@interop/wallet-core 0.70.0 → 0.72.0

package/dist/menders/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/menders/runner.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,uBAAuB,yBAAyB,CAAA;AAE7D;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM;IACrE;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA;IAC9C;;OAEG;IACH,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC/B;;;;OAIG;IACH,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC9B;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;CAChD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,SAAS,MAAM,GAAG,MAAM,KAC7B,qBAAqB,CAAC,QAAQ,CAAC,CAqBnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAsB,cAAc,CAClC,IAAI,EACJ,QAAQ,SAAS,MAAM,GAAG,MAAM,EAChC,IAAI,SAAS,gBAAgB,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAC5D,EACA,QAAQ,EACR,OAAO,EACP,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,MAAM,EACN,aAAa,EACb,IAAI,EACJ,SAAS,EACV,EAAE;IACD,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IAC9B,KAAK,EAAE,UAAU,CAAA;IACjB,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACnC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAA;CACvD,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAqChC;AA6HD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAQhD"}

package/dist/menders/runner.js

@@ -0,0 +1,222 @@
+/**
+ * The `errorName` a normalized entry carries when a registration resolves
+ * with entries that do not match the invariants it reports.
+ */
+export const MEND_REPORT_SHAPE_ERROR = 'MendReportShapeError';
+/**
+ * Creates a report accumulator. Generic over the wallet's ceremony-id
+ * union, which defaults to `string`.
+ *
+ * @returns {MendReportAccumulator}
+ */
+export function mendReportAccumulator() {
+    const recorded = [];
+    let resolveSettled = () => undefined;
+    const settled = new Promise(resolve => {
+        resolveSettled = resolve;
+    });
+    let assembled;
+    return {
+        report(entry) {
+            recorded.push(entry);
+        },
+        entries: () => [...recorded],
+        settle() {
+            if (!assembled) {
+                assembled = [...recorded];
+                resolveSettled(assembled);
+            }
+            return assembled;
+        },
+        settled
+    };
+}
+/**
+ * Runs one registration block: the registrations listed under `trigger`
+ * whose every reported invariant declares an authority the session holds
+ * and admits this login route, in list order.
+ *
+ * The discipline, in one place. An optional `seed` registration runs first,
+ * and its failure aborts the block: nothing behind it runs, which is what a
+ * rejected chain seed does today. Past the seed, a registration that throws
+ * warns once per reported invariant with that declaration's own `warn`
+ * string, reports `failed` for each of them, and the block carries on to
+ * the next registration. Only `err.name` rides a report: a thrown error's
+ * message routinely carries a DID or a Space id, so the error itself goes
+ * to the logger alone.
+ *
+ * A registration that resolves with the wrong number of entries, or with an
+ * entry whose `invariant` is not the id it reports at that position, is a
+ * programming error. It warns and is normalized to `failed` entries
+ * carrying {@link MEND_REPORT_SHAPE_ERROR} rather than throwing, so a
+ * mismatched adapter cannot tear a login.
+ *
+ * `trigger` is one of the two chain values, so a `ceremony-tail` entry is
+ * out of reach here. Such an entry has no registration at all: its body
+ * stays inside its ceremony's sequenced code and it reports from there.
+ *
+ * `Deps` is the wallet's own type, one object per registration block,
+ * handed to the seed and to every `converge` unread. This runner never
+ * inspects it, and the raw passphrase does not cross into this package.
+ *
+ * `registrations` overrides which registrations the block runs, for a wallet
+ * that runs one trigger's list in parts (a settle point partway through, say).
+ * The same authority and route tests still admit each one, and one listed
+ * under another trigger is refused, so the override narrows the block and
+ * never widens it.
+ *
+ * A registry may index converge-free sites beside its registrations -- a
+ * wallet's routing entries, or an entry whose own call site fires it -- and
+ * such a site is never executed here, whichever list the block runs from.
+ *
+ * @param options {object}
+ * @param options.registry {MenderRegistry}   the wallet's declarations and
+ *   its registrations
+ * @param options.trigger {ChainTrigger}   which chain is running
+ * @param options.held {ReadonlyArray<Authority>}   the session's held
+ *   authorities, from `heldAuthorities`
+ * @param options.route {LoginRoute}   the login route each declaration's
+ *   `when` predicate reads
+ * @param options.deps {Deps}   passed to the seed and to every `converge`
+ * @param options.logger {Logger}   the wallet's own sink, so its warn
+ *   copy keeps the wallet's namespace
+ * @param [options.registrations] {ReadonlyArray<Registration>}   the
+ *   registrations to run, in place of the ones the registry lists under
+ *   `trigger`. Each is admitted by the same authority and route tests
