@interop/wallet-core 0.66.0 → 0.67.0

package/dist/recovery/recoveryDelegation.d.ts

@@ -1,7 +1,28 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The recovery code's authorization bridge: the pre-minted PUT-on-`did.jsonl`
+ * delegation. The delegation is a wire artifact both apps must mint
+ * byte-identically (issuance and every re-bind produce the record another
+ * replica later recovers with), so its builder lives here: PUT on the one
+ * `did.jsonl` resource, one-year TTL, delegated to the code-derived signing
+ * DID. Its narrow scope is what keeps recovery loud -- a stolen code must
+ * extend the world-readable log before it can read anything.
+ *
+ * No ceremony re-mints another credential's bridge. A record's bridge and
+ * `delegatedClients` sibling are signed by that record's own credential's
+ * ladder VM, and its frame proof by that credential's own unlock identity
+ * key (`decisions/0019`), so the only thing that can rot a bridge is
+ * retiring the credential it belongs to -- which deletes the record with it.
+ * A bridge that ages out, or one a pre-rule bind left signed by a foreign
+ * key, is refreshed by that credential's own login on the house staleness
+ * axes ({@link zcapExpiring}, `recordedZcapStale`), and the registry fields
+ * a refresh records are built here ({@link recordedDelegationFields}).
+ */
 import type { IZcap } from '@interop/data-integrity-core';
 import type { ZcapClient } from '@interop/ezcap';
-import type { PublishedKeyDocument } from '../webvh/listClients.js';
-import type { AccountPointer, RecordSigner } from '../keyring/record.js';
+import type { AccountPointer } from '../keyring/record.js';
 import { delegationProofKeyId } from '../webvh/standingZcap.js';
 /**
  * The recovery delegation's lifetime: the house standing-zcap value
@@ -64,128 +85,4 @@ export declare function recordedDelegationFields({ delegation, delegatedClients
     delegatedClientsKeyId?: string;
     delegatedClientsExpires?: string;
 };
-/**
- * The members of a recovery-code registry entry the re-mint reads: where the
- * code's unlock Space and record are (`unlockSpaceId`, `manageCapability`),
- * which key signed the recorded delegation and when it expires
- * (`delegationKeyId` / `delegationExpires` -- either absent on an entry
- * predating its field, which the staleness checks conservatively flag), and
- * the re-mint fields: the code-derived signing DID the fresh delegation names
- * and the unlock KAK public half the record is re-wrapped to. A standing
- * credential's entry additionally tracks its annex Space sibling
- * delegation as a second scalar pair (`delegatedClientsKeyId` /
- * `delegatedClientsExpires` -- absent for recovery codes, mirroring the
- * record member's optionality); the sibling rots on exactly the bridge's
- * axis, so one pass reseals both. Structural on
- * purpose -- an app's richer registry entry satisfies it, and the re-mint
- * hands the SAME entry back (with the fresh key ids and expiries) through the
- * record seam, extra members untouched.
- */
-export interface RecoveryDelegationEntry {
-    label: string;
-    unlockSpaceId: string;
-    manageCapability?: IZcap;
-    delegationKeyId?: string;
-    delegationExpires?: string;
-    delegatedClientsKeyId?: string;
-    delegatedClientsExpires?: string;
-    recoveryClientDid?: string;
-    unlockKeyAgreementKeyId?: string;
-    unlockKeyAgreementKeyMultibase?: string;
-}
-/**
- * One registry entry's fate in a re-mint pass: `current` (both members stand
- * and are outside the renewal window -- nothing written), `reminted` (the
- * record re-sealed and the entry handed back fresh; `siblingCarriedVerbatim`
- * flags a recorded sibling the pass could not rebuild because the document
- * points at no generation, which stays flagged for the health check),
- * `incomplete-entry` (an entry predating the re-mint fields, skipped until
- * the credential is re-bound), `pending-entry` (the entry's recorded
- * unlock-key members do not match the credential the record at its unlock
- * Space is sealed to -- a passphrase change torn before its retirement; the
- * next passphrase login's repair finishes it, and re-minting here would
- * re-arm the retired credential into the new one's record), or `failed` (the record could not be read,
- * re-sealed, or re-PUT -- `error` carries the cause). A skipped or failed
- * entry is named here so no caller can lose it silently.
