@interop/wallet-core 0.97.0 → 0.99.0

package/dist/clientAnnex/recoveryLadderAnchored.js

@@ -17,7 +17,7 @@ import { unlockKeyVerificationMethod, unlockKeyVmId } from '../unlock/standingWe
 import { RECOVERY_CODE_SPEND_REFUSALS, recoveryContinuationOnce, spendOutcome } from '../recovery/continuation.js';
 import { ceremonyEvents } from '../ceremonyEvents.js';
 import { log } from '../log.js';
-import { ladderRung, ladderVmKeyMultibase } from './ladder.js';
+import { ladderRung, ladderVmKeyMultibase } from '../webvh/ladderDerivation.js';
 import { clientAnnexDidParts, servicesPointedAtClientAnnex } from './log.js';
 /**
  * THE TRANSIENT-RECOVERY CONTINUATION (run by the code-derived client through

package/dist/clientAnnex/recoveryLadderAnchored.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryLadderAnchored.js","sourceRoot":"","sources":["../../src/clientAnnex/recoveryLadderAnchored.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,2BAA2B,EAC3B,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,YAAY,EACb,MAAM,6BAA6B,CAAA;AAQpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgJG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAWhD;IAUC,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,6DAA6D;IAC7D,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,mEAAmE;YACjE,oEAAoE;YACpE,oCAAoC,CACvC,CAAA;IACH,CAAC;IACD,MAAM,EACJ,UAAU,EACV,sBAAsB,EACtB,WAAW,EACX,MAAM,EACN,WAAW,EACX,GAAG,MAAM,EACV,GAAG,OAAO,CAAA;IACX,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACpC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;KACrC,CAAC,CAAA;IACF,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,yEAAyE;IACzE,MAAM,MAAM,GAAG,cAAc,CAAyB;QACpD,QAAQ,EAAE,qBAAqB;QAC/B,GAAG;QACH,QAAQ,EAAE,4BAA4B;KACvC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAC9B,GAAG,EAAE,CACH,oBAAoB,CAAC,GAAG,EAAE,CACxB,wBAAwB,CAAC;QACvB,GAAG,MAAM;QACT,SAAS,EAAE;YACT,kBAAkB,EAAE,KAAK,CAAC,YAAY;YACtC,UAAU,EAAE,KAAK,CAAC,IAAI;YACtB,kBAAkB,EAAE,KAAK,CAAC,YAAY;SACvC;QACD,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,2CAA2C;QAC3C,WAAW;QACX,mEAAmE;QACnE,+DAA+D;QAC/D,mEAAmE;QACnE,eAAe,EAAE,GAAG,CAAC,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,sBAAsB,EAAE,CAAC;SAC7D;QACD,qEAAqE;QACrE,yDAAyD;QACzD,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,4DAA4D;QAC5D,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE;YACjC,gEAAgE;YAChE,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAA;YACtD,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;YAC1C,MAAM,cAAc,GAAG,aAAa,CAAC;gBACnC,GAAG;gBACH,YAAY,EAAE,sBAAsB;aACrC,CAAC,CAAA;YACF,OAAO;gBACL,OAAO,EAAE;oBACP,wBAAwB,CAAC;wBACvB,UAAU,EAAE,GAAG;wBACf,kBAAkB,EAAE,WAAW;qBAChC,CAAC;oBACF,2BAA2B,CAAC;wBAC1B,GAAG;wBACH,YAAY,EAAE,sBAAsB;wBACpC,gBAAgB;qBACjB,CAAC;iBACH;gBACD,eAAe,EAAE,CAAC,UAAU,CAAC;gBAC7B,YAAY,EAAE,CAAC,cAAc,CAAC;gBAC9B,oBAAoB,EAAE,CAAC,UAAU,CAAC;gBAClC,QAAQ,EAAE,4BAA4B,CAAC;oBACrC,GAAG;oBACH,UAAU,EAAE,GAAG;oBACf,cAAc,EAAE,SAAS,CAAC,cAAc;iBACzC,CAAC;aACH,CAAA;QACH,CAAC;QACD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM;KACP,CAAC,CACH,EACH,YAAY,CACb,CAAA;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"recoveryLadderAnchored.js","sourceRoot":"","sources":["../../src/clientAnnex/recoveryLadderAnchored.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAE7D,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,2BAA2B,EAC3B,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,YAAY,EACb,MAAM,6BAA6B,CAAA;AAQpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgJG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAWhD;IAUC,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,6DAA6D;IAC7D,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,mEAAmE;YACjE,oEAAoE;YACpE,oCAAoC,CACvC,CAAA;IACH,CAAC;IACD,MAAM,EACJ,UAAU,EACV,sBAAsB,EACtB,WAAW,EACX,MAAM,EACN,WAAW,EACX,GAAG,MAAM,EACV,GAAG,OAAO,CAAA;IACX,yEAAyE;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACpC,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACpC,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC;KACrC,CAAC,CAAA;IACF,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,yEAAyE;IACzE,MAAM,MAAM,GAAG,cAAc,CAAyB;QACpD,QAAQ,EAAE,qBAAqB;QAC/B,GAAG;QACH,QAAQ,EAAE,4BAA4B;KACvC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAC9B,GAAG,EAAE,CACH,oBAAoB,CAAC,GAAG,EAAE,CACxB,wBAAwB,CAAC;QACvB,GAAG,MAAM;QACT,SAAS,EAAE;YACT,kBAAkB,EAAE,KAAK,CAAC,YAAY;YACtC,UAAU,EAAE,KAAK,CAAC,IAAI;YACtB,kBAAkB,EAAE,KAAK,CAAC,YAAY;SACvC;QACD,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,2CAA2C;QAC3C,WAAW;QACX,mEAAmE;QACnE,+DAA+D;QAC/D,mEAAmE;QACnE,eAAe,EAAE,GAAG,CAAC,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,sBAAsB,EAAE,CAAC;SAC7D;QACD,qEAAqE;QACrE,yDAAyD;QACzD,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,iEAAiE;QACjE,4DAA4D;QAC5D,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE;YACjC,gEAAgE;YAChE,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAA;YACtD,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;YAC1C,MAAM,cAAc,GAAG,aAAa,CAAC;gBACnC,GAAG;gBACH,YAAY,EAAE,sBAAsB;aACrC,CAAC,CAAA;YACF,OAAO;gBACL,OAAO,EAAE;oBACP,wBAAwB,CAAC;wBACvB,UAAU,EAAE,GAAG;wBACf,kBAAkB,EAAE,WAAW;qBAChC,CAAC;oBACF,2BAA2B,CAAC;wBAC1B,GAAG;wBACH,YAAY,EAAE,sBAAsB;wBACpC,gBAAgB;qBACjB,CAAC;iBACH;gBACD,eAAe,EAAE,CAAC,UAAU,CAAC;gBAC7B,YAAY,EAAE,CAAC,cAAc,CAAC;gBAC9B,oBAAoB,EAAE,CAAC,UAAU,CAAC;gBAClC,QAAQ,EAAE,4BAA4B,CAAC;oBACrC,GAAG;oBACH,UAAU,EAAE,GAAG;oBACf,cAAc,EAAE,SAAS,CAAC,cAAc;iBACzC,CAAC;aACH,CAAA;QACH,CAAC;QACD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM;KACP,CAAC,CACH,EACH,YAAY,CACb,CAAA;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/clientAnnex/zcap.js