+ * @param [options.seed] {Registration}   the step whose failure aborts the
+ *   block. Admitted by the same authority and route tests as any other
+ *   registration; one it does not pass is skipped rather than failed
+ * @param [options.onOutcome] {(entry: MendReportEntry) => void}   called
+ *   once per reported entry, in order. The single place a chain entry's
+ *   outcome is reported
+ * @returns {Promise<MendReport>}   the block's entries in order. It never
+ *   rejects; a seed failure resolves with the seed's `failed` entries alone
+ * @throws {TypeError}   when the seed or an override registration is listed
+ *   under a trigger other than `trigger`, a programming error
+ */
+export async function runMenderBlock({ registry, trigger, held, route, deps, logger, registrations, seed, onOutcome }) {
+    const report = [];
+    const collect = (entries) => {
+        for (const entry of entries) {
+            report.push(entry);
+            onOutcome?.(entry);
+        }
+    };
+    for (const supplied of [...(seed ? [seed] : []), ...(registrations ?? [])]) {
+        if (supplied.trigger !== trigger) {
+            throw new TypeError(`A ${supplied.trigger} registration was handed to the ${trigger} block`);
+        }
+    }
+    const admitted = (site) => registry.admits({ site, held, route });
+    const listed = (registrations?.filter(admitted) ?? registry.dueAt({ held, trigger, route })).filter((isRegistration));
+    // One ordered list, the seed first: the seed is the one step whose throw
+    // ends the block.
+    const steps = seed && admitted(seed) ? [seed, ...listed] : listed;
+    for (const registration of steps) {
+        const outcome = await runRegistration({
+            registry,
+            registration,
+            deps,
+            logger,
+            trigger
+        });
+        collect(outcome.entries);
+        if (outcome.threw && registration === seed) {
+            return report;
+        }
+    }
+    return report;
+}
+/**
+ * Runs one registration under the block's discipline, returning its entries
+ * and whether it threw.
+ */
+async function runRegistration({ registry, registration, deps, logger, trigger }) {
+    try {
+        const entries = await registration.converge(deps);
+        if (!matchesReports({ registration, entries })) {
+            logger.warn('A mender registration returned entries that do not match the invariants it reports', { trigger, reports: [...registration.reports] });
+            // A malformed return is a defect in the adapter rather than a mend
+            // failure: the step ran to completion, so a malformed seed does not
+            // abort the block.
+            return {
+                entries: failedEntries({
+                    registry,
+                    registration,
+                    errorName: MEND_REPORT_SHAPE_ERROR
+                }),
+                threw: false
+            };
+        }
+        return { entries, threw: false };
+    }
+    catch (err) {
+        for (const id of registration.reports) {
+            logger.warn(registry.byId(id)?.warn ?? `Could not converge ${id}`, {
+                invariant: id,
+                trigger,
+                err
+            });
+        }
+        return {
+            entries: failedEntries({
+                registry,
+                registration,
+                errorName: errorNameOf(err)
+            }),
+            threw: true
+        };
+    }
+}
+/**
+ * Whether a site carries a converger, so the block can run it. A wallet's
+ * registry indexes its converge-free sites beside its registrations.
+ *
+ * @param site {RegistrationSite}
+ * @returns {boolean}
+ */
+function isRegistration(site) {
+    return typeof site.converge === 'function';
+}
+/**
+ * Whether a registration's entries name the invariants it reports, in that
+ * order.
+ */
+function matchesReports({ registration, entries }) {
+    return (entries.length === registration.reports.length &&
+        entries.every((entry, index) => entry.invariant === registration.reports[index]));
+}
+/**
+ * One `failed` entry per reported invariant, carrying the declaration's
+ * ceremonies where it names any.
+ */
+function failedEntries({ registry, registration, errorName }) {
+    return registration.reports.map(id => {
+        const ceremonies = registry.byId(id)?.ceremonies;
+        return {
+            invariant: id,
+            outcome: 'failed',
+            errorName,
+            ...(ceremonies && ceremonies.length > 0 ? { ceremonies } : {})
+        };
+    });
+}
+/**
+ * The thrown value's class name alone. Its message may carry a DID or a
+ * Space id, so a report keeps the name and the logger keeps the error. A
+ * value that is not an `Error` still yields a name, so a report site never
+ * carries `undefined` where a name belongs.
+ *
+ * @param err {unknown}
+ * @returns {string}
+ */
+export function errorNameOf(err) {
+    if (err instanceof Error) {
+        return err.name;
+    }
+    if (typeof err === 'object' && err !== null && 'name' in err) {
+        return String(err.name);
+    }
+    return 'Error';
+}
+//# sourceMappingURL=runner.js.map