- */
-export interface RecordRemintOutcome {
-    label: string;
-    unlockSpaceId: string;
-    outcome: 'current' | 'reminted' | 'incomplete-entry' | 'pending-entry' | 'failed';
-    siblingCarriedVerbatim?: boolean;
-    error?: unknown;
-}
-/**
- * Re-mints the recovery delegations the current document no longer backs --
- * the recovery-code delta riding the revocation cascade (see the module doc
- * for the mechanism and the skip policy).
- *
- * The record's credential-authenticated core is preserved verbatim: the
- * re-mint reads the standing record through the entry's management zcap and
- * replaces only its delegation members
- * ({@link remintUnlockRecordDelegations}) -- the bridge always, and the
- * annex Space sibling where the entry records one (the two rot on one
- * axis, so both reseal in the same atomic pass and one registry-entry
- * rewrite records both fresh pairs). The
- * shell, the ladder member (where one rides), and the binding tag all travel
- * untouched, since the re-mint can decrypt none of them and does not need to.
- * A re-mint therefore can never change the pointer or controller the
- * credential was bound against -- and after a host migration the tag no
- * longer matches the moved pointer, so credentials must be rebound (codes
- * re-issued) when the account moves hosts.
- *
- * The re-mint holds the code's KAK public half but not its signing key, so
- * every record it re-PUTs is signed with the acting client's own account key
- * (`recordSigner`) -- the mixed-signer case a reader settles against the
- * verified did:webvh document.
- *
- * Best-effort per entry: a skipped entry stays flagged by the login-time
- * health check, whose regenerate nudge remains the backstop.
- *
- * @param options {object}
- * @param options.doc {PublishedKeyDocument}   the locally verified did:webvh
- *   document, AFTER the revocation edit
- * @param options.entries {RecoveryDelegationEntry[]}   the registry's
- *   recovery-code entries, as the app's registry read returned them
- * @param options.pointer {AccountPointer}
- * @param options.storageServerUrl {string}   the unlock Spaces' storage server
- * @param options.zcapClient {ZcapClient}   the acting client's promoted
- *   signer, which mints the fresh delegations
- * @param options.recordSigner {RecordSigner}   the acting client's account
- *   key, which signs the re-wrapped records
- * @param options.managementZcapClient {Function}   `({ capability }) =>
- *   ZcapClient` -- the client an entry's management zcap is invoked with
- * @param options.recordEntry {Function}   `({ entry }) => Promise<void>` --
- *   persists one updated registry entry (matching on the app's entry key)
- * @param [options.mintDelegatedClientsDelegation] {Function}   `({ controller })
- *   => Promise<IZcap | undefined>` -- the annex-side mint of a fresh
- *   `delegatedClients` sibling delegation, injected by the caller (the
- *   annex subpath's `delegatedClientsDelegationMinter` builds one over the
- *   verified document); `undefined` when the document points at no
- *   generation, in which case the old sealed member travels verbatim
- * @returns {Promise<{ reminted: number; skipped: number }>}
- */
-export declare function remintRecoveryDelegations<Entry extends RecoveryDelegationEntry>({ doc, entries, pointer, storageServerUrl, zcapClient, recordSigner, managementZcapClient, recordEntry, mintDelegatedClientsDelegation, retiringKeyMultibases, now }: {
-    doc: PublishedKeyDocument;
-    entries: Entry[];
-    pointer: AccountPointer;
-    storageServerUrl: string;
-    zcapClient: ZcapClient;
-    recordSigner: RecordSigner;
-    managementZcapClient: (options: {
-        capability: IZcap;
-    }) => ZcapClient;
-    recordEntry: (options: {
-        entry: Entry;
-    }) => Promise<void>;
-    mintDelegatedClientsDelegation?: (options: {
-        controller: string;
-    }) => Promise<IZcap | undefined>;
-    retiringKeyMultibases?: string[];
-    now?: number;
-}): Promise<{
-    reminted: number;
-    skipped: number;
-    outcomes: RecordRemintOutcome[];
-}>;
 //# sourceMappingURL=recoveryDelegation.d.ts.map

package/dist/recovery/recoveryDelegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKxE,OAAO,EACL,oBAAoB,EAGrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAgB,EACjB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EACjB,EAAE;IACD,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,gBAAgB,CAAC,EAAE,KAAK,CAAA;CACzB,GAAG;IACF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,CAiBA;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EACL,SAAS,GAAG,UAAU,GAAG,kBAAkB,GAAG,eAAe,GAAG,QAAQ,CAAA;IAC1E,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAA0B,EAC1B,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,8BAA8B,CAAC,EAAE,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,KAAK,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAAC,CAoLD"}
