@interop/wallet-core 0.69.0 → 0.71.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +22 -36
- package/dist/clientAnnex/ladder.d.ts +103 -57
- package/dist/clientAnnex/ladder.d.ts.map +1 -1
- package/dist/clientAnnex/ladder.js +254 -335
- package/dist/clientAnnex/ladder.js.map +1 -1
- package/dist/clientAnnex/ladderAnchored.d.ts.map +1 -1
- package/dist/clientAnnex/ladderAnchored.js +10 -5
- package/dist/clientAnnex/ladderAnchored.js.map +1 -1
- package/dist/clientAnnex/recoveryLadderAnchored.d.ts +3 -15
- package/dist/clientAnnex/recoveryLadderAnchored.d.ts.map +1 -1
- package/dist/clientAnnex/recoveryLadderAnchored.js +22 -3
- package/dist/clientAnnex/recoveryLadderAnchored.js.map +1 -1
- package/dist/clientAnnex/selfEnroll.js +1 -1
- package/dist/clientAnnex/selfEnroll.js.map +1 -1
- package/dist/clientAnnex/zcap.js +1 -1
- package/dist/clientAnnex/zcap.js.map +1 -1
- package/dist/clients/grantState.d.ts +67 -0
- package/dist/clients/grantState.d.ts.map +1 -0
- package/dist/clients/grantState.js +72 -0
- package/dist/clients/grantState.js.map +1 -0
- package/dist/clients/index.d.ts +7 -0
- package/dist/clients/index.d.ts.map +1 -1
- package/dist/clients/index.js +6 -0
- package/dist/clients/index.js.map +1 -1
- package/dist/enrollment/connectCode.d.ts +4 -3
- package/dist/enrollment/connectCode.d.ts.map +1 -1
- package/dist/enrollment/connectCode.js +4 -3
- package/dist/enrollment/connectCode.js.map +1 -1
- package/dist/enrollment/enrollment.js +1 -1
- package/dist/enrollment/enrollment.js.map +1 -1
- package/dist/enrollment/index.d.ts +2 -2
- package/dist/enrollment/index.js +2 -2
- package/dist/enrollment/onboardingInvite.d.ts +1 -1
- package/dist/enrollment/onboardingInvite.js +1 -1
- package/dist/enrollment/onboardingResponse.js +1 -1
- package/dist/index.d.ts +4 -11
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -11
- package/dist/index.js.map +1 -1
- package/dist/keyring/index.d.ts +1 -1
- package/dist/keyring/index.js +1 -1
- package/dist/keyring/kdf.d.ts +34 -20
- package/dist/keyring/kdf.d.ts.map +1 -1
- package/dist/keyring/kdf.js +37 -26
- package/dist/keyring/kdf.js.map +1 -1
- package/dist/keys/userKey.js +1 -1
- package/dist/keys/userKey.js.map +1 -1
- package/dist/recovery/continuation.d.ts +5 -4
- package/dist/recovery/continuation.d.ts.map +1 -1
- package/dist/recovery/continuation.js +14 -13
- package/dist/recovery/continuation.js.map +1 -1
- package/dist/resourceLog/document.d.ts +10 -2
- package/dist/resourceLog/document.d.ts.map +1 -1
- package/dist/resourceLog/document.js +1 -2
- package/dist/resourceLog/document.js.map +1 -1
- package/dist/space/index.d.ts +4 -2
- package/dist/space/index.d.ts.map +1 -1
- package/dist/space/index.js +4 -2
- package/dist/space/index.js.map +1 -1
- package/dist/space/wasLink.d.ts +13 -2
- package/dist/space/wasLink.d.ts.map +1 -1
- package/dist/space/wasLink.js +28 -2
- package/dist/space/wasLink.js.map +1 -1
- package/dist/unlock/index.d.ts +1 -1
- package/dist/unlock/index.d.ts.map +1 -1
- package/dist/unlock/index.js.map +1 -1
- package/dist/unlock/standingClient.d.ts +1 -1
- package/dist/unlock/standingClient.d.ts.map +1 -1
- package/dist/unlock/standingClient.js +3 -3
- package/dist/unlock/standingClient.js.map +1 -1
- package/dist/unlock/standingWebvh.d.ts +81 -19
- package/dist/unlock/standingWebvh.d.ts.map +1 -1
- package/dist/unlock/standingWebvh.js +170 -30
- package/dist/unlock/standingWebvh.js.map +1 -1
- package/dist/webvh/did.d.ts +2 -4
- package/dist/webvh/did.d.ts.map +1 -1
- package/dist/webvh/did.js +2 -4
- package/dist/webvh/did.js.map +1 -1
- package/dist/webvh/didWebvh.d.ts +3 -2
- package/dist/webvh/didWebvh.d.ts.map +1 -1
- package/dist/webvh/didWebvh.js +2 -1
- package/dist/webvh/didWebvh.js.map +1 -1
- package/dist/webvh/index.d.ts +1 -1
- package/dist/webvh/index.js +1 -1
- package/dist/webvh/revokeClient.d.ts +13 -7
- package/dist/webvh/revokeClient.d.ts.map +1 -1
- package/dist/webvh/revokeClient.js +14 -7
- package/dist/webvh/revokeClient.js.map +1 -1
- package/dist/webvh/zcap.js +1 -1
- package/dist/webvh/zcap.js.map +1 -1
- package/package.json +2 -23
- package/dist/identity/agents.d.ts +0 -100
- package/dist/identity/agents.d.ts.map +0 -1
- package/dist/identity/agents.js +0 -120
- package/dist/identity/agents.js.map +0 -1
- package/dist/identity/index.d.ts +0 -24
- package/dist/identity/index.d.ts.map +0 -1
- package/dist/identity/index.js +0 -23
- package/dist/identity/index.js.map +0 -1
- package/dist/identity/keyResolver.d.ts +0 -30
