@interop/wallet-core 0.62.0 → 0.66.0

package/dist/clientAnnex/heal.js

@@ -1,14 +1,30 @@
 import { WasClient } from '@interop/was-client';
-import { effectiveParameters, readPublishedLog, WebvhLogConflictError, withLogConflictRetry } from '../webvh/didWebvh.js';
-import { delegationKeyInDocument, ladderVmIds } from '../webvh/listClients.js';
-import { delegationProofKeyId, zcapExpiring } from '../webvh/standingZcap.js';
+import { spacePath } from '@interop/was-client/paths';
+import { currentLogParameters, readPublishedLog, readPublishedLogOrThrow, WebvhLogConflictError, withLogConflictRetry } from '../webvh/didWebvh.js';
+import { ladderVmIds } from '../resourceLog/document.js';
+import { standingZcapStale } from '../webvh/standingZcap.js';
 import { delegateLogWrite } from '../recovery/recoveryDelegation.js';
 import { accountLogPinId } from '../webvh/verifyLog.js';
 import { mintSpaceId } from '../genesis/accountGenesis.js';
 import { attributeLadderRung, ladderRung, ladderVmKeyMultibase } from './ladder.js';
 import { revealLadderRungWebvh } from './ladderAnchored.js';
 import { ladderVmAgent, ladderVmZcapClient } from './zcap.js';
-import { clientAnnexDidParts, clientAnnexLogPinId, clientAnnexLogStore, delegatedClientsDelegationSpaceId, delegatedClientsPointer, ensureGenerationDelegationCurrent, mintCredentialClientAnnexGeneration, mintDelegatedClientsDelegation, mintGenerationDelegation, setDelegatedClientsPointerOnce } from './log.js';
+import { mintSpaceRootVerbCapability } from './spaceCapability.js';
+import { clientAnnexDidParts, clientAnnexLogPinId, clientAnnexLogStore, delegatedClientsDelegationSpaceId, delegatedClientsPointer, ensureClientAnnexSpace, ensureGenerationDelegationCurrent, mintDelegatedClientsDelegation, mintGenerationDelegation, mintPointedClientAnnexGeneration, setDelegatedClientsPointerOnce } from './log.js';
+/**
+ * The HTTP status a raw signed request's rejection carries, when it carries
+ * one. `WasClient.request` applies no error mapping, so the status is all a
+ * caller has to dispatch on, and different transports hang it in different
+ * places (`status`, or `response.status`).
+ *
+ * @param err {unknown}
+ * @returns {number | undefined}
+ */
+function rawRequestStatus(err) {
+    const raw = err;
+    const status = raw?.status ?? raw?.response?.status;
+    return typeof status === 'number' ? status : undefined;
+}
 /**
  * The typed refusal of {@link ensureCredentialClientAnnexGeneration}: the
  * account is not in a shape this visit can mend, and nothing was written.
@@ -212,259 +228,364 @@ async function ensureCredentialClientAnnexGenerationChecked({ wasServerUrl, spac
         }
         return {};
     }
-    if (annexSpaceId === undefined) {
-        // THE FRESH-SPACE ARM: neither the pointer nor a sibling names a Space.
-        // The pre-flight attribution runs before any generation or Space is
-        // minted (a bridge delegation mint writes nothing durable); the stage
-        // order mirrors the credential-anchored genesis exactly. A rung that is
-        // only committed passes here and is revealed at the pointer entry.
-        await assertPointerEntryAttributable({ ladderSeed, log: account.log });
+    /**
+     * The fresh-Space stage, controller-first past the create. The create
+     * itself must name the ladder VM's bare did:key: a storage server
+     * authorizes a Space create against the controller the request body names,
+     * and a root invocation must be signed by that very DID, so a create
+     * naming the account did:webvh is refused. The controller is flipped to
+     * the account DID in the very next request, before anything publishes into
+     * the Space.
+     *
+     * So the stranding window is one request wide. Inside it the stranded
+     * Space is did:key-controlled, which no server orphan sweep can reap,
+     * since a did:key resolves from its own bytes forever. Past the flip it is
+     * account-controlled and reapable. Narrowing the window to that one
+     * request is what this ordering buys; it does not close it.
