE,SAAS,CAAC,GAAG;YAC1B,GAAG,MAAM;SACV,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,WAAW,EAAE,CAAA;IACrC,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAA;IAEtD,kEAAkE;IAClE,6EAA6E;IAC7E,mEAAmE;IACnE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,GAAG;QACf,kBAAkB,EAAE,WAAW;KAChC,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC1C,MAAM,YAAY,GAAG,2BAA2B,CAAC;QAC/C,GAAG;QACH,YAAY,EAAE,sBAAsB;KACrC,CAAC,CAAA;IACF,MAAM,cAAc,GAAG,aAAa,CAAC;QACnC,GAAG;QACH,YAAY,EAAE,sBAAsB;KACrC,CAAC,CAAA;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,2DAA2D;IAC3D,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,eAAe,CAAC,CAAA;IAChE,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACtE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;SACpD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IACzC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,MAAM,CACzD,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CACvB,CAAA;IACD,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;QACnD,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,eAAe,EAAE,sBAAsB;QACvC,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC;QACxD,aAAa,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;KACpC,CAAC,CAAA;IACF,MAAM,YAAY,GAAyB;QACzC,QAAQ;QACR,YAAY;QACZ;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;KACF,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YACnD,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS;gBACtB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CACnD;QACD,GAAG,YAAY;KAChB,CAAA;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,CACrB,QAAqD,EACrD,KAAgB,EAChB,EAAE,CAAC;QACH,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC7B,YAAY,CAAC,EAAE,CACb,YAAY,KAAK,SAAS;gBAC1B,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACjC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAChD;YACD,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,CAAC;KACH,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CACJ,GAAG,KAAK,QAAQ,CAAC,kBAAkB;oBACnC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnC;gBACD,KAAK,CAAC,YAAY;aACnB,CAAC;SACH;QACD,aAAa,EAAE,yBAAyB,CAAC;YACvC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrE;YACD,QAAQ,EAAE,6CAA6C;SACxD,CAAC;QACF,mBAAmB;QACnB,4DAA4D;QAC5D,yDAAyD;QACzD,qEAAqE;QACrE,kBAAkB;QAClB,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC;QAClD,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,CAAC;QAClE,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE;YAC7C,cAAc;YACd,eAAe;SAChB,CAAC;QACF,oBAAoB,EAAE,cAAc,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC9D,oBAAoB,EAAE,cAAc,CAAC,GAAG,CAAC,oBAAoB,EAAE;YAC7D,UAAU;SACX,CAAC;QACF,sEAAsE;QACtE,wEAAwE;QACxE,qDAAqD;QACrD,QAAQ,EAAE,4BAA4B,CAAC;YACrC,GAAG;YACH,UAAU,EAAE,GAAG;YACf,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CAAC;KACH,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,sBAAsB;QACtB,gBAAgB,EAAE,MAAM,CAAC,YAAY;QACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAA;AACH,CAAC"}
+{"version":3,"file":"recoveryLadderAnchored.js","sourceRoot":"","sources":["../../src/clientAnnex/recoveryLadderAnchored.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,6BAA6B,EAC7B,WAAW,EACX,WAAW,EACZ,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,2BAA2B,EAC3B,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,4BAA4B,EAC5B,YAAY,EACZ,6BAA6B,EAI9B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,UAAU,EACV,oBAAoB,EACpB,+BAA+B,EAChC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAUhD;IASC,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,6DAA6D;IAC7D,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,mEAAmE;YACjE,oEAAoE;YACpE,oCAAoC,CACvC,CAAA;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,8BAA8B,CAAC,EAC5C,KAAK,EACL,QAAQ,EACR,UAAU,EACV,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,KAAK,EAWN;IASC,sEAAsE;IACtE,4EAA4E;IAC5E,gDAAgD;IAChD,IAAI,SAAS,GAAG,MAAM,uBAAuB,CAAC;QAC5C,OAAO,EAAE,KAAK;QACd,WAAW;QACX,QAAQ;QACR,KAAK;QACL,cAAc,EAAE,sDAAsD;KACvE,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC9D,uEAAuE;IACvE,0DAA0D;IAC1D,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,6CAA6C;QAC7C,MAAM,OAAO,GAAG,6BAA6B,CAAC;YAC5C,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,qBAAqB,EAAE,KAAK,CAAC,YAAY;YACzC,SAAS,EAAE,YAAY,CAAC;gBACtB,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;aAC5D,CAAC;SACH,CAAC,CAAA;