@interop/wallet-core 0.62.0 → 0.66.0

package/dist/unlock/retire.js

@@ -1,5 +1,6 @@
 import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
-import { attributeUnlockLadderInventory, readLogOrThrow, removeUnlockKey } from './standingWebvh.js';
+import { readPublishedLogOrThrow } from '../webvh/didWebvh.js';
+import { assertLadderVmClaimed, attributeUnlockLadderInventory, ladderVmClaimOf, removeUnlockKey, unlockKeyVmId } from './standingWebvh.js';
 /**
  * Retires one standing unlock credential from an account. See the module doc
  * for the order and the convergence story. Once the inventory edit lands, a
@@ -8,15 +9,23 @@ import { attributeUnlockLadderInventory, readLogOrThrow, removeUnlockKey } from
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the account's `id` collection store
- * @param options.updateKeys {ClientWebvhUpdateKeys}   the RETIRING (enrolled)
- *   client's own did:webvh update-key seeds, which sign the inventory edit
+ * @param options.signer {AccountLogSigner}   who signs the inventory edit:
+ *   the retiring enrolled client's own did:webvh update-key seeds, or the
+ *   ACTING (surviving or successor) credential's ladder seed
  * @param options.unlockKeys {StandingUnlockKeys}   the retired credential's
  *   public inventory (its key-agreement publication and its recorded update
  *   key, which the inventory edit treats as a ladder anchor rather than truth
  *   -- see `removeUnlockKey`)
  * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
  *   seed, when the ceremony holds the credential's secret; it strengthens the
- *   ladder attribution but is not required
+ *   ladder attribution, and it is what a retry supplies after a seedless run
+ *   refused with `UnclaimedLadderVmRetirementError`
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through, passed straight to the inventory edit: the
+ *   post-strike `did:web` projection is PUT through it immediately before
+ *   that entry publishes, so a ladder-signed retirement does not leave
+ *   `did.json` naming the retired credential. Best-effort, and omitted the
+ *   behavior is unchanged (see `removeUnlockKey`)
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the inventory edit refuses a `did.jsonl`
  *   resolving to any other account
@@ -46,7 +55,10 @@ import { attributeUnlockLadderInventory, readLogOrThrow, removeUnlockKey } from
  *   re-mint (stage 0), run against the PRE-edit document with the ladder VM
  *   ids this retirement is about to strike. Fail-closed: a throw aborts the
  *   retirement before the document edit. Absent, the stage is skipped and no
- *   log read happens for it (the no-WAS path)
+ *   log read happens for it (the no-WAS path). It is also skipped on the
+ *   ladder arm: every unlock record is signed by its own credential's ladder
+ *   VM, so this strike rots no sibling record, and there is nothing to
+ *   re-mint (`decisions/0019`)
  * @param [options.retireClientAnnexInventory] {Function}   `({ document }) =>
  *   Promise<ClientAnnexInventoryRetirement>` -- the annex reach (stage 1b in
  *   the module doc), run against the post-edit document; a throw is caught
@@ -56,7 +68,7 @@ import { attributeUnlockLadderInventory, readLogOrThrow, removeUnlockKey } from
  *   the session keeps operating without a re-login
  * @returns {Promise<UnlockCredentialRetirementResult>}
  */
-export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys, ladderSeed, expectedDid, pinStore, logId, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintDependentRecords, retireClientAnnexInventory, onRotationAdopted }) {
+export async function retireUnlockCredential({ idStore, signer, unlockKeys, ladderSeed, projectionStore, expectedDid, pinStore, logId, verb, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintDependentRecords, retireClientAnnexInventory, onRotationAdopted }) {
     // 0. The dependent-record re-mint, against the PRE-edit document: whatever
     // the doomed ladder VM signed for OTHER credentials is re-signed under a
     // key that outlives the edit. The pass is named the VM ids the attribution
@@ -70,11 +82,17 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
     };
     let dependentRecords;
     let expectedLadderVmIds;
-    if (remintDependentRecords) {
-        const published = await readLogOrThrow({
-            store: idStore,
+    // The stage is the enrolled branch's alone. On the ladder arm a record's
+    // bridge and sibling are signed by its own credential's ladder VM, so this
+    // strike reaches no record but the retired credential's own, which the
+    // caller deletes with its unlock Space (`decisions/0019`).
