@interop/wallet-core 0.66.0 → 0.68.0

package/dist/recovery/continuation.js

@@ -0,0 +1,467 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The shared core of the two recovery continuations: the control flow a
+ * spent code's two entries share whether the successor is an enrolled client
+ * (`recoverWebvhClient`, the remembered variant in `recoveryWebvh.ts`) or a
+ * fresh credential's ladder (`recoverWebvhLadderAnchored`, the transient
+ * variant in `clientAnnex/`). The two differ in exactly three things: the
+ * successor key the add-and-retire entry authorizes and signs with, the
+ * verification methods and relation memberships that entry adds, and what the
+ * `onCommitted` seam hands back into it. Everything else -- the resume
+ * detection, the reveal-and-commit entry, the seam's placement, the
+ * structural retirement of every pre-recovery credential, the rung strike,
+ * and the entry assembly -- is here once, so a change to the mechanics is
+ * made once and the two variants publish byte-identical entries for the
+ * parts they share.
+ *
+ * Lives in `recovery/` rather than beside the transient variant because the
+ * layer rule lets the annex import from the base and not the reverse.
+ */
+import { deriveNextKeyHash } from '@interop/did-method-webvh';
+import { effectiveParameters, ladderVerificationMethod, MULTIKEY_VM_TYPE, readPublishedLogOrThrow, servedHead } from '../webvh/didWebvh.js';
+import { accountEntryHead, signAccountEntry } from '../webvh/accountEntry.js';
+import { mergeVerificationMethods } from '../webvh/mergeMethods.js';
+import { credentialKeyAgreementMethods, ladderVmIds, retiredCredentialKeys } from '../resourceLog/document.js';
+// The base-side dependency the lint config pins: the ladder ATTRIBUTION
+// helpers only, never the annex log machinery. The add-and-retire entry
+// resolves each retired credential's standing rungs from the log with them.
+import { assertNextKeyHashesRemain, attributeRetiredCredentialRungs, retiredCredentialRungsBeforeKey } from '../clientAnnex/ladder.js';
+/**
+ * What the add-and-retire entry retired, read back OFF THE LOG -- the resumed
+ * spend's answer to the same question the live run answers from the document
+ * it is editing. A run torn after that entry but before the caller's registry
+ * and unlock-Space teardown resumes into the already-complete branch, and
+ * without this it would be told nothing was retired and leave every other
+ * credential's registry entry standing.
+ *
+ * The entry is located by its own signature on the log: it is the first entry
+ * whose effective `updateKeys` authorize the successor key (the fresh
+ * ladder's rung 0 on the transient continuation, the new client's update key
+ * on the remembered one), which only that entry writes. What it retired is
+ * then the credential-class `keyAgreement` ids its predecessor published and
+ * it does not, less the spent code's own id -- the same exclusion the live
+ * branch makes, since the caller retires that one by name.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the verified account log
+ * @param options.did {string}   the account DID the log resolves to
+ * @param options.successorKeyMultibase {string}   the update key only the
+ *   add-and-retire entry authorizes
+ * @param options.spentVmId {string}   the spent code's key-agreement
+ *   verification-method id, excluded from the result
+ * @returns {string[]}   the retired credentials' key-agreement ids, empty
+ *   when no entry authorizes the successor key or it is the genesis entry
+ */
+export function retiredCredentialVmIdsFromLog({ log, did, successorKeyMultibase, spentVmId }) {
+    const params = effectiveParameters(log);
+    const index = params.findIndex(entry => (entry.updateKeys ?? []).includes(successorKeyMultibase));
+    const previous = index > 0 ? log[index - 1]?.state : undefined;
+    const entryDoc = index > 0 ? log[index]?.state : undefined;
+    if (previous === undefined || entryDoc === undefined) {
+        return [];
+    }
+    return retiredCredentialKeys({
+        doc: entryDoc,
+        prevDoc: previous,
+        did
+    }).filter(id => id !== spentVmId);
+}
+/**
+ * The retirement report of a spend whose add-and-retire entry already
+ * stands, read back off the log: the same three members the continuation
+ * returns, derived the way its completed branch derives them, so a resume
+ * that holds only the successor's public halves (a remembered spend's pending
+ * client-key record, say) reports exactly what the first run reported rather
+ * than a second definition of the same question.