+     *
+     * The flip preceding the generation mint is load-bearing rather than
+     * cosmetic. The mint and the delegation embed ride the ladder-signed
+     * sibling delegation, and the server admits that chain only once the
+     * Space's controller is the account DID whose document lists the ladder
+     * VM. Minting first and flipping afterwards would need the bootstrap key's
+     * own root invocations, which is the ordering this stage replaced.
+     *
+     * The flip swallows nothing. The establishment's bootstrap arm tolerates
+     * an authorization-class refusal there because its Space may be a
+     * sibling-named one a concurrent run already flipped; this Space's id was
+     * minted a moment ago and no other run can hold it, so every failure is
+     * the transport or logic failure it looks like and propagates.
+     *
+     * @returns {Promise<string>}   the fresh auxiliary Space's id
+     */
+    async function mintFreshAnnexSpace() {
         const freshSpaceId = mintSpaceId();
         const keyAgent = await ladderVmAgent({ ladderSeed });
         const bootstrapWas = bootstrapWasFor({ keyAgent });
-        const minted = await mintCredentialClientAnnexGeneration({
+        const created = await ensureClientAnnexSpace({
             was: bootstrapWas,
-            wasServerUrl,
             spaceId: freshSpaceId,
-            controller: keyAgent.id,
-            ladderSeed
-        });
-        // The delegation embeds while the Space still answers to the bootstrap
-        // did:key; the controller flip follows, then the pointer entry.
-        const ensured = await ensureGenerationDelegationCurrent({
-            store: clientAnnexLogStore({
-                was: bootstrapWas,
-                spaceId: freshSpaceId,
-                generationId: minted.generationId
-            }),
-            ladderSeed,
-            generationId: minted.generationId,
-            mintGenerationDelegation: mintDelegation,
-            expectedDid: minted.did,
-            ...(pinStore !== undefined
-                ? {
-                    pinStore,
-                    logId: clientAnnexLogPinId({
-                        spaceId: freshSpaceId,
-                        generationId: minted.generationId
-                    })
-                }
-                : {}),
-            ...(now !== undefined ? { now } : {})
+            controller: keyAgent.id
         });
+        // The create's own answer is the current Description, so the flip carries
+        // it as `current` rather than re-reading what this call just wrote.
         await bootstrapWas
             .space(freshSpaceId)
-            .configure({ controller: account.did, force: true });
-        await movePointerAsLadder({
-            idStore,
-            ladderSeed,
-            clientAnnexDid: minted.did,
-            accountDid: account.did,
-            ...(pinStore !== undefined
-                ? { pinStore, logId: accountLogPinId({ spaceId }) }
-                : {})
-        });
-        const sibling = await mintDelegatedClientsDelegation({
+            .configure({ current: created, controller: account.did, force: true });
+        return freshSpaceId;
+    }
+    /**
+     * One Space Description read, judged by its HTTP STATUS alone. A 404 is
+     * `'not-found'`; a 2xx is `'present'`, whatever its body says, since a
+     * Space served with an unreadable body is a present Space and reading it
+     * as absence is exactly what would re-point a live account. Every other
+     * answer -- a transport failure, a 5xx, a 4xx that is not 404 -- throws,
+     * so nothing but a real 404 can ever reach the absence decision.
+     *
+     * The read goes through the raw signed request rather than the
+     * `describe()` handle, whose null-on-404 translation also swallows 401 and
+     * 403 and an unparseable body.
+     *
+     * @param options {object}
+     * @param options.was {WasClient}   the client whose signer invokes
+     * @param options.annexSpaceId {string}
+     * @param [options.capability] {IZcap}   the attached capability; absent
+     *   means a root invocation
+     * @returns {Promise<'present' | 'not-found'>}
+     */
+    async function readSpaceDescription({ was, annexSpaceId, capability }) {
+        let status;
+        try {
+            const response = await was.request({
+                path: spacePath(annexSpaceId),
+                method: 'GET',
+                ...(capability !== undefined ? { capability } : {})
+            });
+            status = response.status;
+        }
+        catch (err) {
+            if (rawRequestStatus(err) === 404) {
+                return 'not-found';
+            }
+            throw err;
+        }
+        if (status >= 200 && status < 300) {
+            return 'present';
+        }
+        if (status === 404) {
+            return 'not-found';
+        }
+        throw new Error(`client annex: the Space Description read for "${annexSpaceId}" ` +
+            `answered ${status}; the visit cannot tell whether the Space is gone.`);
+    }
+    /**
+     * Whether the auxiliary Space itself is gone from the server, asked only
+     * when the pointed generation's log did not read back. A storage server
+     * masks an unauthorized read as the same 404 an absent Space answers, so
+     * ONE 404 is not absence: it is "absent, or this reader has no authority
+     * here". Absence is therefore corroborated by two independent readers, and
+     * the Space is gone only when both answer a real 404.