@@ -10,7 +10,7 @@
  */
 import { Ed25519VerificationKey } from '@interop/ed25519-verification-key';
 import { zcapClientForSigner } from '@interop/was-client';
-import { ladderVmSeed } from './ladder.js';
+import { ladderVmSeed } from '../webvh/ladderDerivation.js';
 /**
  * What the ladder VM's key material amounts to for a caller: its public
  * multibase and a bound `sign`, generated once from the seed. Both entry

package/dist/clientAnnex/zcap.js.map

@@ -1 +1 @@
-{"version":3,"file":"zcap.js","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,EAAE,UAAU,EAA8B;IAC3E,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;KACnC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAA;IACxC,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,IAAI,EAAE,CAAC,OAA6B,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;KACjE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,UAAU,EACV,UAAU,EAIX;IACC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1D,OAAO,uBAAuB,CAAC;QAC7B,QAAQ;QACR,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAAC,EAC/B,QAAQ,EACR,UAAU,EAOX;IACC,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;IAC7C,MAAM,UAAU,GAAG,UAAU,IAAI,WAAW,kBAAkB,EAAE,CAAA;IAChE,OAAO;QACL,kBAAkB;QAClB,UAAU;QACV,MAAM,EAAE;YACN,EAAE,EAAE,GAAG,UAAU,IAAI,kBAAkB,EAAE;YACzC,IAAI,EAAE,4BAA4B;YAClC,IAAI;SACL;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EAIX;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,UAAU,EAGX;IACC,OAAO,eAAe,CAAC;QACrB,QAAQ,EAAE,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,EACvB,QAAQ,EAMT;IACC,iEAAiE;IACjE,kEAAkE;IAClE,MAAM,EACJ,kBAAkB,EAClB,UAAU,EAAE,GAAG,EACf,MAAM,EACP,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACzC,OAAO;QACL,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,4BAA4B;YAClC,UAAU,EAAE,GAAG;YACf,kBAAkB;SACnB,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,UAAU,EAIX;IACC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;IACpE,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;QACpC,UAAU,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAA;AACH,CAAC"}
+{"version":3,"file":"zcap.js","sourceRoot":"","sources":["../../src/clientAnnex/zcap.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAE3D;;;;;;;;;GASG;AACH,KAAK,UAAU,mBAAmB,CAAC,EAAE,UAAU,EAA8B;IAC3E,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;KACnC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAA;IACxC,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,IAAI,EAAE,CAAC,OAA6B,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;KACjE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,UAAU,EACV,UAAU,EAIX;IACC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1D,OAAO,uBAAuB,CAAC;QAC7B,QAAQ;QACR,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAAC,EAC/B,QAAQ,EACR,UAAU,EAOX;IACC,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAA;IAC7C,MAAM,UAAU,GAAG,UAAU,IAAI,WAAW,kBAAkB,EAAE,CAAA;IAChE,OAAO;QACL,kBAAkB;QAClB,UAAU;QACV,MAAM,EAAE;YACN,EAAE,EAAE,GAAG,UAAU,IAAI,kBAAkB,EAAE;YACzC,IAAI,EAAE,4BAA4B;YAClC,IAAI;SACL;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,UAAU,EACV,UAAU,EAIX;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACnE,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,UAAU,EAGX;IACC,OAAO,eAAe,CAAC;QACrB,QAAQ,EAAE,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,EACvB,QAAQ,EAMT;IACC,iEAAiE;IACjE,kEAAkE;IAClE,MAAM,EACJ,kBAAkB,EAClB,UAAU,EAAE,GAAG,EACf,MAAM,EACP,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACzC,OAAO;QACL,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7B,IAAI,EAAE,4BAA4B;YAClC,UAAU,EAAE,GAAG;YACf,kBAAkB;SACnB,CAAC;KACH,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,UAAU,EAIX;IACC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;IACpE,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;QACpC,UAAU,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAA;AACH,CAAC"}

