@interop/wallet-core 0.66.0 → 0.68.0

package/dist/recovery/recoveryDelegation.d.ts

@@ -1,7 +1,28 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The recovery code's authorization bridge: the pre-minted PUT-on-`did.jsonl`
+ * delegation. The delegation is a wire artifact both apps must mint
+ * byte-identically (issuance and every re-bind produce the record another
+ * replica later recovers with), so its builder lives here: PUT on the one
+ * `did.jsonl` resource, one-year TTL, delegated to the code-derived signing
+ * DID. Its narrow scope is what keeps recovery loud -- a stolen code must
+ * extend the world-readable log before it can read anything.
+ *
+ * No ceremony re-mints another credential's bridge. A record's bridge and
+ * `delegatedClients` sibling are signed by that record's own credential's
+ * ladder VM, and its frame proof by that credential's own unlock identity
+ * key (`decisions/0019`), so the only thing that can rot a bridge is
+ * retiring the credential it belongs to -- which deletes the record with it.
+ * A bridge that ages out, or one a pre-rule bind left signed by a foreign
+ * key, is refreshed by that credential's own login on the house staleness
+ * axes ({@link zcapExpiring}, `recordedZcapStale`), and the registry fields
+ * a refresh records are built here ({@link recordedDelegationFields}).
+ */
 import type { IZcap } from '@interop/data-integrity-core';
 import type { ZcapClient } from '@interop/ezcap';
-import type { PublishedKeyDocument } from '../webvh/listClients.js';
-import type { AccountPointer, RecordSigner } from '../keyring/record.js';
+import type { AccountPointer } from '../keyring/record.js';
 import { delegationProofKeyId } from '../webvh/standingZcap.js';
 /**
  * The recovery delegation's lifetime: the house standing-zcap value
@@ -64,128 +85,4 @@ export declare function recordedDelegationFields({ delegation, delegatedClients
     delegatedClientsKeyId?: string;
     delegatedClientsExpires?: string;
 };
-/**
- * The members of a recovery-code registry entry the re-mint reads: where the
- * code's unlock Space and record are (`unlockSpaceId`, `manageCapability`),
- * which key signed the recorded delegation and when it expires
- * (`delegationKeyId` / `delegationExpires` -- either absent on an entry
- * predating its field, which the staleness checks conservatively flag), and
- * the re-mint fields: the code-derived signing DID the fresh delegation names
- * and the unlock KAK public half the record is re-wrapped to. A standing
- * credential's entry additionally tracks its annex Space sibling
- * delegation as a second scalar pair (`delegatedClientsKeyId` /
- * `delegatedClientsExpires` -- absent for recovery codes, mirroring the
- * record member's optionality); the sibling rots on exactly the bridge's
- * axis, so one pass reseals both. Structural on
- * purpose -- an app's richer registry entry satisfies it, and the re-mint
- * hands the SAME entry back (with the fresh key ids and expiries) through the
- * record seam, extra members untouched.
- */
-export interface RecoveryDelegationEntry {
-    label: string;
-    unlockSpaceId: string;
-    manageCapability?: IZcap;
-    delegationKeyId?: string;
-    delegationExpires?: string;
-    delegatedClientsKeyId?: string;
-    delegatedClientsExpires?: string;
-    recoveryClientDid?: string;
-    unlockKeyAgreementKeyId?: string;
-    unlockKeyAgreementKeyMultibase?: string;
-}
-/**
- * One registry entry's fate in a re-mint pass: `current` (both members stand
- * and are outside the renewal window -- nothing written), `reminted` (the
- * record re-sealed and the entry handed back fresh; `siblingCarriedVerbatim`
- * flags a recorded sibling the pass could not rebuild because the document
- * points at no generation, which stays flagged for the health check),
- * `incomplete-entry` (an entry predating the re-mint fields, skipped until
- * the credential is re-bound), `pending-entry` (the entry's recorded
- * unlock-key members do not match the credential the record at its unlock
- * Space is sealed to -- a passphrase change torn before its retirement; the
- * next passphrase login's repair finishes it, and re-minting here would
- * re-arm the retired credential into the new one's record), or `failed` (the record could not be read,
- * re-sealed, or re-PUT -- `error` carries the cause). A skipped or failed
- * entry is named here so no caller can lose it silently.