- package/dist/identity/keyResolver.d.ts.map +0 -1
- package/dist/identity/keyResolver.js +0 -25
- package/dist/identity/keyResolver.js.map +0 -1
- package/dist/request/appKey.d.ts +0 -295
- package/dist/request/appKey.d.ts.map +0 -1
- package/dist/request/appKey.js +0 -516
- package/dist/request/appKey.js.map +0 -1
- package/dist/request/capabilityRequest.d.ts +0 -41
- package/dist/request/capabilityRequest.d.ts.map +0 -1
- package/dist/request/capabilityRequest.js +0 -46
- package/dist/request/capabilityRequest.js.map +0 -1
- package/dist/request/classify.d.ts +0 -226
- package/dist/request/classify.d.ts.map +0 -1
- package/dist/request/classify.js +0 -416
- package/dist/request/classify.js.map +0 -1
- package/dist/request/composeVp.d.ts +0 -52
- package/dist/request/composeVp.d.ts.map +0 -1
- package/dist/request/composeVp.js +0 -176
- package/dist/request/composeVp.js.map +0 -1
- package/dist/request/ephemeralExchange.d.ts +0 -100
- package/dist/request/ephemeralExchange.d.ts.map +0 -1
- package/dist/request/ephemeralExchange.js +0 -230
- package/dist/request/ephemeralExchange.js.map +0 -1
- package/dist/request/exchangeClient.d.ts +0 -142
- package/dist/request/exchangeClient.d.ts.map +0 -1
- package/dist/request/exchangeClient.js +0 -241
- package/dist/request/exchangeClient.js.map +0 -1
- package/dist/request/index.d.ts +0 -59
- package/dist/request/index.d.ts.map +0 -1
- package/dist/request/index.js +0 -59
- package/dist/request/index.js.map +0 -1
- package/dist/request/interactionRequest.d.ts +0 -23
- package/dist/request/interactionRequest.d.ts.map +0 -1
- package/dist/request/interactionRequest.js +0 -46
- package/dist/request/interactionRequest.js.map +0 -1
- package/dist/request/interactionUrl.d.ts +0 -42
- package/dist/request/interactionUrl.d.ts.map +0 -1
- package/dist/request/interactionUrl.js +0 -104
- package/dist/request/interactionUrl.js.map +0 -1
- package/dist/request/matching.d.ts +0 -95
- package/dist/request/matching.d.ts.map +0 -1
- package/dist/request/matching.js +0 -205
- package/dist/request/matching.js.map +0 -1
- package/dist/request/onboarding.d.ts +0 -94
- package/dist/request/onboarding.d.ts.map +0 -1
- package/dist/request/onboarding.js +0 -167
- package/dist/request/onboarding.js.map +0 -1
- package/dist/request/parse.d.ts +0 -63
- package/dist/request/parse.d.ts.map +0 -1
- package/dist/request/parse.js +0 -153
- package/dist/request/parse.js.map +0 -1
- package/dist/request/presentationSuite.d.ts +0 -71
- package/dist/request/presentationSuite.d.ts.map +0 -1
- package/dist/request/presentationSuite.js +0 -143
- package/dist/request/presentationSuite.js.map +0 -1
- package/dist/request/processRequest.d.ts +0 -45
- package/dist/request/processRequest.d.ts.map +0 -1
- package/dist/request/processRequest.js +0 -147
- package/dist/request/processRequest.js.map +0 -1
- package/dist/request/queryPredicates.d.ts +0 -98
- package/dist/request/queryPredicates.d.ts.map +0 -1
- package/dist/request/queryPredicates.js +0 -107
- package/dist/request/queryPredicates.js.map +0 -1
- package/dist/request/types.d.ts +0 -257
- package/dist/request/types.d.ts.map +0 -1
- package/dist/request/types.js +0 -2
- package/dist/request/types.js.map +0 -1
- package/dist/request/walletInput.d.ts +0 -93
- package/dist/request/walletInput.d.ts.map +0 -1
- package/dist/request/walletInput.js +0 -179
- package/dist/request/walletInput.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACxD,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA"}
|
package/dist/clients/index.js
CHANGED
|
@@ -13,6 +13,11 @@
|
|
|
13
13
|
* set widened by the document's ladder VMs, the allowlist a re-minted
|
|
14
14
|
* unlock or recovery record's proof is settled against. All take an
|
|
15
15
|
* already-verified log in place of fetching one.
|
|
16
|
+
* - `deriveGrantSignerState` -- the grant-state check a connected-apps
|
|
17
|
+
* surface runs over a recorded delegation's signer against that key set:
|
|
18
|
+
* active, orphaned (an enrolled client the account struck), or unknown
|
|
19
|
+
* (nothing to check against, or a client-annex per-visit signer the
|
|
20
|
+
* document never lists).
|
|
16
21
|
* - `disconnectEligibility` / `revokedClientKeysFor` / `cascadeCompletion` --
|
|
17
22
|
* the disconnect-eligibility policy as data and pure functions, so both
|
|
18
23
|
* surfaces refuse the same rows for the same reasons and report a partial
|
|
@@ -29,6 +34,7 @@
|
|
|
29
34
|
* the roster log's seal).
