@interop/wallet-core 0.65.0 → 0.67.0

package/dist/clientAnnex/zcap.js

@@ -11,6 +11,33 @@
 import { Ed25519VerificationKey } from '@interop/ed25519-verification-key';
 import { zcapClientForSigner } from '../identity/agents.js';
 import { ladderVmSeed } from './ladder.js';
+/**
+ * What the ladder VM's key material amounts to for a caller: its public
+ * multibase and a bound `sign`, generated once from the seed. Both entry
+ * points below present the SAME key under two controllers, so the generation
+ * is stated here rather than at each of them.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
+ * @returns {Promise<object>}   `{ publicKeyMultibase, sign }`
+ */
+async function ladderVmKeyMaterial({ ladderSeed }) {
+    const keyPair = await Ed25519VerificationKey.generate({
+        seed: ladderVmSeed({ ladderSeed })
+    });
+    const { publicKeyMultibase } = keyPair;
+    // The key pair refuses to hand out a signer without an id; set the
+    // verification-method id before asking. Which controller it names does not
+    // reach the signature -- the caller's own signer object below carries the
+    // id the proof states.
+    keyPair.id = `did:key:${publicKeyMultibase}#${publicKeyMultibase}`;
+    keyPair.controller = `did:key:${publicKeyMultibase}`;
+    const keySigner = keyPair.signer();
+    return {
+        publicKeyMultibase,
+        sign: keySigner.sign.bind(keySigner)
+    };
+}
 /**
  * The ladder VM's key pair as a signer under the DID it is presented as, the
  * one derivation both entry points below share (`Ed25519VerificationKey`
@@ -26,24 +53,33 @@ import { ladderVmSeed } from './ladder.js';
  * @returns {Promise<object>}   `{ publicKeyMultibase, controller, signer }`
  */
 async function ladderVmSigner({ ladderSeed, accountDid }) {
-    const keyPair = await Ed25519VerificationKey.generate({
-        seed: ladderVmSeed({ ladderSeed })
+    const material = await ladderVmKeyMaterial({ ladderSeed });
+    return presentedLadderVmSigner({
+        material,
+        ...(accountDid !== undefined ? { accountDid } : {})
     });
-    const { publicKeyMultibase } = keyPair;
+}
+/**
+ * One presentation of the ladder VM's key material: the same key under the
+ * controller the caller states, with the verification-method id
+ * `<controller>#<multibase>` the proof carries.
+ *
+ * @param options {object}
+ * @param options.material {object}   {@link ladderVmKeyMaterial}'s result
+ * @param [options.accountDid] {string}   the DID the key is presented under;
+ *   omitted, the key stands under its own bare did:key
+ * @returns {object}   `{ publicKeyMultibase, controller, signer }`
+ */
+function presentedLadderVmSigner({ material, accountDid }) {
+    const { publicKeyMultibase, sign } = material;
     const controller = accountDid ?? `did:key:${publicKeyMultibase}`;
-    const id = `${controller}#${publicKeyMultibase}`;
-    // The key pair refuses to hand out a signer without an id; set the
-    // verification-method id before asking.
-    keyPair.id = id;
-    keyPair.controller = controller;
-    const keySigner = keyPair.signer();
     return {
         publicKeyMultibase,
         controller,
         signer: {
-            id,
+            id: `${controller}#${publicKeyMultibase}`,
             type: 'Ed25519VerificationKey2020',
-            sign: keySigner.sign.bind(keySigner)
+            sign
         }
     };
 }
@@ -97,9 +133,21 @@ export async function ladderVmZcapClient({ accountDid, ladderSeed }) {
  * @returns {Promise<ICapabilityAgent>}
  */
 export async function ladderVmAgent({ ladderSeed }) {
+    return ladderVmAgentOf({
+        material: await ladderVmKeyMaterial({ ladderSeed })
+    });
+}
+/**
+ * {@link ladderVmAgent} over key material a caller already generated.
+ *
+ * @param options {object}
+ * @param options.material {object}   {@link ladderVmKeyMaterial}'s result
+ * @returns {ICapabilityAgent}
+ */
+function ladderVmAgentOf({ material }) {
     // No account DID: the key stands under its own bare did:key, the
     // verification-method form the server's did:key resolver expects.
-    const { publicKeyMultibase, controller: did, signer } = await ladderVmSigner({ ladderSeed });
+    const { publicKeyMultibase, controller: did, signer } = presentedLadderVmSigner({ material });
     return {
         id: did,
         handle: 'ladder-vm',
@@ -111,4 +159,24 @@ export async function ladderVmAgent({ ladderSeed }) {
         })
     };
 }
+/**
+ * The ladder VM's two presentations from ONE key generation: the bare did:key
+ * agent a bootstrap identity invokes as, and the ZcapClient that delegates
+ * under `<accountDid>#<multibase>`. A caller needing both -- a ceremony that
+ * mints delegations while invoking as the ladder -- takes them here instead of
+ * paying the Ed25519 generation twice.
+ *
+ * @param options {object}
+ * @param options.accountDid {string}   the account did:webvh
+ * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
+ * @returns {Promise<{ agent: ICapabilityAgent, zcapClient: ZcapClient }>}
+ */
+export async function ladderVmSigners({ accountDid, ladderSeed }) {
+    const material = await ladderVmKeyMaterial({ ladderSeed });
+    const { signer } = presentedLadderVmSigner({ material, accountDid });
+    return {
+        agent: ladderVmAgentOf({ material }),
+        zcapClient: zcapClientForSigner({ signer })
+    };
+}
 //# sourceMappingURL=zcap.js.map