+ *
+ * The entry is located by the successor key it authorized
+ * ({@link retiredCredentialVmIdsFromLog}), and the strike is recomputed over
+ * the log as it stood just before that entry with the same protected sets the
+ * first run used: the successor key and its staged partner, and the
+ * replacement code's rung 0. A log that does not authorize the successor key
+ * (the entry never landed) reports nothing retired, since there is no entry to
+ * read back.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the verified account log
+ * @param options.did {string}   the account DID the log resolves to
+ * @param options.successor {object}   the public halves of the key the entry
+ *   authorized (`updateKeyMultibase`) and the staged partner whose hash the
+ *   reveal entry committed after it (`stagedKeyMultibase`)
+ * @param options.replacementUpdateKeyMultibase {string}   the replacement
+ *   code's rung-0 update key
+ * @param options.spentKeyAgreementKeyMultibase {string}   the spent code's
+ *   key-agreement key, excluded from the retired set
+ * @returns {Promise<RecoverySpendRetirement>}
+ */
+export async function recoverySpendRetirementFromLog({ log, did, successor, replacementUpdateKeyMultibase, spentKeyAgreementKeyMultibase }) {
+    const authorized = effectiveParameters(log).some(entry => (entry.updateKeys ?? []).includes(successor.updateKeyMultibase));
+    if (!authorized) {
+        return {
+            retiredCredentialVmIds: [],
+            struckRungHashes: [],
+            unclaimedCredentialVmIds: []
+        };
+    }
+    const retiredCredentialVmIds = retiredCredentialVmIdsFromLog({
+        log,
+        did,
+        successorKeyMultibase: successor.updateKeyMultibase,
+        spentVmId: recoveryVmId({
+            did,
+            keyAgreementKeyMultibase: spentKeyAgreementKeyMultibase
+        })
+    });
+    const protectedHashes = await Promise.all([
+        deriveNextKeyHash(successor.updateKeyMultibase),
+        deriveNextKeyHash(successor.stagedKeyMultibase),
+        deriveNextKeyHash(replacementUpdateKeyMultibase)
+    ]);
+    const strike = await retiredCredentialRungsBeforeKey({
+        log,
+        authorizedKeyMultibase: successor.updateKeyMultibase,
+        credentialVmIds: retiredCredentialVmIds,
+        protectedHashes,
+        protectedKeys: [successor.updateKeyMultibase]
+    });
+    return {
+        retiredCredentialVmIds,
+        struckRungHashes: strike.struckHashes,
+        unclaimedCredentialVmIds: strike.unclaimedCredentialVmIds
+    };
+}
+/**
+ * The verification-method id a code's key-agreement key publishes under --
+ * the ordinary `<did>#<multibase>` form, indistinguishable by id from any
+ * other keyAgreement entry. Consumers that must exclude recovery entries do
+ * it structurally (an enrolled client is a `capabilityInvocation` entry; a
+ * recovery key never has one) or by the registry's recorded multibase.
+ *
+ * @param options {object}
+ * @param options.did {string}   the account's did:webvh
+ * @param options.keyAgreementKeyMultibase {string}
+ * @returns {string}
+ */
+export function recoveryVmId({ did, keyAgreementKeyMultibase }) {
+    return `${did}#${keyAgreementKeyMultibase}`;
+}
+/**
+ * Thrown by the recovery continuation when the log carries neither the code's
+ * update key nor its committed hash -- the code was revoked (or never
+ * issued), so no continuation can verify.
+ */
+export class RecoveryKeyNotCommittedError extends Error {
+    constructor(message = 'The account log no longer commits this recovery code; the ' +
+        'code has been revoked or was never issued.') {
+        super(message);
+        this.name = 'RecoveryKeyNotCommittedError';
+    }
+}
+/**
+ * Thrown by the recovery continuation, before its reveal entry, when a
+ * credential-class `keyAgreement` id the add-and-retire entry would introduce
+ * already stands in the document -- the user re-typed a passphrase the
+ * account already stands on. The recovery exists to retire that credential,
+ * and an entry that re-binds it would strike its old ladder VM while leaving
+ * its old rung commitments standing, one member backed by two ladders. The
+ * app maps the refusal to "choose a passphrase you have not used". Nothing
+ * is published.