|
|
30
35
|
*/
|
|
31
36
|
export { currentAccountRecordSigners, currentAccountSigningKeys, listAccountClients } from './listing.js';
|
|
37
|
+
export { deriveGrantSignerState } from './grantState.js';
|
|
32
38
|
export { cascadeCompletion, disconnectEligibility, revokedClientKeysFor } from './policy.js';
|
|
33
39
|
export { revokeAccountClient } from './revocation.js';
|
|
34
40
|
export { checkUserKeyRosterAtLogin, convergeUserKeyRosterToAccount } from './rosterPolicy.js';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AAOrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAGxD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAQrD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA"}
|
|
@@ -7,9 +7,10 @@
|
|
|
7
7
|
*
|
|
8
8
|
* It is a leaf module deliberately. Recognizing a connect code is something a
|
|
9
9
|
* paste box or a QR scanner does long before any ceremony machinery is
|
|
10
|
-
* involved
|
|
11
|
-
*
|
|
12
|
-
*
|
|
10
|
+
* involved: {@link isConnectCode} is the recognizer a wallet hands
|
|
11
|
+
* `@interop/wallet-request`'s input classifier for its `connect-code` branch,
|
|
12
|
+
* and importing it here pulls in none of the enrollment ceremony's graph --
|
|
13
|
+
* while there is still exactly one spelling of the prefix in the codebase.
|
|
13
14
|
*/
|
|
14
15
|
/**
|
|
15
16
|
* The connect-code prefix; the payload after it is base64url(JSON) of an
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connectCode.d.ts","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"connectCode.d.ts","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}
|
|
@@ -7,9 +7,10 @@
|
|
|
7
7
|
*
|
|
8
8
|
* It is a leaf module deliberately. Recognizing a connect code is something a
|
|
9
9
|
* paste box or a QR scanner does long before any ceremony machinery is
|
|
10
|
-
* involved
|
|
11
|
-
*
|
|
12
|
-
*
|
|
10
|
+
* involved: {@link isConnectCode} is the recognizer a wallet hands
|
|
11
|
+
* `@interop/wallet-request`'s input classifier for its `connect-code` branch,
|
|
12
|
+
* and importing it here pulls in none of the enrollment ceremony's graph --
|
|
13
|
+
* while there is still exactly one spelling of the prefix in the codebase.
|
|
13
14
|
*/
|
|
14
15
|
/**
|
|
15
16
|
* The connect-code prefix; the payload after it is base64url(JSON) of an
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connectCode.js","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"connectCode.js","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAA;AACpD,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { decodeMultikey, MultikeyCodec } from '@interop/data-integrity-core/multihash';
|
|
2
2
|
import { base64urlnopad } from '@scure/base';
|
|
3
|
-
import { agentsFromSeed } from '
|
|
3
|
+
import { agentsFromSeed } from '@interop/was-client/identity';
|
|
4
4
|
import { keyAgreementTwinMultibase, mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
|
|
5
5
|
import { enrollWebvhClient } from '../webvh/enrollClient.js';
|
|
6
6
|
import { clientSigningKeyMultibase, isWebvhDid, webvhZcapClient } from '../webvh/zcap.js';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,cAAc,EACd,aAAa,EACd,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,cAAc,EACd,aAAa,EACd,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAO5D,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AACrE,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AAGpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAS9B;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YACE,OAAO,GAAG,6DAA6D;QACrE,oDAAoD;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB,CAAC,EAC7B,KAAK,EACL,MAAM,EACN,aAAa,EACb,IAAI,EAML;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,CAAC;QACH,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,EAAE;YAC/D,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,OAAO,EAGR;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IACvE,OAAO,GAAG,mBAAmB,GAAG,cAAc,CAAC,MAAM,CACnD,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAClC,EAAE,CAAA;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,IAAI,EAGL;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACjE,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EACJ,CAAC,EACD,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAAE,SAAS,EAC7B,wBAAwB,EACzB,GAAG,MAAiC,CAAA;IACrC,IAAI,CAAC,KAAK,oBAAoB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,qBAAqB,CAAC;YACzC,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,aAAa;SACpB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,aAAa,CAAC,UAAU;YACvC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;QACF,kBAAkB,EAAE,qBAAqB,CAAC;YACxC,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,YAAY;SACnB,CAAC;QACF,wBAAwB,EAAE,qBAAqB,CAAC;YAC9C,KAAK,EAAE,wBAAwB;YAC/B,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,IAAI,EAAE,mBAAmB;SAC1B,CAAC;KACH,CAAA;IACD,6BAA6B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1C,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,OAAO,EAGR;IACC,MAAM,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAA;IACjE,IACE,wBAAwB;QACxB,yBAAyB,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,qEAAqE;YACrE,yDAAyD,CAC5D,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EAGR;IACC,OAAO,WAAW,OAAO,CAAC,mBAAmB,EAAE,CAAA;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,OAAO,EAGR;IACC,OAAO,kBAAkB,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAMzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,eAAe,GAAG,yBAAyB,EAAE,CAAA;IACnD,MAAM,OAAO,GAAsB;QACjC,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC5D,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IACD,OAAO;QACL,UAAU;QACV,eAAe;QACf,IAAI,EAAE,uBAAuB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1C,SAAS,EAAE,QAAQ,CAAC,EAAE;KACvB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EAOR;IACC,2EAA2E;IAC3E,2EAA2E;IAC3E,yBAAyB;IACzB,6BAA6B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE1C,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CACxB,yBAAyB,CAAC;QACxB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE;YACT,EAAE,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,CAAC;YACvC,kBAAkB,EAAE,OAAO,CAAC,wBAAwB;SACrD;QACD,oBAAoB,EAAE,qBAAqB;KAC5C,CAAC,CAAA;IAEJ,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAC3C,OAAO;QACP,MAAM;QACN,SAAS,EAAE,OAAO;KACnB,CAAC,CAAA;IAEF,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,mBAAmB,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QAClE,MAAM,MAAM,EAAE,CAAA;IAChB,CAAC;IACD,OAAO;QACL,GAAG;QACH,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC3C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EAMnB;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,4BAA4B,CAC/B,CAAA;IACH,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IAEF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,gBAAgB,CAAC;YAChC,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,EAAE,CAAA;QACpC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC;QACzC,IAAI,EAAE,eAAe,CAAC,UAAU;KACjC,CAAC,CAAA;IACF,MAAM,QAAQ,GACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB,CACzD,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACxD,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,eAAe;KACvC,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAA;AACrE,CAAC"}
|
|
@@ -19,11 +19,11 @@
|
|
|
19
19
|
* - `encodeOnboardingResponse` / `parseOnboardingResponse` -- the onboarding-
|
|
20
20
|
* response envelope, the transport that carries a connect code (verbatim)
|
|
21
21
|
* plus a suggested display label back over an exchange whose request asked
|
|
22
|
-
* with a `WalletOnboardingQuery` (`@interop/wallet-
|
|
22
|
+
* with a `WalletOnboardingQuery` (`@interop/wallet-request`).