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;YACnD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,sBAAsB,EAAE,KAAK,CAAC,YAAY;YAC1C,eAAe,EAAE,OAAO;YACxB,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC;YACxD,aAAa,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;SACpC,CAAC,CAAA;QACF,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,sBAAsB,EAAE,OAAO;YAC/B,gBAAgB,EAAE,MAAM,CAAC,YAAY;YACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;SAC1D,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CACrE,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CACvC,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,SAAS;oBACT,SAAS;oBACT,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,wEAAwE;QACxE,uEAAuE;QACvE,qCAAqC;QACrC,MAAM,kBAAkB,CAAC;YACvB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;YACvB,QAAQ;YACR,KAAK;SACN,CAAC,CAAA;QACF,uEAAuE;QACvE,SAAS,GAAG,MAAM,uBAAuB,CAAC;YACxC,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,SAAS,CAAC,GAAG;YAC1B,QAAQ;YACR,KAAK;YACL,cAAc,EAAE,sDAAsD;SACvE,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,WAAW,EAAE,CAAA;IACrC,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAA;IAEtD,kEAAkE;IAClE,6EAA6E;IAC7E,mEAAmE;IACnE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,GAAG;QACf,kBAAkB,EAAE,WAAW;KAChC,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC1C,MAAM,YAAY,GAAG,2BAA2B,CAAC;QAC/C,GAAG;QACH,YAAY,EAAE,sBAAsB;KACrC,CAAC,CAAA;IACF,MAAM,cAAc,GAAG,aAAa,CAAC;QACnC,GAAG;QACH,YAAY,EAAE,sBAAsB;KACrC,CAAC,CAAA;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,2DAA2D;IAC3D,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,WAAW;IACX,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,CAAA;IAC1E,MAAM,UAAU,GAAG;QACjB,UAAU;QACV,cAAc;QACd,eAAe;QACf,qBAAqB;KACtB,CAAA;IACD,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACtE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;SACpD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;IACzC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,MAAM,CACzD,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CACvB,CAAA;IACD,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;QACnD,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,eAAe,EAAE,sBAAsB;QACvC,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC;QACxD,aAAa,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;KACpC,CAAC,CAAA;IACF,MAAM,YAAY,GAAyB;QACzC,QAAQ;QACR,YAAY;QACZ;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;QACD,wBAAwB,CAAC;YACvB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,oBAAoB;SACrD,CAAC;KACH,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YACnD,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS;gBACtB,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CACnD;QACD,GAAG,YAAY;KAChB,CAAA;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,CACrB,QAAqD,EACrD,KAAgB,EAChB,EAAE,CAAC;QACH,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC7B,YAAY,CAAC,EAAE,CACb,YAAY,KAAK,SAAS;gBAC1B,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACjC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAChD;YACD,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,CAAC;KACH,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CACJ,GAAG,KAAK,QAAQ,CAAC,kBAAkB;oBACnC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnC;gBACD,KAAK,CAAC,YAAY;aACnB,CAAC;SACH;QACD,aAAa,EAAE,yBAAyB,CAAC;YACvC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrE;YACD,QAAQ,EAAE,6CAA6C;SACxD,CAAC;QACF,mBAAmB;QACnB,4DAA4D;QAC5D,yDAAyD;QACzD,qEAAqE;QACrE,kBAAkB;QAClB,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC;QAClD,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE;YACnD,UAAU;YACV,qBAAqB;SACtB,CAAC;QACF,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE;YAC7C,cAAc;YACd,eAAe;SAChB,CAAC;QACF,oBAAoB,EAAE,cAAc,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC9D,oBAAoB,EAAE,cAAc,CAAC,GAAG,CAAC,oBAAoB,EAAE;YAC7D,UAAU;YACV,qBAAqB;SACtB,CAAC;QACF,sEAAsE;QACtE,wEAAwE;QACxE,qDAAqD;QACrD,QAAQ,EAAE,4BAA4B,CAAC;YACrC,GAAG;YACH,UAAU,EAAE,GAAG;YACf,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CAAC;KACH,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,kBAAkB,CAAC;QACvB,KAAK;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,SAAS,CAAC,IAAI;QACvB,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,sBAAsB;QACtB,gBAAgB,EAAE,MAAM,CAAC,YAAY;QACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAA;AACH,CAAC"}