package/dist/menders/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/menders/runner.ts"],"names":[],"mappings":"AAyBA;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAA;AA+B7D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB;IAGnC,MAAM,QAAQ,GAAqC,EAAE,CAAA;IACrD,IAAI,cAAc,GAA2C,GAAG,EAAE,CAAC,SAAS,CAAA;IAC5E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAuB,OAAO,CAAC,EAAE;QAC1D,cAAc,GAAG,OAAO,CAAA;IAC1B,CAAC,CAAC,CAAA;IACF,IAAI,SAA2C,CAAA;IAC/C,OAAO;QACL,MAAM,CAAC,KAAK;YACV,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC;QAC5B,MAAM;YACJ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAA;gBACzB,cAAc,CAAC,SAAS,CAAC,CAAA;YAC3B,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAIlC,EACA,QAAQ,EACR,OAAO,EACP,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,MAAM,EACN,aAAa,EACb,IAAI,EACJ,SAAS,EAWV;IACC,MAAM,MAAM,GAAqC,EAAE,CAAA;IACnD,MAAM,OAAO,GAAG,CAAC,OAAiD,EAAQ,EAAE;QAC1E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,SAAS,EAAE,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC3E,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CACjB,KAAK,QAAQ,CAAC,OAAO,mCAAmC,OAAO,QAAQ,CACxE,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,IAAsB,EAAW,EAAE,CACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,CACb,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAC5E,CAAC,MAAM,CAAC,CAAA,cAA8B,CAAA,CAAC,CAAA;IACxC,yEAAyE;IACzE,kBAAkB;IAClB,MAAM,KAAK,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IACjE,KAAK,MAAM,YAAY,IAAI,KAAK,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,QAAQ;YACR,YAAY;YACZ,IAAI;YACJ,MAAM;YACN,OAAO;SACR,CAAC,CAAA;QACF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACxB,IAAI,OAAO,CAAC,KAAK,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAI5B,EACA,QAAQ,EACR,YAAY,EACZ,IAAI,EACJ,MAAM,EACN,OAAO,EAOR;IAIC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CACT,oFAAoF,EACpF,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAChD,CAAA;YACD,mEAAmE;YACnE,oEAAoE;YACpE,mBAAmB;YACnB,OAAO;gBACL,OAAO,EAAE,aAAa,CAAC;oBACrB,QAAQ;oBACR,YAAY;oBACZ,SAAS,EAAE,uBAAuB;iBACnC,CAAC;gBACF,KAAK,EAAE,KAAK;aACb,CAAA;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,sBAAsB,EAAE,EAAE,EAAE;gBACjE,SAAS,EAAE,EAAE;gBACb,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,aAAa,CAAC;gBACrB,QAAQ;gBACR,YAAY;gBACZ,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC;aAC5B,CAAC;YACF,KAAK,EAAE,IAAI;SACZ,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,IAAsB;IAEtB,OAAO,OAAQ,IAAqC,CAAC,QAAQ,KAAK,UAAU,CAAA;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAgC,EACrD,YAAY,EACZ,OAAO,EAIR;IACC,OAAO,CACL,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,MAAM;QAC9C,OAAO,CAAC,KAAK,CACX,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAClE,CACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAIpB,EACA,QAAQ,EACR,YAAY,EACZ,SAAS,EAKV;IACC,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,CAAA;QAChD,OAAO;YACL,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,QAAiB;YAC1B,SAAS;YACT,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAC7D,OAAO,MAAM,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/menders/types.d.ts