|
|
23
23
|
* - `ONBOARDING_INVITE_TTL_MS` -- how long a wallet offers an invite for. The
|
|
24
24
|
* invite's transport (creating the ephemeral exchange that carries the
|
|
25
25
|
* query, polling it until the envelope arrives) is the generic requester in
|
|
26
|
-
* `@interop/wallet-
|
|
26
|
+
* `@interop/wallet-request` (`createEphemeralExchange` /
|
|
27
27
|
* `pollEphemeralExchange`).
|
|
28
28
|
* - `completeEnrollmentCore` -- the enrollee's half: verify from the published
|
|
29
29
|
* log, read the roster, hand back the user key and the epoch to pin. Persisting
|
package/dist/enrollment/index.js
CHANGED
|
@@ -19,11 +19,11 @@
|
|
|
19
19
|
* - `encodeOnboardingResponse` / `parseOnboardingResponse` -- the onboarding-
|
|
20
20
|
* response envelope, the transport that carries a connect code (verbatim)
|
|
21
21
|
* plus a suggested display label back over an exchange whose request asked
|
|
22
|
-
* with a `WalletOnboardingQuery` (`@interop/wallet-
|
|
22
|
+
* with a `WalletOnboardingQuery` (`@interop/wallet-request`).
|
|
23
23
|
* - `ONBOARDING_INVITE_TTL_MS` -- how long a wallet offers an invite for. The
|
|
24
24
|
* invite's transport (creating the ephemeral exchange that carries the
|
|
25
25
|
* query, polling it until the envelope arrives) is the generic requester in
|
|
26
|
-
* `@interop/wallet-
|
|
26
|
+
* `@interop/wallet-request` (`createEphemeralExchange` /
|
|
27
27
|
* `pollEphemeralExchange`).
|
|
28
28
|
* - `completeEnrollmentCore` -- the enrollee's half: verify from the published
|
|
29
29
|
* log, read the roster, hand back the user key and the epoch to pin. Persisting
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
/**
|
|
5
5
|
* The wallet-onboarding invite's one policy constant. The invite's transport
|
|
6
6
|
* is the generic ephemeral-exchange requester in
|
|
7
|
-
* `@interop/wallet-
|
|
7
|
+
* `@interop/wallet-request` (`createEphemeralExchange` /
|
|
8
8
|
* `pollEphemeralExchange`); what stays here is how long a wallet offers the
|
|
9
9
|
* invite for.
|
|
10
10
|
*/
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
/**
|
|
5
5
|
* The wallet-onboarding invite's one policy constant. The invite's transport
|
|
6
6
|
* is the generic ephemeral-exchange requester in
|
|
7
|
-
* `@interop/wallet-
|
|
7
|
+
* `@interop/wallet-request` (`createEphemeralExchange` /
|
|
8
8
|
* `pollEphemeralExchange`); what stays here is how long a wallet offers the
|
|
9
9
|
* invite for.
|
|
10
10
|
*/
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
/**
|
|
5
5
|
* The onboarding-response envelope: what a fresh wallet (the enrollee) POSTs
|
|
6
6
|
* back to an ephemeral exchange whose request carried a
|
|
7
|
-
* `WalletOnboardingQuery` (`@interop/wallet-
|
|
7
|
+
* `WalletOnboardingQuery` (`@interop/wallet-request`). It is transport
|
|
8
8
|
* vocabulary only -- the enrollment ceremony is untouched.
|
|
9
9
|
*
|
|
10
10
|
* The envelope carries an ordinary connect code VERBATIM as its payload, so
|
package/dist/index.d.ts
CHANGED
|
@@ -7,13 +7,6 @@
|
|
|
7
7
|
*
|
|
8
8
|
* - `@interop/wallet-core/sync` -- the WAS replication engine core.
|
|
9
9
|
* - `@interop/wallet-core/space` -- the wallet Space layout contract.
|
|
10
|
-
* - `@interop/wallet-core/identity` -- the WAS identity derivation
|
|
11
|
-
* (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
|
|
12
|
-
* apps must perform byte-for-byte identically.
|
|
13
|
-
* - `@interop/wallet-core/request` -- wallet-request / exchange protocol
|
|
14
|
-
* handling (classification and parsing, QueryByExample matching, cryptosuite
|
|
15
|
-
* negotiation, VP composition, the VC-API exchange client, and VCALM
|
|
16
|
-
* `interaction:` URL handling).
|
|
17
10
|
* - `@interop/wallet-core/webvh` -- the account's did:webvh identity: the
|
|
18
11
|
* hosted DID log, its per-client update-key rotation, the client enrollment
|
|
19
12
|
* entries, and ZCap signing under the did:webvh verification-method id.
