@interop/wallet-core 0.78.0 → 0.79.0

package/dist/keyring/recordEnvelope.js

@@ -0,0 +1,282 @@
+import { createEdvDocCipher, createEdvEncryptOnlyDocCipher, initRecipients, ownerRecipient } from '@interop/was-client/edv/cipher';
+import { KEYRING_COLLECTION } from '../space/systemCollections.js';
+/**
+ * The version stamped on the stored `{ version, encryption, wrapped, proof }`
+ * keyring envelope: the signed record, whose envelope seals under the record's
+ * own key epoch (the `encryption` member) and whose sibling members carry a
+ * Data Integrity proof by the unlock identity's signing key. Any other version
+ * is refused as unusable -- such accounts are re-provisioned, not migrated.
+ */
+export const KEYRING_RECORD_VERSION = 2;
+/**
+ * A record's proof is absent, malformed, signed by a key this client does not
+ * accept, or does not verify over the record's own members. Its own class,
+ * distinct from a decrypt failure or an unusable-version refusal: this is the
+ * refusal that says the storage host forged or tampered with the record, which
+ * an app maps to its own login copy.
+ */
+export class RecordProofError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'RecordProofError';
+    }
+}
+/**
+ * Checks the shape of a record's `proof` member against the fixed shape.
+ * Verifies nothing: no cryptography runs here, so a match says only that
+ * the member could be a proof, not that it is genuine.
+ *
+ * @param options {object}
+ * @param options.proof {unknown}
+ * @param options.label {string}   names the record kind in the refusal
+ * @returns {RecordProof}
+ */
+export function checkRecordProofShape({ proof, label }) {
+    const candidate = proof;
+    if (candidate === null ||
+        typeof candidate !== 'object' ||
+        candidate.type !== 'DataIntegrityProof' ||
+        candidate.cryptosuite !== 'eddsa-jcs-2022' ||
+        candidate.proofPurpose !== 'assertionMethod' ||
+        typeof candidate.verificationMethod !== 'string' ||
+        typeof candidate.proofValue !== 'string') {
+        throw new RecordProofError(`The ${label} record carries no proof in the fixed shape ` +
+            `(DataIntegrityProof / eddsa-jcs-2022 / assertionMethod).`);
+    }
+    return candidate;
+}
+/**
+ * Mints the one-epoch descriptor a fresh record is sealed under: epoch[0]
+ * wrapped to the given KAK alone, built through `initRecipients` against a
+ * throwaway in-memory store (the descriptor's home is the record itself).
+ * Exported for any consumer sealing a self-contained
+ * `{ version, encryption, wrapped }` record -- the keyring and recovery
+ * records here, and a wallet app's own locally stored records (e.g.
+ * freewallet's client-key record and unlock-methods registry).
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the wrapping KAK (for
+ *   the keyring record, the unlock KAK)
+ * @returns {Promise<CollectionEncryption>}
+ */
+export async function mintRecordEncryption({ keyAgreementKey }) {
+    let stored = null;
+    const store = {
+        async read() {
+            return stored ? { descriptor: stored } : null;
+        },
+        async replace(next) {
+            stored = next;
+        },
+        async create(next) {
+            stored = next;
+        }
+    };
+    return initRecipients({
+        store,
+        recipients: [ownerRecipient({ keyAgreementKey })]
+    });
+}
+/**
+ * Builds the record's reading cipher: an EDV cipher over the record's own
+ * descriptor, from the reader's key-agreement key. The unwrap paths' cipher
+ * (and the recovery record's, which reuses the keyring cipher context
+ * verbatim); the wrap paths seal through {@link recordSealCipher} instead. An
+ * app's own record kind passes its own `collectionId` so its failures name
+ * the record kind. The context labels errors only -- the codec is agnostic to
+ * it, so a record kind's real swap protection is its contents validation on
+ * unwrap.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {IKeyAgreementKey}   the wrapping KAK (for
+ *   the keyring record, the unlock KAK)
+ * @param options.keyResolver {IKeyResolver}
+ * @param options.encryption {CollectionEncryption}   the record's descriptor
+ * @param [options.collectionId] {string}   the cipher context failures are
+ *   labeled with; defaults to the keyring context
