@interop/wallet-core 0.9.0 → 0.10.0

package/dist/webvh/revokeClient.js

@@ -0,0 +1,241 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Client revocation, the did:webvh half: removing an enrolled wallet client
+ * from the document roster. Per the identity model this is a pure roster edit
+ * -- nothing shared rotates, because nothing was shared -- and, because a
+ * removal reveals no new key, it is a SINGLE log entry (unlike enrollment's
+ * two): the client's Ed25519 verification method leaves all four signing
+ * relationships, its X25519 twin leaves `keyAgreement`, its update key leaves
+ * `updateKeys`, and both of its standing commitments leave `nextKeyHashes` --
+ * the carry-over hash of its active update key, and the hash of its staged
+ * key.
+ *
+ * The staged-key hash is the subtle half, and removing it is load-bearing: a
+ * hash left committed in `nextKeyHashes` is a standing credential -- an entry
+ * verifies against its own re-stated `updateKeys`, each hashing into the
+ * previous entry's commitments, so a revoked client whose staged hash
+ * survived could author an entry revealing that key and re-seize update
+ * authority (the same reveal mechanism recovery uses legitimately). The hash
+ * itself is opaque (only the revoked client ever held the staged key), so it
+ * is recovered by **log attribution**: every staged commitment was added in
+ * the entry that revealed or committed its client's active key -- genesis,
+ * an enrollment commit, a rotation, a recovery reveal-and-commit -- and
+ * diffing that entry's `nextKeyHashes` against its predecessor isolates it.
+ * The one ambiguous shape is a recovery continuation, whose commit entry also
+ * carries the replacement code's latent hash; the caller disambiguates by
+ * supplying the standing recovery-code hashes it knows
+ * (`knownLatentHashes`, from its recovery registry), and a residue of more
+ * than one candidate refuses loudly rather than guessing
+ * ({@link StagedCommitmentAmbiguousError}) -- removing a wrong hash would
+ * either leave the revoked client re-enrollable or brick another party's
+ * standing commitment.
+ */
+import { deriveNextKeyHash, updateDID } from '@interop/did-method-webvh';
+import { assertCarryOverCommitments, publishWebvhLog, readPublishedLog, relationIds, updateKeyMultibase, updateKeySigner } from './didWebvh.js';
+/**
+ * Thrown when the log attribution cannot isolate the revoked client's staged
+ * commitment to a single hash -- more than one candidate survives after the
+ * known latent (recovery-code) hashes are excluded. Refusing beats guessing:
+ * see the module doc. The fix is to pass the standing recovery codes' update-
+ * key hashes as `knownLatentHashes`.
+ */
+export class StagedCommitmentAmbiguousError extends Error {
+    candidates;
+    constructor({ candidates }) {
+        super("did:webvh: the revoked client's staged-key commitment cannot be " +
+            'isolated in nextKeyHashes (more than one candidate hash); pass the ' +
+            "standing recovery codes' update-key hashes as knownLatentHashes.");
+        this.name = 'StagedCommitmentAmbiguousError';
+        this.candidates = candidates;
+    }
+}
+/**
+ * The per-entry EFFECTIVE `updateKeys` / `nextKeyHashes` of a log, with
+ * did:webvh's carry-forward semantics applied (an entry that omits a
+ * parameter inherits the previous entry's value).
+ *
+ * @param log {DIDLog}
+ * @returns {Array<{ updateKeys: string[]; nextKeyHashes: string[] }>}
+ */
+function effectiveParameters(log) {
+    const out = [];
+    let updateKeys = [];
+    let nextKeyHashes = [];
+    for (const entry of log) {
+        if (entry.parameters?.updateKeys) {
+            updateKeys = entry.parameters.updateKeys;
+        }
+        if (entry.parameters?.nextKeyHashes) {
+            nextKeyHashes = entry.parameters.nextKeyHashes;
+        }
+        out.push({ updateKeys, nextKeyHashes });
+    }
+    return out;
+}
+/**
+ * Recovers the revoked client's staged-key hash from the log (see the module
+ * doc for why attribution works and where it can be ambiguous). Resolves
+ * `undefined` when there is nothing to attribute -- the client's key never
+ * entered `updateKeys`, or its commitment event added no other hash (already
+ * cleaned up).