@@ -0,0 +1,146 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The mender registry's structural types. A declaration is data: what must
+ * hold between ceremonies and, where the detector is separable, how to see
+ * it. A registration is code: the one place a callable `converge` lives,
+ * reporting one or more declared invariants. The registry is the
+ * declaration table plus the per-trigger registration lists, and the
+ * derived-set helpers read the converge-free `RegistrationSite` shape a
+ * registration extends, so an index of sites and a list of registrations
+ * feed the same readers.
+ */
+import type { InvariantId } from './ids.js';
+import type { AccountShape, Authority, Evidence, GapKind, MendOutcomeKind, Trigger } from './vocabulary.js';
+/**
+ * The login route a declaration's `when` predicate reads: the popup axis
+ * alone today, the CHAPI popup being the one route on which several chain
+ * entries stand down.
+ */
+export interface LoginRoute {
+    popup: boolean;
+}
+/**
+ * One invariant: a predicate over the account's server-held state (for a
+ * few entries, over this browser's local state) that must hold between
+ * ceremonies. Generic over the dependencies a wallet's detectors take and
+ * over the wallet's ceremony-id union, which defaults to `string` for a
+ * wallet that declares none.
+ */
+export interface InvariantDeclaration<Deps, Ceremony extends string = string> {
+    /**
+     * The stable kebab-case key, naming the predicate rather than the code.
+     */
+    id: InvariantId;
+    /**
+     * One present-tense sentence stating what holds.
+     */
+    statement: string;
+    /**
+     * The account shapes on which a violation can stand un-mended.
+     */
+    standsOn: ReadonlyArray<AccountShape>;
+    /**
+     * The one authority a converger needs. A runtime filter at the two chain
+     * triggers; a declaration-time claim, checked by the entry's own call
+     * site, everywhere else.
+     */
+    authority: Authority;
+    /**
+     * Where the predicate is checked today.
+     */
+    triggers: ReadonlyArray<Trigger>;
+    /**
+     * The ceremonies whose torn runs can violate the predicate. May be
+     * empty: several invariants are violated by ordinary drift.
+     */
+    ceremonies: ReadonlyArray<Ceremony>;
+    /**
+     * What the detector trusts.
+     */
+    evidence: ReadonlyArray<Evidence>;
+    /**
+     * The warning a runner logs when a registration reporting this invariant
+     * throws.
+     */
+    warn: string;
+    /**
+     * The popup axis: whether the entry runs on this login route. Absent
+     * means every route.
+     */
+    when?(route: LoginRoute): boolean;
+    /**
+     * The separable detector, reading state alone. `undetermined` is what a
+     * transport failure returns, so a converger is never invited to write on
+     * a flap.
+     */
+    holdsWhen?(deps: Deps): Promise<'holds' | 'violated' | 'undetermined'>;
+}
+/**
+ * Where a registration sits: the trigger it is listed under and the
+ * invariants it reports, in report order. A routing site behind the
+ * client-key-record probe says so, since only a browser holding such a
+ * record reaches it; the guard is a routing-site member alone, so a chain
+ * or ceremony-tail site cannot carry one and the chain readers never have
+ * to honor it.
+ */
+export type RegistrationSite = {
+    trigger: Exclude<Trigger, 'login-routing'>;
+    reports: ReadonlyArray<InvariantId>;
+    guardedBy?: undefined;
+} | {
+    trigger: 'login-routing';
+    reports: ReadonlyArray<InvariantId>;
+    guardedBy?: 'client-key-record';