+ * @returns {Promise<DocCipher>}
+ */
+export async function recordCipher({ keyAgreementKey, keyResolver, encryption, collectionId = KEYRING_COLLECTION.id }) {
+    return createEdvDocCipher({
+        keyAgreementKey,
+        keyResolver,
+        collectionId,
+        encryption
+    });
+}
+/**
+ * Builds the record's sealing cipher: an encrypt-only EDV cipher over the
+ * record's own descriptor, needing no key-agreement secret -- a write seals to
+ * the descriptor's epoch public key, reconstructed from the epoch id. This is
+ * what lets the recovery re-mint, which holds only the code's unlock KAK
+ * public half, re-seal a record it can never open; the issuance wraps go
+ * through the same construction and produce the same envelope shape. Decrypt
+ * on it refuses with was-client's typed `EncryptOnlyCipherError`.
+ *
+ * @param options {object}
+ * @param options.encryption {CollectionEncryption}   the record's descriptor
+ * @param [options.collectionId] {string}   the cipher context failures are
+ *   labeled with; defaults to the keyring context
+ * @returns {Promise<DocCipher>}
+ */
+export async function recordSealCipher({ encryption, collectionId = KEYRING_COLLECTION.id }) {
+    return createEdvEncryptOnlyDocCipher({ collectionId, encryption });
+}
+/**
+ * Reads the addressed id a stored record envelope must be decrypted under.
+ *
+ * A record's members seal through {@link recordSealCipher}, which builds on
+ * was-client's default content-derived id mode: the id does not exist until
+ * after encryption, so the codec computes it from the JWE ciphertext and
+ * stamps it onto the cleartext envelope afterwards. That stamped member is
+ * the only value {@link recordCipher}'s decrypt accepts -- the record's own
+ * well-known resource id does not verify, and the sealed members of an unlock
+ * record have no resource id of their own at all.
+ *
+ * The check this id feeds is therefore inert here, and deliberately so. In
+ * content-derived mode the id is a hash of the ciphertext, so a substituted
+ * envelope carries a matching stamp and the comparison always passes. It
+ * detects corruption rather than substitution. A record's protection against a
+ * substituting storage host is the frame's `eddsa-jcs-2022` proof over
+ * `wrapped` and every sealed member, verified by `record.ts`'s
+ * `verifyRecordProof` before any unwrap path decrypts. Do not read this id
+ * as a security boundary.
+ *
+ * @param options {object}
+ * @param options.wrapped {unknown}   the stored envelope
+ * @param options.label {string}   `'keyring'`, `'recovery'`, or an app record
+ *   kind's own label, naming the refusal
+ * @returns {string}   the envelope's addressed id
+ */
+export function recordEnvelopeId({ wrapped, label }) {
+    const id = wrapped !== null && typeof wrapped === 'object'
+        ? wrapped.id
+        : undefined;
+    if (typeof id !== 'string' || !id) {
+        throw new Error(`Malformed ${label} record: the sealed envelope carries no id.`);
+    }
+    return id;
+}
+/**
+ * Validates the common `{ version, encryption, wrapped }` frame of a stored
+ * record (keyring or recovery -- `label` names the refusals) and returns its
+ * members, the `proof` among them for the signed frame. Exported so an app's
+ * own record kinds open their records through the same frame validation the
+ * codec here seals with, rather than re-deriving the version and shape checks.
+ *
+ * A frame at the keyring record version is the signed frame, so it must carry
+ * a fixed-shape proof; a record kind stamping its own version is unaffected
+ * (its authenticity story is its own). Validating the shape here does not
+ * verify it -- `record.ts`'s `verifyRecordProof` does, and every unwrap path
+ * there runs it before decrypting.
+ *
+ * @param options {object}
+ * @param options.record {unknown}
+ * @param options.label {string}   `'keyring'`, `'recovery'`, or an app record
+ *   kind's own label
+ * @param [options.version] {number}   the version the frame must carry;
+ *   defaults to the keyring record version
+ * @returns {{ encryption: CollectionEncryption, wrapped: unknown,
+ *   proof?: RecordProof }}
+ */
+export function parseRecordFrame({ record, label, version = KEYRING_RECORD_VERSION }) {
+    if (record === null || typeof record !== 'object') {