+ */
+export class RecoveryCredentialStandingError extends Error {
+    credentialVmIds;
+    constructor({ credentialVmIds }) {
+        super('The recovery would re-bind a credential the account already stands ' +
+            `on (${credentialVmIds.join(', ')}); choose a credential the account ` +
+            'has not used.');
+        this.name = 'RecoveryCredentialStandingError';
+        this.credentialVmIds = credentialVmIds;
+    }
+}
+/**
+ * One attempt of a recovery continuation, the shared control flow of
+ * `recoverWebvhClient` and `recoverWebvhLadderAnchored`; each wraps it in the
+ * conflict retry under its own preconditions. Both entries go through the
+ * account-entry seam ({@link signAccountEntry}) on its committed-key arm: the
+ * spent code's rung 0 signs the reveal-and-commit entry, and the successor
+ * key that entry committed signs the add-and-retire entry, so the pinned
+ * read, the carry-over precondition, the self-reveal union, the conditional
+ * publish, and the pin advance are the seam's. The body detects a completed
+ * run by the successor key standing authorized (reporting what the entry
+ * retired off the log), publishes the reveal-and-commit entry unless a torn
+ * earlier run left it standing, enters the `onCommitted` seam, and builds the
+ * add-and-retire entry from what the variant's `added` callback hands in.
+ *
+ * The reveal-and-commit entry commits, in this order, the successor key's
+ * hash, its staged partner's hash, and the replacement code's rung-0 hash --
+ * the ratified append order of `decisions/0007` (the replacement's comes
+ * LAST) and the anchor rule of `decisions/0014` both read that order. The
+ * add-and-retire entry is built on the head the reveal entry's own publish
+ * leaves standing, with no read in between; against a store whose PUT serves
+ * no ETag it is re-read under the same pin instead, so its compare-and-swap
+ * never degrades to an unconditional write.
+ *
+ * @param options {object}
+ * @param options.store {RecoveryLogStore}
+ * @param options.recovery {object}   the spent code's update seed and public
+ *   halves
+ * @param options.successor {object}   the key the add-and-retire entry
+ *   authorizes and signs with (`updateKeyMultibase`, from `updateSeed`) and
+ *   the staged partner whose hash the reveal entry commits right after it
+ *   (`stagedKeyMultibase`: the new client's staged key, or the fresh ladder's
+ *   rung 1)
+ * @param options.replacement {ReplacementRecoveryPublicKeys}
+ * @param options.onCommitted {function}   the persist-before-publish seam,
+ *   entered once per attempt after the reveal entry stands and before the
+ *   pivot is built; what it resolves to is handed to `added`
+ * @param options.added {function}   builds the variant's additions to the
+ *   add-and-retire entry from the account DID, the document the entry edits,
+ *   and what the seam persisted
+ * @param [options.credentialVmIds] {function}   `(did) => string[]` -- the
+ *   credential-class `keyAgreement` ids `added` will introduce, checked
+ *   against the read document before the reveal entry: one already standing
+ *   is refused with {@link RecoveryCredentialStandingError}. The transient
+ *   variant supplies its fresh credential's; the remembered variant's new
+ *   client publishes a marked pair, which is never credential-class
+ * @param [options.expectedDid] {string}
+ * @returns {Promise<RecoveryContinuationOutcome>}
+ */
+export async function recoveryContinuationOnce({ store, recovery, successor, replacement, onCommitted, added, credentialVmIds, expectedDid }) {
+    const pinned = {
+        ...(expectedDid !== undefined ? { expectedDid } : {})
+    };
+    const missingMessage = 'did:webvh: did.jsonl is missing; nothing to recover.';
+    // The successor's own hashes, which the reveal entry commits and the strike
+    // never touches; {@link recoverySpendRetirementFromLog} re-derives the same
+    // sets for a resumed run.
+    const [recoveryHash, successorHash, stagedHash, replacementHash] = await Promise.all([
+        deriveNextKeyHash(recovery.updateKeyMultibase),
+        deriveNextKeyHash(successor.updateKeyMultibase),
+        deriveNextKeyHash(successor.stagedKeyMultibase),
+        deriveNextKeyHash(replacement.updateKeyMultibase)
+    ]);
+    const protectedHashes = [successorHash, stagedHash, replacementHash];
+    const protectedKeys = [successor.updateKeyMultibase];
+    const spentVmIdOf = (did) => recoveryVmId({
+        did,
+        keyAgreementKeyMultibase: recovery.keyAgreementKeyMultibase
+    });
+    const complete = (read) => read.updateKeys.includes(successor.updateKeyMultibase);
+    // The reveal-and-commit entry, signed by the spent code's rung 0. Each
+    // attempt's own read is what the CAS publish is built on, so the continuity
+    // check runs here -- and again on a conflict-retry re-run -- not only on
+    // the verify that follows both entries.
+    const reveal = await signAccountEntry({
+        idStore: store,
+        signer: { kind: 'committed', updateSeed: recovery.updateSeed },
+        ...pinned,
+        missingMessage,
+        verb: 'spending a recovery code',
+        logOnly: true,
+        skip: read => {
+            // Already complete (a torn earlier run finished the add entry): the
+            // successor key is authorized, which only the add entry writes.