+    const ranRemint = Boolean(remintDependentRecords) && signer.kind === 'client';
+    if (ranRemint && remintDependentRecords) {
+        const published = await readPublishedLogOrThrow({
+            idStore,
             ...(expectedDid !== undefined ? { expectedDid } : {}),
-            ...pinned
+            ...pinned,
+            missingMessage: 'did:webvh: did.jsonl is missing; nothing to enroll into.'
         });
         const inventory = await attributeUnlockLadderInventory({
             log: published.log,
@@ -82,6 +100,24 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
             unlockKeys,
             ...(ladderSeed ? { ladderSeed } : {})
         });
+        // The gate, before the pass writes anything: a claim that strikes no
+        // ladder VM while VMs stand unclaimed refuses here, with the credential
+        // still standing and no sibling record touched.
+        await assertLadderVmClaimed({
+            log: published.log,
+            doc: published.doc,
+            credentialVmId: unlockKeyVmId({
+                did: published.did,
+                keyAgreement: unlockKeys.keyAgreement
+            }),
+            claim: await ladderVmClaimOf({
+                doc: published.doc,
+                did: published.did,
+                inventory,
+                ...(ladderSeed ? { ladderSeed } : {})
+            }),
+            anchorKeyMultibase: unlockKeys.updateKeyMultibase
+        });
         // What the edit's own attribution must resolve to: the pass below acts on
         // this list, so an edit that resolved a different one would strike
         // something the pass never covered.
@@ -96,10 +132,12 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
     // its remaining recipients from.
     const { did, doc, log, ladderVm } = await removeUnlockKey({
         idStore,
-        updateKeys,
+        signer,
         unlockKeys,
         ...(ladderSeed ? { ladderSeed } : {}),
+        ...(projectionStore ? { projectionStore } : {}),
         ...(expectedLadderVmIds !== undefined ? { expectedLadderVmIds } : {}),
+        requireLadderVmClaim: true,
         ...(expectedDid !== undefined ? { expectedDid } : {}),
         ...pinned,
         ...(verb !== undefined ? { verb } : {})
@@ -119,7 +157,7 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         }
     }
     // 2. The shared roster-and-cascade tail: the roster rotation onto the
-    // post-edit document (with its post-edit controller floor and its seal
+    // post-edit document (with its post-edit minimum controller version and its seal
     // backstop), then the collection fan-out onto the fresh key.
     const tail = await rotateRosterToDocumentAndCascade({
         rosterStore,
@@ -141,7 +179,7 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
             collections: tail.collections,
             document: doc,
             ...(clientAnnex ? { clientAnnex } : {}),
-            ...(remintDependentRecords ? { dependentRecords } : {})
+            ...(ranRemint ? { dependentRecords } : {})
         };
     }
     if (tail.rotated) {
@@ -156,7 +194,7 @@ export async function retireUnlockCredential({ idStore, updateKeys, unlockKeys,
         userKey: tail.userKey,
         rosterDescriptor: tail.rosterDescriptor,
         ...(clientAnnex ? { clientAnnex } : {}),
-        ...(remintDependentRecords ? { dependentRecords } : {})
+        ...(ranRemint ? { dependentRecords } : {})
     };
 }
 //# sourceMappingURL=retire.js.map

package/dist/unlock/retire.js.map

@@ -1 +1 @@
-{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAiGA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,8BAA8B,EAC9B,cAAc,EACd,eAAe,EAGhB,MAAM,oBAAoB,CAAA;AAwC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,EACV,WAAW,EACX,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EA4BlB;IACC,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,gBAAyB,CAAA;IAC7B,IAAI,mBAAyC,CAAA;IAC7C,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC;YACrC,KAAK,EAAE,OAAO;YACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,MAAM;SACV,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;YACrD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,UAAU;YACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAA;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,oCAAoC;QACpC,mBAAmB,GAAG,SAAS,CAAC,WAAW,CAAA;QAC3C,gBAAgB,GAAG,MAAM,sBAAsB,CAAC;YAC9C,QAAQ,EAAE,SAAS,CAAC,GAAG;YACvB,qBAAqB,EAAE,SAAS,CAAC,WAAW;SAC7C,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;QACxD,OAAO;QACP,UAAU;QACV,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;QACT,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,WAAuD,CAAA;IAC3D,IAAI,0BAA0B,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,0BAA0B,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;QACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAA;AACH,CAAC"}