package/dist/clientAnnex/spaceCapability.d.ts

@@ -0,0 +1,123 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Single-verb Space capabilities: the short-lived children a transient
+ * session mints so it can destroy (or probe) a Space it has no root
+ * invocation over. Two shapes, one mint, both target-exact:
+ *
+ * - Three links, over a stored parent. The parent is the management zcap an
+ *   unlock identity delegated to the account at bind time. The child's
+ *   `invocationTarget` is the parent's own, copied verbatim from the parent's
+ *   bytes rather than rebuilt, so a deployment whose stored parent carries a
+ *   target this client would build differently still lands on the bytes the
+ *   server checks.
+ * - Two links, over a Space's synthesized root. The child's
+ *   `invocationTarget` is the bare Space URL, built with was-client's path
+ *   builders so a sub-path deployment keeps its prefix.
+ *
+ * `allowedAction` is exactly one HTTP verb -- `DELETE` for the deletion
+ * child, `GET` for the probe child -- which is what a storage server's
+ * admission predicate keys on. The delegatee is the caller's: the ladder
+ * VM's bare did:key on a transient session (it re-derives from the ladder
+ * seed and resolves from its own bytes, so it outlives the account log it
+ * was minted beside), the account did:webvh on a remembered one.
+ *
+ * Nothing here is stored. A child is minted immediately before its own
+ * request and dropped; on a torn run it lapses by its short TTL, so no
+ * revocation is owed.
+ *
+ * Two checks stay with the caller rather than here: that the parent's
+ * `controller` is the delegator this client signs as, and that the parent's
+ * target names the Space the caller means on the deployment it is talking
+ * to. The caller holds the deployment URL and the delegator DID; this module
+ * holds neither, and guessing either would rebuild the very bytes the
+ * verbatim copy exists to preserve.
+ */
+import type { IZcap } from '@interop/data-integrity-core';
+import type { ZcapClient } from '@interop/ezcap';
+/**
+ * The single-verb Space capability's lifetime: ten minutes, long enough for
+ * the request it is minted for and twice `@interop/zcap`'s 300-second clock
+ * skew allowance. A child's `expires` is the earlier of this and its
+ * parent's, since the library refuses a child less restrictive than its
+ * parent with no skew allowance.
+ */
+export declare const DELETION_ZCAP_TTL_MS: number;
+/**
+ * The two verbs a single-verb Space capability may carry: the deletion
+ * child's `DELETE` and the probe child's `GET`.
+ */
+export type SpaceCapabilityVerb = 'DELETE' | 'GET';
+/**
+ * The typed refusal of a mint over a parent capability whose own `expires`
+ * has already passed: the child would verify nowhere, so nothing is minted
+ * and nothing is sent. Matched on `name` -- error classes do not survive
+ * crossing package copies. The parent's `expires` and `id` ride the error so
+ * a caller can name the lapsed capability in its own copy without re-reading
+ * the parent.
+ */
+export declare class ExpiredParentCapabilityError extends Error {
+    readonly parentExpires: string;
+    readonly parentId: string | undefined;
+    constructor({ message, parentExpires, parentId }: {
+        message: string;
+        parentExpires: string;
+        parentId: string | undefined;
+    });
+}
+/**
+ * Mints a single-verb child of a STORED parent capability -- the three-link
+ * shape, used on an unlock Space whose management zcap the account already
+ * holds. The child's `invocationTarget` is the parent's unchanged.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating signer (the ladder
+ *   VM's client on a transient session, an enrolled client's on a remembered
+ *   one)
+ * @param options.parent {IZcap}   the stored parent capability
+ * @param options.verb {SpaceCapabilityVerb}   the child's one allowed action
+ * @param options.controller {string}   the delegatee DID
+ * @param [options.ttlMs] {number}   the child's requested lifetime
+ * @param [options.now] {number}   the clock the child is minted against
+ *   (epoch milliseconds); a caller holding server-relative time passes it
+ *   so the proof's `created` and the child's `expires` come off one clock
+ * @returns {Promise<IZcap>}
+ */
+export declare function mintSpaceVerbCapability({ zcapClient, parent, verb, controller, ttlMs, now }: {
+    zcapClient: ZcapClient;
+    parent: IZcap;
+    verb: SpaceCapabilityVerb;
+    controller: string;
+    ttlMs?: number;
+    now?: number;
+}): Promise<IZcap>;
+/**
+ * Mints a single-verb child of a Space's SYNTHESIZED ROOT -- the two-link
+ * shape, used on the account Space and an auxiliary annex Space, where the
+ * session holds no stored parent. The child's `invocationTarget` is the bare
+ * Space URL, with no trailing slash, so the deletion child covers the Space
+ * itself rather than its items subtree.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating signer
+ * @param options.storageServerUrl {string}   the Space's storage server
+ * @param options.spaceId {string}
+ * @param options.verb {SpaceCapabilityVerb}   the child's one allowed action
+ * @param options.controller {string}   the delegatee DID
+ * @param [options.ttlMs] {number}   the child's requested lifetime
+ * @param [options.now] {number}   the clock the child is minted against
+ *   (epoch milliseconds); a caller holding server-relative time passes it
+ *   so the proof's `created` and the child's `expires` come off one clock
+ * @returns {Promise<IZcap>}
+ */
+export declare function mintSpaceRootVerbCapability({ zcapClient, storageServerUrl, spaceId, verb, controller, ttlMs, now }: {
+    zcapClient: ZcapClient;
+    storageServerUrl: string;
+    spaceId: string;
+    verb: SpaceCapabilityVerb;
+    controller: string;
+    ttlMs?: number;
+    now?: number;
+}): Promise<IZcap>;
+//# sourceMappingURL=spaceCapability.d.ts.map