package/dist/clientAnnex/zcap.js.map

@@ -1 +1 @@
-{"version":3,"file":"zcap.js","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,UAAU,EACV,UAAU,EAIX;IACC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;KACnC,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAA;IACtC,MAAM,UAAU,GAAG,UAAU,IAAI,WAAW,kBAAkB,EAAE,CAAA;IAChE,MAAM,EAAE,GAAG,GAAG,UAAU,IAAI,kBAAkB,EAAE,CAAA;IAChD,mEAAmE;IACnE,wCAAwC;IACxC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAA;IACf,OAAO,CAAC,UAAU,GAAG,UAAU,CAAA;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;IAClC,OAAO;QACL,kBAAkB;QAClB,UAAU;QACV,MAAM,EAAE;YACN,EAAE;YACF,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAEV;SAC1B;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EAIX;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,UAAU,EAGX;IACC,iEAAiE;IACjE,kEAAkE;IAClE,MAAM,EACJ,kBAAkB,EAClB,UAAU,EAAE,GAAG,EACf,MAAM,EACP,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACxC,OAAO;QACL,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,4BAA4B;YAClC,UAAU,EAAE,GAAG;YACf,kBAAkB;SACnB,CAAC;KACH,CAAA;AACH,CAAC"}
+{"version":3,"file":"zcap.js","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,EAAE,UAAU,EAA8B;IAC3E,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;KACnC,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAA;IACtC,mEAAmE;IACnE,2EAA2E;IAC3E,0EAA0E;IAC1E,uBAAuB;IACvB,OAAO,CAAC,EAAE,GAAG,WAAW,kBAAkB,IAAI,kBAAkB,EAAE,CAAA;IAClE,OAAO,CAAC,UAAU,GAAG,WAAW,kBAAkB,EAAE,CAAA;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;IAClC,OAAO;QACL,kBAAkB;QAClB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAEV;KAC1B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,UAAU,EACV,UAAU,EAIX;IACC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1D,OAAO,uBAAuB,CAAC;QAC7B,QAAQ;QACR,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAAC,EAC/B,QAAQ,EACR,UAAU,EAOX;IACC,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;IAC7C,MAAM,UAAU,GAAG,UAAU,IAAI,WAAW,kBAAkB,EAAE,CAAA;IAChE,OAAO;QACL,kBAAkB;QAClB,UAAU;QACV,MAAM,EAAE;YACN,EAAE,EAAE,GAAG,UAAU,IAAI,kBAAkB,EAAE;YACzC,IAAI,EAAE,4BAA4B;YAClC,IAAI;SACL;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EAIX;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,UAAU,EAGX;IACC,OAAO,eAAe,CAAC;QACrB,QAAQ,EAAE,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,EACvB,QAAQ,EAMT;IACC,iEAAiE;IACjE,kEAAkE;IAClE,MAAM,EACJ,kBAAkB,EAClB,UAAU,EAAE,GAAG,EACf,MAAM,EACP,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACzC,OAAO;QACL,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,4BAA4B;YAClC,UAAU,EAAE,GAAG;YACf,kBAAkB;SACnB,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,UAAU,EAIX;IACC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;IACpE,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;QACpC,UAAU,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAA;AACH,CAAC"}