+};
+/**
+ * A registration: the code that converges the invariants it reports.
+ * `converge` returns exactly one entry per id in `reports`, in that order.
+ */
+export type Registration<Deps, Ceremony extends string = string> = RegistrationSite & {
+    converge(deps: Deps): Promise<ReadonlyArray<MendReportEntry<Ceremony>>>;
+};
+/**
+ * The outcome of one mend attempt. `detail` is scalar only, so a later emit
+ * through the mender event channel needs no reshaping and no account
+ * identifier rides a report.
+ */
+export interface MendOutcome {
+    outcome: MendOutcomeKind;
+    detail?: Record<string, string | number | boolean | undefined>;
+    /**
+     * The thrown error's class name alone; its message may carry a DID or a
+     * Space id, which a report never does.
+     */
+    errorName?: string;
+}
+/**
+ * One reported invariant's outcome.
+ */
+export interface MendReportEntry<Ceremony extends string = string> extends MendOutcome {
+    invariant: InvariantId;
+    ceremonies?: ReadonlyArray<Ceremony>;
+}
+/**
+ * A login's or a ceremony's mend report.
+ */
+export type MendReport<Ceremony extends string = string> = ReadonlyArray<MendReportEntry<Ceremony>>;
+/**
+ * One declared gap, keyed by `{ invariant, tornState }`: one predicate can
+ * hold several torn states, and each is its own gap.
+ */
+export interface InvariantGap {
+    invariant: InvariantId;
+    /**
+     * One sentence of prose naming the torn state.
+     */
+    tornState: string;
+    standsOn: ReadonlyArray<AccountShape>;
+    /**
+     * The tracking work item.
+     */
+    item: string;
+    kind: GapKind;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/menders/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/menders/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,OAAO,EACP,eAAe,EACf,OAAO,EACR,MAAM,iBAAiB,CAAA;AAExB;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,OAAO,CAAA;CACf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB,CAAC,IAAI,EAAE,QAAQ,SAAS,MAAM,GAAG,MAAM;IAC1E;;OAEG;IACH,EAAE,EAAE,WAAW,CAAA;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IACrC;;;;OAIG;IACH,SAAS,EAAE,SAAS,CAAA;IACpB;;OAEG;IACH,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;IAChC;;;OAGG;IACH,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IACnC;;OAEG;IACH,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;IACjC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAA;IACjC;;;;OAIG;IACH,SAAS,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,UAAU,GAAG,cAAc,CAAC,CAAA;CACvE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IAC1C,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;IACnC,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB,GACD;IACE,OAAO,EAAE,eAAe,CAAA;IACxB,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;IACnC,SAAS,CAAC,EAAE,mBAAmB,CAAA;CAChC,CAAA;AAEL;;;GAGG;AACH,MAAM,MAAM,YAAY,CACtB,IAAI,EACJ,QAAQ,SAAS,MAAM,GAAG,MAAM,IAC9B,gBAAgB,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;CACxE,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,eAAe,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAA;IAC9D;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAC9B,QAAQ,SAAS,MAAM,GAAG,MAAM,CAChC,SAAQ,WAAW;IACnB,SAAS,EAAE,WAAW,CAAA;IACtB,UAAU,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAA;CACrC;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM,IAAI,aAAa,CACtE,eAAe,CAAC,QAAQ,CAAC,CAC1B,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAA;IACtB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;IACrC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,OAAO,CAAA;CACd"}