package/dist/clientAnnex/spaceCapability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spaceCapability.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/spaceCapability.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAiB,CAAA;AAElD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,KAAK,CAAA;AAElD;;;;;;;GAOG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;gBAEzB,EACV,OAAO,EACP,aAAa,EACb,QAAQ,EACT,EAAE;QACD,OAAO,EAAE,MAAM,CAAA;QACf,aAAa,EAAE,MAAM,CAAA;QACrB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;KAC7B;CAMF;AA+ED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,UAAU,EACV,MAAM,EACN,IAAI,EACJ,UAAU,EACV,KAA4B,EAC5B,GAAgB,EACjB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,KAAK,CAAA;IACb,IAAI,EAAE,mBAAmB,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,KAAK,CAAC,CAkBjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,IAAI,EACJ,UAAU,EACV,KAA4B,EAC5B,GAAgB,EACjB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,gBAAgB,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,mBAAmB,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,KAAK,CAAC,CAajB"}

package/dist/clientAnnex/spaceCapability.js

@@ -0,0 +1,152 @@
+import { rootCapabilityId, spacePath, toUrl } from '@interop/was-client/paths';
+/**
+ * The single-verb Space capability's lifetime: ten minutes, long enough for
+ * the request it is minted for and twice `@interop/zcap`'s 300-second clock
+ * skew allowance. A child's `expires` is the earlier of this and its
+ * parent's, since the library refuses a child less restrictive than its
+ * parent with no skew allowance.
+ */
+export const DELETION_ZCAP_TTL_MS = 10 * 60 * 1000;
+/**
+ * The typed refusal of a mint over a parent capability whose own `expires`
+ * has already passed: the child would verify nowhere, so nothing is minted
+ * and nothing is sent. Matched on `name` -- error classes do not survive
+ * crossing package copies. The parent's `expires` and `id` ride the error so
+ * a caller can name the lapsed capability in its own copy without re-reading
+ * the parent.
+ */
+export class ExpiredParentCapabilityError extends Error {
+    parentExpires;
+    parentId;
+    constructor({ message, parentExpires, parentId }) {
+        super(message);
+        this.name = 'ExpiredParentCapabilityError';
+        this.parentExpires = parentExpires;
+        this.parentId = parentId;
+    }
+}
+/**
+ * The child's expiry: `min(now + ttlMs, parent.expires)`. A parent already
+ * expired is refused rather than minted from, since the child would verify
+ * nowhere.
+ *
+ * @param options {object}
+ * @param options.ttlMs {number}
+ * @param [options.parent] {IZcap}   the stored parent capability, absent on
+ *   the root-parented shape (a synthesized root has no expiry)
+ * @param options.now {number}   epoch milliseconds
+ * @returns {Date}
+ */
+function childExpires({ ttlMs, parent, now }) {
+    const requested = now + ttlMs;
+    const parentExpires = Date.parse(parent?.expires ?? '');
+    if (Number.isNaN(parentExpires)) {
+        return new Date(requested);
+    }
+    if (parentExpires <= now) {
+        const expiresIso = new Date(parentExpires).toISOString();
+        throw new ExpiredParentCapabilityError({
+            message: 'single-verb Space capability: the parent capability expired at ' +
+                `${expiresIso}; refusing to mint a child that verifies nowhere.`,
+            parentExpires: expiresIso,
+            parentId: parent?.id
+        });
+    }
+    return new Date(Math.min(requested, parentExpires));
+}
+/**
+ * Refuses a child the parent cannot authorize. A parent's `allowedAction` may
+ * be a single string, a list, or absent (which delegates every action), so
+ * the check normalizes before asking. Refusing locally is what keeps the
+ * failure legible: an unauthorized invocation comes back from the storage
+ * server as a 404, indistinguishable from a Space that is simply gone, so a
