@interop/wallet-core 0.66.0 → 0.68.0

package/dist/recovery/recoveryWebvh.d.ts

@@ -1,91 +1,49 @@
-import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
-import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
-import type { ResourceLogPinStore } from '@interop/vh-resource-log';
-import type { UnlockInventoryPart } from '../unlock/standingWebvh.js';
-import type { AccountLogSigner } from '../webvh/accountEntry.js';
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
 /**
- * What the add-and-retire entry retired, read back OFF THE LOG -- the resumed
- * spend's answer to the same question the live run answers from the document
- * it is editing. A run torn after that entry but before the caller's registry
- * and unlock-Space teardown resumes into the already-complete branch, and
- * without this it would be told nothing was retired and leave every other
- * credential's registry entry standing.
+ * The did:webvh half of recovery-code lifecycle: the split configuration a
+ * code holds as a standing unlock credential that retires on spend. At
+ * issuance the document gains the code's `keyAgreement` verification method
+ * (an ordinary Multikey entry -- deliberately unmarked; a recovery key is
+ * distinguishable structurally, since it appears under `keyAgreement` and
+ * `assertionMethod`/`capabilityDelegation` while every enrolled client also
+ * publishes an invocation relationship, so client listings key on
+ * `capabilityInvocation` and never see it), the code's ladder VM, and its
+ * rung-0 hash in `nextKeyHashes` -- decryption and delegation standing,
+ * update authority latent: rung 0 joins `updateKeys` nowhere, and every key
+ * of the set exists nowhere until the code is typed.
  *
- * The entry is located by its own signature on the log: it is the first entry
- * whose effective `updateKeys` authorize the successor key (the fresh
- * ladder's rung 0 on the transient continuation, the new client's update key
- * on the remembered one), which only that entry writes. What it retired is
- * then the credential-class `keyAgreement` ids its predecessor published and
- * it does not, less the spent code's own id -- the same exclusion the live
- * branch makes, since the caller retires that one by name.
+ * At recovery time the pre-committed rung 0 reveals itself to sign the
+ * self-enrolling continuation, two entries:
  *
- * @param options {object}
- * @param options.log {DIDLog}   the verified account log
- * @param options.did {string}   the account DID the log resolves to
- * @param options.successorKeyMultibase {string}   the update key only the
- *   add-and-retire entry authorizes
- * @param options.spentVmId {string}   the spent code's key-agreement
- *   verification-method id, excluded from the result
- * @returns {string[]}   the retired credentials' key-agreement ids, empty
- *   when no entry authorizes the successor key or it is the genesis entry
- */
-export declare function retiredCredentialVmIdsFromLog({ log, did, successorKeyMultibase, spentVmId }: {
-    log: DIDLog;
-    did: string;
-    successorKeyMultibase: string;
-    spentVmId: string;
-}): string[];
-/**
- * The verification-method id a code's key-agreement key publishes under --
- * the ordinary `<did>#<multibase>` form, indistinguishable by id from any
- * other keyAgreement entry. Consumers that must exclude recovery entries do
- * it structurally (an enrolled client is a `capabilityInvocation` entry; a
- * recovery key never has one) or by the registry's recorded multibase.
+ * 1. **Reveal + commit**: rung 0 joins `updateKeys` (its hash stands
+ *    committed since issuance, which is what makes the entry verify -- the
+ *    ordinary ladder reveal) and `nextKeyHashes` extends with the NEW
+ *    ordinary client's update- and staged-key hashes plus the replacement
+ *    code's rung-0 hash.
+ * 2. **Add + retire**: signed by the new client's update key (revealed from
+ *    the commit), this entry publishes the new client's verification methods
+ *    and update key, removes the spent code's `keyAgreement` VM and its
+ *    ladder VM (with every other standing credential's, by the relation
+ *    asymmetry), publishes the replacement code's inventory, and drops the
+ *    spent code's revealed rung and its hash -- so no recovery authority
+ *    stands afterwards.
  *
- * @param options {object}
- * @param options.did {string}   the account's did:webvh
- * @param options.keyAgreementKeyMultibase {string}
- * @returns {string}
- */
-export declare function recoveryVmId({ did, keyAgreementKeyMultibase }: {
-    did: string;
-    keyAgreementKeyMultibase: string;
-}): string;
-/**
- * The public halves of a recovery code as the document and log carry them:
- * the X25519 key-agreement key published as the recovery VM, and the update
- * key whose hash stands in `nextKeyHashes`.
- */
-export interface RecoveryPublicKeys {
-    keyAgreementKeyMultibase: string;
-    updateKeyMultibase: string;
-}
-/**
- * The public halves a SPEND needs of the replacement code it publishes: the
- * two above plus the code's ladder VM key, which the add-and-retire entry
- * installs under `assertionMethod` and `capabilityDelegation`. A code is a
- * standing unlock credential with a ladder (`decisions/0020`) and its bridge
- * delegation is signed by that ladder's VM (`decisions/0019`), so a
- * replacement published without the VM could neither sign its own bridge nor
- * spend. `recoveryClientFromCode` produces all three.
- */
-export interface ReplacementRecoveryPublicKeys extends RecoveryPublicKeys {
-    ladderVmKeyMultibase: string;
-}
-/**
- * Thrown by the recovery continuation when the log carries neither the code's
- * update key nor its committed hash -- the code was revoked (or never
- * issued), so no continuation can verify.
+ * Both entries are written through the caller's store seam; the recovery
+ * continuation publishes ONLY `did.jsonl` (the delegation the record carries
+ * covers nothing else -- narrow scope preserves loudness), and hands back the
+ * final `webDoc` so the recovered session can republish `did.json` once it is
+ * the authorized controller. Every step is idempotent/resumable: re-running
+ * with the same key material converges without forking the log.
  */
-export declare class RecoveryKeyNotCommittedError extends Error {
