@interop/wallet-core 0.65.0 → 0.66.0

package/dist/keys/userKeyRosterCascade.js

@@ -1,7 +1,7 @@
 import { webvhResourceLogController } from '../resourceLog/index.js';
 import { cascadeCollectionsToUserKey } from './userKeyCascade.js';
 import { isSealableDescriptorStore } from './rosterLogStore.js';
-import { convergeUserKeyRosterToDocument, readUserKeyRoster } from './userKeyRoster.js';
+import { convergeUserKeyRosterToDocument, readUserKeyRoster, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
 /**
  * Resolves the collection ids the fan-out covers, whether they are a fixed set
  * or a listing the app performs.
@@ -16,6 +16,94 @@ async function collectionIdsOf({ collections }) {
         ? await collectionIds()
         : collectionIds;
 }
+/**
+ * The post-edit anchoring guarantee, shared by both entry points: the roster
+ * appends -- and the seal backstop's removal detection -- must run under a
+ * controller view that includes the log the ceremony is anchoring at, or the
+ * rotation anchors before it (a revocation's rotation leaves the log
+ * unsealed with the seal blind to the removal; the last-client transition's
+ * ladder-signed rotation lands before its reinstall version and the
+ * ceremony-tail license refuses it). Rather than leaving that to the
+ * injected store's own controller wiring, the view built from the ceremony's
+ * log is set as the store's minimum controller version; a fresher resolved
+ * view still wins. A store that is not log-governed has no controller view
+ * to anchor and is left alone. Exported for the one caller that reads the
+ * roster before its anchoring entry exists (the last-client transition's
+ * pre-pair probe, anchored at the pre-transition head it verified).
+ *
+ * @param options {object}
+ * @param options.rosterStore {EncryptionDescriptorStore}
+ * @param options.did {string}
+ * @param options.log {DIDLog}
+ */
+export function anchorRosterStoreAt({ rosterStore, did, log }) {
+    if (isSealableDescriptorStore(rosterStore)) {
+        rosterStore.setMinimumControllerVersion({
+            controller: webvhResourceLogController({ did, log })
+        });
+    }
+}
+/**
+ * The adopting read after a rotation: the roster read on the threaded
+ * descriptor (the continuity and possession checks still run on it), then
+ * the caller's `onUserKeyAdopted` when the key rotated on this run.
+ *
+ * @param options {object}
+ * @param options.rosterStore {EncryptionDescriptorStore}
+ * @param options.descriptor {CollectionEncryption}   the rotation's own
+ *   verified result, so one run acquires the roster once for both halves
+ * @param [options.userKey] {UserKey}
+ * @param options.readBackKeyAgreementKey {IKeyAgreementKey}
+ * @param [options.pinnedEpochId] {string}
+ * @param [options.onUserKeyAdopted] {Function}
+ * @returns {Promise<object>}
+ */
+async function adoptRotatedUserKey({ rosterStore, descriptor, userKey, readBackKeyAgreementKey, pinnedEpochId, onUserKeyAdopted }) {
+    const read = await readUserKeyRoster({
+        store: rosterStore,
+        descriptor,
+        ...(userKey ? { userKey } : {}),
+        clientKeyAgreementKey: readBackKeyAgreementKey,
+        pinnedEpochId
+    });
+    if (read.rotated) {
+        await onUserKeyAdopted?.({
+            userKey: read.userKey,
+            latestEpochId: read.latestEpochId,
+            descriptor: read.descriptor
+        });
+    }
+    return {
+        rotated: read.rotated,
+        userKey: read.userKey,
+        descriptor: read.descriptor
+    };
+}
+/**
+ * The collection fan-out, in parallel -- run even when the roster was found
+ * already rotated (a re-run after a crash), because the staleness rule finds
+ * exactly the stranded collections.
+ *
+ * @param options {object}
+ * @param options.collections {CascadeCollections}
+ * @param options.rosterDescriptor {CollectionEncryption}
+ * @param options.clientKeyAgreementKey {IKeyAgreementKey}   the key that
+ *   unwraps the roster's generations for the per-collection re-epoch
+ * @param options.userKey {UserKey}
+ * @returns {Promise<UserKeyCascadeResult>}
+ */
+async function fanOutToCollections({ collections, rosterDescriptor, clientKeyAgreementKey, userKey }) {