+     *
+     * The first reader is a ladder-signed GET-only child of the Space's own
+     * root, which the account DID's document backs. The sibling delegation
+     * cannot carry the question: it targets the items subtree beneath the
+     * Space and says nothing about the Space Description.
+     *
+     * The second is a root invocation as the ladder VM's BARE did:key, the
+     * controller a torn establishment leaves behind when its flip never
+     * landed. That reader answers 2xx on exactly the Space the first reader
+     * has no authority over, so the pair covers both controllers a live annex
+     * Space of this credential's can have.
+     *
+     * The residual bound, stated because no read can close it: a server that
+     * does not admit the ladder delegation clause's single-verb predicate
+     * refuses the first probe with the same masked 404, and on an
+     * account-controlled Space the second probe is refused too. Both readers
+     * then say `'not-found'` about a live Space. That is a server older than
+     * the one this arm was built against, and the arm's cost there is a
+     * re-point of a live generation.
+     *
+     * @param options {object}
+     * @param options.annexSpaceId {string}
+     * @param options.was {WasClient}   the standing client's storage client
+     * @returns {Promise<boolean>}
+     */
+    async function annexSpaceAbsent({ annexSpaceId, was }) {
+        const probe = await mintSpaceRootVerbCapability({
             zcapClient: ladderClient,
-            wasServerUrl,
-            clientAnnexSpaceId: freshSpaceId,
+            storageServerUrl: wasServerUrl,
+            spaceId: annexSpaceId,
+            verb: 'GET',
             controller: standingClient.did,
             ...(now !== undefined ? { now } : {})
         });
+        const delegated = await readSpaceDescription({
+            was,
+            annexSpaceId,
+            capability: probe
+        });
+        if (delegated === 'present') {
+            return false;
+        }
+        const bootstrapWas = bootstrapWasFor({
+            keyAgent: await ladderVmAgent({ ladderSeed })
+        });
+        const asBootstrap = await readSpaceDescription({
+            was: bootstrapWas,
+            annexSpaceId
+        });
+        return asBootstrap === 'not-found';
+    }
+    let spaceMinted = false;
+    let pointedSpaceMissing = false;
+    /**
+     * The arms that run inside one auxiliary Space: the sibling delegation,
+     * the pointed generation's renewal, and the fresh-generation mint with its
+     * pointer move. Called once on the resolved Space, and once more on a
+     * fresh Space when the pointed one turns out to be gone -- the replacement
+     * is decided before any write, so nothing is stranded by the re-run.
+     *
+     * @param options {object}
+     * @param options.annexSpaceId {string}   the Space this run works in
+     * @param options.allowSpaceReplacement {boolean}   whether an absent
+     *   pointed generation may be checked against the Space itself, and a
+     *   fresh Space minted when the Space is gone. False on the run that
+     *   already works in a Space this visit created
+     * @param [options.pointer] {string}   the pointed annex DID, when the
+     *   document names one and this run works in its Space
+     * @returns {Promise<ClientAnnexGenerationEnsureOutcome>}
+     */
+    async function runInAnnexSpace({ annexSpaceId, allowSpaceReplacement, pointer }) {
+        // A usable sibling first: absent, targeting a different Space than this
+        // run works in, or stale on either of the standing-zcap axes -- expiry
+        // (past, or inside the renewal window) and signer death (its proof key
+        // no longer under `capabilityDelegation` in the verified account
+        // document, the current-key-set rule) -- a fresh sibling is minted
+        // (local ladder-VM signing, which verifies because the gate above proved
+        // the VM a document verification method) so every annex request below
+        // can ride it.