+            if (complete(read)) {
+                return true;
+            }
+            // A member this continuation would re-bind: refused before anything
+            // publishes, on the first attempt and on a resume alike.
+            const standing = (credentialVmIds?.(read.did) ?? []).filter(id => credentialKeyAgreementMethods({ doc: read.doc, did: read.did }).some(method => method.id === id));
+            if (standing.length > 0) {
+                throw new RecoveryCredentialStandingError({ credentialVmIds: standing });
+            }
+            // Skipped when a torn earlier run already published it (the revealed
+            // key authorized AND every needed hash committed).
+            const revealed = read.updateKeys.includes(recovery.updateKeyMultibase);
+            if (!revealed && !read.nextKeyHashes.includes(recoveryHash)) {
+                throw new RecoveryKeyNotCommittedError();
+            }
+            return (revealed &&
+                protectedHashes.every(hash => read.nextKeyHashes.includes(hash)));
+        },
+        // The spent code's own hash is kept through this entry by the arm's
+        // carry-over union (so a resumed commit can re-state the revealed key);
+        // the add entry drops it. The three new hashes follow in the ratified
+        // order, the replacement code's last.
+        build: () => ({ commitHashes: protectedHashes })
+    });
+    let published = accountEntryHead({ outcome: reveal });
+    // The seam is deliberately NOT entered on the completed branch -- nothing
+    // is about to be published, so there is no pivot to persist ahead of.
+    if (complete(published)) {
+        // The add entry already struck the pre-recovery credentials, so the
+        // document names none of them any more. The report is read back off the
+        // log instead ({@link recoverySpendRetirementFromLog}, the same entry
+        // point an app's own resume calls), so a resume tells the caller exactly
+        // what the first run told it.
+        const retirement = await recoverySpendRetirementFromLog({
+            log: published.log,
+            did: published.did,
+            successor: {
+                updateKeyMultibase: successor.updateKeyMultibase,
+                stagedKeyMultibase: successor.stagedKeyMultibase
+            },
+            replacementUpdateKeyMultibase: replacement.updateKeyMultibase,
+            spentKeyAgreementKeyMultibase: recovery.keyAgreementKeyMultibase
+        });
+        return {
+            did: published.did,
+            doc: published.doc,
+            log: published.log,
+            committed: false,
+            ...retirement
+        };
+    }
+    if (reveal.updated && published.etag === undefined) {
+        // The same account the reveal entry just extended, under the same pin.
+        published = await readPublishedLogOrThrow({
+            idStore: store,
+            ...pinned,
+            expectedDid: published.did,
+            missingMessage
+        });
+    }
+    // The persist-before-publish seam: the successor material is persisted
+    // HERE, on the head the add-and-retire entry is about to be built on,
+    // before that entry -- the ceremony's pivot -- retires the spent code.
+    // Reached on both paths into the add entry: the reveal entry just published
+    // above, or a torn earlier run's reveal entry standing already.
+    const persisted = await onCommitted({
+        builtOnHead: servedHead(published.log)
+    });
+    // The add-and-retire entry: the variant's successor inventory in, the
+    // replacement code's inventory in after it, every pre-recovery standing
+    // credential fully retired -- the spent code by name, and every other one
+    // structurally (its ladder VM by the relation asymmetry, its keyAgreement
+    // member by the account-DID controller). Signed by the successor key, whose
+    // hash the commit entry just committed.
+    let retiredCredentialVmIds = [];
+    let strike = {
+        struckHashes: [],
+        struckKeys: [],
+        unclaimedCredentialVmIds: []
+    };
+    const add = await signAccountEntry({
+        idStore: store,
+        signer: { kind: 'committed', updateSeed: successor.updateSeed },
+        published,
+        ...pinned,
+        expectedDid: published.did,
+        verb: 'spending a recovery code',
+        logOnly: true,
+        build: async ({ published: read }) => {
+            const { did, doc } = read;
+            const spentVmId = spentVmIdOf(did);
+            const replacementVmId = recoveryVmId({
+                did,
+                keyAgreementKeyMultibase: replacement.keyAgreementKeyMultibase
+            });
+            // The replacement code's ladder VM, published in the same entry as its
+            // key-agreement member: a code is a standing credential with a ladder,
+            // and its own bridge delegation is signed by this VM, so a replacement
+            // without it could never spend (`decisions/0019`, `decisions/0020`).