+{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EACL,oBAAoB,EAErB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAgB,EACjB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EACjB,EAAE;IACD,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,gBAAgB,CAAC,EAAE,KAAK,CAAA;CACzB,GAAG;IACF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,CAiBA"}

package/dist/recovery/recoveryDelegation.js

@@ -1,55 +1,6 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The recovery code's authorization bridge: the pre-minted PUT-on-`did.jsonl`
- * delegation and the revocation cascade's re-mint of it. The delegation is a
- * wire artifact both apps must mint byte-identically (issuance and every
- * re-mint produce the record another replica later recovers with), so its
- * builder lives here: PUT on the one `did.jsonl` resource, one-year TTL,
- * delegated to the code-derived signing DID. Its narrow scope is what keeps
- * recovery loud -- a stolen code must extend the world-readable log before it
- * can read anything.
- *
- * Beside the builder lives the re-mint core (`remintRecoveryDelegations`):
- * revoking a client kills, by the current-key-set rule, every `did.jsonl`
- * delegation that client signed, which would brick recovery exactly when it
- * is needed -- and a delegation left standing eventually reaches its own
- * expiry. For each registry entry whose recorded delegation no longer
- * chains (its signing verification method left `capabilityDelegation` in the
- * document) or is expired or inside the renewal window, the acting client
- * signs a fresh delegation to the code's signing DID, re-wraps the
- * record to the code's unlock KAK (the public half the registry records --
- * the record carries no secrets, so re-encryption needs none), re-PUTs it
- * through the entry's management zcap, and updates the registry's
- * `delegationKeyId` and `delegationExpires`. A standing credential's
- * client-annex Space sibling delegation rides the same pass (its scalar pair is
- * `delegatedClientsKeyId` / `delegatedClientsExpires`): either member going
- * stale reseals both, and the one registry rewrite records both fresh pairs
- * -- a re-mint handling only the bridge is incomplete. The skip policy is
- * cross-replica correctness and is
- * decided here once: an entry that predates the re-mint fields, or whose
- * standing record cannot be read or carries no binding, is skipped and stays
- * flagged by the login-time health check. Every entry's fate is reported
- * (`RecordRemintOutcome`), so a record the pass could not reach is named
- * rather than silently left with a rotted bridge. What stays app-side is the
- * seams: the management-zcap client factory, the storage server URL, and the
- * registry read/record halves.
- *
- * The same pass serves the last-client forget ceremony, whose acting signer
- * is the ladder VM rather than an enrolled client: there the rot check runs
- * against the post-install document, in which the client about to be removed
- * still stands, so the ceremony names it as retiring
- * (`retiringKeyMultibases`) and every delegation it signed counts as rotted
- * ahead of the removal entry.
- */
-import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
 import { resourcePath, toUrl } from '@interop/was-client/paths';
-import { log } from '../log.js';
 import { DID_LOG_RESOURCE, ID_COLLECTION } from '../space/collections.js';
-import { getUnlockKeyringWithCapability, putUnlockKeyringWithCapability } from '../keyring/unlockSpace.js';
-import { remintUnlockRecordDelegations, unlockRecordSealedTo } from '../unlock/unlockRecord.js';
-import { delegationProofKeyId, recordedZcapStale, STANDING_ZCAP_TTL_MS } from '../webvh/standingZcap.js';
+import { delegationProofKeyId, STANDING_ZCAP_TTL_MS } from '../webvh/standingZcap.js';
 /**
  * The recovery delegation's lifetime: the house standing-zcap value
  * ({@link STANDING_ZCAP_TTL_MS} -- one year, per NIST SP 800-57's
@@ -153,220 +104,4 @@ export function recordedDelegationFields({ delegation, delegatedClients }) {
 function zcapExpires(zcap) {
     return zcap.expires;
 }
-/**
- * Re-mints the recovery delegations the current document no longer backs --
- * the recovery-code delta riding the revocation cascade (see the module doc
- * for the mechanism and the skip policy).