package/dist/connections/grants.d.ts

@@ -54,6 +54,24 @@ export declare function connectionGrants({ entry, spaceUrl }: {
     entry: ConnectionEntry;
     spaceUrl: string;
 }): ConnectionGrant[];
+/**
+ * The Collection a capability target addresses when it is exactly a
+ * Collection container URL of the given Space (`<spaceUrl><collectionId>/`),
+ * else `undefined`: a Resource, a sub-resource, the Space itself, and a
+ * target outside the Space all read as none. The target is normalized by URL
+ * parsing first, as `isTargetInSpace` does, and the segment is
+ * percent-decoded.
+ *
+ * @param options {object}
+ * @param options.target {string}
+ * @param options.spaceUrl {string}   the Space's container URL, with its
+ *   trailing slash
+ * @returns {string | undefined}
+ */
+export declare function collectionIdInSpace({ target, spaceUrl }: {
+    target: string;
+    spaceUrl: string;
+}): string | undefined;
 /**
  * The distinct targets of a set of grants, in first-seen order.
  *

package/dist/connections/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE5E;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAaV;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EACT,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,eAAe,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACP,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;CAC1B,GAAG,MAAM,EAAE,CAEX;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAgB,EACjB,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,GAAG;IAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CAAE,CAc1D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,MAAM,GAAG,SAAS,CAErB"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE5E;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAaV;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EACT,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,eAAe,EAAE,CAyBpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,MAAM,GAAG,SAAS,CAcrB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACP,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;CAC1B,GAAG,MAAM,EAAE,CAEX;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAgB,EACjB,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,GAAG;IAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CAAE,CAc1D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,MAAM,GAAG,SAAS,CAErB"}

package/dist/connections/grants.js

@@ -73,6 +73,36 @@ export function connectionGrants({ entry, spaceUrl }) {
     }
     return grants;
 }
+/**
+ * The Collection a capability target addresses when it is exactly a
+ * Collection container URL of the given Space (`<spaceUrl><collectionId>/`),
+ * else `undefined`: a Resource, a sub-resource, the Space itself, and a
+ * target outside the Space all read as none. The target is normalized by URL
+ * parsing first, as `isTargetInSpace` does, and the segment is
+ * percent-decoded.
+ *
+ * @param options {object}
+ * @param options.target {string}
+ * @param options.spaceUrl {string}   the Space's container URL, with its
+ *   trailing slash
+ * @returns {string | undefined}
+ */
+export function collectionIdInSpace({ target, spaceUrl }) {
+    if (!isTargetInSpace({ target, spaceUrl })) {
+        return undefined;
+    }
+    const rest = new URL(target).href.slice(new URL(spaceUrl).href.length);
+    const segment = /^([^/?#]+)\/$/.exec(rest)?.[1];
+    if (segment === undefined) {
+        return undefined;
+    }
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * The distinct targets of a set of grants, in first-seen order.
  *

package/dist/connections/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AA8BxC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,iDAAiD,QAAQ,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EAIT;IACC,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;QACtB,IACE,KAAK,CAAC,EAAE,KAAK,SAAS;YACtB,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE;YAC5B,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC7D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gBACtC,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5D,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,MAAM,EAGP;IACC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAIjB;IACC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAC1C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EAGN;IACC,OAAO,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;AAC1D,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AA8BxC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,iDAAiD,QAAQ,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EAIT;IACC,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;QACtB,IACE,KAAK,CAAC,EAAE,KAAK,SAAS;YACtB,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE;YAC5B,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC7D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gBACtC,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5D,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,MAAM,EAGP;IACC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAIjB;IACC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAC1C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EAGN;IACC,OAAO,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;AAC1D,CAAC"}

package/dist/connections/index.d.ts

@@ -34,7 +34,7 @@ export { wasConnectionsStore } from './store.js';
 export type { ConnectionsStore, StoredConnection } from './store.js';
 export { findConnection, readConnections } from './read.js';
 export type { ConnectionsListing, ReadConnection } from './read.js';
-export { connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
+export { collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
 export type { ConnectionGrant } from './grants.js';
 export { connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
 export { ConnectionKindMismatchError } from './errors.js';

package/dist/connections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC7E,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC7E,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/connections/index.js

@@ -30,7 +30,7 @@ export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_WRITER_POLICY, G
 export { CONNECTIONS_ID_PREFIX, connectionResourceId } from './resourceId.js';
 export { wasConnectionsStore } from './store.js';
 export { findConnection, readConnections } from './read.js';
-export { connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
+export { collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
 export { connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
 export { ConnectionKindMismatchError } from './errors.js';
 export { recordGrants, removeGrants, retireConnection, setConnectionLabel, unretireConnection } from './upsert.js';

package/dist/connections/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAUnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAUnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/connections/store.d.ts