+{"version":3,"file":"retire.js","sourceRoot":"","sources":["../../src/unlock/retire.ts"],"names":[],"mappings":"AAgHA,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAIzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,eAAe,EACf,eAAe,EACf,aAAa,EAGd,MAAM,oBAAoB,CAAA;AAwC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,OAAO,EACP,MAAM,EACN,UAAU,EACV,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EACL,IAAI,EACJ,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,EA6BlB;IACC,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,gBAAyB,CAAA;IAC7B,IAAI,mBAAyC,CAAA;IAC7C,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAA;IAC7E,IAAI,SAAS,IAAI,sBAAsB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC;YAC9C,OAAO;YACP,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,MAAM;YACT,cAAc,EAAE,0DAA0D;SAC3E,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;YACrD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,UAAU;YACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC,CAAA;QACF,qEAAqE;QACrE,wEAAwE;QACxE,gDAAgD;QAChD,MAAM,qBAAqB,CAAC;YAC1B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,cAAc,EAAE,aAAa,CAAC;gBAC5B,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,YAAY,EAAE,UAAU,CAAC,YAAY;aACtC,CAAC;YACF,KAAK,EAAE,MAAM,eAAe,CAAC;gBAC3B,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,SAAS;gBACT,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC;YACF,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;SAClD,CAAC,CAAA;QACF,0EAA0E;QAC1E,mEAAmE;QACnE,oCAAoC;QACpC,mBAAmB,GAAG,SAAS,CAAC,WAAW,CAAA;QAC3C,gBAAgB,GAAG,MAAM,sBAAsB,CAAC;YAC9C,QAAQ,EAAE,SAAS,CAAC,GAAG;YACvB,qBAAqB,EAAE,SAAS,CAAC,WAAW;SAC7C,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,iCAAiC;IACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;QACxD,OAAO;QACP,MAAM;QACN,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,oBAAoB,EAAE,IAAI;QAC1B,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;QACT,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAA;IAEF,kEAAkE;IAClE,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,WAAuD,CAAA;IAC3D,IAAI,0BAA0B,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,0BAA0B,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QACvD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,wDAAwD;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;QACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAA;AACH,CAAC"}

package/dist/unlock/standingClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standingClient.d.ts","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,yCAAyC,CAAA;AAI1E;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,aAAa,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;IAChC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgBhC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,aAAa,EAAE,UAAU,CAAA;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkBhC"}
+{"version":3,"file":"standingClient.d.ts","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,yCAAyC,CAAA;AAI1E;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,aAAa,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wBAAwB,EAAE,MAAM,CAAA;IAChC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAmBhC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,aAAa,EAAE,UAAU,CAAA;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkBhC"}

package/dist/unlock/standingClient.js

@@ -22,6 +22,7 @@
  */
 import { hkdf } from '@noble/hashes/hkdf.js';
 import { sha256 } from '@noble/hashes/sha2.js';
+import { rosterRecipientKid } from '../keys/userKeyRoster.js';
 import { agentsFromSeed } from '../identity/agents.js';
 /**
  * The HKDF salt for a standing credential's client-side expansions, and the
@@ -57,7 +58,10 @@ export async function unlockClientIdentityFromSeed({ clientSeed }) {
         clientDid: agents.keyAgent.id,
         signingKeyMultibase: signingKeyMultibase,
         keyAgreementKeyMultibase,
-        recipientKid: `${agents.keyAgent.id}#${keyAgreementKeyMultibase}`
+        recipientKid: rosterRecipientKid({
+            signingKeyMultibase: signingKeyMultibase,
+            keyAgreementKeyMultibase
+        })
     };
 }
 /**