- */
-export interface RecordRemintOutcome {
-    label: string;
-    unlockSpaceId: string;
-    outcome: 'current' | 'reminted' | 'incomplete-entry' | 'pending-entry' | 'failed';
-    siblingCarriedVerbatim?: boolean;
-    error?: unknown;
-}
-/**
- * Re-mints the recovery delegations the current document no longer backs --
- * the recovery-code delta riding the revocation cascade (see the module doc
- * for the mechanism and the skip policy).
- *
- * The record's credential-authenticated core is preserved verbatim: the
- * re-mint reads the standing record through the entry's management zcap and
- * replaces only its delegation members
- * ({@link remintUnlockRecordDelegations}) -- the bridge always, and the
- * annex Space sibling where the entry records one (the two rot on one
- * axis, so both reseal in the same atomic pass and one registry-entry
- * rewrite records both fresh pairs). The
- * shell, the ladder member (where one rides), and the binding tag all travel
- * untouched, since the re-mint can decrypt none of them and does not need to.
- * A re-mint therefore can never change the pointer or controller the
- * credential was bound against -- and after a host migration the tag no
- * longer matches the moved pointer, so credentials must be rebound (codes
- * re-issued) when the account moves hosts.
- *
- * The re-mint holds the code's KAK public half but not its signing key, so
- * every record it re-PUTs is signed with the acting client's own account key
- * (`recordSigner`) -- the mixed-signer case a reader settles against the
- * verified did:webvh document.
- *
- * Best-effort per entry: a skipped entry stays flagged by the login-time
- * health check, whose regenerate nudge remains the backstop.
- *
- * @param options {object}
- * @param options.doc {PublishedKeyDocument}   the locally verified did:webvh
- *   document, AFTER the revocation edit
- * @param options.entries {RecoveryDelegationEntry[]}   the registry's
- *   recovery-code entries, as the app's registry read returned them
- * @param options.pointer {AccountPointer}
- * @param options.storageServerUrl {string}   the unlock Spaces' storage server
- * @param options.zcapClient {ZcapClient}   the acting client's promoted
- *   signer, which mints the fresh delegations
- * @param options.recordSigner {RecordSigner}   the acting client's account
- *   key, which signs the re-wrapped records
- * @param options.managementZcapClient {Function}   `({ capability }) =>
- *   ZcapClient` -- the client an entry's management zcap is invoked with
- * @param options.recordEntry {Function}   `({ entry }) => Promise<void>` --
- *   persists one updated registry entry (matching on the app's entry key)
- * @param [options.mintDelegatedClientsDelegation] {Function}   `({ controller })
- *   => Promise<IZcap | undefined>` -- the annex-side mint of a fresh
- *   `delegatedClients` sibling delegation, injected by the caller (the
- *   annex subpath's `delegatedClientsDelegationMinter` builds one over the
- *   verified document); `undefined` when the document points at no
- *   generation, in which case the old sealed member travels verbatim
- * @returns {Promise<{ reminted: number; skipped: number }>}
- */
-export declare function remintRecoveryDelegations<Entry extends RecoveryDelegationEntry>({ doc, entries, pointer, storageServerUrl, zcapClient, recordSigner, managementZcapClient, recordEntry, mintDelegatedClientsDelegation, retiringKeyMultibases, now }: {
-    doc: PublishedKeyDocument;
-    entries: Entry[];
-    pointer: AccountPointer;
-    storageServerUrl: string;
-    zcapClient: ZcapClient;
-    recordSigner: RecordSigner;
-    managementZcapClient: (options: {
-        capability: IZcap;
-    }) => ZcapClient;
-    recordEntry: (options: {
-        entry: Entry;
-    }) => Promise<void>;
-    mintDelegatedClientsDelegation?: (options: {
-        controller: string;
-    }) => Promise<IZcap | undefined>;
-    retiringKeyMultibases?: string[];
-    now?: number;
-}): Promise<{
-    reminted: number;
-    skipped: number;
-    outcomes: RecordRemintOutcome[];
-}>;
 //# sourceMappingURL=recoveryDelegation.d.ts.map