- *
- * The record's credential-authenticated core is preserved verbatim: the
- * re-mint reads the standing record through the entry's management zcap and
- * replaces only its delegation members
- * ({@link remintUnlockRecordDelegations}) -- the bridge always, and the
- * annex Space sibling where the entry records one (the two rot on one
- * axis, so both reseal in the same atomic pass and one registry-entry
- * rewrite records both fresh pairs). The
- * shell, the ladder member (where one rides), and the binding tag all travel
- * untouched, since the re-mint can decrypt none of them and does not need to.
- * A re-mint therefore can never change the pointer or controller the
- * credential was bound against -- and after a host migration the tag no
- * longer matches the moved pointer, so credentials must be rebound (codes
- * re-issued) when the account moves hosts.
- *
- * The re-mint holds the code's KAK public half but not its signing key, so
- * every record it re-PUTs is signed with the acting client's own account key
- * (`recordSigner`) -- the mixed-signer case a reader settles against the
- * verified did:webvh document.
- *
- * Best-effort per entry: a skipped entry stays flagged by the login-time
- * health check, whose regenerate nudge remains the backstop.
- *
- * @param options {object}
- * @param options.doc {PublishedKeyDocument}   the locally verified did:webvh
- *   document, AFTER the revocation edit
- * @param options.entries {RecoveryDelegationEntry[]}   the registry's
- *   recovery-code entries, as the app's registry read returned them
- * @param options.pointer {AccountPointer}
- * @param options.storageServerUrl {string}   the unlock Spaces' storage server
- * @param options.zcapClient {ZcapClient}   the acting client's promoted
- *   signer, which mints the fresh delegations
- * @param options.recordSigner {RecordSigner}   the acting client's account
- *   key, which signs the re-wrapped records
- * @param options.managementZcapClient {Function}   `({ capability }) =>
- *   ZcapClient` -- the client an entry's management zcap is invoked with
- * @param options.recordEntry {Function}   `({ entry }) => Promise<void>` --
- *   persists one updated registry entry (matching on the app's entry key)
- * @param [options.mintDelegatedClientsDelegation] {Function}   `({ controller })
- *   => Promise<IZcap | undefined>` -- the annex-side mint of a fresh
- *   `delegatedClients` sibling delegation, injected by the caller (the
- *   annex subpath's `delegatedClientsDelegationMinter` builds one over the
- *   verified document); `undefined` when the document points at no
- *   generation, in which case the old sealed member travels verbatim
- * @returns {Promise<{ reminted: number; skipped: number }>}
- */
-export async function remintRecoveryDelegations({ doc, entries, pointer, storageServerUrl, zcapClient, recordSigner, managementZcapClient, recordEntry, mintDelegatedClientsDelegation, retiringKeyMultibases = [], now = Date.now() }) {
-    let reminted = 0;
-    let skipped = 0;
-    const outcomes = [];
-    // The house staleness policy, decided once in `webvh` and asked here over
-    // the scalars a registry entry records: expiry, the current-key-set rule
-    // (a recorded signing key the document no longer lists under
-    // `capabilityDelegation` -- or no recorded key at all -- has rotted), and
-    // the caller's retiring set, which the document still lists only until the
-    // entry that removes those keys lands.
-    const recordedStale = (delegationKeyId, expires) => recordedZcapStale({
-        doc,
-        ...(delegationKeyId ? { delegationKeyId } : {}),
-        ...(expires ? { expires } : {}),
-        retiringKeyMultibases,
-        now
-    });
-    for (const entry of entries) {
-        const stale = recordedStale(entry.delegationKeyId, entry.delegationExpires);
-        // The annex Space sibling, where the entry records one, is checked on the
-        // same axes; either member going stale re-mints BOTH in one atomic pass
-        // (both resealed, one registry-entry rewrite).