package/dist/unlock/standingClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"standingClient.js","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAA;AAC1E,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAwB/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,MAAM,CAAC,eAA6D,CAAA;IACtE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,CAAC,EAAE,AAAD,EAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO;QACL,UAAU;QACV,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC7B,mBAAmB,EAAE,mBAAoB;QACzC,wBAAwB;QACxB,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,wBAAwB,EAAE;KAClE,CAAA;AACH,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,CAAA;AACvC,CAAC"}
+{"version":3,"file":"standingClient.js","sourceRoot":"","sources":["../../src/unlock/standingClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAA;AAC1E,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAC/C,MAAM,yBAAyB,GAAG,aAAa,CAAA;AAwB/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,MAAM,CAAC,eAA6D,CAAA;IACtE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,CAAC,EAAE,AAAD,EAAG,mBAAmB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO;QACL,UAAU;QACV,MAAM;QACN,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC7B,mBAAmB,EAAE,mBAAoB;QACzC,wBAAwB;QACxB,YAAY,EAAE,kBAAkB,CAAC;YAC/B,mBAAmB,EAAE,mBAAoB;YACzC,wBAAwB;SACzB,CAAC;KACH,CAAA;AACH,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EAGX;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAI,CACrB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,aAAa,GAAG,IAAI,CACxB,MAAM,EACN,UAAU,EACV,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,EACnD,EAAE,CACH,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,CAAA;AACvC,CAAC"}

package/dist/unlock/standingWebvh.d.ts

@@ -1,5 +1,6 @@
 import type { DIDDoc, DIDLog, VerificationMethod } from '@interop/did-method-webvh';
-import type { ClientWebvhUpdateKeys, PublishedWebvhLog, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { AccountLogSigner } from '../webvh/accountEntry.js';
+import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type LadderStandingInventory } from '../clientAnnex/ladder.js';
 /**
@@ -9,6 +10,15 @@ import { type LadderStandingInventory } from '../clientAnnex/ladder.js';
  * it too.
  */
 export type UnlockLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
+/**
+ * Which half of a credential's inventory one bind entry carries. `'all'` is
+ * the merged entry: the `keyAgreement` member, the update-key commitment, and
+ * the ladder VM together. The split halves exist for a ceremony that must
+ * land the credential's decryption material before its authority: `'key'`
+ * publishes the `keyAgreement` member alone, `'authority'` installs the
+ * ladder VM and commits the rung-0 hash.
+ */
+export type UnlockInventoryPart = 'all' | 'key' | 'authority';
 /**
  * The ladder inventory the removal edit resolved from the log diverges from
  * what the caller was told one read earlier. A ceremony that names its
@@ -28,17 +38,54 @@ export declare class LadderInventoryDriftError extends Error {
         attributed: string[];
     });
 }
+/**
+ * A retirement whose ladder attribution could not claim the retired
+ * credential's ladder VM, refused with nothing written. The shape is the
+ * seedless strike claiming nothing: the credential still stands in the
+ * document, the walk struck no ladder VM, and ladder VMs stand there that it
+ * could not claim. A leftover VM would keep the retired credential's
+ * delegation authority alive -- under `capabilityDelegation` it can still
+ * sign a DELETE-only capability on the account Space -- and nothing
+ * downstream can tell such a leftover from a sibling credential's standing
+ * VM, so the retirement is the one place the state can be closed
+ * (`decisions/0015`).
+ *
+ * `unclaimedLadderVmIds` names every ladder VM the walk left unclaimed, and
+ * `anchorKeyMultibase` the update key the walk was anchored on (a recovery
+ * code's revocation anchors on the rung-0 multibase the registry recorded at
+ * issuance). On a
+ * multi-credential account that list carries the siblings' VMs beside the
+ * retired credential's, since telling them apart is exactly what the walk
+ * could not do. `retryableWithLadderSeed` says whether a retry supplying the
+ * credential's ladder seed can let attribution succeed. The gate raises this
+ * error only from a seedless claim (a seeded one either strikes the derived
+ * VM or proves there is none), so the hint is `true` from this library; the
+ * member is the wallets' read for the retry they offer.
+ * Matched on `name` (the error crosses app-injected seams that may resolve
+ * to another copy of this package).