+    return cascadeCollectionsToUserKey({
+        collectionIds: await collectionIdsOf({ collections }),
+        storeFor: collections.storeFor,
+        ...(collections.isEncrypted
+            ? { isEncrypted: collections.isEncrypted }
+            : {}),
+        rosterDescriptor,
+        clientKeyAgreementKey,
+        userKey
+    });
+}
 /**
  * Runs the roster rotation (with its seal backstop) and the collection
  * fan-out over the document a ceremony's own edit just published. See the
@@ -33,25 +121,13 @@ async function collectionIdsOf({ collections }) {
  *   (identity) key-agreement key -- its roster entry
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
  *   roster epoch
- * @param [options.onUserKeyAdopted] {Function}   persists a rotated key:
- *   called with `{ userKey, latestEpochId, descriptor }` after the roster read
- *   and BEFORE the fan-out. The key and the epoch pin must persist atomically
+ * @param [options.onUserKeyAdopted] {UserKeyAdoptedHook}   persists a
+ *   rotated key
  * @param options.collections {CascadeCollections}   the fan-out's work
  * @returns {Promise<RosterCascadeResult>}
  */
 export async function rotateRosterToDocumentAndCascade({ rosterStore, did, doc, log, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections }) {
-    // The post-edit anchoring guarantee: the roster appends -- and the seal
-    // backstop's removal detection -- must run under a controller view that
-    // includes the edit the ceremony just published, or the rotation anchors
-    // pre-edit and the log stays unsealed with the seal blind to the removal.
-    // Rather than leaving that to the injected store's own controller wiring,
-    // the view built from the edit's post-edit log is set as the store's minimum
-    // controller version; a fresher resolved view still wins.
-    if (isSealableDescriptorStore(rosterStore)) {
-        rosterStore.setMinimumControllerVersion({
-            controller: webvhResourceLogController({ did, log })
-        });
-    }
+    anchorRosterStoreAt({ rosterStore, did, log });
     // The roster rotation, recipients resolved from that same document.
     // Whether there IS a roster is settled BY the convergence call itself: a
     // `null` descriptor back means the account has no `key-map/user-key.jsonl`
@@ -70,23 +146,14 @@ export async function rotateRosterToDocumentAndCascade({ rosterStore, did, doc,
     if (converged.descriptor === null) {
         return { rotated: false, collections: { outcomes: {}, failed: [] } };
     }
-    // The rotation's own verified result is threaded into the adopting read, so
-    // one run acquires the roster once for both halves of the stage (the
-    // continuity and possession checks still run on the threaded descriptor).
-    const read = await readUserKeyRoster({
-        store: rosterStore,
+    const read = await adoptRotatedUserKey({
+        rosterStore,
         descriptor: converged.descriptor,
-        ...(userKey ? { userKey } : {}),
-        clientKeyAgreementKey,
-        pinnedEpochId
+        userKey,
+        readBackKeyAgreementKey: clientKeyAgreementKey,
+        pinnedEpochId,
+        onUserKeyAdopted
     });
-    if (read.rotated) {
-        await onUserKeyAdopted?.({
-            userKey: read.userKey,
-            latestEpochId: read.latestEpochId,
-            descriptor: read.descriptor
-        });
-    }
     // The seal backstop: an ordinary rotation is the sealing append by
     // construction, but a rotation that no-op'd (the removed party held no
     // current-epoch wrap -- an orphan entry, or any re-run) appended nothing,
@@ -102,15 +169,8 @@ export async function rotateRosterToDocumentAndCascade({ rosterStore, did, doc,
             rosterSeal = { outcome: 'failed', error: err };
         }
     }
-    // The collection fan-out, in parallel -- run even when this call found the
-    // roster already rotated (a re-run after a crash), because the staleness
-    // rule finds exactly the stranded collections.
-    const cascade = await cascadeCollectionsToUserKey({
-        collectionIds: await collectionIdsOf({ collections }),
-        storeFor: collections.storeFor,
-        ...(collections.isEncrypted
-            ? { isEncrypted: collections.isEncrypted }