package/dist/clients/index.d.ts

@@ -19,8 +19,9 @@
  *   fan-out as the resumable success it is.
  * - `revokeAccountClient` -- the revocation cascade in dependency order
  *   (document edit, roster rotation with its seal backstop, collection
- *   fan-out, optional recovery re-mints), with the app-specific stages
- *   injected.
+ *   fan-out, the optional generation-delegation re-mint), with the
+ *   app-specific stages injected. It writes no unlock record: each is signed
+ *   by its own credential (`decisions/0019`).
  * - `checkUserKeyRosterAtLogin` / `convergeUserKeyRosterToAccount` -- the
  *   login-time
  *   roster policy: which roster failures refuse a session, and the standing

package/dist/clients/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/clients/index.js

@@ -19,8 +19,9 @@
  *   fan-out as the resumable success it is.
  * - `revokeAccountClient` -- the revocation cascade in dependency order
  *   (document edit, roster rotation with its seal backstop, collection
- *   fan-out, optional recovery re-mints), with the app-specific stages
- *   injected.
+ *   fan-out, the optional generation-delegation re-mint), with the
+ *   app-specific stages injected. It writes no unlock record: each is signed
+ *   by its own credential (`decisions/0019`).
  * - `checkUserKeyRosterAtLogin` / `convergeUserKeyRosterToAccount` -- the
  *   login-time
  *   roster policy: which roster failures refuse a session, and the standing

package/dist/clients/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AAOrB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAQrD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AAOrB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAQrD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA"}

package/dist/clients/listing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listing.d.ts","sourceRoot":"","sources":["../../src/clients/listing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAGL,gBAAgB,EAChB,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAA;AAE7E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAoB/B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,OAAO,EACP,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAUvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,OAAO,EACP,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAkBvB"}
+{"version":3,"file":"listing.d.ts","sourceRoot":"","sources":["../../src/clients/listing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAGL,gBAAgB,EAChB,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAA;AAE7E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,OAAO,CAAA;CACnB;AAmCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAgB/B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,OAAO,EACP,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CASvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,OAAO,EACP,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAiBvB"}