+        throw new Error(`Malformed ${label} record.`);
+    }
+    const { version: recordVersion, encryption, wrapped, proof } = record;
+    if (recordVersion !== version) {
+        // Two retired version-1 shapes are named rather than reported as an
+        // unsupported number, so neither refusal is read as corruption: the
+        // pre-extraction record (a data-seed wrap with no descriptor) and the
+        // unsigned envelope this version's proof replaced. Both are unusable.
+        if (version === KEYRING_RECORD_VERSION && recordVersion === 1) {
+            if (encryption === undefined) {
+                throw new Error(`The ${label} record uses the retired pre-extraction version 1 ` +
+                    'shape (a data-seed wrap with no encryption descriptor); such ' +
+                    'accounts are re-provisioned, not migrated.');
+            }
+            throw new Error(`The ${label} record uses the retired unsigned version 1 shape (no ` +
+                'proof over its frame, so a storage host could substitute it); ' +
+                'such accounts are re-provisioned, not migrated.');
+        }
+        throw new Error(`Unsupported ${label} record version "${String(recordVersion)}".`);
+    }
+    if (wrapped === undefined || wrapped === null) {
+        throw new Error(`Malformed ${label} record.`);
+    }
+    if (encryption === null || typeof encryption !== 'object') {
+        throw new Error(`The ${label} record is missing its encryption descriptor.`);
+    }
+    return {
+        encryption: encryption,
+        wrapped,
+        ...(version === KEYRING_RECORD_VERSION
+            ? { proof: checkRecordProofShape({ proof, label }) }
+            : {})
+    };
+}
+/**
+ * The bind timestamp a wrap path stamps into a record's plaintext: the
+ * caller's, validated as a parseable ISO timestamp, or now. A caller supplies
+ * one when it pins record freshness, so it knows the stamp of the record it is
+ * writing without reading it back.
+ *
+ * @param options {object}
+ * @param [options.createdAt] {string}   the caller's timestamp
+ * @returns {string}
+ */
+export function recordCreatedAtStamp({ createdAt }) {
+    if (createdAt === undefined) {
+        return new Date().toISOString();
+    }
+    if (typeof createdAt !== 'string' || Number.isNaN(Date.parse(createdAt))) {
+        throw new Error(`Invalid record createdAt timestamp "${createdAt}".`);
+    }
+    return createdAt;
+}
+/**
+ * Parses and validates the required `createdAt` member of a record plaintext:
+ * the moment the record was bound, as an ISO timestamp that must parse. Apps
+ * pin freshness on it, so a record that cannot state its own bind time is
+ * refused rather than defaulted.
+ *
+ * @param options {object}
+ * @param options.value {unknown}   the plaintext's `createdAt` member
+ * @param options.label {string}   names the record kind in the refusal
+ * @returns {string}
+ */
+export function parseRecordCreatedAt({ value, label }) {
+    if (typeof value !== 'string' || Number.isNaN(Date.parse(value))) {
+        throw new Error(`${label} record has no valid createdAt timestamp.`);
+    }
+    return value;
+}
+/**
+ * Parses and validates the optional `pointer` member of a keyring record
+ * plaintext. An absent member is a no-WAS record (returns undefined); a
+ * present-but-malformed one throws -- a record that claims a pointer but
+ * cannot state where the account lives is unusable.
+ *
+ * @param value {unknown}   the record's `pointer` member
+ * @returns {AccountPointer | undefined}
+ */
+export function parseRecordPointer(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (value === null || typeof value !== 'object') {
+        throw new Error('Keyring record has a malformed account pointer.');
+    }
+    const { did, spaceId, host } = value;
+    if (typeof spaceId !== 'string' || !spaceId) {
+        throw new Error('Keyring record account pointer is missing its spaceId.');
+    }
+    if (typeof host !== 'string' || !host) {
+        throw new Error('Keyring record account pointer is missing its host.');
+    }
+    if (did !== undefined && (typeof did !== 'string' || !did)) {
+        throw new Error('Keyring record account pointer has a malformed did.');
+    }
+    return { ...(did ? { did } : {}), spaceId, host };
+}
+//# sourceMappingURL=recordEnvelope.js.map