+ * child that verifies nowhere must never be minted and sent.
+ *
+ * @param options {object}
+ * @param options.parent {IZcap}
+ * @param options.verb {SpaceCapabilityVerb}
+ * @returns {void}
+ */
+function assertParentAllows({ parent, verb }) {
+    const allowed = parent
+        .allowedAction;
+    if (allowed === undefined) {
+        return;
+    }
+    const actions = Array.isArray(allowed) ? allowed : [allowed];
+    if (actions.length === 0 || actions.includes(verb)) {
+        return;
+    }
+    throw new Error(`single-verb Space capability: the parent capability allows ` +
+        `${actions.join(', ')} and not ${verb}; refusing to mint a child that ` +
+        'verifies nowhere.');
+}
+/**
+ * Mints a single-verb child of a STORED parent capability -- the three-link
+ * shape, used on an unlock Space whose management zcap the account already
+ * holds. The child's `invocationTarget` is the parent's unchanged.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating signer (the ladder
+ *   VM's client on a transient session, an enrolled client's on a remembered
+ *   one)
+ * @param options.parent {IZcap}   the stored parent capability
+ * @param options.verb {SpaceCapabilityVerb}   the child's one allowed action
+ * @param options.controller {string}   the delegatee DID
+ * @param [options.ttlMs] {number}   the child's requested lifetime
+ * @param [options.now] {number}   the clock the child is minted against
+ *   (epoch milliseconds); a caller holding server-relative time passes it
+ *   so the proof's `created` and the child's `expires` come off one clock
+ * @returns {Promise<IZcap>}
+ */
+export async function mintSpaceVerbCapability({ zcapClient, parent, verb, controller, ttlMs = DELETION_ZCAP_TTL_MS, now = Date.now() }) {
+    const invocationTarget = parent
+        .invocationTarget;
+    if (invocationTarget === undefined) {
+        throw new Error('single-verb Space capability: the parent capability names no ' +
+            '`invocationTarget`.');
+    }
+    assertParentAllows({ parent, verb });
+    return (await zcapClient.delegate({
+        capability: parent,
+        invocationTarget,
+        controller,
+        allowedActions: [verb],
+        expires: childExpires({ ttlMs, parent, now }),
+        now
+    }));
+}
+/**
+ * Mints a single-verb child of a Space's SYNTHESIZED ROOT -- the two-link
+ * shape, used on the account Space and an auxiliary annex Space, where the
+ * session holds no stored parent. The child's `invocationTarget` is the bare
+ * Space URL, with no trailing slash, so the deletion child covers the Space
+ * itself rather than its items subtree.
+ *
+ * @param options {object}
+ * @param options.zcapClient {ZcapClient}   the delegating signer
+ * @param options.storageServerUrl {string}   the Space's storage server
+ * @param options.spaceId {string}
+ * @param options.verb {SpaceCapabilityVerb}   the child's one allowed action
+ * @param options.controller {string}   the delegatee DID
+ * @param [options.ttlMs] {number}   the child's requested lifetime
+ * @param [options.now] {number}   the clock the child is minted against
+ *   (epoch milliseconds); a caller holding server-relative time passes it
+ *   so the proof's `created` and the child's `expires` come off one clock
+ * @returns {Promise<IZcap>}
+ */
+export async function mintSpaceRootVerbCapability({ zcapClient, storageServerUrl, spaceId, verb, controller, ttlMs = DELETION_ZCAP_TTL_MS, now = Date.now() }) {
+    const spaceUrl = toUrl({
+        serverUrl: storageServerUrl,
+        path: spacePath(spaceId)
+    });
+    return (await zcapClient.delegate({
+        capability: rootCapabilityId(spaceUrl),
+        invocationTarget: spaceUrl,
+        controller,
+        allowedActions: [verb],
+        expires: childExpires({ ttlMs, now }),
+        now
+    }));
+}
+//# sourceMappingURL=spaceCapability.js.map