package/dist/clients/listing.js

@@ -29,6 +29,28 @@
 import { ladderVmIds, listEnrolledWebvhClients, verifyAccountLog } from '../webvh/index.js';
 import { vmFragmentOf } from '@interop/vh-resource-log';
 import { readClientLabels } from '../keys/index.js';
+/**
+ * The verified account log every reader here stands on: the caller's own
+ * already-verified log when it supplied one, else a fetch-and-verify under
+ * its chain-head pin. Stated once so the three listings share one contract --
+ * a supplied log is trusted verbatim, and a fetched one is pinned whenever
+ * the caller keeps pins.
+ *
+ * @param options {object}
+ * @param options.pointer {AccountLogPointer}   where the account log lives
+ * @param [options.verifiedLog] {VerifiedAccountLog}   an already-verified log
+ *   to read instead of fetching and verifying one
+ * @param [options.accountLogPinStore] {ResourceLogPinStore}   this client's
+ *   chain-head pin for the account log, checked when the log is fetched here
+ * @returns {Promise<VerifiedAccountLog>}
+ */
+async function resolveVerifiedAccountLog({ pointer, verifiedLog, accountLogPinStore }) {
+    return (verifiedLog ??
+        (await verifyAccountLog({
+            ...pointer,
+            ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
+        })));
+}
 /**
  * Lists the wallet clients enrolled on an account, from the locally verified
  * did:webvh log, with labels merged and the caller's own client marked.
@@ -48,11 +70,7 @@ import { readClientLabels } from '../keys/index.js';
 export async function listAccountClients({ pointer, labelsStore, ownSigningKeyMultibase, verifiedLog, accountLogPinStore }) {
     // The log read and the label read are independent, so they run together.
     const [{ log }, labels] = await Promise.all([
-        verifiedLog ??
-            verifyAccountLog({
-                ...pointer,
-                ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
-            }),
+        resolveVerifiedAccountLog({ pointer, verifiedLog, accountLogPinStore }),
         labelsStore
             ? readClientLabels({ store: labelsStore }).then(read => read.labels)
             : Promise.resolve({})
@@ -89,11 +107,11 @@ export async function listAccountClients({ pointer, labelsStore, ownSigningKeyMu
  * @returns {Promise<Set<string>>}
  */
 export async function currentAccountSigningKeys({ pointer, verifiedLog, accountLogPinStore }) {
-    const { log } = verifiedLog ??
-        (await verifyAccountLog({
-            ...pointer,
-            ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
-        }));
+    const { log } = await resolveVerifiedAccountLog({
+        pointer,
+        verifiedLog,
+        accountLogPinStore
+    });
     return new Set(listEnrolledWebvhClients({ log }).map(client => client.signingKeyMultibase));
 }
 /**
@@ -124,11 +142,11 @@ export async function currentAccountSigningKeys({ pointer, verifiedLog, accountL
  * @returns {Promise<Set<string>>}   public key multibases
  */
 export async function currentAccountRecordSigners({ pointer, verifiedLog, accountLogPinStore }) {
-    const verified = verifiedLog ??
-        (await verifyAccountLog({
-            ...pointer,
-            ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
-        }));
+    const verified = await resolveVerifiedAccountLog({
+        pointer,
+        verifiedLog,
+        accountLogPinStore
+    });
     const keys = await currentAccountSigningKeys({
         pointer,
         verifiedLog: verified

package/dist/clients/listing.js.map

@@ -1 +1 @@
-{"version":3,"file":"listing.js","sourceRoot":"","sources":["../../src/clients/listing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAA0B,MAAM,kBAAkB,CAAA;AAmC3E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EAOnB;IACC,yEAAyE;IACzE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1C,WAAW;YACT,gBAAgB,CAAC;gBACf,GAAG,OAAO;gBACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC;QACJ,WAAW;YACT,CAAC,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACpE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAyB,EAAE,CAAC;KAChD,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,GAAG,MAAM;QACT,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,MAAM,CAAC,mBAAmB,KAAK,sBAAsB;KACjE,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,MAAM,EAAE,GAAG,EAAE,GACX,WAAW;QACX,CAAC,MAAM,gBAAgB,CAAC;YACtB,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC,CAAA;IACL,OAAO,IAAI,GAAG,CACZ,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAC5E,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,MAAM,QAAQ,GACZ,WAAW;QACX,CAAC,MAAM,gBAAgB,CAAC;YACtB,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC,CAAA;IACL,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC;QAC3C,OAAO;QACP,WAAW,EAAE,QAAQ;KACtB,CAAC,CAAA;IACF,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;QAClC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"listing.js","sourceRoot":"","sources":["../../src/clients/listing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAA0B,MAAM,kBAAkB,CAAA;AAmC3E;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,OAAO,CACL,WAAW;QACX,CAAC,MAAM,gBAAgB,CAAC;YACtB,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC,CACJ,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EAOnB;IACC,yEAAyE;IACzE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1C,yBAAyB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QACvE,WAAW;YACT,CAAC,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YACpE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAyB,EAAE,CAAC;KAChD,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,GAAG,MAAM;QACT,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,SAAS;YAClD,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,MAAM,CAAC,mBAAmB,KAAK,sBAAsB;KACjE,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC;QAC9C,OAAO;QACP,WAAW;QACX,kBAAkB;KACnB,CAAC,CAAA;IACF,OAAO,IAAI,GAAG,CACZ,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAC5E,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;QAC/C,OAAO;QACP,WAAW;QACX,kBAAkB;KACnB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC;QAC3C,OAAO;QACP,WAAW,EAAE,QAAQ;KACtB,CAAC,CAAA;IACF,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;QAClC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/clients/policy.d.ts