@@ -69,23 +69,17 @@ export interface ConnectionsStore {
     }): Promise<{
         etag?: string;
     }>;
-    /**
-     * Deletes one resource, conditional on `ifMatch` when given.
-     */
-    delete(options: {
-        resourceId: string;
-        ifMatch?: string;
-    }): Promise<void>;
 }
 /**
  * Builds the directory store over the `connections` collection handle.
  *
  * A listing reads the collection's documents feed, bodies and ETags, one
  * request per page, and opens each envelope with `cipher` under the resource
- * id the feed served it at. A `get`, a `put`, and a `delete` go through the
- * handle, whose encryption provider opens a read and seals a write. A `put`
- * at an id with no resource yet creates the resource there, sealed under the
- * collection's current epoch.
+ * id the feed served it at. A `get` and a `put` go through the handle, whose
+ * encryption provider opens a read and seals a write. A `put` at an id with
+ * no resource yet creates the resource there, sealed under the collection's
+ * current epoch. The seam has no delete: an entry is retired and never
+ * deleted while the account stands.
  *
  * @param options {object}
  * @param options.collection {Collection}   the account data Space's

package/dist/connections/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/connections/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,qBAAqB,CAAA;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AAE/D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,GAAG,IAAI,CAAC,CAAA;IAC1C;;;OAGG;IACH,GAAG,CAAC,OAAO,EAAE;QACX,UAAU,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACzD;;;OAGG;IACH,GAAG,CAAC,OAAO,EAAE;QACX,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9B;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,UAAU,EACV,MAAM,EACP,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;CACnC,GAAG,gBAAgB,CA+CnB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/connections/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,qBAAqB,CAAA;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AAE/D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAA;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,GAAG,IAAI,CAAC,CAAA;IAC1C;;;OAGG;IACH,GAAG,CAAC,OAAO,EAAE;QACX,UAAU,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACzD;;;OAGG;IACH,GAAG,CAAC,OAAO,EAAE;QACX,UAAU,EAAE,MAAM,CAAA;QAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,UAAU,EACV,MAAM,EACP,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;CACnC,GAAG,gBAAgB,CA0CnB"}

package/dist/connections/store.js

@@ -3,10 +3,11 @@
  *
  * A listing reads the collection's documents feed, bodies and ETags, one
  * request per page, and opens each envelope with `cipher` under the resource
- * id the feed served it at. A `get`, a `put`, and a `delete` go through the
- * handle, whose encryption provider opens a read and seals a write. A `put`
- * at an id with no resource yet creates the resource there, sealed under the
- * collection's current epoch.
+ * id the feed served it at. A `get` and a `put` go through the handle, whose
+ * encryption provider opens a read and seals a write. A `put` at an id with
+ * no resource yet creates the resource there, sealed under the collection's
+ * current epoch. The seam has no delete: an entry is retired and never
+ * deleted while the account stands.
  *
  * @param options {object}
  * @param options.collection {Collection}   the account data Space's
@@ -56,11 +57,6 @@ export function wasConnectionsStore({ collection, cipher }) {
                 ...(ifMatch !== undefined && { ifMatch }),
                 ...(ifNoneMatch === true && { ifNoneMatch })
             });
-        },
-        async delete({ resourceId, ifMatch }) {
-            await collection
-                .resource(resourceId)
-                .delete(ifMatch !== undefined ? { ifMatch } : {});
         }
     };
 }

package/dist/connections/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/connections/store.ts"],"names":[],"mappings":"AA0EA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,UAAU,EACV,MAAM,EAIP;IACC,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;YAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,EAAE,CAAA;YACzC,OAAO,OAAO,CAAC,GAAG,CAChB,SAAS,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;wBAChC,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,QAAQ,EAAE,GAAG,CAAC,IAAY;wBAC1B,OAAO;qBACR,CAAC,CAAA;oBACF,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;gBACxD,CAAC;YACH,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;YAClE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aACxD,CAAA;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE;YAClD,OAAO,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,IAAkB,EAAE;gBACpD,WAAW,EAAE,kBAAkB;gBAC/B,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;gBACzC,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;aAC7C,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE;YAClC,MAAM,UAAU;iBACb,QAAQ,CAAC,UAAU,CAAC;iBACpB,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACrD,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/connections/store.ts"],"names":[],"mappings":"AAsEA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,UAAU,EACV,MAAM,EAIP;IACC,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;YAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,EAAE,CAAA;YACzC,OAAO,OAAO,CAAC,GAAG,CAChB,SAAS,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;wBAChC,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,QAAQ,EAAE,GAAG,CAAC,IAAY;wBAC1B,OAAO;qBACR,CAAC,CAAA;oBACF,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;gBACxD,CAAC;YACH,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;YAClE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aACxD,CAAA;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE;YAClD,OAAO,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,IAAkB,EAAE;gBACpD,WAAW,EAAE,kBAAkB;gBAC/B,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;gBACzC,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;aAC7C,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/keyring/index.d.ts