|
|
@@ -40,10 +33,10 @@
|
|
|
40
33
|
* re-implementing its swallow.
|
|
41
34
|
*
|
|
42
35
|
* This root re-exports `sync` and `space` for convenience. `identity`,
|
|
43
|
-
* `
|
|
44
|
-
*
|
|
45
|
-
*
|
|
46
|
-
*
|
|
36
|
+
* `webvh`, `keys`, `descriptors`, `keyring`, `enrollment`, and `recovery`
|
|
37
|
+
* are deliberately NOT re-exported here, so plaintext consumers of the root
|
|
38
|
+
* never pull the signing / KMS dependency graph (the was-client
|
|
39
|
+
* subpath-isolation pattern).
|
|
47
40
|
*/
|
|
48
41
|
export * from './sync/index.js';
|
|
49
42
|
export * from './space/index.js';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACnD,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}
|
package/dist/index.js
CHANGED
|
@@ -7,13 +7,6 @@
|
|
|
7
7
|
*
|
|
8
8
|
* - `@interop/wallet-core/sync` -- the WAS replication engine core.
|
|
9
9
|
* - `@interop/wallet-core/space` -- the wallet Space layout contract.
|
|
10
|
-
* - `@interop/wallet-core/identity` -- the WAS identity derivation
|
|
11
|
-
* (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
|
|
12
|
-
* apps must perform byte-for-byte identically.
|
|
13
|
-
* - `@interop/wallet-core/request` -- wallet-request / exchange protocol
|
|
14
|
-
* handling (classification and parsing, QueryByExample matching, cryptosuite
|
|
15
|
-
* negotiation, VP composition, the VC-API exchange client, and VCALM
|
|
16
|
-
* `interaction:` URL handling).
|
|
17
10
|
* - `@interop/wallet-core/webvh` -- the account's did:webvh identity: the
|
|
18
11
|
* hosted DID log, its per-client update-key rotation, the client enrollment
|
|
19
12
|
* entries, and ZCap signing under the did:webvh verification-method id.
|
|
@@ -40,10 +33,10 @@
|
|
|
40
33
|
* re-implementing its swallow.
|
|
41
34
|
*
|
|
42
35
|
* This root re-exports `sync` and `space` for convenience. `identity`,
|
|
43
|
-
* `
|
|
44
|
-
*
|
|
45
|
-
*
|
|
46
|
-
*
|
|
36
|
+
* `webvh`, `keys`, `descriptors`, `keyring`, `enrollment`, and `recovery`
|
|
37
|
+
* are deliberately NOT re-exported here, so plaintext consumers of the root
|
|
38
|
+
* never pull the signing / KMS dependency graph (the was-client
|
|
39
|
+
* subpath-isolation pattern).
|
|
47
40
|
*/
|
|
48
41
|
export * from './sync/index.js';
|
|
49
42
|
export * from './space/index.js';
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}
|
package/dist/keyring/index.d.ts
CHANGED
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
* app's caching, pinning, and client-key persistence wrap around it.
|
|
34
34
|
*
|
|
35
35
|
* Kept out of the root export: this subpath pulls the webkms-client / ezcap /
|
|
36
|
-
* was-client dependency graph (the same isolation pattern as `./
|
|
36
|
+
* was-client dependency graph (the same isolation pattern as `./webvh`).
|
|
37
37
|
*/
|
|
38
38
|
export { deriveUnlockIdentity, deriveUnlockSeed, unlockIdentityFromSeed, KEYRING_KDF, UNLOCK_HANDLE, UNLOCK_KEY_NAME, unlockSpaceIdFor } from './kdf.js';
|
|
39
39
|
export type { UnlockIdentity, UnlockKdf } from './kdf.js';
|
package/dist/keyring/index.js
CHANGED
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
* app's caching, pinning, and client-key persistence wrap around it.
|
|
34
34
|
*
|
|
35
35
|
* Kept out of the root export: this subpath pulls the webkms-client / ezcap /
|
|
36
|
-
* was-client dependency graph (the same isolation pattern as `./
|
|
36
|
+
* was-client dependency graph (the same isolation pattern as `./webvh`).
|
|
37
37
|
*/
|
|
38
38
|
export { deriveUnlockIdentity, deriveUnlockSeed, unlockIdentityFromSeed, KEYRING_KDF, UNLOCK_HANDLE, UNLOCK_KEY_NAME, unlockSpaceIdFor } from './kdf.js';
|
|
39
39
|
export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, RecordProofError, recordProofKeyMultibase, recordSealCipher, recordSignerFromAgent, signRecordFrame, unwrapKeyringRecord, verifyRecordProof, wrapKeyringRecord } from './record.js';
|
package/dist/keyring/kdf.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { CapabilityAgent } from '@interop/webkms-client';
|
|
2
|
-
import type { ProfileAgents } from '
|
|
2
|
+
import type { ProfileAgents } from '@interop/was-client/identity';
|
|
3
3
|
import type { RecordSigner } from './record.js';
|
|
4
4
|
/**
|
|
5
5
|
* The load-bearing `CapabilityAgent` derivation names for an unlock identity
|
|
@@ -10,18 +10,24 @@ import type { RecordSigner } from './record.js';
|
|
|
10
10
|
export declare const UNLOCK_HANDLE = "unlock";
|
|
11
11
|
export declare const UNLOCK_KEY_NAME = "unlock-key";
|
|
12
12
|
/**
|
|
13
|
-
* Unlock-derivation parameters, one variant per KDF family:
|
|
14
|
-
* a low-entropy passphrase; HKDF expands
|
|
15
|
-
* passkey PRF output). Each unlock method
|
|
16
|
-
* its own salt, so two methods can never
|
|
17
|
-
* The `version`
|
|
18
|
-
*
|
|
13
|
+
* Unlock-derivation parameters, one variant per KDF family: Argon2id
|
|
14
|
+
* (memory-hard) stretches a low-entropy passphrase; HKDF expands
|
|
15
|
+
* already-uniform key material (e.g. a passkey PRF output). Each unlock method
|
|
16
|
+
* pins its own parameter set -- and its own salt, so two methods can never
|
|
17
|
+
* derive the same unlock identity. The `version` is one counter per unlock
|
|
18
|
+
* method, recording which parameter set produced that method's derivation;
|
|
19
|
+
* the keyring record's own `version` is stamped separately.