package/dist/recovery/recoveryDelegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAoB,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAKnE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAKxE,OAAO,EACL,oBAAoB,EAGrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAgB,EACjB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EACjB,EAAE;IACD,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,gBAAgB,CAAC,EAAE,KAAK,CAAA;CACzB,GAAG;IACF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,CAiBA;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,CAAC,EAAE,KAAK,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,8BAA8B,CAAC,EAAE,MAAM,CAAA;CACxC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EACL,SAAS,GAAG,UAAU,GAAG,kBAAkB,GAAG,eAAe,GAAG,QAAQ,CAAA;IAC1E,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,SAAS,uBAAuB,EACrC,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAA0B,EAC1B,GAAgB,EACjB,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzD,8BAA8B,CAAC,EAAE,CAAC,OAAO,EAAE;QACzC,UAAU,EAAE,MAAM,CAAA;KACnB,KAAK,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAA;IAChC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAChC,CAAC,CAoLD"}
+{"version":3,"file":"recoveryDelegation.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EACL,oBAAoB,EAErB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,QAAuB,CAAA;AAI9D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAqB/E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAgB,EACjB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,iBAAiB,EAAE,MAAM,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,KAAK,CAAC,CAOjB;AAID,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EACjB,EAAE;IACD,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,gBAAgB,CAAC,EAAE,KAAK,CAAA;CACzB,GAAG;IACF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,CAiBA"}

package/dist/recovery/recoveryDelegation.js

@@ -1,55 +1,6 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The recovery code's authorization bridge: the pre-minted PUT-on-`did.jsonl`
- * delegation and the revocation cascade's re-mint of it. The delegation is a
- * wire artifact both apps must mint byte-identically (issuance and every
- * re-mint produce the record another replica later recovers with), so its
- * builder lives here: PUT on the one `did.jsonl` resource, one-year TTL,
- * delegated to the code-derived signing DID. Its narrow scope is what keeps
- * recovery loud -- a stolen code must extend the world-readable log before it
- * can read anything.
- *
- * Beside the builder lives the re-mint core (`remintRecoveryDelegations`):
- * revoking a client kills, by the current-key-set rule, every `did.jsonl`
- * delegation that client signed, which would brick recovery exactly when it
- * is needed -- and a delegation left standing eventually reaches its own
- * expiry. For each registry entry whose recorded delegation no longer
- * chains (its signing verification method left `capabilityDelegation` in the
- * document) or is expired or inside the renewal window, the acting client
- * signs a fresh delegation to the code's signing DID, re-wraps the
- * record to the code's unlock KAK (the public half the registry records --
- * the record carries no secrets, so re-encryption needs none), re-PUTs it
- * through the entry's management zcap, and updates the registry's
- * `delegationKeyId` and `delegationExpires`. A standing credential's
- * client-annex Space sibling delegation rides the same pass (its scalar pair is
- * `delegatedClientsKeyId` / `delegatedClientsExpires`): either member going
- * stale reseals both, and the one registry rewrite records both fresh pairs
- * -- a re-mint handling only the bridge is incomplete. The skip policy is
- * cross-replica correctness and is
- * decided here once: an entry that predates the re-mint fields, or whose
- * standing record cannot be read or carries no binding, is skipped and stays
- * flagged by the login-time health check. Every entry's fate is reported
- * (`RecordRemintOutcome`), so a record the pass could not reach is named
- * rather than silently left with a rotted bridge. What stays app-side is the
- * seams: the management-zcap client factory, the storage server URL, and the
- * registry read/record halves.
- *
- * The same pass serves the last-client forget ceremony, whose acting signer
- * is the ladder VM rather than an enrolled client: there the rot check runs
- * against the post-install document, in which the client about to be removed
- * still stands, so the ceremony names it as retiring
- * (`retiringKeyMultibases`) and every delegation it signed counts as rotted
- * ahead of the removal entry.