package/dist/menders/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/menders/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/menders/types.ts"],"names":[],"mappings":""}

package/dist/menders/vocabulary.d.ts

@@ -0,0 +1,88 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The closed vocabularies the mender registry is keyed on: the authority a
+ * converger needs, the trigger sites that check an invariant today, the
+ * account shapes a violation can stand on, the evidence a detector trusts,
+ * the mend outcomes, and the two gap kinds. Each is an `as const` array with
+ * its union, so extending one is a compile error rather than a drift. All
+ * are code-only; nothing persists them.
+ */
+/**
+ * The one authority context a converger needs. `enrolled` and `ladder` are
+ * the two kinds the wallets' account-ceremony context resolves; `account`
+ * means either kind converges the invariant; `none` means no account
+ * authority at all (local cleanup, reads, writes the visit's own generation
+ * delegation covers).
+ */
+export declare const AUTHORITIES: readonly ["none", "account", "enrolled", "ladder"];
+/**
+ * One value of {@link AUTHORITIES}.
+ */
+export type Authority = (typeof AUTHORITIES)[number];
+/**
+ * Where an invariant is checked today. The two chain triggers are the
+ * login-time chains a remembered and a transient login seed; `login-routing`
+ * entries are invoked by name at a routing call site before or during
+ * session assembly and may refuse the login; `ceremony-tail` entries execute
+ * inside a ceremony's own sequenced code and only report through the
+ * registry.
+ */
+export declare const TRIGGERS: readonly ["remembered-login-chain", "transient-login-chain", "login-routing", "ceremony-tail"];
+/**
+ * One value of {@link TRIGGERS}.
+ */
+export type Trigger = (typeof TRIGGERS)[number];
+/**
+ * The two triggers a runner batches registrations for, and the only two the
+ * held-authority filter applies to.
+ */
+export declare const CHAIN_TRIGGERS: readonly ["remembered-login-chain", "transient-login-chain"];
+/**
+ * One value of {@link CHAIN_TRIGGERS}.
+ */
+export type ChainTrigger = (typeof CHAIN_TRIGGERS)[number];
+/**
+ * The account shapes a violation can stand on un-mended: `client-less` (a
+ * credential-anchored account with no enrolled client) and `enrolled` (an
+ * account with at least one enrolled client).
+ */
+export declare const ACCOUNT_SHAPES: readonly ["client-less", "enrolled"];
+/**
+ * One value of {@link ACCOUNT_SHAPES}.
+ */
+export type AccountShape = (typeof ACCOUNT_SHAPES)[number];
+/**
+ * What a detector trusts when it decides an invariant is violated. A
+ * `verified-log` read is checked under the visit's continuity pins; every
+ * `served-*` value and `host-listing` is host state taken as served; the two
+ * `local-*` values are this browser's own state and clock.
+ */
+export declare const EVIDENCE: readonly ["verified-log", "served-registry", "served-unlock-record", "host-listing", "served-body", "served-projection", "local-record", "local-clock"];
+/**
+ * One value of {@link EVIDENCE}.
+ */
+export type Evidence = (typeof EVIDENCE)[number];
+/**
+ * The outcome of one mend attempt, shared with the mender event channel so
+ * a report entry and an emitted event cannot diverge.
+ */
+export declare const MEND_OUTCOMES: readonly ["clean", "noop", "partial", "refused", "failed"];
+/**
+ * One value of {@link MEND_OUTCOMES}.
+ */
+export type MendOutcomeKind = (typeof MEND_OUTCOMES)[number];
+/**
+ * The two kinds of declared gap. `none`: no registration reports the
+ * invariant on any trigger, whether because no converger is built or because
+ * the code that converges it is not an addressable symbol. `unreachable`: a
+ * registration reports it, but only on triggers a credential-only visit on
+ * the affected account shape cannot fire.
+ */
+export declare const GAP_KINDS: readonly ["none", "unreachable"];
+/**
+ * One value of {@link GAP_KINDS}.
+ */
+export type GapKind = (typeof GAP_KINDS)[number];
+//# sourceMappingURL=vocabulary.d.ts.map

package/dist/menders/vocabulary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary.d.ts","sourceRoot":"","sources":["../../src/menders/vocabulary.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,oDAAqD,CAAA;AAE7E;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,gGAKX,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;AAE/C;;;GAGG;AACH,eAAO,MAAM,cAAc,8DAGjB,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1D;;;;GAIG;AACH,eAAO,MAAM,cAAc,sCAAuC,CAAA;AAElE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,yJASX,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhD;;;GAGG;AACH,eAAO,MAAM,aAAa,4DAMhB,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,kCAAmC,CAAA;AAEzD;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/menders/vocabulary.js