+            // Its rung-0 hash needs nothing here -- the reveal-and-commit entry
+            // committed it, and this entry carries it through.
+            const replacementLadderVmId = `${did}#${replacement.ladderVmKeyMultibase}`;
+            const variant = added({ did, doc, persisted });
+            const addedMethods = [
+                ...variant.methods,
+                {
+                    id: replacementVmId,
+                    type: MULTIKEY_VM_TYPE,
+                    controller: did,
+                    publicKeyMultibase: replacement.keyAgreementKeyMultibase
+                },
+                ladderVerificationMethod({
+                    controller: did,
+                    publicKeyMultibase: replacement.ladderVmKeyMultibase
+                })
+            ];
+            // The full retirement, recognized structurally rather than from a list
+            // the caller supplies: every standing ladder VM, and every keyAgreement
+            // member the account DID controls, less the ids this entry itself adds.
+            // Other unspent recovery codes retire with the rest -- a code's member
+            // is unmarked and verbatim, indistinguishable from a passkey's. The
+            // enrolled clients' marked pairs and the KMS convenience key are
+            // untouched -- neither is account-DID-controlled keyAgreement.
+            const ladderVms = ladderVmIds({ doc });
+            const addedVmIds = addedMethods
+                .map(method => method.id)
+                .filter((id) => typeof id === 'string');
+            const struckCredentialVmIds = credentialKeyAgreementMethods({ doc, did })
+                .map(method => method.id)
+                .filter((id) => typeof id === 'string')
+                .filter(id => !addedVmIds.includes(id));
+            retiredCredentialVmIds = struckCredentialVmIds.filter(id => id !== spentVmId);
+            // Each retired credential's committed rungs and any revealed rung of its
+            // own go in the SAME entry. Striking the ladder VM rots only a
+            // ladder-signed bridge; a bridge an enrolled client minted outlives the
+            // strike, and that client survives this entry, so a committed rung left
+            // standing is a reveal the retired credential could still perform
+            // (`decisions/0014`). Anchored from the log alone, and an unanchorable
+            // credential is reported rather than struck.
+            strike = await attributeRetiredCredentialRungs({
+                log: read.log,
+                credentialVmIds: retiredCredentialVmIds,
+                protectedHashes,
+                protectedKeys
+            });
+            const struck = (id) => id === spentVmId ||
+                ladderVms.includes(id) ||
+                struckCredentialVmIds.includes(id);
+            return {
+                // The spent code's revealed rung and every struck rung leave; the
+                // arm unions the successor key in after this.
+                updateKeys: read.updateKeys.filter(key => key !== recovery.updateKeyMultibase &&
+                    !strike.struckKeys.includes(key)),
+                nextKeyHashes: assertNextKeyHashesRemain({
+                    nextKeyHashes: read.nextKeyHashes.filter(hash => hash !== recoveryHash && !strike.struckHashes.includes(hash)),
+                    ceremony: 'the recovery add-and-retire entry'
+                }),
+                // The retirement runs over the EXISTING document only, and the added
+                // ids join afterwards: a ladder VM this entry publishes may already
+                // stand in `doc.capabilityDelegation`, and filtering the union would
+                // strike the very method this entry is publishing.
+                ...mergeVerificationMethods({
+                    doc,
+                    methods: addedMethods,
+                    retire: struck,
+                    relations: {
+                        authentication: variant.authentication,
+                        // The ladder VMs' relation asymmetry: `assertionMethod` and
+                        // `capabilityDelegation` only, so neither reads as an enrolled
+                        // client.
+                        assertionMethod: [
+                            ...(variant.assertionMethod ?? []),
+                            replacementLadderVmId
+                        ],
+                        // The variant's own key-agreement member precedes the replacement
+                        // code's: the position `decisions/0014`'s anchor rule reads the
+                        // pair by.
+                        keyAgreement: [...(variant.keyAgreement ?? []), replacementVmId],
+                        capabilityInvocation: variant.capabilityInvocation,
+                        capabilityDelegation: [
+                            ...(variant.capabilityDelegation ?? []),
+                            replacementLadderVmId
+                        ]
+                    }
+                }),
+                ...(variant.services ? { services: variant.services } : {})
+            };
+        }
+    });
+    // The build never declines, so the seam published.