+        let sibling = delegatedClients;
+        let siblingReminted = false;
+        const siblingStale = sibling !== undefined &&
+            standingZcapStale({
+                zcap: sibling,
+                doc: account.doc,
+                ...(now !== undefined ? { now } : {})
+            });
+        if (sibling === undefined ||
+            siblingSpaceId !== annexSpaceId ||
+            siblingStale) {
+            sibling = await mintDelegatedClientsDelegation({
+                zcapClient: ladderClient,
+                wasServerUrl,
+                clientAnnexSpaceId: annexSpaceId,
+                controller: standingClient.did,
+                ...(now !== undefined ? { now } : {})
+            });
+            siblingReminted = true;
+        }
+        const usableSibling = sibling;
+        const standingWas = new WasClient({
+            serverUrl: wasServerUrl,
+            zcapClient: standingClient.zcapClient
+        });
+        const storeFor = (generationId) => clientAnnexLogStore({
+            was: standingWas,
+            spaceId: annexSpaceId,
+            generationId,
+            capability: usableSibling
+        });
+        const annexPin = (generationId) => pinStore !== undefined
+            ? {
+                pinStore,
+                logId: clientAnnexLogPinId({ spaceId: annexSpaceId, generationId })
+            }
+            : {};
+        // RENEW PRECEDES MINT: a live, verifiable pointed generation is renewed
+        // in place; only a rung this generation never committed falls through to
+        // the fresh mint (the GC swap's no-committed-survivor escape).
+        if (pointer !== undefined) {
+            const parts = clientAnnexDidParts({ did: pointer });
+            const pointedLog = await readPublishedLog({
+                idStore: storeFor(parts.generationId),
+                expectedDid: pointer,
+                ...annexPin(parts.generationId)
+            });
+            if (pointedLog !== undefined) {
+                try {
+                    const ensured = await ensureGenerationDelegationCurrent({
+                        store: storeFor(parts.generationId),
+                        ladderSeed,
+                        generationId: parts.generationId,
+                        mintGenerationDelegation: mintDelegation,
+                        expectedDid: pointer,
+                        accountDoc: account.doc,
+                        // The head just read: on a healthy account this stage spends no
+                        // second round trip on the same log, and hands its head back for
+                        // the enrollment to build on.
+                        published: pointedLog,
+                        ...annexPin(parts.generationId),
+                        ...(now !== undefined ? { now } : {})
+                    });
+                    const resealed = await resealRecord({
+                        delegatedClients: usableSibling,
+                        siblingReminted
+                    });
+                    return {
+                        clientAnnexDid: pointer,
+                        generationDelegation: ensured.delegation,
+                        delegation: usableBridge,
+                        delegatedClients: usableSibling,
+                        generationMinted: false,
+                        spaceMinted,
+                        pointedSpaceMissing,
+                        delegationRenewed: ensured.renewed,
+                        siblingReminted,
+                        bridgeReminted,
+                        ...(ensured.published !== undefined
+                            ? { generationLog: ensured.published }
+                            : {}),
+                        ...resealed
+                    };
+                }
+                catch (err) {
+                    if (err.name !==
+                        'ClientAnnexRungUncommittedError') {
+                        throw err;
+                    }
+                    // This credential's rung was never committed into the pointed
+                    // generation (bound mid-generation): fall through to the fresh
+                    // mint, which commits it with the fresh genesis.
+                }
+            }
+            else if (allowSpaceReplacement &&
+                (await annexSpaceAbsent({ annexSpaceId, was: standingWas }))) {
+                // THE POINTED SPACE IS GONE. A missing generation log inside a live
+                // Space is the fresh-generation arm's case; a missing SPACE is not,
+                // since every write below would land in a Space that does not exist
+                // and the visit would fail on something other than the typed
+                // refusal. The Space is re-minted and the run starts over in it,
+                // before anything has been written.
+                await attributePointerEntryRung({ ladderSeed, log: account.log });
+                const freshSpaceId = await mintFreshAnnexSpace();
+                spaceMinted = true;
+                pointedSpaceMissing = true;
+                return runInAnnexSpace({
+                    annexSpaceId: freshSpaceId,
+                    allowSpaceReplacement: false
+                });
+            }
+        }
+        // THE FRESH-GENERATION ARM: pre-flight attribution first (never mint a
+        // generation the pointer entry cannot then name), then the GC swap's
+        // stage order minus its revoke -- mint, install the delegation,
+        // re-point. The fresh genesis commits only the acting credential's annex
+        // rung; other standing credentials' per-generation rungs are re-committed
+        // only by their own later ceremonies (a property of every generation
+        // swap).