-        const siblingRecorded = entry.delegatedClientsKeyId !== undefined ||
-            entry.delegatedClientsExpires !== undefined;
-        const siblingStale = siblingRecorded &&
-            recordedStale(entry.delegatedClientsKeyId, entry.delegatedClientsExpires);
-        if (!stale && !siblingStale) {
-            outcomes.push({
-                label: entry.label,
-                unlockSpaceId: entry.unlockSpaceId,
-                outcome: 'current'
-            });
-            continue;
-        }
-        if (!entry.recoveryClientDid ||
-            !entry.unlockKeyAgreementKeyId ||
-            !entry.unlockKeyAgreementKeyMultibase ||
-            !entry.manageCapability) {
-            // An entry issued before the re-mint fields existed: the health check
-            // keeps flagging it until the code is regenerated.
-            skipped += 1;
-            outcomes.push({
-                label: entry.label,
-                unlockSpaceId: entry.unlockSpaceId,
-                outcome: 'incomplete-entry'
-            });
-            continue;
-        }
-        try {
-            // The standing record, whose credential-authenticated core travels
-            // verbatim (a record with no binding predates the standing layout and
-            // cannot be re-minted -- `remintUnlockRecordDelegations` refuses, and the
-            // entry is skipped into the health check's regenerate nudge).
-            const standing = await getUnlockKeyringWithCapability({
-                storageServerUrl,
-                zcapClient: managementZcapClient({
-                    capability: entry.manageCapability
-                }),
-                spaceId: entry.unlockSpaceId,
-                capability: entry.manageCapability
-            });
-            // The pending-shaped guard: the entry's `unlockSpaceId` and
-            // `manageCapability` name one credential while its identity members
-            // name another -- the state a passphrase change torn before its
-            // retirement leaves. Re-minting here would seal a fresh
-            // current-client-signed bridge for the OLD credential into the NEW
-            // credential's record, re-arming the half-retired credential and
-            // bricking the new one's entry paths. Nothing is written; the next
-            // passphrase login's repair is the mender.
-            if (!unlockRecordSealedTo({
-                record: standing,
-                keyAgreementKeyMultibase: entry.unlockKeyAgreementKeyMultibase
-            })) {
-                log.warn('The unlock record at the Space recorded for this entry is ' +
-                    'sealed to another credential (a passphrase change torn before ' +
-                    'its retirement landed); its delegations are not re-minted', { label: entry.label });
-                skipped += 1;
-                outcomes.push({
-                    label: entry.label,
-                    unlockSpaceId: entry.unlockSpaceId,
-                    outcome: 'pending-entry'
-                });
-                continue;
-            }
-            const delegation = await delegateLogWrite({
-                zcapClient,
-                pointer,
-                recoveryClientDid: entry.recoveryClientDid
-            });
-            // The fresh annex Space sibling, for an entry that records one --
-            // minted through the injected annex-side closure, so this orchestrator
-            // never imports the annex module. A document not (yet) pointing at a
-            // generation (or a caller wiring no minter) leaves nothing to rebuild
-            // the target from, so the old sealed member travels verbatim and the
-            // pair stays stale-flagged for the login-time health check.
-            let delegatedClients;
-            let siblingCarriedVerbatim = false;
-            if (siblingRecorded) {
-                delegatedClients = await mintDelegatedClientsDelegation?.({
-                    controller: entry.recoveryClientDid
-                });
-                if (!delegatedClients) {
-                    siblingCarriedVerbatim = true;
-                    log.warn('The account document names no client-annex generation; the ' +
-                        'delegatedClients delegation for this entry is carried verbatim', { label: entry.label });
-                }
-            }
-            // The credential's unlock KAK, public half only -- exactly enough to
-            // seal the fresh bridge to the same recipient the credential derives
-            // (sealing goes through the encrypt-only cipher, so no secret is
-            // needed).