@@ -0,0 +1,83 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The closed vocabularies the mender registry is keyed on: the authority a
+ * converger needs, the trigger sites that check an invariant today, the
+ * account shapes a violation can stand on, the evidence a detector trusts,
+ * the mend outcomes, and the two gap kinds. Each is an `as const` array with
+ * its union, so extending one is a compile error rather than a drift. All
+ * are code-only; nothing persists them.
+ */
+/**
+ * The one authority context a converger needs. `enrolled` and `ladder` are
+ * the two kinds the wallets' account-ceremony context resolves; `account`
+ * means either kind converges the invariant; `none` means no account
+ * authority at all (local cleanup, reads, writes the visit's own generation
+ * delegation covers).
+ */
+export const AUTHORITIES = ['none', 'account', 'enrolled', 'ladder'];
+/**
+ * Where an invariant is checked today. The two chain triggers are the
+ * login-time chains a remembered and a transient login seed; `login-routing`
+ * entries are invoked by name at a routing call site before or during
+ * session assembly and may refuse the login; `ceremony-tail` entries execute
+ * inside a ceremony's own sequenced code and only report through the
+ * registry.
+ */
+export const TRIGGERS = [
+    'remembered-login-chain',
+    'transient-login-chain',
+    'login-routing',
+    'ceremony-tail'
+];
+/**
+ * The two triggers a runner batches registrations for, and the only two the
+ * held-authority filter applies to.
+ */
+export const CHAIN_TRIGGERS = [
+    'remembered-login-chain',
+    'transient-login-chain'
+];
+/**
+ * The account shapes a violation can stand on un-mended: `client-less` (a
+ * credential-anchored account with no enrolled client) and `enrolled` (an
+ * account with at least one enrolled client).
+ */
+export const ACCOUNT_SHAPES = ['client-less', 'enrolled'];
+/**
+ * What a detector trusts when it decides an invariant is violated. A
+ * `verified-log` read is checked under the visit's continuity pins; every
+ * `served-*` value and `host-listing` is host state taken as served; the two
+ * `local-*` values are this browser's own state and clock.
+ */
+export const EVIDENCE = [
+    'verified-log',
+    'served-registry',
+    'served-unlock-record',
+    'host-listing',
+    'served-body',
+    'served-projection',
+    'local-record',
+    'local-clock'
+];
+/**
+ * The outcome of one mend attempt, shared with the mender event channel so
+ * a report entry and an emitted event cannot diverge.
+ */
+export const MEND_OUTCOMES = [
+    'clean',
+    'noop',
+    'partial',
+    'refused',
+    'failed'
+];
+/**
+ * The two kinds of declared gap. `none`: no registration reports the
+ * invariant on any trigger, whether because no converger is built or because
+ * the code that converges it is not an addressable symbol. `unreachable`: a
+ * registration reports it, but only on triggers a credential-only visit on
+ * the affected account shape cannot fire.
+ */
+export const GAP_KINDS = ['none', 'unreachable'];
+//# sourceMappingURL=vocabulary.js.map

package/dist/menders/vocabulary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary.js","sourceRoot":"","sources":["../../src/menders/vocabulary.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAA;AAO7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,eAAe;IACf,eAAe;CACP,CAAA;AAOV;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,wBAAwB;IACxB,uBAAuB;CACf,CAAA;AAOV;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,UAAU,CAAU,CAAA;AAOlE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,cAAc;IACd,aAAa;IACb,mBAAmB;IACnB,cAAc;IACd,aAAa;CACL,CAAA;AAOV;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO;IACP,MAAM;IACN,SAAS;IACT,SAAS;IACT,QAAQ;CACA,CAAA;AAOV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,aAAa,CAAU,CAAA"}