+        await attributePointerEntryRung({ ladderSeed, log: account.log });
+        const generation = await mintPointedClientAnnexGeneration({
+            was: standingWas,
+            wasServerUrl,
+            spaceId: annexSpaceId,
+            controller: account.did,
+            ladderSeed,
+            capability: usableSibling,
+            mintGenerationDelegation: mintDelegation,
+            // No revocation of the superseded generation's delegation is
+            // attempted: a transient visit has no reach that could invoke it (the
+            // standing client is neither the Space controller nor in that
+            // delegation's chain). The pointer move itself retires it on a
+            // conforming server -- the inspector clause compares the delegation's
+            // controller against the document's pointer -- and it otherwise rots
+            // on its TTL.
+            point: clientAnnexDid => movePointerAsLadder({
+                idStore,
+                ladderSeed,
+                clientAnnexDid,
+                accountDid: account.did,
+                ...(pinStore !== undefined
+                    ? { pinStore, logId: accountLogPinId({ spaceId }) }
+                    : {})
+            }),
+            ...(pinStore !== undefined ? { pinStore } : {}),
+            ...(now !== undefined ? { now } : {})
+        });
         const resealed = await resealRecord({
-            delegatedClients: sibling,
-            siblingReminted: true
+            delegatedClients: usableSibling,
+            siblingReminted
         });
         return {
-            clientAnnexDid: minted.did,
-            generationDelegation: ensured.delegation,
+            clientAnnexDid: generation.clientAnnexDid,
+            generationDelegation: generation.generationDelegation,
             delegation: usableBridge,
-            delegatedClients: sibling,
+            delegatedClients: usableSibling,
             generationMinted: true,
-            spaceMinted: true,
+            spaceMinted,
+            pointedSpaceMissing,
             delegationRenewed: false,
-            siblingReminted: true,
+            siblingReminted,
             bridgeReminted,
             ...resealed
         };
     }
-    // THE EXISTING-SPACE ARMS. A usable sibling first: absent, targeting a
-    // different Space than the resolved one, or stale on either of the
-    // standing-zcap axes -- expiry (past, or inside the renewal window) and
-    // signer death (its proof key no longer under `capabilityDelegation` in
-    // the verified account document, the current-key-set rule) -- a fresh
-    // sibling is minted (local ladder-VM signing, which verifies because the
-    // gate above proved the VM a document verification method) so every annex
-    // request below can ride it.
-    let sibling = delegatedClients;
-    let siblingReminted = false;
-    const siblingStale = sibling !== undefined &&
-        standingZcapStale({
-            zcap: sibling,
-            doc: account.doc,
-            ...(now !== undefined ? { now } : {})
-        });
-    if (sibling === undefined ||
-        siblingSpaceId !== annexSpaceId ||
-        siblingStale) {
-        sibling = await mintDelegatedClientsDelegation({
-            zcapClient: ladderClient,
-            wasServerUrl,
-            clientAnnexSpaceId: annexSpaceId,
-            controller: standingClient.did,
-            ...(now !== undefined ? { now } : {})
-        });
-        siblingReminted = true;
-    }
-    const usableSibling = sibling;
-    const standingWas = new WasClient({
-        serverUrl: wasServerUrl,
-        zcapClient: standingClient.zcapClient
-    });
-    const storeFor = (generationId) => clientAnnexLogStore({
-        was: standingWas,
-        spaceId: annexSpaceId,
-        generationId,
-        capability: usableSibling
-    });
-    const annexPin = (generationId) => pinStore !== undefined
-        ? {
-            pinStore,
-            logId: clientAnnexLogPinId({ spaceId: annexSpaceId, generationId })
-        }
-        : {};
-    // RENEW PRECEDES MINT: a live, verifiable pointed generation is renewed in
-    // place; only a rung this generation never committed falls through to the
-    // fresh mint (the GC swap's no-committed-survivor escape).
-    if (pointer !== undefined) {
-        const parts = clientAnnexDidParts({ did: pointer });
-        const pointedLog = await readPublishedLog({
-            idStore: storeFor(parts.generationId),
-            expectedDid: pointer,
-            ...annexPin(parts.generationId)
+    if (annexSpaceId === undefined) {
+        // NEITHER THE POINTER NOR A SIBLING NAMES A SPACE. The pre-flight
+        // attribution runs before any Space or generation is minted (a bridge
+        // delegation mint writes nothing durable).