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}
+ * @param options.revokedUpdateKey {string}   the revoked client's active
+ *   update-key multibase
+ * @param options.knownLatentHashes {string[]}   standing latent commitments
+ *   the caller can vouch for (recovery-code update-key hashes)
+ * @returns {Promise<string | undefined>}
+ */
+async function attributeStagedHash({ log, revokedUpdateKey, knownLatentHashes }) {
+    const revokedHash = await deriveNextKeyHash(revokedUpdateKey);
+    const params = effectiveParameters(log);
+    const added = (index) => {
+        const previous = new Set(index > 0 ? params[index - 1].nextKeyHashes : []);
+        return new Set(params[index].nextKeyHashes.filter(hash => !previous.has(hash)));
+    };
+    const prune = (candidates) => {
+        candidates.delete(revokedHash);
+        for (const hash of knownLatentHashes) {
+            candidates.delete(hash);
+        }
+        return candidates;
+    };
+    // The entry where the revoked client's active key ENTERED updateKeys (the
+    // latest such, in case of anything odd).
+    let revealIndex = -1;
+    for (let index = params.length - 1; index >= 0; index--) {
+        const present = params[index].updateKeys.includes(revokedUpdateKey);
+        const before = index > 0 && params[index - 1].updateKeys.includes(revokedUpdateKey);
+        if (present && !before) {
+            revealIndex = index;
+            break;
+        }
+    }
+    if (revealIndex === -1) {
+        return undefined;
+    }
+    // A rotation entry commits the fresh staged hash in the same entry that
+    // reveals the new active key (genesis likewise commits both of its hashes
+    // in entry one), so the reveal entry's own additions are tried first. An
+    // enrollment add or a recovery add-and-retire adds no hash at the reveal.
+    const atReveal = prune(added(revealIndex));
+    if (atReveal.size === 1) {
+        return [...atReveal][0];
+    }
+    if (atReveal.size > 1) {
+        throw new StagedCommitmentAmbiguousError({ candidates: [...atReveal] });
+    }
+    // Fall back to the entry that COMMITTED the revoked key's own hash (an
+    // enrollment commit entry, or a recovery reveal-and-commit): the staged
+    // hash was added beside it.
+    let commitIndex = -1;
+    for (let index = revealIndex; index >= 0; index--) {
+        const present = params[index].nextKeyHashes.includes(revokedHash);
+        const before = index > 0 && params[index - 1].nextKeyHashes.includes(revokedHash);
+        if (present && !before) {
+            commitIndex = index;
+            break;
+        }
+    }
+    if (commitIndex === -1) {
+        return undefined;
+    }
+    const atCommit = prune(added(commitIndex));
+    if (atCommit.size > 1) {
+        throw new StagedCommitmentAmbiguousError({ candidates: [...atCommit] });
+    }
+    return atCommit.size === 1 ? [...atCommit][0] : undefined;
+}
+/**
+ * REVOCATION (run by another enrolled client, root authority): removes an
+ * enrolled wallet client from the published document -- its two verification
+ * methods out of the document and all five relationship arrays, its update
+ * key out of `updateKeys`, and its carry-over and staged hashes out of
+ * `nextKeyHashes` -- in one log entry (a removal reveals no key, so
+ * prerotation forces no commit entry). Under the current-key-set rule this
+ * single edit is also the revoked client's pull axis everywhere: its
+ * invocations and every delegation it signed stop verifying the moment its
+ * verification method leaves the document.
+ *
+ * Idempotent: a client with no remaining presence (verification methods,
+ * update key, commitments all gone) is a no-op, so a naive re-run after a
+ * mid-cascade crash converges without forking the log.
+ *
+ * Self-revocation is refused: the entry is signed by THIS client's active
+ * update key, and a client that removed its own key could not have signed
+ * the removal the resolver will verify (and would strand the cascade that
+ * follows the document edit). Revoking the last remaining client is refused
+ * by the same guard.