package/dist/recovery/index.d.ts

@@ -41,7 +41,7 @@
  *   delegations stand for. A bridge is signed by its own credential's ladder
  *   VM, so no ceremony re-mints another credential's.
  *
- * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * Kept out of the root export: this subpath pulls the capability-agent / ezcap /
  * was-client dependency graph (the same isolation pattern as `./keyring`).
  */
 export { decodeRecoveryCode, formatRecoveryCode, generateRecoveryCode, normalizeRecoveryCode, RECOVERY_CODE_BYTES, RECOVERY_KDF, RecoveryCodeInvalidError, recoveryClientFromCode } from './recoveryCode.js';

package/dist/recovery/index.js

@@ -41,7 +41,7 @@
  *   delegations stand for. A bridge is signed by its own credential's ladder
  *   VM, so no ceremony re-mints another credential's.
  *
- * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * Kept out of the root export: this subpath pulls the capability-agent / ezcap /
  * was-client dependency graph (the same isolation pattern as `./keyring`).
  */
 export { decodeRecoveryCode, formatRecoveryCode, generateRecoveryCode, normalizeRecoveryCode, RECOVERY_CODE_BYTES, RECOVERY_KDF, RecoveryCodeInvalidError, recoveryClientFromCode } from './recoveryCode.js';

package/dist/recovery/recoveryWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAM/D,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAEhE,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAI1B,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,YAAY,EACZ,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAerD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,6BAA6B,CAAA;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC,CAAC,CAiED"}
+{"version":3,"file":"recoveryWebvh.d.ts","sourceRoot":"","sources":["../../src/recovery/recoveryWebvh.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAM/D,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAE7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAEhE,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAI1B,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,YAAY,EACZ,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC9B,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,IAAI,EACJ,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,UAAU,EACV,eAAe,EACf,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAerD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,aAAa,EAAE,mBAAmB,CAAA;IAClC,oBAAoB,EAAE,qBAAqB,CAAA;IAC3C,WAAW,EAAE,6BAA6B,CAAA;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC,CAAC,CA2DD"}

package/dist/recovery/recoveryWebvh.js

@@ -1,4 +1,4 @@
-import { assertCanonicalClientKeys, markedVerificationMethodPair, withLogConflictRetry } from '../webvh/didWebvh.js';
+import { assertCanonicalClientKeys, clientAdditionFields, withLogConflictRetry } from '../webvh/didWebvh.js';
 import { publishUnlockKey, removeUnlockKey } from '../unlock/standingWebvh.js';
 import { recoveryContinuationOnce } from './continuation.js';
 // The continuation's shared core and the names both variants read live in
@@ -213,23 +213,17 @@ export async function recoverWebvhClient(options) {
         // client's key-agreement method alone carries the controller marker
         // (see clientKeyAgreementController) -- which is exactly what tells the
         // two simultaneously published keyAgreement methods apart. The marked
-        // pair goes through the shared builder, which refuses a new client
-        // whose key-agreement key is not its signing key's canonical twin; the
-        // core appends the replacement code's unmarked method after it.
+        // pair and its relation membership come from the shared add-side
+        // builder, which refuses a new client whose key-agreement key is not
+        // its signing key's canonical twin; the core appends the replacement
+        // code's unmarked method after it.
         added: ({ did }) => {
-            const signingVmId = `${did}#${newClientKeys.signingKeyMultibase}`;
-            return {
-                methods: markedVerificationMethodPair({
-                    controller: did,
-                    signingKeyMultibase: newClientKeys.signingKeyMultibase,
-                    keyAgreementKeyMultibase: newClientKeys.keyAgreementKeyMultibase
-                }),
-                authentication: [signingVmId],
-                assertionMethod: [signingVmId],
-                keyAgreement: [`${did}#${newClientKeys.keyAgreementKeyMultibase}`],
-                capabilityInvocation: [signingVmId],
-                capabilityDelegation: [signingVmId]
-            };
+            const { methods, relations } = clientAdditionFields({
+                controller: did,
+                signingKeyMultibase: newClientKeys.signingKeyMultibase,
+                keyAgreementKeyMultibase: newClientKeys.keyAgreementKeyMultibase
+            });
+            return { methods, ...relations };
         },
         ...(expectedDid !== undefined ? { expectedDid } : {})
     }));