+        await attributePointerEntryRung({ ladderSeed, log: account.log });
+        const freshSpaceId = await mintFreshAnnexSpace();
+        spaceMinted = true;
+        return runInAnnexSpace({
+            annexSpaceId: freshSpaceId,
+            allowSpaceReplacement: false
         });
-        if (pointedLog !== undefined) {
-            try {
-                const ensured = await ensureGenerationDelegationCurrent({
-                    store: storeFor(parts.generationId),
-                    ladderSeed,
-                    generationId: parts.generationId,
-                    mintGenerationDelegation: mintDelegation,
-                    expectedDid: pointer,
-                    accountDoc: account.doc,
-                    ...annexPin(parts.generationId),
-                    ...(now !== undefined ? { now } : {})
-                });
-                const resealed = await resealRecord({
-                    delegatedClients: usableSibling,
-                    siblingReminted
-                });
-                return {
-                    clientAnnexDid: pointer,
-                    generationDelegation: ensured.delegation,
-                    delegation: usableBridge,
-                    delegatedClients: usableSibling,
-                    generationMinted: false,
-                    spaceMinted: false,
-                    delegationRenewed: ensured.renewed,
-                    siblingReminted,
-                    bridgeReminted,
-                    ...resealed
-                };
-            }
-            catch (err) {
-                if (err.name !== 'ClientAnnexRungUncommittedError') {
-                    throw err;
-                }
-                // This credential's rung was never committed into the pointed
-                // generation (bound mid-generation): fall through to the fresh mint,
-                // which commits it with the fresh genesis.
-            }
-        }
     }
-    // THE FRESH-GENERATION ARM, existing Space: pre-flight attribution first
-    // (never mint a generation the pointer entry cannot then name), then the
-    // GC swap's stage order minus its revoke -- mint, install the delegation,
-    // re-point. The fresh genesis commits only the acting credential's annex
-    // rung; other standing credentials' per-generation rungs are re-committed
-    // only by their own later ceremonies (a property of every generation
-    // swap).
-    await assertPointerEntryAttributable({ ladderSeed, log: account.log });
-    const minted = await mintCredentialClientAnnexGeneration({
-        was: standingWas,
-        wasServerUrl,
-        spaceId: annexSpaceId,
-        controller: account.did,
-        ladderSeed,
-        capability: usableSibling
+    return runInAnnexSpace({
+        annexSpaceId,
+        allowSpaceReplacement: true,
+        ...(pointer !== undefined ? { pointer } : {})
     });
-    const ensured = await ensureGenerationDelegationCurrent({
-        store: storeFor(minted.generationId),
-        ladderSeed,
-        generationId: minted.generationId,
-        mintGenerationDelegation: mintDelegation,
-        expectedDid: minted.did,
-        ...annexPin(minted.generationId),
-        ...(now !== undefined ? { now } : {})
-    });
-    // No revocation of the superseded generation's delegation is attempted:
-    // a transient visit has no reach that could invoke it (the standing client
-    // is neither the Space controller nor in that delegation's chain). The
-    // pointer move itself retires it on a conforming server -- the inspector
-    // clause compares the delegation's controller against the document's
-    // pointer -- and it otherwise rots on its TTL.
-    await movePointerAsLadder({
-        idStore,
-        ladderSeed,
-        clientAnnexDid: minted.did,
-        accountDid: account.did,
-        ...(pinStore !== undefined
-            ? { pinStore, logId: accountLogPinId({ spaceId }) }
-            : {})
-    });
-    const resealed = await resealRecord({
-        delegatedClients: usableSibling,
-        siblingReminted
-    });
-    return {
-        clientAnnexDid: minted.did,
-        generationDelegation: ensured.delegation,
-        delegation: usableBridge,
-        delegatedClients: usableSibling,
-        generationMinted: true,
-        spaceMinted: false,
-        delegationRenewed: false,
-        siblingReminted,
-        bridgeReminted,
-        ...resealed
-    };
-}
-/**
- * The one staleness predicate for the standing recorded delegations this
- * ensure may renew: the record's bridge delegation and its `delegatedClients`
- * sibling. Two axes, the established pair -- expiry (past, or inside the
- * renewal window) and signer death (the proof's verification method no longer
- * under `capabilityDelegation` in the verified account document, the
- * current-key-set rule). One helper rather than a copy per delegation, so the
- * two can never drift onto different rules.