-            : {}),
+    const cascade = await fanOutToCollections({
+        collections,
         rosterDescriptor: read.descriptor,
         clientKeyAgreementKey,
         userKey: read.userKey
@@ -123,4 +183,84 @@ export async function rotateRosterToDocumentAndCascade({ rosterStore, did, doc,
         rosterDescriptor: read.descriptor
     };
 }
+/**
+ * The recipient-naming entry point: retires ONE named roster recipient and
+ * runs the collection fan-out, for a ceremony that rotates BEFORE its own
+ * document edit (see the module doc). The document handed in still keys the
+ * retiring recipient, so the rotation names its kid explicitly; the fresh key
+ * is read back through `readBackKeyAgreementKey`, a recipient whose wrap
+ * survives the rotation (the standing credential's, on both forgets). No
+ * seal backstop runs here.
+ *
+ * Every stage detects its own completion from durable state: a recipient the
+ * current epoch no longer wraps to skips the append (so a re-run of a
+ * torn-after-rotation ceremony attempts no second append at the same anchor,
+ * which on a ladder-signed roster the one-shot license would refuse), the
+ * read-back adopts whatever the roster now delivers, and the fan-out is
+ * staleness-driven. An account with no roster yet reports `rotated: false`
+ * with an empty fan-out and no key.
+ *
+ * @param options {object}
+ * @param options.rosterStore {EncryptionDescriptorStore}   the
+ *   `key-map/user-key.jsonl` roster store
+ * @param options.did {string}   the account's did:webvh
+ * @param options.doc {DIDDoc}   the document the rotation's recipients are
+ *   resolved from -- the one `log` resolves to
+ * @param options.log {DIDLog}   the log the rotation anchors at, which the
+ *   minimum controller version is built from: the pre-edit head for a plain
+ *   forget, the post-reinstall head for the last-client transition
+ * @param options.retireRecipientId {string}   the roster kid to retire
+ * @param [options.userKey] {UserKey}   this client's cached user key
+ * @param options.readBackKeyAgreementKey {IKeyAgreementKey}   the recipient
+ *   whose wrap survives the rotation, reading the fresh key back and
+ *   unwrapping the generations for the fan-out
+ * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
+ *   roster epoch
+ * @param [options.onUserKeyAdopted] {UserKeyAdoptedHook}   persists a
+ *   rotated key
+ * @param options.collections {CascadeCollections}   the fan-out's work
+ * @returns {Promise<RosterCascadeResult>}   `rotated` says whether THIS run
+ *   retired the recipient's wrap; `rosterSeal` is never present
+ * @throws {UserKeyRosterIntegrityError}   the roster's `currentEpoch` names
+ *   no epoch in its own list
+ */
+export async function retireRosterRecipientAndCascade({ rosterStore, did, doc, log, retireRecipientId, userKey, readBackKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections }) {
+    anchorRosterStoreAt({ rosterStore, did, log });
+    const current = await rosterStore.read();
+    if (current === null) {
+        return { rotated: false, collections: { outcomes: {}, failed: [] } };
+    }
+    let descriptor = current.descriptor;
+    let rotated = false;
+    if (rosterWrapsRecipient({ descriptor, recipientId: retireRecipientId })) {
+        descriptor = await rotateUserKeyRoster({
+            store: rosterStore,
+            document: doc,
+            retireRecipientId
+        });
+        rotated = true;
+    }
+    // The fresh key comes back through the surviving recipient's wrap -- the
+    // retired one is gone from the current epoch.
+    const read = await adoptRotatedUserKey({
+        rosterStore,
+        descriptor,
+        userKey,
+        readBackKeyAgreementKey,
+        pinnedEpochId,
+        onUserKeyAdopted
+    });
+    const cascade = await fanOutToCollections({
+        collections,
+        rosterDescriptor: read.descriptor,
+        clientKeyAgreementKey: readBackKeyAgreementKey,
+        userKey: read.userKey
+    });
+    return {
+        rotated,
+        collections: cascade,
+        userKey: read.userKey,
+        rosterDescriptor: read.descriptor
+    };
+}
 //# sourceMappingURL=userKeyRosterCascade.js.map