@@ -31,12 +31,14 @@
  *   way (under their own cipher context) rather than re-deriving the
  *   construction. These live in `recordEnvelope.ts`, whose runtime imports
  *   are was-client's EDV subpath and the system collections leaf alone.
- * - `ensureUnlockSpace` / `getUnlockKeyring` / `putUnlockKeyring` /
- *   `deleteUnlockSpace` -- the unlock Space's lifecycle and its one resource.
- *   The read, write, and delete each take an optional `capability` (the
- *   management zcap the unlock identity delegated at bind time) for a
- *   ceremony that reaches the Space without its secret; the delete reports a
- *   404 as an outcome rather than deciding it.
+ * - `ensureUnlockSpace` / `getUnlockKeyring` / `getUnlockKeyringWithEtag` /
+ *   `putUnlockKeyring` / `deleteUnlockSpace` -- the unlock Space's lifecycle
+ *   and its one resource. The read, write, and delete each take an optional
+ *   `capability` (the management zcap the unlock identity delegated at bind
+ *   time) for a ceremony that reaches the Space without its secret; the
+ *   delete reports a 404 as an outcome rather than deciding it. The etag read
+ *   and the write's optional `ifMatch` make a re-bind of an existing record a
+ *   compare-and-swap.
  * - `fetchKeyringRecord` -- the composed lookup (derive, read, unwrap); an
  *   app's caching, pinning, and client-key persistence wrap around it.
  *
@@ -51,6 +53,6 @@ export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, par
 export type { AccountPointer, KeyringRecordContents, RecordProof, SignedRecord } from './recordEnvelope.js';
 export { recordProofKeyMultibase, recordSignerFromAgent, recordSignerFromSeed, signRecordFrame, unwrapKeyringRecord, verifyRecordProof, wrapKeyringRecord } from './record.js';
 export type { RecordSigner } from './record.js';
-export { deleteUnlockSpace, ensureUnlockSpace, getUnlockKeyring, putUnlockKeyring, UNLOCK_SPACE_NAME, UNLOCK_SPACE_TYPE } from './unlockSpace.js';
+export { deleteUnlockSpace, ensureUnlockSpace, getUnlockKeyring, getUnlockKeyringWithEtag, putUnlockKeyring, UNLOCK_SPACE_NAME, UNLOCK_SPACE_TYPE } from './unlockSpace.js';
 export { fetchKeyringRecord } from './fetch.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/keyring/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC/E,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,YAAY,EACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAC/E,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,YAAY,EACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/keyring/index.js

@@ -31,12 +31,14 @@
  *   way (under their own cipher context) rather than re-deriving the
  *   construction. These live in `recordEnvelope.ts`, whose runtime imports
  *   are was-client's EDV subpath and the system collections leaf alone.
- * - `ensureUnlockSpace` / `getUnlockKeyring` / `putUnlockKeyring` /
- *   `deleteUnlockSpace` -- the unlock Space's lifecycle and its one resource.
- *   The read, write, and delete each take an optional `capability` (the
- *   management zcap the unlock identity delegated at bind time) for a
- *   ceremony that reaches the Space without its secret; the delete reports a
- *   404 as an outcome rather than deciding it.
+ * - `ensureUnlockSpace` / `getUnlockKeyring` / `getUnlockKeyringWithEtag` /
+ *   `putUnlockKeyring` / `deleteUnlockSpace` -- the unlock Space's lifecycle
+ *   and its one resource. The read, write, and delete each take an optional
+ *   `capability` (the management zcap the unlock identity delegated at bind
+ *   time) for a ceremony that reaches the Space without its secret; the
+ *   delete reports a 404 as an outcome rather than deciding it. The etag read
+ *   and the write's optional `ifMatch` make a re-bind of an existing record a
+ *   compare-and-swap.
  * - `fetchKeyringRecord` -- the composed lookup (derive, read, unwrap); an
  *   app's caching, pinning, and client-key persistence wrap around it.
  *
@@ -47,6 +49,6 @@ export { BACKUP_CREDENTIAL_KDF, deriveUnlockSeed, KEYRING_KDF } from './kdf.js';
 export { deriveUnlockIdentity, unlockIdentityFromSeed, UNLOCK_HANDLE, UNLOCK_KEY_NAME, unlockSpaceIdFor } from './unlockIdentity.js';
 export { KEYRING_RECORD_VERSION, mintRecordEncryption, parseRecordCreatedAt, parseRecordFrame, parseRecordPointer, recordCipher, recordCreatedAtStamp, recordEnvelopeId, RecordProofError, recordSealCipher } from './recordEnvelope.js';
 export { recordProofKeyMultibase, recordSignerFromAgent, recordSignerFromSeed, signRecordFrame, unwrapKeyringRecord, verifyRecordProof, wrapKeyringRecord } from './record.js';
-export { deleteUnlockSpace, ensureUnlockSpace, getUnlockKeyring, putUnlockKeyring, UNLOCK_SPACE_NAME, UNLOCK_SPACE_TYPE } from './unlockSpace.js';
+export { deleteUnlockSpace, ensureUnlockSpace, getUnlockKeyring, getUnlockKeyringWithEtag, putUnlockKeyring, UNLOCK_SPACE_NAME, UNLOCK_SPACE_TYPE } from './unlockSpace.js';
 export { fetchKeyringRecord } from './fetch.js';
 //# sourceMappingURL=index.js.map

package/dist/keyring/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAG/E,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAQ5B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAG/E,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAQ5B,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/keyring/unlockSpace.d.ts