+ */
+export declare class UnclaimedLadderVmRetirementError extends Error {
+    readonly unclaimedLadderVmIds: string[];
+    readonly retryableWithLadderSeed: boolean;
+    readonly anchorKeyMultibase?: string;
+    constructor({ unclaimedLadderVmIds, retryableWithLadderSeed, anchorKeyMultibase }: {
+        unclaimedLadderVmIds: string[];
+        retryableWithLadderSeed: boolean;
+        anchorKeyMultibase?: string;
+    });
+}
 /**
  * What the removal edit says about ladder VMs: `struck`, the ids this entry
  * removed from the document, and `unclaimed`, the ladder VMs still standing
  * afterwards that this credential's attribution could not claim.
  *
- * `unclaimed` is information rather than a gate, and the caller cannot read
- * an orphan out of it by subtraction alone: a VM standing here may perfectly
- * well be a SIBLING credential's, which this ladder has no business claiming.
- * What it does catch is the seedless strike whose attribution claims nothing
- * -- a retirement that returns clean while the credential's VM stands on --
- * which would otherwise be reported as a completed removal.
+ * `unclaimed` is information, and the caller cannot read an orphan out of it
+ * by subtraction alone: a VM standing here may perfectly well be a SIBLING
+ * credential's, which this ladder has no business claiming. The gate that
+ * refuses the seedless strike claiming nothing is narrower
+ * ({@link assertLadderVmClaimed}): it reads `struck` empty beside a
+ * non-empty `unclaimed` while the credential itself still stands, and it
+ * runs only for a credential that carries a ladder.
  */
 export interface LadderVmRemovalReport {
     struck: string[];
@@ -59,7 +106,7 @@ export type UnlockKeyAgreementPublication = {
 /**
  * A standing credential's public inventory as the document and log carry it:
  * its key-agreement publication and the update key whose hash stands in
- * `nextKeyHashes` (ladder rung 0 at bind time; a code's single derived key).
+ * `nextKeyHashes` (ladder rung 0 at bind time, for every credential kind).
  */
 export interface StandingUnlockKeys {
     keyAgreement: UnlockKeyAgreementPublication;
@@ -107,6 +154,134 @@ export declare function attributeUnlockLadderInventory({ log, did, unlockKeys, l
     unlockKeys: StandingUnlockKeys;
     ladderSeed?: Uint8Array;
 }): Promise<LadderStandingInventory>;
+/**
+ * What of the document's ladder VMs a credential's attribution claims: the
+ * VM its seed derives (when the ceremony holds one), plus every VM the log
+ * attributes to its ladder. Resolved once here and shared by the removal
+ * edit, the retirement ceremony's pre-edit stage, and the read-only
+ * pre-flight, so the three agree on what is struck and what is left.
+ *
+ * `struck` is what the removal edit strikes: the derived id when it stands,
+ * and the attributed ids. `unclaimed` is every ladder VM standing in the
+ * document that neither the seed nor the attribution claims -- on a
+ * multi-credential account, the siblings' VMs at least. A supplied seed also
+ * cross-checks the attribution: a log attributing a VM the seed does not
+ * derive refuses with {@link LadderAttributionError}.
+ *
+ * @param options {object}
+ * @param options.doc {DIDDoc}   the document the attribution ran over
+ * @param options.did {string}   the account DID
+ * @param options.inventory {LadderStandingInventory}   the credential's
+ *   attributed ladder inventory ({@link attributeUnlockLadderInventory})
+ * @param [options.ladderSeed] {Uint8Array}   the credential's ladder seed
+ * @returns {Promise<{ ladderVmId?: string, struck: string[], unclaimed:
+ *   string[] }>}   the seed-derived VM id when a seed was held
+ */
+export declare function ladderVmClaimOf({ doc, did, inventory, ladderSeed }: {
+    doc: DIDDoc;
+    did: string;
+    inventory: LadderStandingInventory;
+    ladderSeed?: Uint8Array;
+}): Promise<{
+    ladderVmId?: string;
+    struck: string[];
+    unclaimed: string[];
+}>;
+/**
+ * The retirement gate (`decisions/0015`): refuses, with
+ * {@link UnclaimedLadderVmRetirementError}, a retirement of a
+ * ladder-carrying credential whose SEEDLESS claim struck nothing while a
+ * ladder VM that COULD BE THIS CREDENTIAL'S stands unclaimed and the
+ * credential itself still stands in the document. Deliberately narrower than
+ * "`unclaimed` is non-empty", which every retirement on a healthy
+ * multi-credential account produces, and narrower again than the standing
+ * unclaimed set: a sibling credential's VM is nothing this retirement could
+ * leave behind.