package/dist/keys/userKeyRosterCascade.js.map

@@ -1 +1 @@
-{"version":3,"file":"userKeyRosterCascade.js","sourceRoot":"","sources":["../../src/keys/userKeyRosterCascade.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACL,2BAA2B,EAE5B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AA4C3B;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,EAC7B,WAAW,EAGZ;IACC,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAA;IACrC,OAAO,OAAO,aAAa,KAAK,UAAU;QACxC,CAAC,CAAC,MAAM,aAAa,EAAE;QACvB,CAAC,CAAC,aAAa,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,EACrD,WAAW,EACX,GAAG,EACH,GAAG,EACH,GAAG,EACH,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EAeZ;IACC,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,WAAW,CAAC,2BAA2B,CAAC;YACtC,UAAU,EAAE,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACrD,CAAC,CAAA;IACJ,CAAC;IAED,oEAAoE;IACpE,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,oCAAoC;IACpC,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;QACtD,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,GAAG;QACb,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAA;IACtE,CAAC;IACD,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK,EAAE,WAAW;QAClB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;KACd,CAAC,CAAA;IACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,gBAAgB,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,UAAwC,CAAA;IAC5C,IAAI,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QAChD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,aAAa,EAAE,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;YACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;KAClC,CAAA;AACH,CAAC"}
+{"version":3,"file":"userKeyRosterCascade.js","sourceRoot":"","sources":["../../src/keys/userKeyRosterCascade.ts"],"names":[],"mappings":"AAyDA,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACL,2BAA2B,EAE5B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AA+C3B;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,EAC7B,WAAW,EAGZ;IACC,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAA;IACrC,OAAO,OAAO,aAAa,KAAK,UAAU;QACxC,CAAC,CAAC,MAAM,aAAa,EAAE;QACvB,CAAC,CAAC,aAAa,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,WAAW,EACX,GAAG,EACH,GAAG,EAKJ;IACC,IAAI,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,WAAW,CAAC,2BAA2B,CAAC;YACtC,UAAU,EAAE,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACrD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,mBAAmB,CAAC,EACjC,WAAW,EACX,UAAU,EACV,OAAO,EACP,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EAQjB;IAKC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK,EAAE,WAAW;QAClB,UAAU;QACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB,EAAE,uBAAuB;QAC9C,aAAa;KACd,CAAC,CAAA;IACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,gBAAgB,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,mBAAmB,CAAC,EACjC,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,OAAO,EAMR;IACC,OAAO,2BAA2B,CAAC;QACjC,aAAa,EAAE,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;YACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,gBAAgB;QAChB,qBAAqB;QACrB,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,EACrD,WAAW,EACX,GAAG,EACH,GAAG,EACH,GAAG,EACH,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EAWZ;IACC,mBAAmB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IAE9C,oEAAoE;IACpE,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,6EAA6E;IAC7E,oCAAoC;IACpC,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;QACtD,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,GAAG;QACb,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAA;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;QACrC,WAAW;QACX,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,OAAO;QACP,uBAAuB,EAAE,qBAAqB;QAC9C,aAAa;QACb,gBAAgB;KACjB,CAAC,CAAA;IAEF,mEAAmE;IACnE,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,UAAwC,CAAA;IAC5C,IAAI,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QAChD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,WAAW;QACX,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;KAClC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,EACpD,WAAW,EACX,GAAG,EACH,GAAG,EACH,GAAG,EACH,iBAAiB,EACjB,OAAO,EACP,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EAChB,WAAW,EAYZ;IACC,mBAAmB,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IAE9C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAA;IACtE,CAAC;IACD,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACnC,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,oBAAoB,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACzE,UAAU,GAAG,MAAM,mBAAmB,CAAC;YACrC,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,GAAG;YACb,iBAAiB;SAClB,CAAC,CAAA;QACF,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;QACrC,WAAW;QACX,UAAU;QACV,OAAO;QACP,uBAAuB;QACvB,aAAa;QACb,gBAAgB;KACjB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,WAAW;QACX,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,qBAAqB,EAAE,uBAAuB;QAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;IACF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;KAClC,CAAA;AACH,CAAC"}

package/dist/recovery/index.d.ts

@@ -45,7 +45,7 @@ export { decodeRecoveryCode, formatRecoveryCode, generateRecoveryCode, normalize
 export type { RecoveryClient } from './recoveryCode.js';
 export { computeUnlockBinding, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from '../unlock/unlockRecord.js';
 export type { SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from '../unlock/unlockRecord.js';
-export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, remintRecoveryDelegations, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
+export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, recordedDelegationFields, remintRecoveryDelegations, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
 export type { RecordRemintOutcome, RecoveryDelegationEntry } from './recoveryDelegation.js';
 export { publishRecoveryKey, recoverWebvhClient, RecoveryKeyNotCommittedError, recoveryVmId, removeRecoveryKey } from './recoveryWebvh.js';
 export type { RecoveryLogStore, RecoveryPublicKeys, ReplacementRecoveryPublicKeys } from './recoveryWebvh.js';

package/dist/recovery/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,oBAAoB,CAAA"}

package/dist/recovery/index.js

@@ -43,6 +43,6 @@
  */
 export { decodeRecoveryCode, formatRecoveryCode, generateRecoveryCode, normalizeRecoveryCode, RECOVERY_CODE_BYTES, RECOVERY_KDF, RecoveryCodeInvalidError, recoveryClientFromCode } from './recoveryCode.js';
 export { computeUnlockBinding, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from '../unlock/unlockRecord.js';
-export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, remintRecoveryDelegations, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
+export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, recordedDelegationFields, remintRecoveryDelegations, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
 export { publishRecoveryKey, recoverWebvhClient, RecoveryKeyNotCommittedError, recoveryVmId, removeRecoveryKey } from './recoveryWebvh.js';
 //# sourceMappingURL=index.js.map

package/dist/recovery/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAMhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAMhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA"}

package/dist/recovery/recoveryDelegation.d.ts

@@ -41,6 +41,29 @@ export declare function delegateLogWrite({ zcapClient, pointer, recoveryClientDi
     now?: number;
 }): Promise<IZcap>;
 export { delegationProofKeyId };
+/**
+ * The registry fields a record's delegations stand for -- which key signed
+ * the bridge and the `delegatedClients` sibling, and when each expires --
+ * built once here for the re-mint and for the credential-anchored
+ * establishment's standing fields. A member is present iff its source is:
+ * an absent delegation, a proof with no key id, or a caveat-less zcap
+ * contributes nothing.
+ *
+ * @param options {object}
+ * @param [options.delegation] {IZcap}   the record's bridge delegation
+ * @param [options.delegatedClients] {IZcap}   the record's sibling
+ * @returns {{ delegationKeyId?: string, delegationExpires?: string,
+ *   delegatedClientsKeyId?: string, delegatedClientsExpires?: string }}
+ */
+export declare function recordedDelegationFields({ delegation, delegatedClients }: {
+    delegation?: IZcap;
+    delegatedClients?: IZcap;
+}): {
+    delegationKeyId?: string;
+    delegationExpires?: string;
+    delegatedClientsKeyId?: string;
+    delegatedClientsExpires?: string;
+};
 /**
  * The members of a recovery-code registry entry the re-mint reads: where the
  * code's unlock Space and record are (`unlockSpaceId`, `manageCapability`),