package/dist/clientAnnex/spaceCapability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spaceCapability.js","sourceRoot":"","sources":["../../src/clientAnnex/spaceCapability.ts"],"names":[],"mappings":"AAsCA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAQlD;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,aAAa,CAAQ;IACrB,QAAQ,CAAoB;IAErC,YAAY,EACV,OAAO,EACP,aAAa,EACb,QAAQ,EAKT;QACC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;QAC1C,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,EACpB,KAAK,EACL,MAAM,EACN,GAAG,EAKJ;IACC,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,CAAA;IAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAC7B,MAA+B,EAAE,OAAO,IAAI,EAAE,CAChD,CAAA;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAA;QACxD,MAAM,IAAI,4BAA4B,CAAC;YACrC,OAAO,EACL,iEAAiE;gBACjE,GAAG,UAAU,mDAAmD;YAClE,aAAa,EAAE,UAAU;YACzB,QAAQ,EAAG,MAA0B,EAAE,EAAE;SAC1C,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,EAC1B,MAAM,EACN,IAAI,EAIL;IACC,MAAM,OAAO,GAAI,MAAgD;SAC9D,aAAa,CAAA;IAChB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAM;IACR,CAAC;IACD,MAAM,IAAI,KAAK,CACb,6DAA6D;QAC3D,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,kCAAkC;QACvE,mBAAmB,CACtB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,UAAU,EACV,MAAM,EACN,IAAI,EACJ,UAAU,EACV,KAAK,GAAG,oBAAoB,EAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAQjB;IACC,MAAM,gBAAgB,GAAI,MAAwC;SAC/D,gBAAgB,CAAA;IACnB,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,+DAA+D;YAC7D,qBAAqB,CACxB,CAAA;IACH,CAAC;IACD,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACpC,OAAO,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC;QAChC,UAAU,EAAE,MAAM;QAClB,gBAAgB;QAChB,UAAU;QACV,cAAc,EAAE,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC7C,GAAG;KACJ,CAAC,CAAU,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,UAAU,EACV,gBAAgB,EAChB,OAAO,EACP,IAAI,EACJ,UAAU,EACV,KAAK,GAAG,oBAAoB,EAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EASjB;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC;QACrB,SAAS,EAAE,gBAAgB;QAC3B,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC;KACzB,CAAC,CAAA;IACF,OAAO,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC;QAChC,UAAU,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACtC,gBAAgB,EAAE,QAAQ;QAC1B,UAAU;QACV,cAAc,EAAE,CAAC,IAAI,CAAC;QACtB,OAAO,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG;KACJ,CAAC,CAAU,CAAA;AACd,CAAC"}