package/dist/keyring/recordEnvelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordEnvelope.js","sourceRoot":"","sources":["../../src/keyring/recordEnvelope.ts"],"names":[],"mappings":"AA4BA,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,cAAc,EAGf,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAElE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AA4BvC;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,KAAK,EACL,KAAK,EAIN;IACC,MAAM,SAAS,GAAG,KAAoC,CAAA;IACtD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,SAAS,CAAC,WAAW,KAAK,gBAAgB;QAC1C,SAAS,CAAC,YAAY,KAAK,iBAAiB;QAC5C,OAAO,SAAS,CAAC,kBAAkB,KAAK,QAAQ;QAChD,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,EACxC,CAAC;QACD,MAAM,IAAI,gBAAgB,CACxB,OAAO,KAAK,8CAA8C;YACxD,0DAA0D,CAC7D,CAAA;IACH,CAAC;IACD,OAAO,SAAwB,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,eAAe,EAGhB;IACC,IAAI,MAAM,GAAgC,IAAI,CAAA;IAC9C,MAAM,KAAK,GAA8B;QACvC,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,GAAG,IAAI,CAAA;QACf,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,GAAG,IAAI,CAAA;QACf,CAAC;KACF,CAAA;IACD,OAAO,cAAc,CAAC;QACpB,KAAK;QACL,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;KAClD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,eAAe,EACf,WAAW,EACX,UAAU,EACV,YAAY,GAAG,kBAAkB,CAAC,EAAE,EAMrC;IACC,OAAO,kBAAkB,CAAC;QACxB,eAAe;QACf,WAAW;QACX,YAAY;QACZ,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,YAAY,GAAG,kBAAkB,CAAC,EAAE,EAIrC;IACC,OAAO,6BAA6B,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,OAAO,EACP,KAAK,EAIN;IACC,MAAM,EAAE,GACN,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAC7C,CAAC,CAAE,OAA4B,CAAC,EAAE;QAClC,CAAC,CAAC,SAAS,CAAA;IACf,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,6CAA6C,CAChE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,MAAM,EACN,KAAK,EACL,OAAO,GAAG,sBAAsB,EAKjC;IAKC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,EACJ,OAAO,EAAE,aAAa,EACtB,UAAU,EACV,OAAO,EACP,KAAK,EACN,GAAG,MAKH,CAAA;IACD,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;QAC9B,oEAAoE;QACpE,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,OAAO,KAAK,sBAAsB,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,OAAO,KAAK,oDAAoD;oBAC9D,+DAA+D;oBAC/D,4CAA4C,CAC/C,CAAA;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CACb,OAAO,KAAK,wDAAwD;gBAClE,gEAAgE;gBAChE,iDAAiD,CACpD,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,eAAe,KAAK,oBAAoB,MAAM,CAAC,aAAa,CAAC,IAAI,CAClE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,+CAA+C,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO;QACL,UAAU,EAAE,UAAkC;QAC9C,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,sBAAsB;YACpC,CAAC,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE;YACpD,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AA6BD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,SAAS,EAGV;IACC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACjC,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,IAAI,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,KAAK,EACL,KAAK,EAIN;IACC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAA;IACtE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAI9B,CAAA;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC"}