+    const updated = add.updated;
+    return {
+        did: updated.did,
+        doc: updated.doc,
+        log: updated.log,
+        webDoc: updated.webDoc,
+        committed: true,
+        retiredCredentialVmIds,
+        struckRungHashes: strike.struckHashes,
+        unclaimedCredentialVmIds: strike.unclaimedCredentialVmIds
+    };
+}
+//# sourceMappingURL=continuation.js.map

package/dist/recovery/continuation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"continuation.js","sourceRoot":"","sources":["../../src/recovery/continuation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAO7D,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACX,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EACL,6BAA6B,EAC7B,WAAW,EACX,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAChC,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACH,qBAAqB,EACrB,SAAS,EAMV;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACrC,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CACzD,CAAA;IACD,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,qBAAqB,CAAC;QAC3B,GAAG,EAAE,QAAQ;QACb,OAAO,EAAE,QAAQ;QACjB,GAAG;KACJ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAA;AACnC,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,GAAG,EACH,GAAG,EACH,SAAS,EACT,6BAA6B,EAC7B,6BAA6B,EAO9B;IACC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACvD,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAChE,CAAA;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,sBAAsB,EAAE,EAAE;YAC1B,gBAAgB,EAAE,EAAE;YACpB,wBAAwB,EAAE,EAAE;SAC7B,CAAA;IACH,CAAC;IACD,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;QAC3D,GAAG;QACH,GAAG;QACH,qBAAqB,EAAE,SAAS,CAAC,kBAAkB;QACnD,SAAS,EAAE,YAAY,CAAC;YACtB,GAAG;YACH,wBAAwB,EAAE,6BAA6B;SACxD,CAAC;KACH,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/C,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/C,iBAAiB,CAAC,6BAA6B,CAAC;KACjD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;QACnD,GAAG;QACH,sBAAsB,EAAE,SAAS,CAAC,kBAAkB;QACpD,eAAe,EAAE,sBAAsB;QACvC,eAAe;QACf,aAAa,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC;KAC9C,CAAC,CAAA;IACF,OAAO;QACL,sBAAsB;QACtB,gBAAgB,EAAE,MAAM,CAAC,YAAY;QACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;KAC1D,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EAIzB;IACC,OAAO,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;AAC7C,CAAC;AAyBD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YACE,OAAO,GAAG,4DAA4D;QACpE,4CAA4C;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,eAAe,CAAU;IAElC,YAAY,EAAE,eAAe,EAAiC;QAC5D,KAAK,CACH,qEAAqE;YACnE,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;YACtE,eAAe,CAClB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAA;QAC7C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;IACxC,CAAC;CACF;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAY,EACxD,KAAK,EACL,QAAQ,EACR,SAAS,EACT,WAAW,EACX,WAAW,EACX,KAAK,EACL,eAAe,EACf,WAAW,EAoBZ;IACC,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAA;IACD,MAAM,cAAc,GAAG,sDAAsD,CAAA;IAE7E,4EAA4E;IAC5E,4EAA4E;IAC5E,0BAA0B;IAC1B,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,CAAC,GAC9D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC9C,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/C,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/C,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC;KAClD,CAAC,CAAA;IACJ,MAAM,eAAe,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,eAAe,CAAC,CAAA;IACpE,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IACpD,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAClC,YAAY,CAAC;QACX,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACJ,MAAM,QAAQ,GAAG,CAAC,IAAuB,EAAE,EAAE,CAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IAExD,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE;QAC9D,GAAG,MAAM;QACT,cAAc;QACd,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,IAAI,CAAC,EAAE;YACX,oEAAoE;YACpE,gEAAgE;YAChE,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,QAAQ,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAC/D,6BAA6B,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAC3B,CACF,CAAA;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,+BAA+B,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC1E,CAAC;YACD,qEAAqE;YACrE,mDAAmD;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;YACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,4BAA4B,EAAE,CAAA;YAC1C,CAAC;YACD,OAAO,CACL,QAAQ;gBACR,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACjE,CAAA;QACH,CAAC;QACD,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,sCAAsC;QACtC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;KACjD,CAAC,CAAA;IACF,IAAI,SAAS,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