@@ -67,6 +67,24 @@ export declare function disconnectEligibility({ client, clients, signerKind }: {
     allowed: boolean;
     refusal?: DisconnectRefusal;
 };
+/**
+ * Asserts that a client's active update key was attributed from the account
+ * log, throwing the one refusal message every disconnect-eligibility surface
+ * and the revocation cascade's own up-front check share -- guessing a key
+ * here could revoke a different client's authority. Returns the checked key
+ * pair on success, so a caller with a wider row (an `AccountClientView`) can
+ * narrow through this and a caller already holding just the two keys (the
+ * revocation cascade) can re-assert them unchanged.
+ *
+ * @param options {object}
+ * @param options.signingKeyMultibase {string}
+ * @param options.updateKeyMultibase {string | undefined}
+ * @returns {RevokedClientKeys}
+ */
+export declare function assertUpdateKeyAttributed({ signingKeyMultibase, updateKeyMultibase }: {
+    signingKeyMultibase: string;
+    updateKeyMultibase?: string;
+}): RevokedClientKeys;
 /**
  * Narrows a listed row to the key set a revocation needs, throwing when the
  * row's active update key could not be attributed. Carries no key-agreement

package/dist/clients/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAC3B,MAAM,GAAG,aAAa,GAAG,yBAAyB,CAAA;AAEpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACP,UAAqB,EACtB,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CACjC,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAapD;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iBAAiB,CAWpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EACX,EAAE;IACD,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAC9B,GAAG,UAAU,GAAG,SAAS,CAIzB"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAC3B,MAAM,GAAG,aAAa,GAAG,yBAAyB,CAAA;AAEpD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACP,UAAqB,EACtB,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;CACjC,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAapD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,mBAAmB,EACnB,kBAAkB,EACnB,EAAE;IACD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,GAAG,iBAAiB,CAQpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iBAAiB,CAEpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EACX,EAAE;IACD,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAC9B,GAAG,UAAU,GAAG,SAAS,CAIzB"}

package/dist/clients/policy.js

@@ -26,6 +26,27 @@ export function disconnectEligibility({ client, clients, signerKind = 'client' }
     }
     return { allowed: true };
 }
+/**
+ * Asserts that a client's active update key was attributed from the account
+ * log, throwing the one refusal message every disconnect-eligibility surface
+ * and the revocation cascade's own up-front check share -- guessing a key
+ * here could revoke a different client's authority. Returns the checked key
+ * pair on success, so a caller with a wider row (an `AccountClientView`) can
+ * narrow through this and a caller already holding just the two keys (the
+ * revocation cascade) can re-assert them unchanged.
+ *
+ * @param options {object}
+ * @param options.signingKeyMultibase {string}
+ * @param options.updateKeyMultibase {string | undefined}
+ * @returns {RevokedClientKeys}
+ */
+export function assertUpdateKeyAttributed({ signingKeyMultibase, updateKeyMultibase }) {
+    if (!updateKeyMultibase) {
+        throw new Error("This wallet's update key could not be attributed from the account " +
+            'log, so it cannot be disconnected from here.');
+    }
+    return { signingKeyMultibase, updateKeyMultibase };
+}
 /**
  * Narrows a listed row to the key set a revocation needs, throwing when the
  * row's active update key could not be attributed. Carries no key-agreement
@@ -37,14 +58,7 @@ export function disconnectEligibility({ client, clients, signerKind = 'client' }
  * @returns {RevokedClientKeys}
  */
 export function revokedClientKeysFor({ client }) {
-    if (!client.updateKeyMultibase) {
-        throw new Error("This wallet's update key could not be attributed from the account " +
-            'log, so it cannot be disconnected from here.');
-    }
-    return {
-        signingKeyMultibase: client.signingKeyMultibase,
-        updateKeyMultibase: client.updateKeyMultibase
-    };
+    return assertUpdateKeyAttributed(client);
 }
 /**
  * How a completed cascade should be reported: `complete` when every encrypted

package/dist/clients/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACP,UAAU,GAAG,QAAQ,EAKtB;IACC,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;QACnD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EAIX;IACC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACP,UAAU,GAAG,QAAQ,EAKtB;IACC,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;QACnD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,mBAAmB,EACnB,kBAAkB,EAInB;IACC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EAIX;IACC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}