@@ -98,7 +98,43 @@ export declare function getUnlockKeyring({ storageServerUrl, zcapClient, service
     capability?: IZcap;
 }): Promise<unknown | null>;
 /**
- * Writes (upserts) the keyring record into the unlock Space as a JSON document.
+ * Reads the keyring record from the unlock Space together with its `ETag`
+ * validator, or returns `null` when it does not exist yet. The read half of a
+ * compare-and-swap re-bind: a writer that rebuilds the record from what it
+ * read passes this `etag` to {@link putUnlockKeyring}'s `ifMatch`, so a
+ * concurrent writer's record is never overwritten unseen. Same request,
+ * errors, and `capability` semantics as {@link getUnlockKeyring}.
+ *
+ * @param options {object}
+ * @param options.storageServerUrl {string}
+ * @param options.zcapClient {ZcapClient}
+ * @param [options.serviceDescription] {ServiceDescription}   the server's
+ *   service description a client the caller already holds discovered
+ *   (`(await was.service()).description`), so this one skips discovery
+ * @param options.spaceId {string}   the unlock Space id
+ * @param [options.capability] {IZcap}   the delegated management zcap;
+ *   absent, the read is a root invocation
+ * @returns {Promise<{ record: unknown; etag?: string } | null>}   `etag` is
+ *   absent only where the header did not reach the client
+ */
+export declare function getUnlockKeyringWithEtag({ storageServerUrl, zcapClient, serviceDescription, spaceId, capability }: {
+    storageServerUrl: string;
+    zcapClient: ZcapClient;
+    serviceDescription?: ServiceDescription;
+    spaceId: string;
+    capability?: IZcap;
+}): Promise<{
+    record: unknown;
+    etag?: string;
+} | null>;
+/**
+ * Writes the keyring record into the unlock Space as a JSON document. A plain
+ * upsert unless `ifMatch` is given: then the write is a compare-and-swap
+ * against the `etag` a {@link getUnlockKeyringWithEtag} read returned, and a
+ * record another writer replaced in between fails with was-client's
+ * `PreconditionFailedError` (412, matched by `err.name`) rather than being
+ * overwritten. A first bind of a fresh record has no `etag` to name and stays
+ * an upsert.
  *
  * With a `capability`, the `zcapClient` is an enrolled client's rather than
  * the unlock identity's, and the attached management zcap (delegated by the
@@ -118,16 +154,21 @@ export declare function getUnlockKeyring({ storageServerUrl, zcapClient, service
  * @param options.record {object}   the keyring record
  * @param [options.capability] {IZcap}   the delegated management zcap;
  *   absent, the write is a root invocation
- * @returns {Promise<void>}
+ * @param [options.ifMatch] {string}   the `ETag` of the record this write
+ *   replaces; absent, the write is an unconditional upsert
+ * @returns {Promise<{ etag?: string }>}   the stored record's new `ETag`
  */
-export declare function putUnlockKeyring({ storageServerUrl, zcapClient, serviceDescription, spaceId, record, capability }: {
+export declare function putUnlockKeyring({ storageServerUrl, zcapClient, serviceDescription, spaceId, record, capability, ifMatch }: {
     storageServerUrl: string;
     zcapClient: ZcapClient;
     serviceDescription?: ServiceDescription;
     spaceId: string;
     record: object;
     capability?: IZcap;
-}): Promise<void>;
+    ifMatch?: string;
+}): Promise<{
+    etag?: string;
+}>;
 /**
  * Deletes the whole unlock Space (what retires an old passphrase on a
  * passphrase change, or a lost unlock method). The server's answer is

package/dist/keyring/unlockSpace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unlockSpace.d.ts","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAa,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAA;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,UAA6C,CAAA;AAwI3E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAwB,EACzB,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAY1B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAOhD"}
+{"version":3,"file":"unlockSpace.d.ts","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAa,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAIhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uBAAuB,CAAA;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,UAA6C,CAAA;AAuJ3E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAwB,EACzB,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAS1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAYrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EACV,OAAO,EACR,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAc7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACX,EAAE;IACD,gBAAgB,EAAE,MAAM,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAOhD"}