+ *
+ * Which unclaimed VMs are candidates is
+ * {@link ladderVmIdsIntroducedWithCredential}'s question, read off the log's
+ * entry shapes rather than off an attribution that has already refused: a VM
+ * introduced by the entry that introduced this credential's `keyAgreement`
+ * member, or by the entry that committed or authorized its anchor (the split
+ * bind, whose key and authority entries sit two versions apart). None, and
+ * the credential never had a VM to leave standing, so the retirement
+ * completes and strikes what it can. That is the torn issuance's orphan -- a
+ * credential with a `keyAgreement` member, no ladder VM, and no committed
+ * rung -- which previously could never be removed at all, since a sibling's
+ * standing VM refused it forever.
+ *
+ * Two shapes pass ahead of that. A credential whose `keyAgreement` member is
+ * already gone is a completed retirement re-running. And a claim resolved
+ * WITH the seed never refuses: the derived VM is either standing (and
+ * struck) or absent, and an absent derived VM is proof the credential has
+ * nothing to claim -- the last-client transition torn between its strike and
+ * reinstall entries leaves exactly that, and a seeded retirement there must
+ * complete rather than wait on the transition's re-run. So the error's retry
+ * hint is `true` whenever this gate raises it.
+ *
+ * The caller decides whether the credential carries a ladder.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the verified log the claim was resolved over
+ * @param options.doc {DIDDoc}   the document the claim was resolved over
+ * @param options.credentialVmId {string}   the credential's `keyAgreement`
+ *   verification-method id ({@link unlockKeyVmId})
+ * @param options.claim {{ ladderVmId?: string, struck: string[], unclaimed:
+ *   string[] }}   from {@link ladderVmClaimOf}
+ * @param [options.anchorKeyMultibase] {string}   the update key the walk was
+ *   anchored on: the candidate reading's second anchor form, and named in
+ *   the refusal
+ * @returns {Promise<void>}
+ */
+export declare function assertLadderVmClaimed({ log, doc, credentialVmId, claim, anchorKeyMultibase }: {
+    log: DIDLog;
+    doc: DIDDoc;
+    credentialVmId: string;
+    claim: {
+        ladderVmId?: string;
+        struck: string[];
+        unclaimed: string[];
+    };
+    anchorKeyMultibase?: string;
+}): Promise<void>;
+/**
+ * The retirement gate run read-only, before anything is written: one pinned
+ * read of the account log, the credential's ladder attribution, and
+ * {@link assertLadderVmClaimed} over the result. A caller that establishes a
+ * replacement credential before it retires the old one (a passphrase change,
+ * a tap-confirmed passkey removal) runs this first, so a gate refusal lands
+ * the way an invalid-input check does -- nothing established, no
+ * pending-shaped registry entry written -- rather than after establishment,
+ * where the refusal would leave a torn state no seedless repair can clear.
+ * The in-ceremony gate stays as defense in depth, and it is what answers a
+ * log entry landing between the pre-flight and the retirement: the
+ * pre-flight's verdict holds for the head it read, and nothing binds the two
+ * reads.