package/dist/clients/revocation.d.ts

@@ -40,12 +40,8 @@
  *    the fresh key in parallel, so writes stop landing under epochs the
  *    revoked client can still decrypt. Failures are collected per collection
  *    and never abort the fan-out.
- * 4. **The recovery re-mints** (optional): delegations the revoked client had
- *    signed stopped chaining at stage 1, so a wallet that issues recovery
- *    codes re-mints them here -- while the registry is still readable under
- *    the session's pre-adoption vault keys.
- * 5. **The generation-delegation re-mint** (optional, mirroring stage 4 as a
- *    client-annex log entry replacing the service entry): revoking the
+ * 4. **The generation-delegation re-mint** (optional, a client-annex log
+ *    entry replacing the service entry): revoking the
  *    enrolled client that minted the current annex generation's delegation
  *    kills it under the same current-key-set rule, and without this stage
  *    the death is silent mid-generation. The injected closure runs the
@@ -56,6 +52,12 @@
  *    old delegation -- stays dead: mid-generation grant death is a stated
  *    consequence of ordinary disconnects, healed by the app reconnecting.
  *
+ * No unlock record is written anywhere in the cascade. Every record's frame
+ * proof is signed by its own credential's unlock identity key, and its bridge
+ * and `delegatedClients` sibling delegations by that credential's own ladder
+ * VM (`decisions/0019`), so a client's removal rots no record and the
+ * cascade owes no re-seal.
+ *
  * The revoking session then adopts the fresh key in place (`onRotationAdopted`
  * -- profile vault keys, storage ciphers, engine restarts: whatever "in place"
  * means for the app), so it keeps operating without a re-login.
@@ -93,7 +95,7 @@ export interface GenerationDelegationRemint {
  * this run (a re-run of an already-complete revocation reports `false`), the
  * roster's seal-backstop report (present when the roster store is sealable
  * and the roster stage ran), the per-collection fan-out result, the document
- * as the edit left it, and the recovery re-mint counts when that stage ran.
+ * as the edit left it.
  */
 export interface ClientRevocationResult {
     rotated: boolean;
@@ -102,19 +104,18 @@ export interface ClientRevocationResult {
     document: object;
     userKey?: UserKey;
     rosterDescriptor?: CollectionEncryption;
-    recovery?: {
-        reminted: number;
-        skipped: number;
-    };
     generation?: GenerationDelegationRemint;
 }
 /**
  * Runs the whole revocation cascade for one enrolled wallet client. See the
  * module doc for the order and the convergence story. Throws before touching
- * anything on a call that must not proceed (revoking this client itself, a
- * client whose active update key was not attributed); once the document edit
- * lands, a thrown later stage leaves durable state a naive re-run -- or the
- * login-time sweep -- converges from.
+ * anything on a call that must not proceed: a client whose active update key
+ * was not attributed is refused here, and a client revoking itself is refused
+ * by the document edit's own client-arm check, from the seeds it holds, before
+ * its entry publishes -- the one wording every wallet sees, with the `self`
+ * eligibility refusal in `policy.ts` naming the rule for the surface. Once
+ * the document edit lands, a thrown later stage leaves durable state a naive
+ * re-run -- or the login-time sweep -- converges from.
  *
  * The document edit's `StagedCommitmentAmbiguousError` passes through
  * unwrapped, so a surface can re-word it ("disconnect this wallet from the
@@ -145,9 +146,6 @@ export interface ClientRevocationResult {
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the document edit refuses a `did.jsonl`
  *   resolving to any other account
- * @param [options.ownSigningKeyMultibase] {string}   this client's own signing
- *   key; supplied, self-revocation is refused up front by the rule the surface
- *   should name, rather than by the update-key check inside the edit
  * @param options.rosterStore {EncryptionDescriptorStore}   the
  *   `key-map/user-key.jsonl` roster store
  * @param [options.userKey] {UserKey}   this client's cached user key
@@ -159,26 +157,22 @@ export interface ClientRevocationResult {
  *   with `{ userKey, latestEpochId, descriptor }` after the roster read and BEFORE
  *   the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
- * @param [options.remintRecoveryDelegations] {Function}   `({ document }) =>
- *   Promise<{ reminted, skipped }>` -- the recovery-delegation re-mint stage,
- *   for a wallet that issues recovery codes
  * @param [options.remintGenerationDelegation] {Function}   `({ document }) =>
  *   Promise<GenerationDelegationRemint>` -- the generation-delegation
- *   re-mint stage, run against the post-edit document (stage 5 in the module
+ *   re-mint stage, run against the post-edit document (stage 4 in the module
  *   doc); expected to catch its own failures and report them
  * @param [options.onRotationAdopted] {Function}   `({ userKey }) => Promise<void>`
  *   -- the live-session adoption of a rotated key, run last so the session
  *   keeps operating without a re-login
  * @returns {Promise<ClientRevocationResult>}
  */
-export declare function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }: {
+export declare function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintGenerationDelegation, onRotationAdopted }: {
     idStore: WebvhIdStore;
     signer: AccountLogSigner;
     projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     revokedClient: RevokedClientKeys;
     knownLatentHashes?: string[];
     expectedDid?: string;
-    ownSigningKeyMultibase?: string;
     rosterStore: EncryptionDescriptorStore;
     userKey?: UserKey;
     clientKeyAgreementKey: IKeyAgreementKey;
@@ -189,12 +183,6 @@ export declare function revokeAccountClient({ idStore, signer, projectionStore,
         descriptor: CollectionEncryption;
     }) => Promise<void>;
     collections: CascadeCollections;
-    remintRecoveryDelegations?: (options: {
-        document: PublishedKeyDocument;
-    }) => Promise<{
-        reminted: number;
-        skipped: number;
-    }>;
     remintGenerationDelegation?: (options: {
         document: PublishedKeyDocument;
     }) => Promise<GenerationDelegationRemint>;