package/dist/clientAnnex/stages.d.ts

@@ -0,0 +1,63 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The stage vocabulary of the credential-anchored ceremonies: the ordered
+ * tuples their `onStage` notifiers report from, the aliases, and the union
+ * types derived from them. The ceremonies emit from these types, so a
+ * mistyped stage name fails the type check, and a consumer's progress
+ * display derives its step list from the tuples instead of re-declaring the
+ * names as bare strings.
+ *
+ * The vocabulary sits in a leaf module of its own rather than beside the
+ * code that emits it, because a progress display needs the names and none of
+ * the ceremony: an app store importing them from `establish.js` would pull
+ * that whole module graph into its bundle.
+ */
+import { KMS_AUTHENTICATION_STAGE } from '../stages.js';
+export { KMS_AUTHENTICATION_STAGE };
+/**
+ * The controller-promotion stage, emitted by the genesis ceremony when it
+ * promotes and by the establishment when the promotion is deferred to it.
+ * Declared once so the two emitters cannot drift apart.
+ */
+export declare const CONTROLLER_PROMOTION_STAGE = "controller-promotion";
+/**
+ * The stages `ensureCredentialAnchoredAccountGenesis` reports, in the order
+ * they fire, up to but not including the controller promotion (which a
+ * caller may defer -- see {@link CONTROLLER_PROMOTION_STAGE}).
+ */
+export declare const CREDENTIAL_ANCHORED_GENESIS_STAGES: readonly ["space-provisioning", "kms-authentication", "webvh-genesis", "roster-genesis", "collection-epochs"];
+/**
+ * A stage name the credential-anchored genesis may emit.
+ */
+export type CredentialAnchoredGenesisStage = (typeof CREDENTIAL_ANCHORED_GENESIS_STAGES)[number] | typeof CONTROLLER_PROMOTION_STAGE;
+/**
+ * The establishment's stage names in the order they fire: its own marks with
+ * the genesis ceremony's spliced in where that ceremony runs (stage 2).
+ *
+ * Two kinds of name are absent by construction. The stages whose body is a
+ * caller's own closure (`beforePromotion`, `promoteKeystore`) are the
+ * caller's to name and mark, since only the caller knows what its closure
+ * does; and an alias below fires in place of a listed name rather than
+ * beside it.
+ */
+export declare const CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGES: readonly ["interim-bind", "space-provisioning", "kms-authentication", "webvh-genesis", "roster-genesis", "collection-epochs", "account-log-read", "annex-generation", "record-rebind", "controller-promotion"];
+/**
+ * A stage the establishment reports as a step of its own.
+ */
+export type CredentialAnchoredEstablishmentStage = (typeof CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGES)[number];
+/**
+ * Stage names that fire in place of a listed stage rather than beside it,
+ * and the stage each stands in for. The heal branch delivers the collection
+ * epochs off an adopted roster instead of minting them, so its mark closes
+ * the boundary `collection-epochs` closes on a fresh run.
+ */
+export declare const CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGE_ALIASES: {
+    readonly 'roster-delivered-epochs': "collection-epochs";
+};
+/**
+ * Every name the establishment may emit: the stages above plus the aliases.
+ */
+export type CredentialAnchoredEstablishmentStageName = CredentialAnchoredEstablishmentStage | keyof typeof CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGE_ALIASES;
+//# sourceMappingURL=stages.d.ts.map

package/dist/clientAnnex/stages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/stages.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD,OAAO,EAAE,wBAAwB,EAAE,CAAA;AAEnC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,yBAAyB,CAAA;AAEhE;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,+GAMrC,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,8BAA8B,GACtC,CAAC,OAAO,kCAAkC,CAAC,CAAC,MAAM,CAAC,GACnD,OAAO,0BAA0B,CAAA;AAErC;;;;;;;;;GASG;AACH,eAAO,MAAM,wCAAwC,gNAO3C,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,oCAAoC,GAC9C,CAAC,OAAO,wCAAwC,CAAC,CAAC,MAAM,CAAC,CAAA;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,+CAA+C;;CAEa,CAAA;AAEzE;;GAEG;AACH,MAAM,MAAM,wCAAwC,GAChD,oCAAoC,GACpC,MAAM,OAAO,+CAA+C,CAAA"}