IAErD,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,MAAM,8BAA8B,CAAC;YACtD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,SAAS,EAAE;gBACT,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;gBAChD,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;aACjD;YACD,6BAA6B,EAAE,WAAW,CAAC,kBAAkB;YAC7D,6BAA6B,EAAE,QAAQ,CAAC,wBAAwB;SACjE,CAAC,CAAA;QACF,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,SAAS,EAAE,KAAK;YAChB,GAAG,UAAU;SACd,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnD,uEAAuE;QACvE,SAAS,GAAG,MAAM,uBAAuB,CAAC;YACxC,OAAO,EAAE,KAAK;YACd,GAAG,MAAM;YACT,WAAW,EAAE,SAAS,CAAC,GAAG;YAC1B,cAAc;SACf,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC;QAClC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;KACvC,CAAC,CAAA;IAEF,sEAAsE;IACtE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,wCAAwC;IACxC,IAAI,sBAAsB,GAAa,EAAE,CAAA;IACzC,IAAI,MAAM,GAAgE;QACxE,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,EAAE;QACd,wBAAwB,EAAE,EAAE;KAC7B,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE;QAC/D,SAAS;QACT,GAAG,MAAM;QACT,WAAW,EAAE,SAAS,CAAC,GAAG;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;YACnC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;YACzB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,eAAe,GAAG,YAAY,CAAC;gBACnC,GAAG;gBACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;aAC/D,CAAC,CAAA;YACF,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,mDAAmD;YACnD,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,CAAA;YAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;YAC9C,MAAM,YAAY,GAAyB;gBACzC,GAAG,OAAO,CAAC,OAAO;gBAClB;oBACE,EAAE,EAAE,eAAe;oBACnB,IAAI,EAAE,gBAAgB;oBACtB,UAAU,EAAE,GAAG;oBACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;iBACzD;gBACD,wBAAwB,CAAC;oBACvB,UAAU,EAAE,GAAG;oBACf,kBAAkB,EAAE,WAAW,CAAC,oBAAoB;iBACrD,CAAC;aACH,CAAA;YACD,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;YACtC,MAAM,UAAU,GAAG,YAAY;iBAC5B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;iBACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAA;YACvD,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;iBACtE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;iBACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;iBACpD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;YACzC,sBAAsB,GAAG,qBAAqB,CAAC,MAAM,CACnD,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CACvB,CAAA;YACD,yEAAyE;YACzE,+DAA+D;YAC/D,wEAAwE;YACxE,wEAAwE;YACxE,kEAAkE;YAClE,uEAAuE;YACvE,6CAA6C;YAC7C,MAAM,GAAG,MAAM,+BAA+B,CAAC;gBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,eAAe,EAAE,sBAAsB;gBACvC,eAAe;gBACf,aAAa;aACd,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,CAAC,EAAU,EAAW,EAAE,CACrC,EAAE,KAAK,SAAS;gBAChB,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YACpC,OAAO;gBACL,kEAAkE;gBAClE,8CAA8C;gBAC9C,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAChC,GAAG,CAAC,EAAE,CACJ,GAAG,KAAK,QAAQ,CAAC,kBAAkB;oBACnC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnC;gBACD,aAAa,EAAE,yBAAyB,CAAC;oBACvC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CACtC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrE;oBACD,QAAQ,EAAE,mCAAmC;iBAC9C,CAAC;gBACF,qEAAqE;gBACrE,oEAAoE;gBACpE,qEAAqE;gBACrE,mDAAmD;gBACnD,GAAG,wBAAwB,CAAC;oBAC1B,GAAG;oBACH,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,MAAM;oBACd,SAAS,EAAE;wBACT,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,4DAA4D;wBAC5D,+DAA+D;wBAC/D,UAAU;wBACV,eAAe,EAAE;4BACf,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;4BAClC,qBAAqB;yBACtB;wBACD,kEAAkE;wBAClE,gEAAgE;wBAChE,WAAW;wBACX,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC;wBAChE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;wBAClD,oBAAoB,EAAE;4BACpB,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;4BACvC,qBAAqB;yBACtB;qBACF;iBACF,CAAC;gBACF,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IACF,mDAAmD;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAQ,CAAA;IAC5B,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI;QACf,sBAAsB;QACtB,gBAAgB,EAAE,MAAM,CAAC,YAAY;QACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;KAC1D,CAAA;AACH,CAAC"}

package/dist/recovery/index.d.ts

@@ -31,12 +31,15 @@
  *   self-enrolling recovery continuation. Its ladder-anchored variant (the
  *   transient-recovery continuation, `recoverWebvhLadderAnchored`) lives in
  *   `@interop/wallet-core/clientAnnex`.
+ * - `recoverySpendRetirementFromLog` -- the retirement report of a spend
+ *   whose add-and-retire entry already stands, read back off the log: what a
+ *   resume that never re-enters the continuation drops registry entries and
+ *   deletes unlock Spaces for, and which retired credentials kept a rung.