- */
-import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
 import { resourcePath, toUrl } from '@interop/was-client/paths';
-import { log } from '../log.js';
 import { DID_LOG_RESOURCE, ID_COLLECTION } from '../space/collections.js';
-import { getUnlockKeyringWithCapability, putUnlockKeyringWithCapability } from '../keyring/unlockSpace.js';
-import { remintUnlockRecordDelegations, unlockRecordSealedTo } from '../unlock/unlockRecord.js';
-import { delegationProofKeyId, recordedZcapStale, STANDING_ZCAP_TTL_MS } from '../webvh/standingZcap.js';
+import { delegationProofKeyId, STANDING_ZCAP_TTL_MS } from '../webvh/standingZcap.js';
 /**
  * The recovery delegation's lifetime: the house standing-zcap value
  * ({@link STANDING_ZCAP_TTL_MS} -- one year, per NIST SP 800-57's
@@ -153,220 +104,4 @@ export function recordedDelegationFields({ delegation, delegatedClients }) {
 function zcapExpires(zcap) {
     return zcap.expires;
 }
-/**
- * Re-mints the recovery delegations the current document no longer backs --
- * the recovery-code delta riding the revocation cascade (see the module doc
- * for the mechanism and the skip policy).
- *
- * The record's credential-authenticated core is preserved verbatim: the
- * re-mint reads the standing record through the entry's management zcap and
- * replaces only its delegation members
- * ({@link remintUnlockRecordDelegations}) -- the bridge always, and the
- * annex Space sibling where the entry records one (the two rot on one
- * axis, so both reseal in the same atomic pass and one registry-entry
- * rewrite records both fresh pairs). The
- * shell, the ladder member (where one rides), and the binding tag all travel
- * untouched, since the re-mint can decrypt none of them and does not need to.
- * A re-mint therefore can never change the pointer or controller the
- * credential was bound against -- and after a host migration the tag no
- * longer matches the moved pointer, so credentials must be rebound (codes
- * re-issued) when the account moves hosts.
- *
- * The re-mint holds the code's KAK public half but not its signing key, so
- * every record it re-PUTs is signed with the acting client's own account key
- * (`recordSigner`) -- the mixed-signer case a reader settles against the
- * verified did:webvh document.
- *
- * Best-effort per entry: a skipped entry stays flagged by the login-time
- * health check, whose regenerate nudge remains the backstop.
- *
- * @param options {object}
- * @param options.doc {PublishedKeyDocument}   the locally verified did:webvh
- *   document, AFTER the revocation edit
- * @param options.entries {RecoveryDelegationEntry[]}   the registry's
- *   recovery-code entries, as the app's registry read returned them
- * @param options.pointer {AccountPointer}
- * @param options.storageServerUrl {string}   the unlock Spaces' storage server
- * @param options.zcapClient {ZcapClient}   the acting client's promoted
- *   signer, which mints the fresh delegations
- * @param options.recordSigner {RecordSigner}   the acting client's account
- *   key, which signs the re-wrapped records
- * @param options.managementZcapClient {Function}   `({ capability }) =>
- *   ZcapClient` -- the client an entry's management zcap is invoked with
- * @param options.recordEntry {Function}   `({ entry }) => Promise<void>` --
- *   persists one updated registry entry (matching on the app's entry key)
- * @param [options.mintDelegatedClientsDelegation] {Function}   `({ controller })
- *   => Promise<IZcap | undefined>` -- the annex-side mint of a fresh
- *   `delegatedClients` sibling delegation, injected by the caller (the
- *   annex subpath's `delegatedClientsDelegationMinter` builds one over the
- *   verified document); `undefined` when the document points at no
- *   generation, in which case the old sealed member travels verbatim
- * @returns {Promise<{ reminted: number; skipped: number }>}
- */
-export async function remintRecoveryDelegations({ doc, entries, pointer, storageServerUrl, zcapClient, recordSigner, managementZcapClient, recordEntry, mintDelegatedClientsDelegation, retiringKeyMultibases = [], now = Date.now() }) {
-    let reminted = 0;
-    let skipped = 0;
-    const outcomes = [];
-    // The house staleness policy, decided once in `webvh` and asked here over
-    // the scalars a registry entry records: expiry, the current-key-set rule
-    // (a recorded signing key the document no longer lists under
-    // `capabilityDelegation` -- or no recorded key at all -- has rotted), and
-    // the caller's retiring set, which the document still lists only until the
-    // entry that removes those keys lands.