package/dist/clientAnnex/stages.js

@@ -0,0 +1,64 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The stage vocabulary of the credential-anchored ceremonies: the ordered
+ * tuples their `onStage` notifiers report from, the aliases, and the union
+ * types derived from them. The ceremonies emit from these types, so a
+ * mistyped stage name fails the type check, and a consumer's progress
+ * display derives its step list from the tuples instead of re-declaring the
+ * names as bare strings.
+ *
+ * The vocabulary sits in a leaf module of its own rather than beside the
+ * code that emits it, because a progress display needs the names and none of
+ * the ceremony: an app store importing them from `establish.js` would pull
+ * that whole module graph into its bundle.
+ */
+import { KMS_AUTHENTICATION_STAGE } from '../stages.js';
+export { KMS_AUTHENTICATION_STAGE };
+/**
+ * The controller-promotion stage, emitted by the genesis ceremony when it
+ * promotes and by the establishment when the promotion is deferred to it.
+ * Declared once so the two emitters cannot drift apart.
+ */
+export const CONTROLLER_PROMOTION_STAGE = 'controller-promotion';
+/**
+ * The stages `ensureCredentialAnchoredAccountGenesis` reports, in the order
+ * they fire, up to but not including the controller promotion (which a
+ * caller may defer -- see {@link CONTROLLER_PROMOTION_STAGE}).
+ */
+export const CREDENTIAL_ANCHORED_GENESIS_STAGES = [
+    'space-provisioning',
+    KMS_AUTHENTICATION_STAGE,
+    'webvh-genesis',
+    'roster-genesis',
+    'collection-epochs'
+];
+/**
+ * The establishment's stage names in the order they fire: its own marks with
+ * the genesis ceremony's spliced in where that ceremony runs (stage 2).
+ *
+ * Two kinds of name are absent by construction. The stages whose body is a
+ * caller's own closure (`beforePromotion`, `promoteKeystore`) are the
+ * caller's to name and mark, since only the caller knows what its closure
+ * does; and an alias below fires in place of a listed name rather than
+ * beside it.
+ */
+export const CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGES = [
+    'interim-bind',
+    ...CREDENTIAL_ANCHORED_GENESIS_STAGES,
+    'account-log-read',
+    'annex-generation',
+    'record-rebind',
+    CONTROLLER_PROMOTION_STAGE
+];
+/**
+ * Stage names that fire in place of a listed stage rather than beside it,
+ * and the stage each stands in for. The heal branch delivers the collection
+ * epochs off an adopted roster instead of minting them, so its mark closes
+ * the boundary `collection-epochs` closes on a fresh run.
+ */
+export const CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGE_ALIASES = {
+    'roster-delivered-epochs': 'collection-epochs'
+};
+//# sourceMappingURL=stages.js.map

package/dist/clientAnnex/stages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages.js","sourceRoot":"","sources":["../../src/clientAnnex/stages.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD,OAAO,EAAE,wBAAwB,EAAE,CAAA;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAA;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,oBAAoB;IACpB,wBAAwB;IACxB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;CACX,CAAA;AASV;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,cAAc;IACd,GAAG,kCAAkC;IACrC,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,0BAA0B;CAClB,CAAA;AAQV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D,yBAAyB,EAAE,mBAAmB;CACyB,CAAA"}

package/dist/clientAnnex/zcap.d.ts

@@ -1,4 +1,4 @@
-import { ZcapClient } from '@interop/ezcap';
+import type { ZcapClient } from '@interop/ezcap';
 import type { ICapabilityAgent } from '../webvh/zcap.js';
 /**
  * A ZcapClient signing with the account ladder's document-visible

package/dist/clientAnnex/zcap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zcap.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGxD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EACX,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4B5B"}
+{"version":3,"file":"zcap.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAgDxD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EACX,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CAAC,EAClC,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkB5B"}