package/dist/keyring/unlockSpace.js

@@ -80,11 +80,13 @@ async function ensurePlaintextCollection({ was, spaceId, collectionId, name }) {
         .configure({ name, force: true });
 }
 /**
- * Reads a single plaintext JSON record from a Space collection, or `null` when
- * it does not exist yet (a missing Space, collection, or resource all surface
- * as a 404-shaped `null` from `resource.get()`). A network / unreachable error
- * propagates, so callers can distinguish "no record" from "could not check".
- * The explicit `plaintext` override is load-bearing (see the module doc).
+ * Reads a single plaintext JSON record from a Space collection together with
+ * its `ETag` validator, or `null` when it does not exist yet (a missing Space,
+ * collection, or resource all surface as a 404-shaped `null` from
+ * `resource.getWithEtag()`). A network / unreachable error propagates, so
+ * callers can distinguish "no record" from "could not check". The explicit
+ * `plaintext` override is load-bearing (see the module doc): it is also what
+ * lets the validator reach the server unchanged on a conditional write.
  *
  * @param options {object}
  * @param options.was {WasClient}   the unlock Space client
@@ -93,7 +95,8 @@ async function ensurePlaintextCollection({ was, spaceId, collectionId, name }) {
  * @param options.resourceId {string}
  * @param [options.capability] {IZcap}   an invocation capability the GET
  *   rides; absent, the request invokes the root capability
- * @returns {Promise<unknown | null>}
+ * @returns {Promise<{ record: unknown; etag?: string } | null>}   `etag` is
+ *   absent only where the header did not reach the client
  */
 async function getPlaintextRecord({ was, spaceId, collectionId, resourceId, capability }) {
     const result = await plaintextCollection({
@@ -103,12 +106,20 @@ async function getPlaintextRecord({ was, spaceId, collectionId, resourceId, capa
         capability
     })
         .resource(resourceId)
-        .get();
-    return result === null ? null : result;
+        .getWithEtag();
+    if (result === null) {
+        return null;
+    }
+    return result.etag !== undefined
+        ? { record: result.data, etag: result.etag }
+        : { record: result.data };
 }
 /**
- * Writes (upserts) a single plaintext JSON record into a Space collection.
- * Serialized to bytes with an explicit `application/json` content-type.
+ * Writes a single plaintext JSON record into a Space collection. Serialized to
+ * bytes with an explicit `application/json` content-type. A plain upsert
+ * unless `ifMatch` is given, in which case the write lands only while the
+ * stored record's `ETag` still matches, and a mismatch throws was-client's
+ * `PreconditionFailedError` (412) unchanged.
  *
  * @param options {object}
  * @param options.was {WasClient}   the unlock Space client
@@ -118,13 +129,15 @@ async function getPlaintextRecord({ was, spaceId, collectionId, resourceId, capa
  * @param options.record {object}
  * @param [options.capability] {IZcap}   an invocation capability the PUT
  *   rides; absent, the request invokes the root capability
- * @returns {Promise<void>}
+ * @param [options.ifMatch] {string}   the `ETag` a prior read returned; the
+ *   write is conditional on it
+ * @returns {Promise<{ etag?: string }>}   the stored record's new `ETag`
  */
-async function putPlaintextRecord({ was, spaceId, collectionId, resourceId, record, capability }) {
+async function putPlaintextRecord({ was, spaceId, collectionId, resourceId, record, capability, ifMatch }) {
     const body = new TextEncoder().encode(JSON.stringify(record));
-    await plaintextCollection({ was, spaceId, collectionId, capability })
+    return plaintextCollection({ was, spaceId, collectionId, capability })
         .resource(resourceId)
-        .put(body, { contentType: 'application/json' });
+        .put(body, { contentType: 'application/json', ifMatch });
 }
 /**
  * Ensures the unlock Space and its single `keyring` collection exist
@@ -185,6 +198,36 @@ export async function ensureUnlockSpace({ storageServerUrl, zcapClient, serviceD
  * @returns {Promise<unknown | null>}
  */
 export async function getUnlockKeyring({ storageServerUrl, zcapClient, serviceDescription, spaceId, capability }) {
+    const result = await getUnlockKeyringWithEtag({
+        storageServerUrl,
+        zcapClient,
+        serviceDescription,
+        spaceId,
+        capability
+    });
+    return result === null ? null : result.record;
+}
+/**
+ * Reads the keyring record from the unlock Space together with its `ETag`
+ * validator, or returns `null` when it does not exist yet. The read half of a
+ * compare-and-swap re-bind: a writer that rebuilds the record from what it
+ * read passes this `etag` to {@link putUnlockKeyring}'s `ifMatch`, so a
+ * concurrent writer's record is never overwritten unseen. Same request,
+ * errors, and `capability` semantics as {@link getUnlockKeyring}.
+ *
+ * @param options {object}
+ * @param options.storageServerUrl {string}
+ * @param options.zcapClient {ZcapClient}
+ * @param [options.serviceDescription] {ServiceDescription}   the server's
+ *   service description a client the caller already holds discovered
+ *   (`(await was.service()).description`), so this one skips discovery
+ * @param options.spaceId {string}   the unlock Space id
+ * @param [options.capability] {IZcap}   the delegated management zcap;
+ *   absent, the read is a root invocation
+ * @returns {Promise<{ record: unknown; etag?: string } | null>}   `etag` is
+ *   absent only where the header did not reach the client
+ */
+export async function getUnlockKeyringWithEtag({ storageServerUrl, zcapClient, serviceDescription, spaceId, capability }) {
     return getPlaintextRecord({
         was: unlockSpaceClient({
             storageServerUrl,
@@ -198,7 +241,13 @@ export async function getUnlockKeyring({ storageServerUrl, zcapClient, serviceDe
     });
 }
 /**
- * Writes (upserts) the keyring record into the unlock Space as a JSON document.
+ * Writes the keyring record into the unlock Space as a JSON document. A plain
+ * upsert unless `ifMatch` is given: then the write is a compare-and-swap
+ * against the `etag` a {@link getUnlockKeyringWithEtag} read returned, and a
+ * record another writer replaced in between fails with was-client's
+ * `PreconditionFailedError` (412, matched by `err.name`) rather than being
+ * overwritten. A first bind of a fresh record has no `etag` to name and stays
+ * an upsert.
  *
  * With a `capability`, the `zcapClient` is an enrolled client's rather than
  * the unlock identity's, and the attached management zcap (delegated by the
@@ -218,10 +267,12 @@ export async function getUnlockKeyring({ storageServerUrl, zcapClient, serviceDe
  * @param options.record {object}   the keyring record
  * @param [options.capability] {IZcap}   the delegated management zcap;
  *   absent, the write is a root invocation
- * @returns {Promise<void>}
+ * @param [options.ifMatch] {string}   the `ETag` of the record this write
+ *   replaces; absent, the write is an unconditional upsert
+ * @returns {Promise<{ etag?: string }>}   the stored record's new `ETag`
  */
-export async function putUnlockKeyring({ storageServerUrl, zcapClient, serviceDescription, spaceId, record, capability }) {
-    await putPlaintextRecord({
+export async function putUnlockKeyring({ storageServerUrl, zcapClient, serviceDescription, spaceId, record, capability, ifMatch }) {
+    return putPlaintextRecord({
         was: unlockSpaceClient({
             storageServerUrl,
             zcapClient,
@@ -231,7 +282,8 @@ export async function putUnlockKeyring({ storageServerUrl, zcapClient, serviceDe
         collectionId: KEYRING_COLLECTION.id,
         resourceId: KEYRING_RESOURCE,
         record,
-        capability
+        capability,
+        ifMatch
     });
 }
 /**