+ *
+ * @param options {object}
+ * @param options.idStore {WebvhIdStore}
+ * @param options.updateKeys {ClientWebvhUpdateKeys}   the REVOKING client's
+ *   own did:webvh update-key seeds
+ * @param options.revokedClient {RevokedClientKeys}   the revoked client's
+ *   public halves
+ * @param [options.knownLatentHashes] {string[]}   standing latent commitments
+ *   the caller vouches for (the recovery registry's update-key hashes),
+ *   excluded from the staged-hash attribution
+ * @returns {Promise<{ did: string }>}
+ */
+export async function revokeWebvhClient({ idStore, updateKeys, revokedClient, knownLatentHashes = [] }) {
+    const published = await readPublishedLog({ idStore });
+    if (!published) {
+        throw new Error('did:webvh: did.jsonl is missing; nothing to revoke from.');
+    }
+    const { did, doc } = published;
+    const activeKey = await updateKeyMultibase({ seed: updateKeys.updateSeed });
+    if (revokedClient.updateKeyMultibase === activeKey) {
+        throw new Error('did:webvh: a client cannot revoke itself; disconnect this client ' +
+            'from another enrolled client instead.');
+    }
+    const signingVmId = `${did}#${revokedClient.signingKeyMultibase}`;
+    const keyAgreementVmId = `${did}#${revokedClient.keyAgreementKeyMultibase}`;
+    const revokedHash = await deriveNextKeyHash(revokedClient.updateKeyMultibase);
+    const existingMethods = (doc.verificationMethod ?? []);
+    const vmPresent = existingMethods.some(method => method.id === signingVmId || method.id === keyAgreementVmId);
+    const keyPresent = published.updateKeys.includes(revokedClient.updateKeyMultibase);
+    const hashPresent = published.nextKeyHashes.includes(revokedHash);
+    if (!vmPresent && !keyPresent && !hashPresent) {
+        return { did };
+    }
+    if (!published.updateKeys.includes(activeKey)) {
+        throw new Error("did:webvh: the published log does not authorize this client's active " +
+            'update key; finalize the pending rotation before revoking a client.');
+    }
+    await assertCarryOverCommitments({ published });
+    // The revoked client's staged commitment, recovered from the log while the
+    // log still shows the enrollment (attribution needs the standing entries,
+    // so this runs before the removal entry is built).
+    const stagedHash = keyPresent
+        ? await attributeStagedHash({
+            log: published.log,
+            revokedUpdateKey: revokedClient.updateKeyMultibase,
+            knownLatentHashes
+        })
+        : undefined;
+    const removedHashes = new Set([revokedHash, stagedHash].filter((hash) => hash !== undefined));
+    const removedVmIds = new Set([signingVmId, keyAgreementVmId]);
+    const signer = await updateKeySigner({ seed: updateKeys.updateSeed });
+    const updated = await updateDID({
+        log: published.log,
+        signer,
+        updateKeys: published.updateKeys.filter(key => key !== revokedClient.updateKeyMultibase),
+        nextKeyHashes: published.nextKeyHashes.filter(hash => !removedHashes.has(hash)),
+        verificationMethods: existingMethods.filter(method => !method.id || !removedVmIds.has(method.id)),
+        authentication: relationIds(doc.authentication).filter(id => id !== signingVmId),
+        assertionMethod: relationIds(doc.assertionMethod).filter(id => id !== signingVmId),
+        keyAgreement: relationIds(doc.keyAgreement).filter(id => id !== keyAgreementVmId),
+        capabilityInvocation: relationIds(doc.capabilityInvocation).filter(id => id !== signingVmId),
+        capabilityDelegation: relationIds(doc.capabilityDelegation).filter(id => id !== signingVmId)
+    });
+    if (!updated.webDoc) {
+        throw new Error('did:webvh: updateDID returned no webDoc despite the did:web alsoKnownAs.');
+    }
+    await publishWebvhLog({ idStore, log: updated.log, webDoc: updated.webDoc });
+    return { did: updated.did };
+}
+//# sourceMappingURL=revokeClient.js.map

package/dist/webvh/revokeClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revokeClient.js","sourceRoot":"","sources":["../../src/webvh/revokeClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAExE,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,eAAe,EAChB,MAAM,eAAe,CAAA;AAiBtB;;;;;;GAMG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,UAAU,CAAU;IACpB,YAAY,EAAE,UAAU,EAA4B;QAClD,KAAK,CACH,kEAAkE;YAChE,qEAAqE;YACrE,kEAAkE,CACrE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAA;QAC5C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,GAAW;IAEX,MAAM,GAAG,GAA6D,EAAE,CAAA;IACxE,IAAI,UAAU,GAAa,EAAE,CAAA;IAC7B,IAAI,aAAa,GAAa,EAAE,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;YACjC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAA;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC;YACpC,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,aAAa,CAAA;QAChD,