package/dist/keyring/unlockIdentity.d.ts

@@ -0,0 +1,71 @@
+import { CapabilityAgent } from '@interop/capability-agent';
+import type { ProfileAgents } from '@interop/was-client/identity';
+import type { UnlockKdf } from './kdf.js';
+import type { RecordSigner } from './record.js';
+/**
+ * The load-bearing `CapabilityAgent` derivation names for an unlock identity
+ * (the counterpart of the data identity's bootstrap names): every unlock
+ * derivation runs through these exact strings, so they can never change
+ * without stranding existing accounts.
+ */
+export declare const UNLOCK_HANDLE = "unlock";
+export declare const UNLOCK_KEY_NAME = "unlock-key";
+/**
+ * Derives the full unlock identity from an unlock secret: the unlock
+ * CapabilityAgent, a ZcapClient that can both invoke and delegate (the
+ * unlock agent delegates a management zcap on its own Space to the account
+ * controller at bind time), the unlock KAK + resolver for wrap/unwrap, the
+ * record signer that signs and verifies the keyring record's proof, and the
+ * unlock Space id. Performs no I/O -- the derivation seam for tests and future
+ * unlock methods.
+ *
+ * @param options {object}
+ * @param options.secret {string | Uint8Array}
+ * @param options.kdf {UnlockKdf}
+ * @returns {Promise<UnlockIdentity>}
+ */
+export declare function deriveUnlockIdentity({ secret, kdf }: {
+    secret: string | Uint8Array;
+    kdf: UnlockKdf;
+}): Promise<UnlockIdentity>;
+/**
+ * Assembles the unlock identity from an already-derived 32-byte unlock seed.
+ * The seam that lets an app run the expensive stretch once per typed secret:
+ * `deriveUnlockSeed` yields the seed, and both this assembly and the
+ * standing-credential expansion (`unlock/standingClient`) consume it.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the method's 32-byte unlock seed
+ * @returns {Promise<UnlockIdentity>}
+ */
+export declare function unlockIdentityFromSeed({ seed }: {
+    seed: Uint8Array;
+}): Promise<UnlockIdentity>;
+/**
+ * The unlock Space id an unlock identity addresses: was-client's
+ * `deriveSpaceId` over the unlock did:key (`base64url(SHA-256(did))`,
+ * unpadded) -- a discovery convention, not an authorization one (holding the
+ * id grants nothing). The address is wire-level (it is the one durable
+ * locator a fresh client holds), so it comes from the one shared derivation
+ * rather than a local restatement of it.
+ *
+ * @param options {object}
+ * @param options.did {string}   the unlock identity's did:key
+ * @returns {string}
+ */
+export declare function unlockSpaceIdFor({ did }: {
+    did: string;
+}): string;
+/**
+ * The derived unlock identity, as `deriveUnlockIdentity` returns it. Stated
+ * explicitly rather than inferred from the return: the agent set's members
+ * are named by `ProfileAgents`, so the emitted declaration references this
+ * package's own copy of those types rather than whichever copy a linked
+ * dependency happens to carry.
+ */
+export interface UnlockIdentity extends Pick<ProfileAgents, 'zcapClient' | 'keyAgreementKey' | 'keyResolver'> {
+    agent: CapabilityAgent;
+    recordSigner: RecordSigner;
+    spaceId: string;
+}
+//# sourceMappingURL=unlockIdentity.d.ts.map

package/dist/keyring/unlockIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlockIdentity.d.ts","sourceRoot":"","sources":["../../src/keyring/unlockIdentity.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAEjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAE3C;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,cAAc,CAAC,CAG1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4B1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,IAAI,CAC1C,aAAa,EACb,YAAY,GAAG,iBAAiB,GAAG,aAAa,CACjD;IACC,KAAK,EAAE,eAAe,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/dist/keyring/unlockIdentity.js