-            const unlockKak = (await X25519KeyAgreementKey2020.from({
-                id: entry.unlockKeyAgreementKeyId,
-                controller: entry.unlockKeyAgreementKeyId.split('#')[0],
-                type: 'X25519KeyAgreementKey2020',
-                publicKeyMultibase: entry.unlockKeyAgreementKeyMultibase
-            }));
-            const wrapped = await remintUnlockRecordDelegations({
-                record: standing,
-                delegation,
-                ...(delegatedClients ? { delegatedClients } : {}),
-                keyAgreementKey: unlockKak,
-                signer: recordSigner
-            });
-            await putUnlockKeyringWithCapability({
-                storageServerUrl,
-                zcapClient: managementZcapClient({
-                    capability: entry.manageCapability
-                }),
-                spaceId: entry.unlockSpaceId,
-                record: wrapped,
-                capability: entry.manageCapability
-            });
-            await recordEntry({
-                entry: {
-                    ...entry,
-                    ...recordedDelegationFields({
-                        delegation,
-                        ...(delegatedClients ? { delegatedClients } : {})
-                    })
-                }
-            });
-            reminted += 1;
-            outcomes.push({
-                label: entry.label,
-                unlockSpaceId: entry.unlockSpaceId,
-                outcome: 'reminted',
-                ...(siblingCarriedVerbatim ? { siblingCarriedVerbatim } : {})
-            });
-        }
-        catch (err) {
-            log.warn('Could not re-mint the recovery delegation', {
-                label: entry.label,
-                err
-            });
-            skipped += 1;
-            outcomes.push({
-                label: entry.label,
-                unlockSpaceId: entry.unlockSpaceId,
-                outcome: 'failed',
-                error: err
-            });
-        }
-    }
-    return { reminted, skipped, outcomes };
-}
 //# sourceMappingURL=recoveryDelegation.js.map

package/dist/recovery/recoveryDelegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEzE,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,wEAAwE;AACxE,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAMjB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,0BAA0B,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED,sEAAsE;AACtE,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EAIjB;IAMC,MAAM,eAAe,GAAG,UAAU;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,MAAM,qBAAqB,GAAG,gBAAgB;QAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;QACxC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,uBAAuB,GAAG,gBAAgB;QAC9C,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAA;IACb,OAAO;QACL,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAW;IAC9B,OAAQ,IAA6B,CAAC,OAAO,CAAA;AAC/C,CAAC;AAwDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAAqB,GAAG,EAAE,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAejB;IAKC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,aAAa,GAAG,CACpB,eAAmC,EACnC,OAA2B,EAClB,EAAE,CACX,iBAAiB,CAAC;QAChB,GAAG;QACH,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,GAAG;KACJ,CAAC,CAAA;IACJ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,eAAe,GACnB,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAA;QAC7C,MAAM,YAAY,GAChB,eAAe;YACf,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,SAAS;aACnB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IACE,CAAC,KAAK,CAAC,iBAAiB;YACxB,CAAC,KAAK,CAAC,uBAAuB;YAC9B,CAAC,KAAK,CAAC,8BAA8B;YACrC,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;YACD,sEAAsE;YACtE,mDAAmD;YACnD,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;gBACpD,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,4DAA4D;YAC5D,oEAAoE;YACpE,gEAAgE;YAChE,wDAAwD;YACxD,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,2CAA2C;YAC3C,IACE,CAAC,oBAAoB,CAAC;gBACpB,MAAM,EAAE,QAAQ;gBAChB,wBAAwB,EAAE,KAAK,CAAC,8BAA8B;aAC/D,CAAC,EACF,CAAC;gBACD,GAAG,CAAC,IAAI,CACN,4DAA4D;oBAC1D,gEAAgE;oBAChE,2DAA2D,EAC7D,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACD,OAAO,IAAI,CAAC,CAAA;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,UAAU;gBACV,OAAO;gBACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAA;YACF,kEAAkE;YAClE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,gBAAmC,CAAA;YACvC,IAAI,sBAAsB,GAAG,KAAK,CAAA;YAClC,IAAI,eAAe,EAAE,CAAC;gBACpB,gBAAgB,GAAG,MAAM,8BAA8B,EAAE,CAAC;oBACxD,UAAU,EAAE,KAAK,CAAC,iBAAiB;iBACpC,CAAC,CAAA;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,sBAAsB,GAAG,IAAI,CAAA;oBAC7B,GAAG,CAAC,IAAI,CACN,6DAA6D;wBAC3D,gEAAgE,EAClE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,MAAM,SAAS,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC;gBACtD,EAAE,EAAE,KAAK,CAAC,uBAAuB;gBACjC,UAAU,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,EAAE,2BAA2B;gBACjC,kBAAkB,EAAE,KAAK,CAAC,8BAA8B;aACzD,CAAC,CAAqB,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;gBAClD,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YACF,MAAM,8BAA8B,CAAC;gBACnC,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,GAAG,wBAAwB,CAAC;wBAC1B,UAAU;wBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAClD,CAAC;iBACH;aACF,CAAC,CAAA;YACF,QAAQ,IAAI,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,UAAU;gBACnB,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;aACJ,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEzE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,wEAAwE;AACxE,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAMjB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,0BAA0B,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED,sEAAsE;AACtE,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EAIjB;IAMC,MAAM,eAAe,GAAG,UAAU;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,MAAM,qBAAqB,GAAG,gBAAgB;QAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;QACxC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,uBAAuB,GAAG,gBAAgB;QAC9C,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAA;IACb,OAAO;QACL,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAW;IAC9B,OAAQ,IAA6B,CAAC,OAAO,CAAA;AAC/C,CAAC"}

package/dist/recovery/recoveryWebvh.d.ts

@@ -1,91 +1,50 @@
-import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
-import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
-import type { ResourceLogPinStore } from '@interop/vh-resource-log';
-import type { UnlockInventoryPart } from '../unlock/standingWebvh.js';
-import type { AccountLogSigner } from '../webvh/accountEntry.js';
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
 /**
- * What the add-and-retire entry retired, read back OFF THE LOG -- the resumed
- * spend's answer to the same question the live run answers from the document
- * it is editing. A run torn after that entry but before the caller's registry
- * and unlock-Space teardown resumes into the already-complete branch, and
- * without this it would be told nothing was retired and leave every other
- * credential's registry entry standing.
+ * The did:webvh half of recovery-code lifecycle: the split configuration a
+ * code holds as a standing unlock credential that retires on spend. At
+ * issuance the document gains the code's `keyAgreement` verification method
+ * (an ordinary Multikey entry -- deliberately unmarked; a recovery key is
+ * distinguishable structurally, since it appears under `keyAgreement` and
+ * `assertionMethod`/`capabilityDelegation` while every enrolled client also
+ * publishes an invocation relationship, so client listings key on
+ * `capabilityInvocation` and never see it), the code's ladder VM, and its
+ * rung-0 hash in `nextKeyHashes` -- decryption and delegation standing,
+ * update authority latent: rung 0 joins `updateKeys` nowhere, and every key
+ * of the set exists nowhere until the code is typed.
  *
- * The entry is located by its own signature on the log: it is the first entry
- * whose effective `updateKeys` authorize the successor key (the fresh
- * ladder's rung 0 on the transient continuation, the new client's update key
- * on the remembered one), which only that entry writes. What it retired is
- * then the credential-class `keyAgreement` ids its predecessor published and
- * it does not, less the spent code's own id -- the same exclusion the live
- * branch makes, since the caller retires that one by name.
+ * At recovery time the pre-committed rung 0 reveals itself to sign the
+ * self-enrolling continuation, two entries:
  *
- * @param options {object}
- * @param options.log {DIDLog}   the verified account log
- * @param options.did {string}   the account DID the log resolves to
- * @param options.successorKeyMultibase {string}   the update key only the
- *   add-and-retire entry authorizes
- * @param options.spentVmId {string}   the spent code's key-agreement
- *   verification-method id, excluded from the result
- * @returns {string[]}   the retired credentials' key-agreement ids, empty
- *   when no entry authorizes the successor key or it is the genesis entry
- */
-export declare function retiredCredentialVmIdsFromLog({ log, did, successorKeyMultibase, spentVmId }: {
-    log: DIDLog;
-    did: string;
-    successorKeyMultibase: string;
-    spentVmId: string;
-}): string[];
-/**
- * The verification-method id a code's key-agreement key publishes under --
- * the ordinary `<did>#<multibase>` form, indistinguishable by id from any
- * other keyAgreement entry. Consumers that must exclude recovery entries do
- * it structurally (an enrolled client is a `capabilityInvocation` entry; a
- * recovery key never has one) or by the registry's recorded multibase.