- *
- * @param options {object}
- * @param options.zcap {IZcap}   the recorded delegation
- * @param options.doc {object}   the VERIFIED account document
- * @param [options.now] {number}   epoch milliseconds, for tests
- * @returns {boolean}
- */
-function standingZcapStale({ zcap, doc, now }) {
-    const { expires } = zcap;
-    const delegationKeyId = delegationProofKeyId(zcap);
-    return (zcapExpiring({
-        ...(expires !== undefined ? { expires } : {}),
-        ...(now !== undefined ? { now } : {})
-    }) ||
-        !delegationKeyInDocument({
-            doc: doc,
-            ...(delegationKeyId !== undefined ? { delegationKeyId } : {})
-        }));
 }
 /**
  * The annex Space, in the settled resolution order: the account document's
@@ -497,85 +618,65 @@ export function resolveClientAnnexSpaceId({ doc, delegatedClients }) {
     };
 }
 /**
- * The pre-flight rung attribution: the `{ updateSeed, stagedSeed }` pair the
- * pointer entry signs with, recovered from the verified account log's
- * current parameters. The signer must be a REVEALED rung (the entry verifies
- * against the log's `updateKeys`), with the next rung staged per the
- * carry-over convention. No rung of this ladder standing -- or only a
- * committed hash, which cannot sign -- refuses with
- * {@link ClientAnnexGenerationUnavailableError} before anything is minted.
- * Exported for the establishment's stage-3 primitive, whose pointer entry
- * signs by the same attribution.
+ * The pre-flight rung attribution every pointer-moving arm runs before
+ * minting anything: this ladder has a rung the pointer entry will be able to
+ * sign with, either standing in `updateKeys` already (`revealed`) or
+ * committed in `nextKeyHashes` and revealable by {@link movePointerAsLadder}
+ * (`committed`). A ladder the log carries no rung of at all, and an
+ * ambiguous attribution, refuse with
+ * {@link ClientAnnexGenerationUnavailableError} before a generation or a
+ * Space is minted -- the one place the ladder's `LadderAttributionError`
+ * maps onto that refusal.
  *
  * @param options {object}
  * @param options.ladderSeed {Uint8Array}
  * @param options.log {DIDLog}   the VERIFIED account log
- * @returns {Promise<ClientWebvhUpdateKeys>}
+ * @returns {Promise<{ rung: LadderRung, state: LadderRungState }>}
  */
-export async function pointerEntryUpdateKeys({ ladderSeed, log }) {
-    const params = effectiveParameters(log);
-    const current = params[params.length - 1] ?? {
-        updateKeys: [],
-        nextKeyHashes: []
-    };
-    const unattributable = () => new ClientAnnexGenerationUnavailableError({
-        reason: 'update-key-not-attributable',
-        message: "No current account-log update key is a rung of this credential's " +
-            'ladder; the pointer entry could not be signed, so nothing is minted.'
-    });
-    let attributed;
+export async function attributePointerEntryRung({ ladderSeed, log }) {
+    const current = currentLogParameters({ log });
     try {
-        attributed = await attributeLadderRung({ ladderSeed, published: current });
+        return await attributeLadderRung({ ladderSeed, published: current });
     }
     catch (err) {
         if (err.name === 'LadderAttributionError') {
-            throw unattributable();
+            throw new ClientAnnexGenerationUnavailableError({
+                reason: 'update-key-not-attributable',
+                message: "The account log carries no rung of this credential's ladder, or " +
+                    'the attribution is ambiguous; the pointer entry could not be ' +
+                    'signed, so nothing is minted.'
+            });
         }
         throw err;
     }
-    if (attributed.state !== 'revealed') {
-        throw unattributable();
-    }
-    const staged = await ladderRung({
-        ladderSeed,
-        index: attributed.rung.index + 1
-    });
-    return { updateSeed: attributed.rung.seed, stagedSeed: staged.seed };
 }
 /**
- * The pre-flight the pointer-moving arms run before minting anything: this
- * ladder has a rung the pointer entry will be able to sign with, either
- * standing in `updateKeys` already or committed in `nextKeyHashes` and
- * revealable by {@link movePointerAsLadder}. A ladder the log carries no rung
- * of at all, and an ambiguous attribution, refuse here with
- * {@link ClientAnnexGenerationUnavailableError} before a generation or a
- * Space is minted.