@@ -0,0 +1,96 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The unlock identity: what an unlock seed (`kdf.ts`) expands into. The
+ * identity's only jobs are addressing the minimal unlock Space and holding
+ * the key-agreement key the keyring record is encrypted to.
+ *
+ * Kept apart from the KDF so a caller that only derives a seed loads a hash
+ * library and nothing else. This file imports `kdf.ts`, and `kdf.ts` imports
+ * nothing from here.
+ */
+import { deriveSpaceId } from '@interop/was-client/sync';
+import { CapabilityAgent } from '@interop/capability-agent';
+import { agentsFromKeyAgent } from '@interop/was-client/identity';
+import { deriveUnlockSeed } from './kdf.js';
+import { recordSignerFromAgent } from './record.js';
+/**
+ * The load-bearing `CapabilityAgent` derivation names for an unlock identity
+ * (the counterpart of the data identity's bootstrap names): every unlock
+ * derivation runs through these exact strings, so they can never change
+ * without stranding existing accounts.
+ */
+export const UNLOCK_HANDLE = 'unlock';
+export const UNLOCK_KEY_NAME = 'unlock-key';
+/**
+ * Derives the full unlock identity from an unlock secret: the unlock
+ * CapabilityAgent, a ZcapClient that can both invoke and delegate (the
+ * unlock agent delegates a management zcap on its own Space to the account
+ * controller at bind time), the unlock KAK + resolver for wrap/unwrap, the
+ * record signer that signs and verifies the keyring record's proof, and the
+ * unlock Space id. Performs no I/O -- the derivation seam for tests and future
+ * unlock methods.
+ *
+ * @param options {object}
+ * @param options.secret {string | Uint8Array}
+ * @param options.kdf {UnlockKdf}
+ * @returns {Promise<UnlockIdentity>}
+ */
+export async function deriveUnlockIdentity({ secret, kdf }) {
+    const seed = await deriveUnlockSeed({ secret, kdf });
+    return unlockIdentityFromSeed({ seed });
+}
+/**
+ * Assembles the unlock identity from an already-derived 32-byte unlock seed.
+ * The seam that lets an app run the expensive stretch once per typed secret:
+ * `deriveUnlockSeed` yields the seed, and both this assembly and the
+ * standing-credential expansion (`unlock/standingClient`) consume it.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the method's 32-byte unlock seed
+ * @returns {Promise<UnlockIdentity>}
+ */
+export async function unlockIdentityFromSeed({ seed }) {
+    const agent = await CapabilityAgent.fromSeed({
+        seed,
+        handle: UNLOCK_HANDLE,
+        keyName: UNLOCK_KEY_NAME
+    });
+    // The unlock KAK is the Montgomery form of the unlock signing key -- the same
+    // derivation the client side uses (`agentsFromSeed`), so a returning user
+    // reconstitutes the exact key that wrapped the keyring record.
+    const { zcapClient, keyAgreementKey, keyResolver } = agentsFromKeyAgent({
+        keyAgent: agent
+    });
+    // The record signer is the unlock signing key itself, named by its public
+    // multibase: the keyring record's proof is made and checked against a key
+    // that derives from the secret, so the storage host never holds it and a
+    // fresh client holds the verification prior by construction.
+    const recordSigner = recordSignerFromAgent({ keyAgent: agent });
+    const spaceId = unlockSpaceIdFor({ did: agent.id });
+    return {
+        agent,
+        zcapClient,
+        keyAgreementKey,
+        keyResolver,
+        recordSigner,
+        spaceId
+    };
+}
+/**
+ * The unlock Space id an unlock identity addresses: was-client's
+ * `deriveSpaceId` over the unlock did:key (`base64url(SHA-256(did))`,
+ * unpadded) -- a discovery convention, not an authorization one (holding the
+ * id grants nothing). The address is wire-level (it is the one durable
+ * locator a fresh client holds), so it comes from the one shared derivation
+ * rather than a local restatement of it.
+ *
+ * @param options {object}
+ * @param options.did {string}   the unlock identity's did:key
+ * @returns {string}
+ */
+export function unlockSpaceIdFor({ did }) {
+    return deriveSpaceId(did);
+}
+//# sourceMappingURL=unlockIdentity.js.map

package/dist/keyring/unlockIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlockIdentity.js","sourceRoot":"","sources":["../../src/keyring/unlockIdentity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAGnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAA;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAA;AAE3C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EAIJ;IACC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpD,OAAO,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,eAAe;KACzB,CAAC,CAAA;IACF,8EAA8E;IAC9E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;QACtE,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAA;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAE/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO;QACL,KAAK;QACL,UAAU;QACV,eAAe;QACf,WAAW;QACX,YAAY;QACZ,OAAO;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,GAAG,EAAmB;IACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC"}

package/dist/keyring/unlockSpace.d.ts

@@ -30,9 +30,20 @@ import type { ZcapClient } from '@interop/ezcap';
  * apps unless a caller deliberately overrides it.
  */
 export declare const UNLOCK_SPACE_NAME = "Freewallet Keyring";
+/**
+ * The Space Description `type` array every unlock Space is created with,
+ * passphrase, passkey, and recovery-code alike (the keyring record inside
+ * names the credential kind). Wire-level and permanent: the server treats a
+ * Space's `type` as immutable after creation, and it is what recognizes an
+ * unlock Space from its Space Metadata object alone. `AuxiliarySpace` marks a
+ * bookkeeping Space holding no user data; `UnlockSpace` names the role.
+ * Sorted lexically, as the WAS spec recommends for a stable serialization.
+ */
+export declare const UNLOCK_SPACE_TYPE: string[];
 /**
  * Ensures the unlock Space and its single `keyring` collection exist
- * (upsert -- idempotent). Runs with the unlock root capability, so `force`
+ * (upsert -- idempotent). The Space is configured with
+ * {@link UNLOCK_SPACE_TYPE}. Runs with the unlock root capability, so `force`
  * lets the collection upsert treat a 404 from the pre-merge describe as
  * genuinely absent rather than unreadable.
  *