package/dist/clients/revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACrD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,UAAU,CAAC,EAAE,0BAA0B,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACzC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA+ElC"}
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAGzB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACrD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,UAAU,CAAC,EAAE,0BAA0B,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACzC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA2DlC"}

package/dist/clients/revocation.js

@@ -1,12 +1,16 @@
 import { revokeWebvhClient } from '../webvh/index.js';
 import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
+import { assertUpdateKeyAttributed } from './policy.js';
 /**
  * Runs the whole revocation cascade for one enrolled wallet client. See the
  * module doc for the order and the convergence story. Throws before touching
- * anything on a call that must not proceed (revoking this client itself, a
- * client whose active update key was not attributed); once the document edit
- * lands, a thrown later stage leaves durable state a naive re-run -- or the
- * login-time sweep -- converges from.
+ * anything on a call that must not proceed: a client whose active update key
+ * was not attributed is refused here, and a client revoking itself is refused
+ * by the document edit's own client-arm check, from the seeds it holds, before
+ * its entry publishes -- the one wording every wallet sees, with the `self`
+ * eligibility refusal in `policy.ts` naming the rule for the surface. Once
+ * the document edit lands, a thrown later stage leaves durable state a naive
+ * re-run -- or the login-time sweep -- converges from.
  *
  * The document edit's `StagedCommitmentAmbiguousError` passes through
  * unwrapped, so a surface can re-word it ("disconnect this wallet from the
@@ -37,9 +41,6 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the document edit refuses a `did.jsonl`
  *   resolving to any other account
- * @param [options.ownSigningKeyMultibase] {string}   this client's own signing
- *   key; supplied, self-revocation is refused up front by the rule the surface
- *   should name, rather than by the update-key check inside the edit
  * @param options.rosterStore {EncryptionDescriptorStore}   the
  *   `key-map/user-key.jsonl` roster store
  * @param [options.userKey] {UserKey}   this client's cached user key
@@ -51,28 +52,17 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
  *   with `{ userKey, latestEpochId, descriptor }` after the roster read and BEFORE
  *   the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
- * @param [options.remintRecoveryDelegations] {Function}   `({ document }) =>
- *   Promise<{ reminted, skipped }>` -- the recovery-delegation re-mint stage,
- *   for a wallet that issues recovery codes
  * @param [options.remintGenerationDelegation] {Function}   `({ document }) =>
  *   Promise<GenerationDelegationRemint>` -- the generation-delegation
- *   re-mint stage, run against the post-edit document (stage 5 in the module
+ *   re-mint stage, run against the post-edit document (stage 4 in the module
  *   doc); expected to catch its own failures and report them
  * @param [options.onRotationAdopted] {Function}   `({ userKey }) => Promise<void>`
  *   -- the live-session adoption of a rotated key, run last so the session
  *   keeps operating without a re-login
  * @returns {Promise<ClientRevocationResult>}
  */
-export async function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }) {
-    if (ownSigningKeyMultibase &&
-        ownSigningKeyMultibase === revokedClient.signingKeyMultibase) {
-        throw new Error('This wallet cannot disconnect itself; use another enrolled wallet ' +
-            'client (or a recovery code) instead.');
-    }
-    if (!revokedClient.updateKeyMultibase) {
-        throw new Error("This wallet's update key could not be attributed from the account " +
-            'log, so it cannot be disconnected from here.');
-    }
+export async function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintGenerationDelegation, onRotationAdopted }) {
+    assertUpdateKeyAttributed(revokedClient);
     // 1. The document edit -- the pull axis everywhere, first. It resolves the
     // document as it now stands, which is what stage 2 resolves its remaining
     // recipients from.
@@ -111,11 +101,7 @@ export async function revokeAccountClient({ idStore, signer, projectionStore, re
             ...(generation ? { generation } : {})
         };
     }
-    // 4. The recovery re-mints, while the registry is still readable under the
-    // session's pre-adoption vault keys.
-    const recovery = await remintRecoveryDelegations?.({ document: doc });
-    // 5. The generation-delegation re-mint, against the same post-edit
-    // document.
+    // 4. The generation-delegation re-mint, against the post-edit document.
     const generation = await remintGenerationDelegation?.({ document: doc });
     if (tail.rotated) {
         await onRotationAdopted?.({ userKey: tail.userKey });
@@ -127,7 +113,6 @@ export async function revokeAccountClient({ idStore, signer, projectionStore, re
         document: doc,
         userKey: tail.userKey,
         rosterDescriptor: tail.rosterDescriptor,
-        ...(recovery ? { recovery } : {}),
         ...(generation ? { generation } : {})
     };
 }