-    constructor(message?: string);
-}
-/**
- * The narrow store seam the recovery continuation writes through: a public
- * read of the log and the delegated `did.jsonl` PUT. A subset of
- * {@link WebvhIdStore}, so an app's remote-store class satisfies it too.
- */
-export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
+import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
+import type { ClientWebvhUpdateKeys, WebvhEnrollmentKeys, WebvhIdStore } from '../webvh/didWebvh.js';
+import type { UnlockInventoryPart } from '../unlock/standingWebvh.js';
+import type { AccountLogSigner } from '../webvh/accountEntry.js';
+import type { RecoveryLogStore, RecoveryPublicKeys, ReplacementRecoveryPublicKeys } from './continuation.js';
+export { RecoveryCredentialStandingError, RecoveryKeyNotCommittedError, recoveryVmId, retiredCredentialVmIdsFromLog } from './continuation.js';
+export type { RecoveryLogStore, RecoveryPublicKeys, ReplacementRecoveryPublicKeys } from './continuation.js';
 /**
  * ISSUANCE: publishes a recovery code's split configuration into the
  * document -- the code's `keyAgreement` verification method (an ordinary,
@@ -115,25 +73,20 @@ export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdRes
  * @param [options.part] {string}   `'all'` (the default), `'key'`, or
  *   `'authority'` -- see above
  * @param [options.expectedDid] {string}   the account DID the log must
- *   resolve to, from the caller's stored account pointer
- * @param [options.pinStore] {ResourceLogPinStore}   the caller's chain-head
- *   pins; a served log that is a rollback, a fork, or an identity switch
- *   against the pinned head is refused (`ResourceLogContinuityError`)
- * @param [options.logId] {string}   the account log's pin slot
- *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
- *   supplied
+ *   resolve to, from the caller's stored account pointer. The read runs under
+ *   the store's own chain-head pin: a served log that is a rollback, a fork,
+ *   or an identity switch against the pinned head is refused
+ *   (`ResourceLogContinuityError`)
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   the account
  *   DID and the document and log as this call leaves them
  */
-export declare function publishRecoveryKey({ idStore, signer, recovery, ladderSeed, part, expectedDid, pinStore, logId }: {
+export declare function publishRecoveryKey({ idStore, signer, recovery, ladderSeed, part, expectedDid }: {
     idStore: WebvhIdStore;
     signer: AccountLogSigner;
     recovery: RecoveryPublicKeys;
     ladderSeed: Uint8Array;
     part?: UnlockInventoryPart;
     expectedDid?: string;
-    pinStore?: ResourceLogPinStore;
-    logId?: string;
 }): Promise<{
     did: string;
     doc: DIDDoc;
@@ -169,15 +122,13 @@ export declare function publishRecoveryKey({ idStore, signer, recovery, ladderSe
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}   see
  *   {@link publishRecoveryKey}
  */
-export declare function removeRecoveryKey({ idStore, signer, recovery, ladderSeed, projectionStore, expectedDid, pinStore, logId }: {
+export declare function removeRecoveryKey({ idStore, signer, recovery, ladderSeed, projectionStore, expectedDid }: {
     idStore: WebvhIdStore;
     signer: AccountLogSigner;
     recovery: RecoveryPublicKeys;
     ladderSeed?: Uint8Array;
     projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     expectedDid?: string;
-    pinStore?: ResourceLogPinStore;
-    logId?: string;
 }): Promise<{
     did: string;
     doc: DIDDoc;
@@ -241,15 +192,11 @@ export declare function removeRecoveryKey({ idStore, signer, recovery, ladderSee
  *   `nextKeyHashes` exactly as on the self-enrollment seam (keys of a lost
  *   random seed; nothing can reveal them)
  * @param [options.expectedDid] {string}   the account DID the log must resolve
- *   to, where the recovering flow already knows it
- * @param [options.pinStore] {ResourceLogPinStore}   this caller's chain-head
- *   pins; every read both entries are built on is checked against the pinned
- *   head (a served prefix is refused before the reveal entry lands, not only
- *   by a verify that follows both entries), and the pin advances to each
- *   entry as it publishes
- * @param [options.logId] {string}   the account log's pin slot
- *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
- *   supplied
+ *   to, where the recovering flow already knows it. Every read both entries
+ *   are built on is checked against the store's own chain-head pin (a served
+ *   prefix is refused before the reveal entry lands, not only by a verify
+ *   that follows both entries), and the pin advances to each entry as it
+ *   publishes
  * @returns {Promise<object>}
  *   the account DID, the final `did.json` projection when the add-and-retire
  *   entry ran here, and `committed` -- whether THIS call published the pivot
@@ -280,8 +227,6 @@ export declare function recoverWebvhClient(options: {
         };
     }) => Promise<void>;
     expectedDid?: string;
-    pinStore?: ResourceLogPinStore;
-    logId?: string;
 }): Promise<{
     did: string;
     webDoc?: object;

package/dist/recovery/recoveryWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EAEP,MAAM,2BAA2B,CAAA;AAclC,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAehE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACH,qBAAqB,EACrB,SAAS,EACV,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,qBAAqB,EAAE,MAAM,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,EAAE,CAmBX;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,6BAA8B,SAAQ,kBAAkB;IACvE,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,CACrC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,WAAW,EACX,QAAQ,EACR,KAAK,EACN,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,6BAA6B,CAAA;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC,CAAC,CAmBD"}
+{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAM/D,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAEhE,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAI1B,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,YAAY,EACZ,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAerD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,6BAA6B,CAAA;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC,CAAC,CAiED"}