package/dist/keyring/unlockSpace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlockSpace.d.ts","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAa,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAA;AAwIrD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAwB,EACzB,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAY1B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAOhD"}
+{"version":3,"file":"unlockSpace.d.ts","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAa,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAA;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,UAA6C,CAAA;AAwI3E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAwB,EACzB,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAY1B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAOhD"}

package/dist/keyring/unlockSpace.js

@@ -30,6 +30,16 @@ import { plaintextCollection } from '../space/plaintextCollection.js';
  * apps unless a caller deliberately overrides it.
  */
 export const UNLOCK_SPACE_NAME = 'Freewallet Keyring';
+/**
+ * The Space Description `type` array every unlock Space is created with,
+ * passphrase, passkey, and recovery-code alike (the keyring record inside
+ * names the credential kind). Wire-level and permanent: the server treats a
+ * Space's `type` as immutable after creation, and it is what recognizes an
+ * unlock Space from its Space Metadata object alone. `AuxiliarySpace` marks a
+ * bookkeeping Space holding no user data; `UnlockSpace` names the role.
+ * Sorted lexically, as the WAS spec recommends for a stable serialization.
+ */
+export const UNLOCK_SPACE_TYPE = ['AuxiliarySpace', 'Space', 'UnlockSpace'];
 /**
  * The bare WAS client for an unlock Space (see the module doc for why it wires
  * in no encryption provider). Each exported function builds one and hands it
@@ -118,7 +128,8 @@ async function putPlaintextRecord({ was, spaceId, collectionId, resourceId, reco
 }
 /**
  * Ensures the unlock Space and its single `keyring` collection exist
- * (upsert -- idempotent). Runs with the unlock root capability, so `force`
+ * (upsert -- idempotent). The Space is configured with
+ * {@link UNLOCK_SPACE_TYPE}. Runs with the unlock root capability, so `force`
  * lets the collection upsert treat a 404 from the pre-merge describe as
  * genuinely absent rather than unreadable.
  *
@@ -139,7 +150,9 @@ export async function ensureUnlockSpace({ storageServerUrl, zcapClient, serviceD
         zcapClient,
         serviceDescription
     });
-    await was.space(spaceId).configure({ name, controller });
+    await was
+        .space(spaceId)
+        .configure({ name, controller, type: UNLOCK_SPACE_TYPE });
     await ensurePlaintextCollection({
         was,
         spaceId,

package/dist/keyring/unlockSpace.js.map

@@ -1 +1 @@
-{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAA2B,MAAM,qBAAqB,CAAA;AAGxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAKnB;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,IAAI,EAML;IACC,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EAOX;IACC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,GAAG;QACH,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC;SACC,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EACN,UAAU,EAQX;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SAClE,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAQzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IACxD,MAAM,yBAAyB,CAAC;QAC9B,GAAG;QACH,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EAQX;IACC,MAAM,kBAAkB,CAAC;QACvB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;QACN,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAA2B,MAAM,qBAAqB,CAAA;AAGxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAKnB;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,IAAI,EAML;IACC,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EAOX;IACC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,GAAG;QACH,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC;SACC,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EACN,UAAU,EAQX;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SAClE,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAQzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC3D,MAAM,yBAAyB,CAAC;QAC9B,GAAG;QACH,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EAQX;IACC,MAAM,kBAAkB,CAAC;QACvB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;QACN,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAA;AAC/D,CAAC"}