+ * The `{ updateSeed, stagedSeed }` pair the pointer entry signs with, over
+ * {@link attributePointerEntryRung}. The signer must be a REVEALED rung (the
+ * entry verifies against the log's `updateKeys`), with the next rung staged
+ * per the carry-over convention; a rung standing only as a committed hash
+ * cannot sign and refuses the same way. Exported for the establishment's
+ * stage-3 primitive, whose pointer entry signs by the same attribution.
  *
  * @param options {object}
  * @param options.ladderSeed {Uint8Array}
  * @param options.log {DIDLog}   the VERIFIED account log
- * @returns {Promise<void>}
+ * @returns {Promise<ClientWebvhUpdateKeys>}
  */
-async function assertPointerEntryAttributable({ ladderSeed, log }) {
-    const params = effectiveParameters(log);
-    const current = params[params.length - 1] ?? {
-        updateKeys: [],
-        nextKeyHashes: []
-    };
-    try {
-        await attributeLadderRung({ ladderSeed, published: current });
-    }
-    catch (err) {
-        if (err.name === 'LadderAttributionError') {
-            throw new ClientAnnexGenerationUnavailableError({
-                reason: 'update-key-not-attributable',
-                message: "The account log carries no rung of this credential's ladder, or " +
-                    'the attribution is ambiguous; the pointer entry could not be ' +
-                    'signed, so nothing is minted.'
-            });
-        }
-        throw err;
+export async function pointerEntryUpdateKeys({ ladderSeed, log }) {
+    const attributed = await attributePointerEntryRung({ ladderSeed, log });
+    if (attributed.state !== 'revealed') {
+        throw new ClientAnnexGenerationUnavailableError({
+            reason: 'update-key-not-attributable',
+            message: "No current account-log update key is a rung of this credential's " +
+                'ladder; the pointer entry could not be signed, so nothing is minted.'
+        });
     }
+    const staged = await ladderRung({
+        ladderSeed,
+        index: attributed.rung.index + 1
+    });
+    return { updateSeed: attributed.rung.seed, stagedSeed: staged.seed };
 }
 /**
  * The `#DelegatedClients` pointer move as a credential-only visit makes it:
@@ -614,7 +715,7 @@ async function assertPointerEntryAttributable({ ladderSeed, log }) {
  * racing entry landing between the attribution and the PUT loses the CAS and
  * surfaces as a `WebvhLogConflictError` -- the refusal the outer loop
  * re-attributes from. The pre-flight guard
- * ({@link assertPointerEntryAttributable}) therefore cannot fire from
+ * ({@link attributePointerEntryRung}) therefore cannot fire from
  * staleness here: it runs on the caller's snapshot before anything is minted,
  * while every entry this function publishes is built on a head it read
  * itself.
@@ -641,14 +742,12 @@ async function movePointerAsLadder({ idStore, ladderSeed, clientAnnexDid, accoun
         });
         // The head the reveal entry just published (or the unchanged head, when
         // the rung was revealed already), under the same pin.
-        const published = await readPublishedLog({
+        const published = await readPublishedLogOrThrow({
             idStore,
             expectedDid: accountDid,
-            ...pin
+            ...pin,
+            missingMessage: 'did:webvh: did.jsonl is missing; nothing to point at a client annex.'
         });
-        if (published === undefined) {
-            throw new Error('did:webvh: did.jsonl is missing; nothing to point at a client annex.');
-        }
         // A racing ceremony that consumed the rung between this reveal and this
         // read leaves the ladder committed-only again, which the attribution
         // reports as `update-key-not-attributable`. Inside this loop that is a
@@ -674,7 +773,7 @@ async function movePointerAsLadder({ idStore, ladderSeed, clientAnnexDid, accoun
         }
         await setDelegatedClientsPointerOnce({
             idStore,
-            updateKeys,
+            signer: { kind: 'client', updateKeys },
             clientAnnexDid,
             expectedDid: accountDid,
             logOnly: true,