-    const recordedStale = (delegationKeyId, expires) => recordedZcapStale({
-        doc,
-        ...(delegationKeyId ? { delegationKeyId } : {}),
-        ...(expires ? { expires } : {}),
-        retiringKeyMultibases,
-        now
-    });
-    for (const entry of entries) {
-        const stale = recordedStale(entry.delegationKeyId, entry.delegationExpires);
-        // The annex Space sibling, where the entry records one, is checked on the
-        // same axes; either member going stale re-mints BOTH in one atomic pass
-        // (both resealed, one registry-entry rewrite).
-        const siblingRecorded = entry.delegatedClientsKeyId !== undefined ||
-            entry.delegatedClientsExpires !== undefined;
-        const siblingStale = siblingRecorded &&
-            recordedStale(entry.delegatedClientsKeyId, entry.delegatedClientsExpires);
-        if (!stale && !siblingStale) {
-            outcomes.push({
-                label: entry.label,
-                unlockSpaceId: entry.unlockSpaceId,
-                outcome: 'current'
-            });
-            continue;
-        }
-        if (!entry.recoveryClientDid ||
-            !entry.unlockKeyAgreementKeyId ||
-            !entry.unlockKeyAgreementKeyMultibase ||
-            !entry.manageCapability) {
-            // An entry issued before the re-mint fields existed: the health check
-            // keeps flagging it until the code is regenerated.
-            skipped += 1;
-            outcomes.push({
-                label: entry.label,
-                unlockSpaceId: entry.unlockSpaceId,
-                outcome: 'incomplete-entry'
-            });
-            continue;
-        }
-        try {
-            // The standing record, whose credential-authenticated core travels
-            // verbatim (a record with no binding predates the standing layout and
-            // cannot be re-minted -- `remintUnlockRecordDelegations` refuses, and the
-            // entry is skipped into the health check's regenerate nudge).
-            const standing = await getUnlockKeyringWithCapability({
-                storageServerUrl,
-                zcapClient: managementZcapClient({
-                    capability: entry.manageCapability
-                }),
-                spaceId: entry.unlockSpaceId,
-                capability: entry.manageCapability
-            });
-            // The pending-shaped guard: the entry's `unlockSpaceId` and
-            // `manageCapability` name one credential while its identity members
-            // name another -- the state a passphrase change torn before its
-            // retirement leaves. Re-minting here would seal a fresh
-            // current-client-signed bridge for the OLD credential into the NEW
-            // credential's record, re-arming the half-retired credential and
-            // bricking the new one's entry paths. Nothing is written; the next
-            // passphrase login's repair is the mender.
-            if (!unlockRecordSealedTo({
-                record: standing,
-                keyAgreementKeyMultibase: entry.unlockKeyAgreementKeyMultibase
-            })) {
-                log.warn('The unlock record at the Space recorded for this entry is ' +
-                    'sealed to another credential (a passphrase change torn before ' +
-                    'its retirement landed); its delegations are not re-minted', { label: entry.label });
-                skipped += 1;
-                outcomes.push({
-                    label: entry.label,
-                    unlockSpaceId: entry.unlockSpaceId,
-                    outcome: 'pending-entry'
-                });
-                continue;
-            }
-            const delegation = await delegateLogWrite({
-                zcapClient,
-                pointer,
-                recoveryClientDid: entry.recoveryClientDid
-            });
-            // The fresh annex Space sibling, for an entry that records one --
-            // minted through the injected annex-side closure, so this orchestrator
-            // never imports the annex module. A document not (yet) pointing at a
-            // generation (or a caller wiring no minter) leaves nothing to rebuild
-            // the target from, so the old sealed member travels verbatim and the
-            // pair stays stale-flagged for the login-time health check.