|
|
20
|
+
*
|
|
21
|
+
* The Argon2id arm carries no `hash` member: Argon2 fixes Blake2b internally.
|
|
22
|
+
* `memory` is in KiB (RFC 9106's and noble's unit); the RFC's `m` / `t` / `p`
|
|
23
|
+
* are named `memory` / `passes` / `parallelism`.
|
|
19
24
|
*/
|
|
20
25
|
export type UnlockKdf = {
|
|
21
26
|
version: number;
|
|
22
|
-
algorithm: '
|
|
23
|
-
|
|
24
|
-
|
|
27
|
+
algorithm: 'Argon2id';
|
|
28
|
+
memory: number;
|
|
29
|
+
passes: number;
|
|
30
|
+
parallelism: number;
|
|
25
31
|
salt: string;
|
|
26
32
|
} | {
|
|
27
33
|
version: number;
|
|
@@ -31,20 +37,28 @@ export type UnlockKdf = {
|
|
|
31
37
|
info: string;
|
|
32
38
|
};
|
|
33
39
|
/**
|
|
34
|
-
*
|
|
35
|
-
* (`unlockSeed =
|
|
36
|
-
*
|
|
37
|
-
*
|
|
38
|
-
*
|
|
39
|
-
*
|
|
40
|
-
*
|
|
41
|
-
*
|
|
42
|
-
* unlock
|
|
40
|
+
* Argon2id parameters for the passphrase unlock derivation
|
|
41
|
+
* (`unlockSeed = Argon2id(passphrase)`): 64 MiB of memory, 3 passes,
|
|
42
|
+
* parallelism 1, a 32-byte tag. The memory and pass counts are those of RFC
|
|
43
|
+
* 9106 section 4's second recommended option (m = 64 MiB, t = 3, p = 4); the
|
|
44
|
+
* parallelism is a deliberate departure from that option's four lanes. It
|
|
45
|
+
* stays 1 because noble is single-threaded, so a higher value changes the
|
|
46
|
+
* bytes and buys no speed. Passphrase version 2 pins exactly
|
|
47
|
+
* these parameters; version 1 was PBKDF2-600k over SHA-256 under the salt
|
|
48
|
+
* `freewallet/keyring/unlock/v1`, and it was replaced outright rather than
|
|
49
|
+
* kept beside this set, so a passphrase bound under it no longer addresses
|
|
50
|
+
* its unlock Space. The KDF's own `version` is what records the parameter
|
|
51
|
+
* set: the keyring record's frame version is unchanged, since a record cannot
|
|
52
|
+
* be read before its derivation has already succeeded, so a version inside it
|
|
53
|
+
* could never steer a lookup. The salt is a fixed app-wide constant -- login
|
|
54
|
+
* stays passphrase-only, with no email (or other) input mixed into the
|
|
55
|
+
* derivation. Every unlock method's KDF carries a distinct salt, so two
|
|
56
|
+
* methods can never derive the same unlock Space.
|
|
43
57
|
*/
|
|
44
58
|
export declare const KEYRING_KDF: UnlockKdf;
|
|
45
59
|
/**
|
|
46
60
|
* Derives the 32-byte unlock seed from an unlock secret, branching on the KDF
|
|
47
|
-
* family:
|
|
61
|
+
* family: Argon2id stretches a passphrase, HKDF expands already-uniform key
|
|
48
62
|
* material such as a passkey PRF output.
|
|
49
63
|
*
|
|
50
64
|
* Exported for the standing-credential derivation (`unlock/standingClient`):
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAQ3C;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,UAAU,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAEL;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,WAAW,EAAE,SAOzB,CAAA;AAoBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,cAAc,CAAC,CAG1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4B1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,IAAI,CAC1C,aAAa,EACb,YAAY,GAAG,iBAAiB,GAAG,aAAa,CACjD;IACC,KAAK,EAAE,eAAe,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB"}
|
package/dist/keyring/kdf.js
CHANGED
|
@@ -12,15 +12,15 @@
|
|
|
12
12
|
* output for the same secret and parameter set, or the same passphrase would
|
|
13
13
|
* address two different unlock Spaces. It is therefore implemented over
|
|
14
14
|
* `@noble/hashes` rather than WebCrypto's `crypto.subtle.deriveBits`, which
|
|
15
|
-
* React Native does not provide;
|
|
16
|
-
* (RFC
|
|
15
|
+
* React Native does not provide; Argon2id and HKDF are both fully specified
|
|
16
|
+
* (RFC 9106 / RFC 5869), so any two implementations agree bit for bit.