package/dist/keys/index.d.ts

@@ -95,12 +95,15 @@
  *   `WalletSpaceProvisioningError` when a collection was left without its
  *   epoch so the engine never memoizes a torn run.
  */
-export { mintUserKey, USER_KEY_SALT, userKeyRecordSigner, userKeySigningKeyMultibase, userKeySigningSeed, userKeyVaultKeys } from './userKey.js';
+export { mintUserKey, USER_KEY_SALT, userKeyVaultKeys } from './userKey.js';
+export { userKeyRecordSigner, userKeySigningKeyMultibase, userKeySigningSeed } from './userKeySigning.js';
 export type { UserKey } from './userKey.js';
 export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, isEnrolledClientKeyRecord, parseClientRecordPending, parseClientRecordUserKey, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
 export type { ClientKeyRecord, ClientKeyRecordJson, ClientKeyRecordPending, EnrolledClientKeyRecord } from './clientKeyRecord.js';
-export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientKid, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
-export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
+export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
+export { rosterRecipientKid } from './rosterRecipientKid.js';
+export { cascadeCollectionsToUserKey, rotateCollectionEpochsToUserKey } from './userKeyCascade.js';
+export { unwrapUserKeyGenerations, userKeyAsRecipient } from './userKeyGenerations.js';
 export type { CollectionUserKeyRotationOutcome, UserKeyCascadeResult } from './userKeyCascade.js';
 export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
 export type { CascadeCollections, RosterCascadeResult, RosterSealReport, UserKeyAdoptedHook } from './userKeyRosterCascade.js';

package/dist/keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EACL,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3E,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAChC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,yBAAyB,CAAA;AAChC,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/index.js

@@ -95,10 +95,13 @@
  *   `WalletSpaceProvisioningError` when a collection was left without its
  *   epoch so the engine never memoizes a torn run.
  */
-export { mintUserKey, USER_KEY_SALT, userKeyRecordSigner, userKeySigningKeyMultibase, userKeySigningSeed, userKeyVaultKeys } from './userKey.js';
+export { mintUserKey, USER_KEY_SALT, userKeyVaultKeys } from './userKey.js';
+export { userKeyRecordSigner, userKeySigningKeyMultibase, userKeySigningSeed } from './userKeySigning.js';
 export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, isEnrolledClientKeyRecord, parseClientRecordPending, parseClientRecordUserKey, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
-export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientKid, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
-export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
+export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
+export { rosterRecipientKid } from './rosterRecipientKid.js';
+export { cascadeCollectionsToUserKey, rotateCollectionEpochsToUserKey } from './userKeyCascade.js';
+export { unwrapUserKeyGenerations, userKeyAsRecipient } from './userKeyGenerations.js';
 export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
 export { accountCollectionStores, collectionDescriptorLogStore, collectionDescriptorStores } from './collectionLogStore.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';

package/dist/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EACL,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,cAAc,CAAA;AAGrB,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAalC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAG/D,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC3E,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAChC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EACnB,MAAM,yBAAyB,CAAA;AAKhC,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAalC,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC3B,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAG/D,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/rosterLogStore.d.ts

@@ -31,7 +31,7 @@
  * current-epoch wrap) appends nothing, leaving the log's head carrying a
  * controller version before the membership change it should have sealed.
  */
-import { EPOCH_CONFIGURATION_STATE_TYPE, type EncryptionDescriptorStore } from '@interop/was-client/edv';
+import { EPOCH_CONFIGURATION_STATE_TYPE, type EncryptionDescriptorStore } from '@interop/was-client/edv/core';
 import type { ResourceLogPinStore, ResourceLogSigner, ResourceLogStore } from '@interop/vh-resource-log';
 import { type ResourceLogClass, type WebvhResourceLogController } from '../resourceLog/index.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE };

package/dist/keys/rosterLogStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAEL,8BAA8B,EAC9B,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;IAClC,2BAA2B,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,0BAA0B,CAAA;KACvC,GAAG,IAAI,CAAA;CACT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,yBAAyB,GAC/B,KAAK,IAAI,iCAAiC,CAM5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,iBAAiB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,iCAAiC,CA2DpC"}
+{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAEL,8BAA8B,EAC9B,KAAK,yBAAyB,EAC/B,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;IAClC,2BAA2B,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,0BAA0B,CAAA;KACvC,GAAG,IAAI,CAAA;CACT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,yBAAyB,GAC/B,KAAK,IAAI,iCAAiC,CAM5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,iBAAiB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,iCAAiC,CA2DpC"}