package/dist/recovery/recoveryDelegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKxE,OAAO,EACL,oBAAoB,EAGrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAgB,EACjB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EACL,SAAS,GAAG,UAAU,GAAG,kBAAkB,GAAG,eAAe,GAAG,QAAQ,CAAA;IAC1E,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAA0B,EAC1B,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,8BAA8B,CAAC,EAAE,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,KAAK,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAAC,CA4LD"}
+{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKxE,OAAO,EACL,oBAAoB,EAGrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAgB,EACjB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EACjB,EAAE;IACD,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,gBAAgB,CAAC,EAAE,KAAK,CAAA;CACzB,GAAG;IACF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,CAiBA;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EACL,SAAS,GAAG,UAAU,GAAG,kBAAkB,GAAG,eAAe,GAAG,QAAQ,CAAA;IAC1E,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAA0B,EAC1B,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,8BAA8B,CAAC,EAAE,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,KAAK,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAAC,CAoLD"}

package/dist/recovery/recoveryDelegation.js

@@ -112,6 +112,47 @@ export async function delegateLogWrite({ zcapClient, pointer, recoveryClientDid,
 // Re-exported from its shared home (`webvh/standingZcap.ts`), so this
 // module's public surface is unchanged.
 export { delegationProofKeyId };
+/**
+ * The registry fields a record's delegations stand for -- which key signed
+ * the bridge and the `delegatedClients` sibling, and when each expires --
+ * built once here for the re-mint and for the credential-anchored
+ * establishment's standing fields. A member is present iff its source is:
+ * an absent delegation, a proof with no key id, or a caveat-less zcap
+ * contributes nothing.
+ *
+ * @param options {object}
+ * @param [options.delegation] {IZcap}   the record's bridge delegation
+ * @param [options.delegatedClients] {IZcap}   the record's sibling
+ * @returns {{ delegationKeyId?: string, delegationExpires?: string,
+ *   delegatedClientsKeyId?: string, delegatedClientsExpires?: string }}
+ */
+export function recordedDelegationFields({ delegation, delegatedClients }) {
+    const delegationKeyId = delegation
+        ? delegationProofKeyId(delegation)
+        : undefined;
+    const delegationExpires = delegation ? zcapExpires(delegation) : undefined;
+    const delegatedClientsKeyId = delegatedClients
+        ? delegationProofKeyId(delegatedClients)
+        : undefined;
+    const delegatedClientsExpires = delegatedClients
+        ? zcapExpires(delegatedClients)
+        : undefined;
+    return {
+        ...(delegationKeyId ? { delegationKeyId } : {}),
+        ...(delegationExpires ? { delegationExpires } : {}),
+        ...(delegatedClientsKeyId ? { delegatedClientsKeyId } : {}),
+        ...(delegatedClientsExpires ? { delegatedClientsExpires } : {})
+    };
+}
+/**
+ * A delegation's `expires` caveat, when it carries one.
+ *
+ * @param zcap {IZcap}
+ * @returns {string | undefined}
+ */
+function zcapExpires(zcap) {
+    return zcap.expires;
+}
 /**
  * Re-mints the recovery delegations the current document no longer backs --
  * the recovery-code delta riding the revocation cascade (see the module doc
@@ -295,21 +336,13 @@ export async function remintRecoveryDelegations({ doc, entries, pointer, storage
                 record: wrapped,
                 capability: entry.manageCapability
             });
-            const delegationKeyId = delegationProofKeyId(delegation);
-            const delegationExpires = delegation.expires;
-            const delegatedClientsKeyId = delegatedClients
-                ? delegationProofKeyId(delegatedClients)
-                : undefined;
-            const delegatedClientsExpires = delegatedClients
-                ? delegatedClients.expires
-                : undefined;
             await recordEntry({
                 entry: {
                     ...entry,
-                    ...(delegationKeyId ? { delegationKeyId } : {}),
-                    ...(delegationExpires ? { delegationExpires } : {}),
-                    ...(delegatedClientsKeyId ? { delegatedClientsKeyId } : {}),
-                    ...(delegatedClientsExpires ? { delegatedClientsExpires } : {})
+                    ...recordedDelegationFields({
+                        delegation,
+                        ...(delegatedClients ? { delegatedClients } : {})
+                    })
                 }
             });
             reminted += 1;