|
|
17
17
|
*/
|
|
18
18
|
import { deriveSpaceId } from '@interop/was-client/sync';
|
|
19
19
|
import { CapabilityAgent } from '@interop/webkms-client';
|
|
20
|
+
import { argon2idAsync } from '@noble/hashes/argon2.js';
|
|
20
21
|
import { hkdf } from '@noble/hashes/hkdf.js';
|
|
21
|
-
import { pbkdf2Async } from '@noble/hashes/pbkdf2.js';
|
|
22
22
|
import { sha256, sha512 } from '@noble/hashes/sha2.js';
|
|
23
|
-
import { agentsFromKeyAgent } from '
|
|
23
|
+
import { agentsFromKeyAgent } from '@interop/was-client/identity';
|
|
24
24
|
import { recordSignerFromAgent } from './record.js';
|
|
25
25
|
/**
|
|
26
26
|
* The load-bearing `CapabilityAgent` derivation names for an unlock identity
|
|
@@ -36,26 +36,36 @@ export const UNLOCK_KEY_NAME = 'unlock-key';
|
|
|
36
36
|
*/
|
|
37
37
|
const UNLOCK_SEED_BYTES = 32;
|
|
38
38
|
/**
|
|
39
|
-
*
|
|
40
|
-
* (`unlockSeed =
|
|
41
|
-
*
|
|
42
|
-
*
|
|
43
|
-
*
|
|
44
|
-
*
|
|
45
|
-
*
|
|
46
|
-
*
|
|
47
|
-
* unlock
|
|
39
|
+
* Argon2id parameters for the passphrase unlock derivation
|
|
40
|
+
* (`unlockSeed = Argon2id(passphrase)`): 64 MiB of memory, 3 passes,
|
|
41
|
+
* parallelism 1, a 32-byte tag. The memory and pass counts are those of RFC
|
|
42
|
+
* 9106 section 4's second recommended option (m = 64 MiB, t = 3, p = 4); the
|
|
43
|
+
* parallelism is a deliberate departure from that option's four lanes. It
|
|
44
|
+
* stays 1 because noble is single-threaded, so a higher value changes the
|
|
45
|
+
* bytes and buys no speed. Passphrase version 2 pins exactly
|
|
46
|
+
* these parameters; version 1 was PBKDF2-600k over SHA-256 under the salt
|
|
47
|
+
* `freewallet/keyring/unlock/v1`, and it was replaced outright rather than
|
|
48
|
+
* kept beside this set, so a passphrase bound under it no longer addresses
|
|
49
|
+
* its unlock Space. The KDF's own `version` is what records the parameter
|
|
50
|
+
* set: the keyring record's frame version is unchanged, since a record cannot
|
|
51
|
+
* be read before its derivation has already succeeded, so a version inside it
|
|
52
|
+
* could never steer a lookup. The salt is a fixed app-wide constant -- login
|
|
53
|
+
* stays passphrase-only, with no email (or other) input mixed into the
|
|
54
|
+
* derivation. Every unlock method's KDF carries a distinct salt, so two
|
|
55
|
+
* methods can never derive the same unlock Space.
|
|
48
56
|
*/
|
|
49
57
|
export const KEYRING_KDF = {
|
|
50
|
-
version:
|
|
51
|
-
algorithm: '
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
58
|
+
version: 2,
|
|
59
|
+
algorithm: 'Argon2id',
|
|
60
|
+
memory: 65_536,
|
|
61
|
+
passes: 3,
|
|
62
|
+
parallelism: 1,
|
|
63
|
+
salt: 'freewallet/keyring/unlock/argon2id/v1'
|
|
55
64
|
};
|
|
56
65
|
/**
|
|
57
|
-
* The noble hash constructor a WebCrypto hash name selects
|
|
58
|
-
* matches `crypto.subtle.deriveBits` for the same
|
|
66
|
+
* The noble hash constructor a WebCrypto hash name selects for the HKDF arm,
|
|
67
|
+
* so the derivation matches `crypto.subtle.deriveBits` for the same
|
|
68
|
+
* parameters.
|
|
59
69
|
*
|
|
60
70
|
* @param hash {string} a WebCrypto digest name (`SHA-256`, `SHA-512`)
|
|
61
71
|
* @returns {object} the noble hash
|
|
@@ -71,7 +81,7 @@ function nobleHash(hash) {
|
|
|
71
81
|
}
|
|
72
82
|
/**
|
|
73
83
|
* Derives the 32-byte unlock seed from an unlock secret, branching on the KDF
|
|
74
|
-
* family:
|
|
84
|
+
* family: Argon2id stretches a passphrase, HKDF expands already-uniform key
|
|
75
85
|
* material such as a passkey PRF output.