  * - `delegateLogWrite` / `delegationProofKeyId` /
- *   `remintRecoveryDelegations` -- the authorization bridge: the pre-minted
- *   PUT-on-`did.jsonl` delegation builder and the revocation cascade's
- *   re-mint of the delegations a document edit rotted, behind injected
- *   app seams (management-zcap client factory, storage URL, registry
- *   read/record).
+ *   `recordedDelegationFields` -- the authorization bridge: the pre-minted
+ *   PUT-on-`did.jsonl` delegation builder, and the registry fields a record's
+ *   delegations stand for. A bridge is signed by its own credential's ladder
+ *   VM, so no ceremony re-mints another credential's.
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * was-client dependency graph (the same isolation pattern as `./keyring`).
@@ -45,8 +48,9 @@ export { decodeRecoveryCode, formatRecoveryCode, generateRecoveryCode, normalize
 export type { RecoveryClient } from './recoveryCode.js';
 export { computeUnlockBinding, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from '../unlock/unlockRecord.js';
 export type { SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from '../unlock/unlockRecord.js';
-export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, recordedDelegationFields, remintRecoveryDelegations, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
-export type { RecordRemintOutcome, RecoveryDelegationEntry } from './recoveryDelegation.js';
-export { publishRecoveryKey, recoverWebvhClient, RecoveryKeyNotCommittedError, recoveryVmId, removeRecoveryKey } from './recoveryWebvh.js';
+export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, recordedDelegationFields, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
+export { recoverySpendRetirementFromLog } from './continuation.js';
+export type { RecoverySpendRetirement } from './continuation.js';
+export { publishRecoveryKey, recoverWebvhClient, RecoveryCredentialStandingError, RecoveryKeyNotCommittedError, recoveryVmId, removeRecoveryKey } from './recoveryWebvh.js';
 export type { RecoveryLogStore, RecoveryPublicKeys, ReplacementRecoveryPublicKeys } from './recoveryWebvh.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/recovery/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAA;AAClE,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,oBAAoB,CAAA"}

package/dist/recovery/index.js

@@ -31,18 +31,22 @@
  *   self-enrolling recovery continuation. Its ladder-anchored variant (the
  *   transient-recovery continuation, `recoverWebvhLadderAnchored`) lives in
  *   `@interop/wallet-core/clientAnnex`.
+ * - `recoverySpendRetirementFromLog` -- the retirement report of a spend
+ *   whose add-and-retire entry already stands, read back off the log: what a
+ *   resume that never re-enters the continuation drops registry entries and
+ *   deletes unlock Spaces for, and which retired credentials kept a rung.
  * - `delegateLogWrite` / `delegationProofKeyId` /
- *   `remintRecoveryDelegations` -- the authorization bridge: the pre-minted
- *   PUT-on-`did.jsonl` delegation builder and the revocation cascade's
- *   re-mint of the delegations a document edit rotted, behind injected
- *   app seams (management-zcap client factory, storage URL, registry
- *   read/record).
+ *   `recordedDelegationFields` -- the authorization bridge: the pre-minted
+ *   PUT-on-`did.jsonl` delegation builder, and the registry fields a record's
+ *   delegations stand for. A bridge is signed by its own credential's ladder
+ *   VM, so no ceremony re-mints another credential's.
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
  * was-client dependency graph (the same isolation pattern as `./keyring`).
  */
 export { decodeRecoveryCode, formatRecoveryCode, generateRecoveryCode, normalizeRecoveryCode, RECOVERY_CODE_BYTES, RECOVERY_KDF, RecoveryCodeInvalidError, recoveryClientFromCode } from './recoveryCode.js';
 export { computeUnlockBinding, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from '../unlock/unlockRecord.js';
-export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, recordedDelegationFields, remintRecoveryDelegations, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
-export { publishRecoveryKey, recoverWebvhClient, RecoveryKeyNotCommittedError, recoveryVmId, removeRecoveryKey } from './recoveryWebvh.js';
+export { delegateLogWrite, delegationProofKeyId, RECOVERY_DELEGATION_TTL_MS, recordedDelegationFields, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './recoveryDelegation.js';
+export { recoverySpendRetirementFromLog } from './continuation.js';
+export { publishRecoveryKey, recoverWebvhClient, RecoveryCredentialStandingError, RecoveryKeyNotCommittedError, recoveryVmId, removeRecoveryKey } from './recoveryWebvh.js';
 //# sourceMappingURL=index.js.map

package/dist/recovery/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAMhC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACb,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAA;AAGlE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,+BAA+B,EAC/B,4BAA4B,EAC5B,YAAY,EACZ,iBAAiB,EAClB,MAAM,oBAAoB,CAAA"}