package/dist/recovery/recoveryDelegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEzE,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,wEAAwE;AACxE,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAMjB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,0BAA0B,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED,sEAAsE;AACtE,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAwD/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAAqB,GAAG,EAAE,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAejB;IAKC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,aAAa,GAAG,CACpB,eAAmC,EACnC,OAA2B,EAClB,EAAE,CACX,iBAAiB,CAAC;QAChB,GAAG;QACH,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,GAAG;KACJ,CAAC,CAAA;IACJ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,eAAe,GACnB,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAA;QAC7C,MAAM,YAAY,GAChB,eAAe;YACf,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,SAAS;aACnB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IACE,CAAC,KAAK,CAAC,iBAAiB;YACxB,CAAC,KAAK,CAAC,uBAAuB;YAC9B,CAAC,KAAK,CAAC,8BAA8B;YACrC,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;YACD,sEAAsE;YACtE,mDAAmD;YACnD,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;gBACpD,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,4DAA4D;YAC5D,oEAAoE;YACpE,gEAAgE;YAChE,wDAAwD;YACxD,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,2CAA2C;YAC3C,IACE,CAAC,oBAAoB,CAAC;gBACpB,MAAM,EAAE,QAAQ;gBAChB,wBAAwB,EAAE,KAAK,CAAC,8BAA8B;aAC/D,CAAC,EACF,CAAC;gBACD,GAAG,CAAC,IAAI,CACN,4DAA4D;oBAC1D,gEAAgE;oBAChE,2DAA2D,EAC7D,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACD,OAAO,IAAI,CAAC,CAAA;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,UAAU;gBACV,OAAO;gBACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAA;YACF,kEAAkE;YAClE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,gBAAmC,CAAA;YACvC,IAAI,sBAAsB,GAAG,KAAK,CAAA;YAClC,IAAI,eAAe,EAAE,CAAC;gBACpB,gBAAgB,GAAG,MAAM,8BAA8B,EAAE,CAAC;oBACxD,UAAU,EAAE,KAAK,CAAC,iBAAiB;iBACpC,CAAC,CAAA;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,sBAAsB,GAAG,IAAI,CAAA;oBAC7B,GAAG,CAAC,IAAI,CACN,6DAA6D;wBAC3D,gEAAgE,EAClE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,MAAM,SAAS,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC;gBACtD,EAAE,EAAE,KAAK,CAAC,uBAAuB;gBACjC,UAAU,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,EAAE,2BAA2B;gBACjC,kBAAkB,EAAE,KAAK,CAAC,8BAA8B;aACzD,CAAC,CAAqB,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;gBAClD,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YACF,MAAM,8BAA8B,CAAC;gBACnC,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;YACxD,MAAM,iBAAiB,GAAI,UAAmC,CAAC,OAAO,CAAA;YACtE,MAAM,qBAAqB,GAAG,gBAAgB;gBAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;gBACxC,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,uBAAuB,GAAG,gBAAgB;gBAC9C,CAAC,CAAE,gBAAyC,CAAC,OAAO;gBACpD,CAAC,CAAC,SAAS,CAAA;YACb,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;aACF,CAAC,CAAA;YACF,QAAQ,IAAI,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,UAAU;gBACnB,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;aACJ,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEzE,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,wEAAwE;AACxE,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAMjB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,0BAA0B,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED,sEAAsE;AACtE,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EAIjB;IAMC,MAAM,eAAe,GAAG,UAAU;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,MAAM,qBAAqB,GAAG,gBAAgB;QAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;QACxC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,uBAAuB,GAAG,gBAAgB;QAC9C,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAA;IACb,OAAO;QACL,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAW;IAC9B,OAAQ,IAA6B,CAAC,OAAO,CAAA;AAC/C,CAAC;AAwDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAAqB,GAAG,EAAE,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAejB;IAKC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,aAAa,GAAG,CACpB,eAAmC,EACnC,OAA2B,EAClB,EAAE,CACX,iBAAiB,CAAC;QAChB,GAAG;QACH,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,GAAG;KACJ,CAAC,CAAA;IACJ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,eAAe,GACnB,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAA;QAC7C,MAAM,YAAY,GAChB,eAAe;YACf,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,SAAS;aACnB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IACE,CAAC,KAAK,CAAC,iBAAiB;YACxB,CAAC,KAAK,CAAC,uBAAuB;YAC9B,CAAC,KAAK,CAAC,8BAA8B;YACrC,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;YACD,sEAAsE;YACtE,mDAAmD;YACnD,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;gBACpD,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,4DAA4D;YAC5D,oEAAoE;YACpE,gEAAgE;YAChE,wDAAwD;YACxD,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,2CAA2C;YAC3C,IACE,CAAC,oBAAoB,CAAC;gBACpB,MAAM,EAAE,QAAQ;gBAChB,wBAAwB,EAAE,KAAK,CAAC,8BAA8B;aAC/D,CAAC,EACF,CAAC;gBACD,GAAG,CAAC,IAAI,CACN,4DAA4D;oBAC1D,gEAAgE;oBAChE,2DAA2D,EAC7D,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACD,OAAO,IAAI,CAAC,CAAA;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,UAAU;gBACV,OAAO;gBACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAA;YACF,kEAAkE;YAClE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,gBAAmC,CAAA;YACvC,IAAI,sBAAsB,GAAG,KAAK,CAAA;YAClC,IAAI,eAAe,EAAE,CAAC;gBACpB,gBAAgB,GAAG,MAAM,8BAA8B,EAAE,CAAC;oBACxD,UAAU,EAAE,KAAK,CAAC,iBAAiB;iBACpC,CAAC,CAAA;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,sBAAsB,GAAG,IAAI,CAAA;oBAC7B,GAAG,CAAC,IAAI,CACN,6DAA6D;wBAC3D,gEAAgE,EAClE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,MAAM,SAAS,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC;gBACtD,EAAE,EAAE,KAAK,CAAC,uBAAuB;gBACjC,UAAU,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,EAAE,2BAA2B;gBACjC,kBAAkB,EAAE,KAAK,CAAC,8BAA8B;aACzD,CAAC,CAAqB,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;gBAClD,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YACF,MAAM,8BAA8B,CAAC;gBACnC,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,GAAG,wBAAwB,CAAC;wBAC1B,UAAU;wBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAClD,CAAC;iBACH;aACF,CAAC,CAAA;YACF,QAAQ,IAAI,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,UAAU;gBACnB,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;aACJ,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC"}