+ *
+ * @param options {object}
+ * @param options.idStore {UnlockLogStore}   the account's `id` collection
+ *   read side
+ * @param options.unlockKeys {StandingUnlockKeys}   the credential's recorded
+ *   public inventory
+ * @param [options.ladderSeed] {Uint8Array}   the credential's ladder seed,
+ *   when the caller holds it
+ * @param [options.expectedDid] {string}   the account DID the log must
+ *   resolve to
+ * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
+ *   pins
+ * @param [options.logId] {string}   the account log's pin slot; required
+ *   whenever a `pinStore` is supplied
+ * @returns {Promise<LadderVmRemovalReport>}   what the retirement would
+ *   strike and what it would leave unclaimed
+ */
+export declare function preflightUnlockCredentialRetirement({ idStore, unlockKeys, ladderSeed, expectedDid, pinStore, logId }: {
+    idStore: Pick<WebvhIdStore, 'getIdResourceRaw'>;
+    unlockKeys: StandingUnlockKeys;
+    ladderSeed?: Uint8Array;
+    expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
+}): Promise<LadderVmRemovalReport>;
 /**
  * The credential's `keyAgreement` verification method: an ordinary unmarked
  * entry carrying either the key verbatim (a `Multikey` with
@@ -127,27 +302,6 @@ export declare function unlockKeyVerificationMethod({ did, keyAgreement }: {
     did: string;
     keyAgreement: UnlockKeyAgreementPublication;
 }): VerificationMethod;
-/**
- * Reads and resolves the published log through the narrow store seam.
- *
- * @param options {object}
- * @param options.store {UnlockLogStore}
- * @param [options.expectedDid] {string}   the account DID the log must resolve
- *   to, where the caller holds one
- * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
- *   pins; a served log that is a rollback, a fork, or an identity switch
- *   against the pinned head is refused (`ResourceLogContinuityError`)
- * @param [options.logId] {string}   the account log's pin slot
- *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
- *   supplied
- * @returns {Promise<PublishedWebvhLog>}
- */
-export declare function readLogOrThrow({ store, expectedDid, pinStore, logId }: {
-    store: UnlockLogStore;
-    expectedDid?: string;
-    pinStore?: ResourceLogPinStore;
-    logId?: string;
-}): Promise<PublishedWebvhLog>;
 /**
  * BIND (run by an enrolled client, root authority): publishes a standing
  * credential's split configuration into the document -- one entry adding the
@@ -163,8 +317,13 @@ export declare function readLogOrThrow({ store, expectedDid, pinStore, logId }:
  * idempotence against the SAME seed, finds the completed stage and publishes
  * nothing -- where a mint-when-absent would publish a second VM that no
  * anchored attribution could later strike. A credential with no ladder at all
- * (a recovery code, whose inventory is one key-agreement method and one
- * update key) passes `null` and gets no VM.
+ * passes `null` and gets no VM.
+ *
+ * `part` splits the bind across two entries where a ceremony needs the
+ * credential's decryption material to precede its authority: `'key'`
+ * publishes the `keyAgreement` member alone, `'authority'` installs the
+ * ladder VM and commits the rung-0 hash, and `'all'` (the default) is the one
+ * merged entry every other caller writes.
  *
  * Idempotent: an inventory already published is a no-op, so re-running a torn
  * bind converges. The entry publishes conditionally on the log this call
@@ -173,13 +332,16 @@ export declare function readLogOrThrow({ store, expectedDid, pinStore, logId }:
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}
- * @param options.updateKeys {ClientWebvhUpdateKeys}   the BINDING client's own
- *   did:webvh update-key seeds
+ * @param options.signer {AccountLogSigner}   who signs the entry: the BINDING
+ *   client's own did:webvh update-key seeds, or the acting credential's
+ *   ladder seed
  * @param options.unlockKeys {StandingUnlockKeys}   the credential's public
  *   inventory
  * @param options.ladderSeed {Uint8Array | null}   the credential's ladder
  *   seed, whose VM this entry installs; `null` for a credential that carries
  *   no ladder
+ * @param [options.part] {string}   `'all'` (the default), `'key'`, or
+ *   `'authority'` -- see above
  * @param [options.expectedDid] {string}   the account DID the log must resolve
  *   to, from the caller's stored account pointer
  * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
@@ -197,9 +359,10 @@ export declare function readLogOrThrow({ store, expectedDid, pinStore, logId }:
  */
 export declare function publishUnlockKey(options: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
     unlockKeys: StandingUnlockKeys;
     ladderSeed: Uint8Array | null;
+    part?: UnlockInventoryPart;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
     logId?: string;
@@ -263,6 +426,15 @@ export declare function publishUnlockKey(options: {
  * @param options {object}   see {@link publishUnlockKey}, plus:
  * @param [options.ladderSeed] {Uint8Array}   the retired credential's ladder
  *   seed, when in hand
+ * @param [options.projectionStore] {object}   an `id`-collection store the
+ *   caller may write through (a transient session's, bound to its generation
+ *   delegation; an enrolled client's own root-invoking store). Supplied, the
+ *   post-strike `did:web` projection is PUT through it immediately BEFORE
+ *   this entry publishes, which is what keeps a ladder-signed removal from
+ *   leaving `did.json` naming the retired credential. Best-effort: a failed
+ *   PUT is warned and the removal proceeds. Omitted, the ladder arm leaves
+ *   the projection to the next visit's `ensureDidWebProjection` and the
+ *   client arm publishes it after the entry, as before
  * @param [options.expectedLadderVmIds] {string[]}   the ladder VM ids the
  *   caller already resolved for this credential, from its own read of the
  *   log. Supplied, this edit's own attribution must match them as a set --
@@ -270,16 +442,26 @@ export declare function publishUnlockKey(options: {
  *   {@link LadderInventoryDriftError} before writing anything. That is what
  *   ties the retirement's stage-0 read (whose list the dependent-record
  *   re-mint pass acted on) to this one, which is otherwise independent
+ * @param [options.requireLadderVmClaim] {boolean}   the credential carries a
+ *   ladder, so its VM must be claimed: the edit refuses with
+ *   {@link UnclaimedLadderVmRetirementError} before writing when the claim
+ *   struck nothing while ladder VMs stand unclaimed and the credential still
+ *   stands ({@link assertLadderVmClaimed}). The retirement ceremony sets it,
+ *   and so does a recovery code's removal, whose inventory carries the code's
+ *   own ladder VM. The refusal names the recorded update key the walk was
+ *   anchored on
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog, ladderVm:
  *   LadderVmRemovalReport }>}   see {@link publishUnlockKey}, plus the ladder
  *   VM report: what this entry struck, and what stands unclaimed after it
  */
 export declare function removeUnlockKey(options: {
     idStore: WebvhIdStore;
-    updateKeys: ClientWebvhUpdateKeys;
+    signer: AccountLogSigner;
+    projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     unlockKeys: StandingUnlockKeys;
     ladderSeed?: Uint8Array;
     expectedLadderVmIds?: string[];
+    requireLadderVmClaim?: boolean;
     expectedDid?: string;
     pinStore?: ResourceLogPinStore;
     logId?: string;

package/dist/unlock/standingWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAclC,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAMnE,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;;;;;GAUG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAA;gBAEjB,EACV,QAAQ,EACR,UAAU,EACX,EAAE;QACD,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,UAAU,EAAE,MAAM,EAAE,CAAA;KACrB;CAYF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,GAAG,EACH,GAAG,EACH,UAAU,EACV,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAUnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,EACnC,KAAK,EACL,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,cAAc,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,qBAAqB,CAAA;CAChC,CAAC,CAID"}
+{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AASlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAGhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAMnE,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,KAAK,GAAG,WAAW,CAAA;AAE7D;;;;;;;;;;GAUG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAA;gBAEjB,EACV,QAAQ,EACR,UAAU,EACX,EAAE;QACD,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,UAAU,EAAE,MAAM,EAAE,CAAA;KACrB;CAYF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAA;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;gBAExB,EACV,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EACnB,EAAE;QACD,oBAAoB,EAAE,MAAM,EAAE,CAAA;QAC9B,uBAAuB,EAAE,OAAO,CAAA;QAChC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B;CAmBF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,GAAG,EACH,GAAG,EACH,UAAU,EACV,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAUnC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CAAC,EACpC,GAAG,EACH,GAAG,EACH,SAAS,EACT,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,uBAAuB,CAAA;IAClC,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+B1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,GAAG,EACH,GAAG,EACH,cAAc,EACd,KAAK,EACL,kBAAkB,EACnB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mCAAmC,CAAC,EACxD,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAA;IAC/C,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgCjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,kBAAkB,CAgBrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAA;IAC7B,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC9B,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,qBAAqB,CAAA;CAChC,CAAC,CAID"}