package/dist/clients/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AA0EA,OAAO,EACL,iBAAiB,EAKlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAoCzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EA0BlB;IACC,IACE,sBAAsB;QACtB,sBAAsB,KAAK,aAAa,CAAC,mBAAmB,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,sCAAsC,CACzC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAChD,OAAO;QACP,MAAM;QACN,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,sEAAsE;QACtE,gEAAgE;QAChE,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,mEAAmE;IACnE,YAAY;IACZ,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAExE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AA4EA,OAAO,EACL,iBAAiB,EAKlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAmCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAsBlB;IACC,yBAAyB,CAAC,aAAa,CAAC,CAAA;IAExC,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAChD,OAAO;QACP,MAAM;QACN,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,sEAAsE;QACtE,gEAAgE;QAChE,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAExE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC"}

package/dist/clients/rosterPolicy.d.ts

@@ -137,6 +137,10 @@ export declare function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgr
  *   store
  * @param options.userKey {UserKey}   the start's current user key
  * @param options.descriptor {CollectionEncryption}   the start's roster read
+ * @param [options.etag] {string}   the validator that read was served under
+ *   (`UserKeyRosterReadResult.etag`), when it was a read on this same
+ *   `store` instance; with it, a convergence write is seeded from the
+ *   start's read rather than acquiring the roster a second time
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
@@ -152,11 +156,12 @@ export declare function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgr
  *   kids found, the kids escrowed by the mirror direction, and the key +
  *   descriptor to fan out with
  */
-export declare function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, clientKeyAgreementKey, pinnedEpochId, accountLogPinStore, onUserKeyAdopted }: {
+export declare function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, etag, clientKeyAgreementKey, pinnedEpochId, accountLogPinStore, onUserKeyAdopted }: {
     pointer: AccountLogPointer;
     store: EncryptionDescriptorStore;
     userKey: UserKey;
     descriptor: CollectionEncryption;
+    etag?: string;
     clientKeyAgreementKey: IKeyAgreementKey;
     pinnedEpochId?: string | null;
     accountLogPinStore?: ResourceLogPinStore;