package/dist/request/appKey.d.ts

@@ -1,4 +1,4 @@
-import type { IVerifiableCredential } from '@interop/data-integrity-core';
+import type { IDocumentLoader, IVerifiableCredential } from '@interop/data-integrity-core';
 import { CONTEXT_URL_V1 as APP_CONNECT_CONTEXT_URL } from 'byoe-context';
 import type { IAppConnectApp } from './types.js';
 /**
@@ -160,6 +160,40 @@ export declare function findAppKeyCredential({ credentials, appUrl, origin }: {
     appUrl: string;
     origin: string;
 }): Promise<IVerifiableCredential | undefined>;
+/**
+ * Assembles and signs an app-key credential for a seed the caller supplies:
+ * the fixed two-entry type array, the hosted App Connect context URL, issuer
+ * and subject both the seed-derived DID, and the `seed` / `appUrl` / `origin`
+ * claims. `vc.issue` auto-fills `issuanceDate` in the canonical UTC form the
+ * ranking expects. Shared by the fresh mint and the legacy re-issue, and
+ * exported for an application's own self-issue path (dev-grant provisioning,
+ * tests), so the credential's shape is maintained in one place.
+ *
+ * @param options {object}
+ * @param options.seedBytes {Uint8Array} - The 32-byte master seed; the
+ *   derived did:key is both issuer and subject.
+ * @param options.appName {string} - Shown on the credential (`name`, and the
+ *   default `description`).
+ * @param options.appUrl {string} - The app's canonical URL, already in
+ *   serialized form.
+ * @param options.origin {string} - The attested requesting origin.
+ * @param [options.description] {string} - Overrides the default consent
+ *   sentence (the legacy re-issue carries the old credential's forward).
+ * @param [options.documentLoader] {IDocumentLoader} - JSON-LD loader; defaults
+ *   to the shared security loader.
+ * @returns {Promise<{ credential: IVerifiableCredential; subjectDid: string }>}
+ */
+export declare function issueAppKeyCredential({ seedBytes, appName, appUrl, origin, description, documentLoader: loader }: {
+    seedBytes: Uint8Array;
+    appName: string;
+    appUrl: string;
+    origin: string;
+    description?: string;
+    documentLoader?: IDocumentLoader;
+}): Promise<{
+    credential: IVerifiableCredential;
+    subjectDid: string;
+}>;
 /**
  * Mints a fresh app-key credential for an app + origin: generates a 32-byte
  * seed, derives the seed's did:key, and self-issues the credential (issuer ==