|
|
76
86
|
*
|
|
77
87
|
* Exported for the standing-credential derivation (`unlock/standingClient`):
|
|
@@ -90,15 +100,16 @@ export async function deriveUnlockSeed({ secret, kdf }) {
|
|
|
90
100
|
const secretBytes = typeof secret === 'string'
|
|
91
101
|
? new TextEncoder().encode(secret)
|
|
92
102
|
: new Uint8Array(secret);
|
|
93
|
-
const hash = nobleHash(kdf.hash);
|
|
94
103
|
const salt = new TextEncoder().encode(kdf.salt);
|
|
95
|
-
if (kdf.algorithm === '
|
|
96
|
-
return
|
|
97
|
-
|
|
104
|
+
if (kdf.algorithm === 'Argon2id') {
|
|
105
|
+
return argon2idAsync(secretBytes, salt, {
|
|
106
|
+
m: kdf.memory,
|
|
107
|
+
t: kdf.passes,
|
|
108
|
+
p: kdf.parallelism,
|
|
98
109
|
dkLen: UNLOCK_SEED_BYTES
|
|
99
110
|
});
|
|
100
111
|
}
|
|
101
|
-
return hkdf(hash, secretBytes, salt, new TextEncoder().encode(kdf.info), UNLOCK_SEED_BYTES);
|
|
112
|
+
return hkdf(nobleHash(kdf.hash), secretBytes, salt, new TextEncoder().encode(kdf.info), UNLOCK_SEED_BYTES);
|
|
102
113
|
}
|
|
103
114
|
/**
|
|
104
115
|
* Derives the full unlock identity from an unlock secret: the unlock
|
package/dist/keyring/kdf.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAGnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAA;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAA;AAE3C;;;GAGG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAgC5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,CAAC;IACT,WAAW,EAAE,CAAC;IACd,IAAI,EAAE,uCAAuC;CAC9C,CAAA;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,IAAI,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EACN,GAAG,EAIJ;IACC,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,WAAW,GACf,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE;YACtC,CAAC,EAAE,GAAG,CAAC,MAAM;YACb,CAAC,EAAE,GAAG,CAAC,MAAM;YACb,CAAC,EAAE,GAAG,CAAC,WAAW;YAClB,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CACT,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EACnB,WAAW,EACX,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAClC,iBAAiB,CAClB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EAIJ;IACC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpD,OAAO,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,eAAe;KACzB,CAAC,CAAA;IACF,8EAA8E;IAC9E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;QACtE,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAA;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAE/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO;QACL,KAAK;QACL,UAAU;QACV,eAAe;QACf,WAAW;QACX,YAAY;QACZ,OAAO;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,GAAG,EAAmB;IACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC"}
|
package/dist/keys/userKey.js
CHANGED
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
*/
|
|
20
20
|
import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
|
|
21
21
|
import { epochKeyIdFor, mintEpoch } from '@interop/was-client/edv';
|
|
22
|
-
import { singleKeyResolver } from '
|
|
22
|
+
import { singleKeyResolver } from '@interop/was-client/identity';
|
|
23
23
|
/**
|
|
24
24
|
* Mints a fresh user key: the X25519 key-agreement pair via the was-client
|
|
25
25
|
* epoch construction (its did:key is the key id, its raw secret is what wraps),
|
package/dist/keys/userKey.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"userKey.js","sourceRoot":"","sources":["../../src/keys/userKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"userKey.js","sourceRoot":"","sources":["../../src/keys/userKey.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAiBhE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;IACnC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,OAAO,EAAwB;IAIhE,MAAM,eAAe,GAAG,yBAAyB,CAAC,aAAa,CAAC;QAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,EAAE,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9B,CAAqB,CAAA;IACtB,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;AACzC,CAAC"}
|
|
@@ -155,9 +155,10 @@ export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdRes
|
|
|
155
155
|
/**
|
|
156
156
|
* What a variant adds to the add-and-retire entry beyond the replacement
|
|
157
157
|
* code's own inventory, which the core appends after it: the verification
|
|
158
|
-
* methods, and the ids each relation gains.
|
|
159
|
-
*
|
|
160
|
-
*
|
|
158
|
+
* methods, and the ids each relation gains. The methods land in
|
|
159
|
+
* `verificationMethod` and each relation in the order given, with the
|
|
160
|
+
* replacement code's after them; nothing reads that order, since each
|
|
161
|
+
* credential-class member names its own ladder commitment.
|
|
161
162
|
*/
|
|
162
163
|
export interface RecoveryAddedInventory extends RelationMembership {
|
|
163
164
|
methods: VerificationMethod[];
|
|
@@ -191,7 +192,7 @@ export interface RecoveryContinuationOutcome extends RecoverySpendRetirement {
|
|
|
191
192
|
* The reveal-and-commit entry commits, in this order, the successor key's
|
|
192
193
|
* hash, its staged partner's hash, and the replacement code's rung-0 hash --
|
|
193
194
|
* the ratified append order of `decisions/0007` (the replacement's comes
|
|
194
|
-
* LAST)
|
|
195
|
+
* LAST), which the forward ladder walk reads. The
|
|
195
196
|
* add-and-retire entry is built on the head the reveal entry's own publish
|
|
196
197
|
* leaves standing, with no read in between; against a store whose PUT serves
|
|
197
198
|
* no ETag it is re-read under the same pin instead, so its compare-and-swap
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"continuation.d.ts","sourceRoot":"","sources":["../../src/recovery/continuation.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,eAAe,EACf,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;
|
|
1
|
+
{"version":3,"file":"continuation.d.ts","sourceRoot":"","sources":["../../src/recovery/continuation.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,eAAe,EACf,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,KAAK,EAAqB,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAG3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAgBlE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACH,qBAAqB,EACrB,SAAS,EACV,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,qBAAqB,EAAE,MAAM,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,EAAE,CAeX;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,GAAG,EACH,GAAG,EACH,SAAS,EACT,6BAA6B,EAC7B,6BAA6B,EAC9B,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAA;IACrE,6BAA6B,EAAE,MAAM,CAAA;IACrC,6BAA6B,EAAE,MAAM,CAAA;CACtC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAqCnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,6BAA8B,SAAQ,kBAAkB;IACvE,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;;;;;;GASG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAA;gBAEtB,EAAE,eAAe,EAAE,EAAE;QAAE,eAAe,EAAE,MAAM,EAAE,CAAA;KAAE;CAS/D;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,GAAG,KAAK,CAC7C,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAA;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,EAAE,EACxD,KAAK,EACL,QAAQ,EACR,SAAS,EACT,WAAW,EACX,WAAW,EACX,KAAK,EACL,eAAe,EACf,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,SAAS,EAAE;QACT,kBAAkB,EAAE,MAAM,CAAA;QAC1B,UAAU,EAAE,UAAU,CAAA;QACtB,kBAAkB,EAAE,MAAM,CAAA;KAC3B,CAAA;IACD,WAAW,EAAE,6BAA6B,CAAA;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;IACxB,KAAK,EAAE,CAAC,OAAO,EAAE;QACf,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,SAAS,EAAE,SAAS,CAAA;KACrB,KAAK,sBAAsB,CAAA;IAC5B,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAkQvC"}
|