+ * 1. **Reveal + commit**: rung 0 joins `updateKeys` (its hash stands
+ *    committed since issuance, which is what makes the entry verify -- the
+ *    ordinary ladder reveal) and `nextKeyHashes` extends with the NEW
+ *    ordinary client's update- and staged-key hashes plus the replacement
+ *    code's rung-0 hash.
+ * 2. **Add + retire**: signed by the new client's update key (revealed from
+ *    the commit), this entry publishes the new client's verification methods
+ *    and update key, removes the spent code's `keyAgreement` VM and its
+ *    ladder VM (with every other standing credential's, by the relation
+ *    asymmetry), publishes the replacement code's inventory, and drops the
+ *    spent code's revealed rung and its hash -- so no recovery authority
+ *    stands afterwards.
  *
- * @param options {object}
- * @param options.did {string}   the account's did:webvh
- * @param options.keyAgreementKeyMultibase {string}
- * @returns {string}
- */
-export declare function recoveryVmId({ did, keyAgreementKeyMultibase }: {
-    did: string;
-    keyAgreementKeyMultibase: string;
-}): string;
-/**
- * The public halves of a recovery code as the document and log carry them:
- * the X25519 key-agreement key published as the recovery VM, and the update
- * key whose hash stands in `nextKeyHashes`.
- */
-export interface RecoveryPublicKeys {
-    keyAgreementKeyMultibase: string;
-    updateKeyMultibase: string;
-}
-/**
- * The public halves a SPEND needs of the replacement code it publishes: the
- * two above plus the code's ladder VM key, which the add-and-retire entry
- * installs under `assertionMethod` and `capabilityDelegation`. A code is a
- * standing unlock credential with a ladder (`decisions/0020`) and its bridge
- * delegation is signed by that ladder's VM (`decisions/0019`), so a
- * replacement published without the VM could neither sign its own bridge nor
- * spend. `recoveryClientFromCode` produces all three.
+ * Both entries are written through the caller's store seam; the recovery
+ * continuation publishes ONLY `did.jsonl` (the delegation the record carries
+ * covers nothing else -- narrow scope preserves loudness), and hands back the
+ * final `webDoc` so the recovered session can republish `did.json` once it is
+ * the authorized controller. Every step is idempotent/resumable: re-running
+ * with the same key material converges without forking the log.
  */
-export interface ReplacementRecoveryPublicKeys extends RecoveryPublicKeys {
-    ladderVmKeyMultibase: string;
-}
-/**
- * Thrown by the recovery continuation when the log carries neither the code's
- * update key nor its committed hash -- the code was revoked (or never
- * issued), so no continuation can verify.
- */
-export declare class RecoveryKeyNotCommittedError extends Error {
-    constructor(message?: string);
-}
-/**
- * The narrow store seam the recovery continuation writes through: a public
- * read of the log and the delegated `did.jsonl` PUT. A subset of
- * {@link WebvhIdStore}, so an app's remote-store class satisfies it too.
- */
-export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
+import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
+import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
+import type { UnlockInventoryPart } from '../unlock/standingWebvh.js';
+import type { AccountLogSigner } from '../webvh/accountEntry.js';
+import type { RecoveryLogStore, RecoveryPublicKeys, ReplacementRecoveryPublicKeys } from './continuation.js';
+export { RecoveryCredentialStandingError, RecoveryKeyNotCommittedError, recoveryVmId, retiredCredentialVmIdsFromLog } from './continuation.js';
+export type { RecoveryLogStore, RecoveryPublicKeys, ReplacementRecoveryPublicKeys } from './continuation.js';
 /**
  * ISSUANCE: publishes a recovery code's split configuration into the
  * document -- the code's `keyAgreement` verification method (an ordinary,

package/dist/recovery/recoveryWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EAEP,MAAM,2BAA2B,CAAA;AAclC,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAehE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACH,qBAAqB,EACrB,SAAS,EACV,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,qBAAqB,EAAE,MAAM,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,EAAE,CAmBX;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,6BAA8B,SAAQ,kBAAkB;IACvE,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,6BAA6B,CAAA;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC,CAAC,CAmBD"}
+{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAM/D,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAEhE,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAI1B,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,YAAY,EACZ,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,6BAA6B,CAAA;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC,CAAC,CAqED"}