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,mBAAmB,CAAC,EACjC,GAAG,EACH,gBAAgB,EAChB,iBAAiB,EAKlB;IACC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAe,EAAE;QAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC3E,OAAO,IAAI,GAAG,CACZ,MAAM,CAAC,KAAK,CAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACjE,CAAA;IACH,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,CAAC,UAAuB,EAAe,EAAE;QACrD,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC9B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;YACrC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QACD,OAAO,UAAU,CAAA;IACnB,CAAC,CAAA;IAED,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAA;IACpB,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QACpE,MAAM,MAAM,GACV,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QACvE,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,WAAW,GAAG,KAAK,CAAA;YACnB,MAAK;QACP,CAAC;IACH,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1C,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACzB,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,8BAA8B,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,4BAA4B;IAC5B,IAAI,WAAW,GAAG,CAAC,CAAC,CAAA;IACpB,KAAK,IAAI,KAAK,GAAG,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAClE,MAAM,MAAM,GACV,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACrE,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,WAAW,GAAG,KAAK,CAAA;YACnB,MAAK;QACP,CAAC;IACH,CAAC;IACD,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1C,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,8BAA8B,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,GAAG,EAAE,EAMvB;IACC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACrD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAE9B,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3E,IAAI,aAAa,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,uCAAuC,CAC1C,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,aAAa,CAAC,mBAAmB,EAAE,CAAA;IACjE,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,aAAa,CAAC,wBAAwB,EAAE,CAAA;IAC3E,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAA;IAC7E,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CACpC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,WAAW,IAAI,MAAM,CAAC,EAAE,KAAK,gBAAgB,CACtE,CAAA;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAC9C,aAAa,CAAC,kBAAkB,CACjC,CAAA;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACjE,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,EAAE,GAAG,EAAE,CAAA;IAChB,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,qEAAqE,CACxE,CAAA;IACH,CAAC;IACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAE/C,2EAA2E;IAC3E,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,MAAM,mBAAmB,CAAC;YACxB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,gBAAgB,EAAE,aAAa,CAAC,kBAAkB;YAClD,iBAAiB;SAClB,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IAEb,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,MAAM,CAC9B,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAC7C,CACF,CAAA;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IACrE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,MAAM,CACrC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,aAAa,CAAC,kBAAkB,CAChD;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CACjC;QACD,mBAAmB,EAAE,eAAe,CAAC,MAAM,CACzC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CACrD;QACD,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CACpD,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CACzB;QACD,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CACtD,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CACzB;QACD,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAChD,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,gBAAgB,CAC9B;QACD,oBAAoB,EAAE,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAChE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CACzB;QACD,oBAAoB,EAAE,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAChE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CACzB;KACF,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAA;IACH,CAAC;IACD,MAAM,eAAe,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;AAC7B,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/wallet-core",
   "description": "Shared wallet-domain logic (WAS sync engine core and wallet Space layout contracts) for Interop wallet apps.",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -114,9 +114,9 @@
     "@interop/ed25519-signature": "^7.1.4",
     "@interop/ed25519-verification-key": "^8.0.3",
     "@interop/ezcap": "^7.4.1",
-    "@interop/security-document-loader": "^9.5.0",
+    "@interop/security-document-loader": "^9.5.1",
     "@interop/vc": "^11.0.6",
-    "@interop/was-client": "^0.23.0",
+    "@interop/was-client": "^0.24.0",
     "@interop/webkms-client": "^14.7.1",
     "@interop/x25519-key-agreement-key": "^5.2.1",
     "@noble/hashes": "^2.2.0",