-            let delegatedClients;
-            let siblingCarriedVerbatim = false;
-            if (siblingRecorded) {
-                delegatedClients = await mintDelegatedClientsDelegation?.({
-                    controller: entry.recoveryClientDid
-                });
-                if (!delegatedClients) {
-                    siblingCarriedVerbatim = true;
-                    log.warn('The account document names no client-annex generation; the ' +
-                        'delegatedClients delegation for this entry is carried verbatim', { label: entry.label });
-                }
-            }
-            // The credential's unlock KAK, public half only -- exactly enough to
-            // seal the fresh bridge to the same recipient the credential derives
-            // (sealing goes through the encrypt-only cipher, so no secret is
-            // needed).
-            const unlockKak = (await X25519KeyAgreementKey2020.from({
-                id: entry.unlockKeyAgreementKeyId,
-                controller: entry.unlockKeyAgreementKeyId.split('#')[0],
-                type: 'X25519KeyAgreementKey2020',
-                publicKeyMultibase: entry.unlockKeyAgreementKeyMultibase
-            }));
-            const wrapped = await remintUnlockRecordDelegations({
-                record: standing,
-                delegation,
-                ...(delegatedClients ? { delegatedClients } : {}),
-                keyAgreementKey: unlockKak,
-                signer: recordSigner
-            });
-            await putUnlockKeyringWithCapability({
-                storageServerUrl,
-                zcapClient: managementZcapClient({
-                    capability: entry.manageCapability
-                }),
-                spaceId: entry.unlockSpaceId,
-                record: wrapped,
-                capability: entry.manageCapability
-            });
-            await recordEntry({
-                entry: {
-                    ...entry,
-                    ...recordedDelegationFields({
-                        delegation,
-                        ...(delegatedClients ? { delegatedClients } : {})
-                    })
-                }
-            });
-            reminted += 1;
-            outcomes.push({
-                label: entry.label,
-                unlockSpaceId: entry.unlockSpaceId,
-                outcome: 'reminted',
-                ...(siblingCarriedVerbatim ? { siblingCarriedVerbatim } : {})
-            });
-        }
-        catch (err) {
-            log.warn('Could not re-mint the recovery delegation', {
-                label: entry.label,
-                err
-            });
-            skipped += 1;
-            outcomes.push({
-                label: entry.label,
-                unlockSpaceId: entry.unlockSpaceId,
-                outcome: 'failed',
-                error: err
-            });
-        }
-    }
-    return { reminted, skipped, outcomes };
-}
 //# sourceMappingURL=recoveryDelegation.js.map

package/dist/recovery/recoveryDelegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAG7E,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEzE,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,2BAA2B,CAAA;AAElC,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACrB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,wEAAwE;AACxE,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAMjB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,0BAA0B,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED,sEAAsE;AACtE,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EAIjB;IAMC,MAAM,eAAe,GAAG,UAAU;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,MAAM,qBAAqB,GAAG,gBAAgB;QAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;QACxC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,uBAAuB,GAAG,gBAAgB;QAC9C,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAA;IACb,OAAO;QACL,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAW;IAC9B,OAAQ,IAA6B,CAAC,OAAO,CAAA;AAC/C,CAAC;AAwDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAE7C,EACA,GAAG,EACH,OAAO,EACP,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,WAAW,EACX,8BAA8B,EAC9B,qBAAqB,GAAG,EAAE,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAejB;IAKC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,QAAQ,GAA0B,EAAE,CAAA;IAC1C,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,MAAM,aAAa,GAAG,CACpB,eAAmC,EACnC,OAA2B,EAClB,EAAE,CACX,iBAAiB,CAAC;QAChB,GAAG;QACH,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,GAAG;KACJ,CAAC,CAAA;IACJ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,eAAe,GACnB,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,uBAAuB,KAAK,SAAS,CAAA;QAC7C,MAAM,YAAY,GAChB,eAAe;YACf,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,SAAS;aACnB,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IACE,CAAC,KAAK,CAAC,iBAAiB;YACxB,CAAC,KAAK,CAAC,uBAAuB;YAC9B,CAAC,KAAK,CAAC,8BAA8B;YACrC,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;YACD,sEAAsE;YACtE,mDAAmD;YACnD,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,kBAAkB;aAC5B,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,mEAAmE;YACnE,sEAAsE;YACtE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC;gBACpD,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,4DAA4D;YAC5D,oEAAoE;YACpE,gEAAgE;YAChE,wDAAwD;YACxD,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,2CAA2C;YAC3C,IACE,CAAC,oBAAoB,CAAC;gBACpB,MAAM,EAAE,QAAQ;gBAChB,wBAAwB,EAAE,KAAK,CAAC,8BAA8B;aAC/D,CAAC,EACF,CAAC;gBACD,GAAG,CAAC,IAAI,CACN,4DAA4D;oBAC1D,gEAAgE;oBAChE,2DAA2D,EAC7D,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACD,OAAO,IAAI,CAAC,CAAA;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;gBACxC,UAAU;gBACV,OAAO;gBACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC,CAAA;YACF,kEAAkE;YAClE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,4DAA4D;YAC5D,IAAI,gBAAmC,CAAA;YACvC,IAAI,sBAAsB,GAAG,KAAK,CAAA;YAClC,IAAI,eAAe,EAAE,CAAC;gBACpB,gBAAgB,GAAG,MAAM,8BAA8B,EAAE,CAAC;oBACxD,UAAU,EAAE,KAAK,CAAC,iBAAiB;iBACpC,CAAC,CAAA;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,sBAAsB,GAAG,IAAI,CAAA;oBAC7B,GAAG,CAAC,IAAI,CACN,6DAA6D;wBAC3D,gEAAgE,EAClE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAA;gBACH,CAAC;YACH,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,WAAW;YACX,MAAM,SAAS,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,CAAC;gBACtD,EAAE,EAAE,KAAK,CAAC,uBAAuB;gBACjC,UAAU,EAAE,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,EAAE,2BAA2B;gBACjC,kBAAkB,EAAE,KAAK,CAAC,8BAA8B;aACzD,CAAC,CAAqB,CAAA;YACvB,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;gBAClD,MAAM,EAAE,QAAQ;gBAChB,UAAU;gBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,eAAe,EAAE,SAAS;gBAC1B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;YACF,MAAM,8BAA8B,CAAC;gBACnC,gBAAgB;gBAChB,UAAU,EAAE,oBAAoB,CAAC;oBAC/B,UAAU,EAAE,KAAK,CAAC,gBAAgB;iBACnC,CAAC;gBACF,OAAO,EAAE,KAAK,CAAC,aAAa;gBAC5B,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,KAAK,CAAC,gBAAgB;aACnC,CAAC,CAAA;YACF,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,GAAG,wBAAwB,CAAC;wBAC1B,UAAU;wBACV,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAClD,CAAC;iBACH;aACF,CAAC,CAAA;YACF,QAAQ,IAAI,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,UAAU;gBACnB,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG;aACJ,CAAC,CAAA;YACF,OAAO,IAAI,CAAC,CAAA;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"recoveryDelegation.js","sourceRoot":"","sources":["../../src/recovery/recoveryDelegation.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEzE,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAA;AAE9D,wEAAwE;AACxE,2DAA2D;AAC3D,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,EAAE,OAAO,EAA+B;IACzD,OAAO,KAAK,CAAC;QACX,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,OAAO,EACP,iBAAiB,EACjB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAMjB;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;QACzB,gBAAgB,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,UAAU,EAAE,iBAAiB;QAC7B,cAAc,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,0BAA0B,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED,sEAAsE;AACtE,wCAAwC;AACxC,OAAO,EAAE,oBAAoB,EAAE,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,UAAU,EACV,gBAAgB,EAIjB;IAMC,MAAM,eAAe,GAAG,UAAU;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC;QAClC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,iBAAiB,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,MAAM,qBAAqB,GAAG,gBAAgB;QAC5C,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;QACxC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,uBAAuB,GAAG,gBAAgB;QAC9C,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAA;IACb,OAAO;QACL,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAW;IAC9B,OAAQ,IAA6B,CAAC,OAAO,CAAA;AAC/C,CAAC"}