package/dist/request/appKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"appKey.d.ts","sourceRoot":"","sources":["../../src/request/appKey.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAMzE,OAAO,EAAE,cAAc,IAAI,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAShD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,YAAY,CAAA;AAIzC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAA;AAEzD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAG9C,CAAA;AAEF;;;;;;GAMG;AACH,OAAO,EAAE,uBAAuB,EAAE,CAAA;AAOlC;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;;CAQ5C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAI5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;;CAQlD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,IAAI,CAAC,CAOf;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,qBAAqB,EAAE,CAU1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,WAAW,EACX,MAAM,EACN,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAU7C;AAmDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,MAAM,EACP,EAAE;IACD,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,WAAW,EACX,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAoB7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,UAAU,EACV,GAAG,EACH,MAAM,EACP,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBrE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAEpB;AA4BD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAMpB"}
+{"version":3,"file":"appKey.d.ts","sourceRoot":"","sources":["../../src/request/appKey.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACtB,MAAM,8BAA8B,CAAA;AAMrC,OAAO,EAAE,cAAc,IAAI,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAShD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,YAAY,CAAA;AAIzC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAA;AAEzD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAG9C,CAAA;AAEF;;;;;;GAMG;AACH,OAAO,EAAE,uBAAuB,EAAE,CAAA;AAOlC;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;;CAQ5C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAI5E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;;CAQlD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,IAAI,CAAC,CAOf;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,WAAW,EACX,MAAM,EACN,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,qBAAqB,EAAE,CAU1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,WAAW,EACX,MAAM,EACN,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAU7C;AAaD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,SAAS,EACT,OAAO,EACP,MAAM,EACN,MAAM,EACN,WAA+C,EAC/C,cAAc,EAAE,MAAuB,EACxC,EAAE;IACD,SAAS,EAAE,UAAU,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BrE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,MAAM,EACP,EAAE;IACD,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAQrE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,WAAW,EACX,MAAM,EACP,EAAE;IACD,WAAW,EAAE,qBAAqB,EAAE,CAAA;IACpC,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAoB7C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,UAAU,EACV,GAAG,EACH,MAAM,EACP,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,GAAG,EAAE,cAAc,CAAA;IACnB,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBrE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAEpB;AA4BD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAMpB"}

package/dist/request/appKey.js

@@ -289,14 +289,38 @@ export async function findAppKeyCredential({ credentials, appUrl, origin }) {
     }
     return undefined;
 }
+/**
+ * The `description` an app-key credential carries when the caller supplies
+ * none: the consent-surface sentence the wallet mints with.
+ */
+function defaultAppKeyDescription(appName) {
+    return (`The ${appName} app keeps this key in your wallet so it can open ` +
+        'your encrypted data on this and other devices.');
+}
 /**
  * Assembles and signs an app-key credential for a seed the caller supplies:
  * the fixed two-entry type array, the hosted App Connect context URL, issuer
  * and subject both the seed-derived DID, and the `seed` / `appUrl` / `origin`
  * claims. `vc.issue` auto-fills `issuanceDate` in the canonical UTC form the
- * ranking expects. Shared by the fresh mint and the legacy re-issue.
+ * ranking expects. Shared by the fresh mint and the legacy re-issue, and
+ * exported for an application's own self-issue path (dev-grant provisioning,
+ * tests), so the credential's shape is maintained in one place.
+ *
+ * @param options {object}
+ * @param options.seedBytes {Uint8Array} - The 32-byte master seed; the
+ *   derived did:key is both issuer and subject.
+ * @param options.appName {string} - Shown on the credential (`name`, and the
+ *   default `description`).
+ * @param options.appUrl {string} - The app's canonical URL, already in
+ *   serialized form.
+ * @param options.origin {string} - The attested requesting origin.
+ * @param [options.description] {string} - Overrides the default consent
+ *   sentence (the legacy re-issue carries the old credential's forward).
+ * @param [options.documentLoader] {IDocumentLoader} - JSON-LD loader; defaults
+ *   to the shared security loader.
+ * @returns {Promise<{ credential: IVerifiableCredential; subjectDid: string }>}
  */
-async function issueAppKeyCredential({ seedBytes, appName, appUrl, origin, description }) {
+export async function issueAppKeyCredential({ seedBytes, appName, appUrl, origin, description = defaultAppKeyDescription(appName), documentLoader: loader = documentLoader }) {
     const agent = await CapabilityAgent.fromSeed({
         seed: seedBytes,
         handle: APP_KEY_HANDLE,
@@ -321,7 +345,7 @@ async function issueAppKeyCredential({ seedBytes, appName, appUrl, origin, descr
     const signed = (await vc.issue({
         credential,
         suite,
-        documentLoader
+        documentLoader: loader
     }));
     return { credential: signed, subjectDid: controllerDid };
 }
@@ -347,9 +371,7 @@ export async function mintAppKeyCredential({ app, origin }) {
         seedBytes,
         appName: app.name,
         appUrl: app.appUrl,
-        origin,
-        description: `The ${app.name} app keeps this key in your wallet so it can open ` +
-            'your encrypted data on this and other devices.'
+        origin
     });
 }
 /**
@@ -428,10 +450,7 @@ export async function reissueAppKeyCredential({ credential, app, origin }) {
         appName: app.name,
         appUrl: app.appUrl,
         origin,
-        description: typeof legacyDescription === 'string'
-            ? legacyDescription
-            : `The ${app.name} app keeps this key in your wallet so it can ` +
-                'open your encrypted data on this and other devices.'
+        description: typeof legacyDescription === 'string' ? legacyDescription : undefined
     });
 }
 /**