package/dist/keyring/unlockSpace.js.map

@@ -1 +1 @@
-{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAA2B,MAAM,qBAAqB,CAAA;AAGxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAKnB;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,IAAI,EAML;IACC,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EAOX;IACC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,GAAG;QACH,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC;SACC,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EACN,UAAU,EAQX;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SAClE,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAQzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC3D,MAAM,yBAAyB,CAAC;QAC9B,GAAG;QACH,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EAQX;IACC,MAAM,kBAAkB,CAAC;QACvB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;QACN,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAA2B,MAAM,qBAAqB,CAAA;AAGxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAKnB;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,IAAI,EAML;IACC,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EAOX;IACC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,GAAG;QACH,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC;SACC,QAAQ,CAAC,UAAU,CAAC;SACpB,WAAW,EAAE,CAAA;IAChB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS;QAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QAC5C,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EACN,UAAU,EACV,OAAO,EASR;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,OAAO,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SACnE,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAQzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC3D,MAAM,yBAAyB,CAAC;QAC9B,GAAG;QACH,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,gBAAgB;QAChB,UAAU;QACV,kBAAkB;QAClB,OAAO;QACP,UAAU;KACX,CAAC,CAAA;IACF,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EACV,OAAO,EASR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;QACN,UAAU;QACV,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAA;AAC/D,CAAC"}

package/dist/menders/ids.d.ts

@@ -10,12 +10,13 @@
  * (`ceremonyEvents.ts`) is a separate diagnostics surface, and its mender
  * events do carry them.
  * Numbered in the order the design table assigned them, and a new one takes
- * the next free number rather than renumbering.
+ * the next free number rather than renumbering. A retired id leaves its
+ * number empty, and no later id takes it.
  */
 /**
  * Every invariant id, in design-table order.
  */
-export declare const INVARIANT_IDS: readonly ["roster-wraps-exactly-the-document-key-set", "governed-log-heads-anchor-past-the-membership-change", "collection-epochs-name-the-current-user-key", "unlock-registry-opens-under-the-current-user-key", "registry-passphrase-entry-names-the-standing-credential", "passkey-entry-carries-its-standing-configuration", "registry-lists-the-passphrase-method", "standing-delegations-verify-under-the-current-document", "registry-records-the-committed-ladder-rung", "unlock-record-points-at-the-account-did", "account-pointer-names-the-account-did", "space-controller-is-the-account-did", "roster-and-collection-epochs-exist", "registry-records-the-establishing-credential", "annex-generation-is-reachable", "generation-delegation-is-current", "acting-credential-manage-zcap-is-current", "did-web-projection-matches-the-log", "no-annex-generation-outlives-its-pointer", "app-keys-live-only-in-app-connections", "client-key-record-matches-the-pointed-account", "this-browser-is-still-an-enrolled-client", "no-client-key-record-stays-pending", "recovery-spend-is-completed", "retired-credential-leaves-no-annex-inventory", "document-lists-the-acting-credential", "keystore-controller-is-the-account-did", "account-document-publishes-an-authentication-key", "every-document-key-agreement-entry-has-a-locatable-credential", "no-unlock-space-outlives-its-credential", "no-keystore-outlives-its-account", "saved-recovery-codes-locate-their-account", "standard-collections-are-provisioned", "no-auxiliary-space-stands-unnamed", "no-registered-writer-outlives-its-expiry", "every-party-with-authority-has-a-connection-entry"];
+export declare const INVARIANT_IDS: readonly ["roster-wraps-exactly-the-document-key-set", "governed-log-heads-anchor-past-the-membership-change", "collection-epochs-name-the-current-user-key", "unlock-registry-opens-under-the-current-user-key", "registry-passphrase-entry-names-the-standing-credential", "passkey-entry-carries-its-standing-configuration", "registry-lists-the-passphrase-method", "standing-delegations-verify-under-the-current-document", "registry-records-the-committed-ladder-rung", "unlock-record-points-at-the-account-did", "account-pointer-names-the-account-did", "space-controller-is-the-account-did", "roster-and-collection-epochs-exist", "registry-records-the-establishing-credential", "annex-generation-is-reachable", "generation-delegation-is-current", "acting-credential-manage-zcap-is-current", "did-web-projection-matches-the-log", "no-annex-generation-outlives-its-pointer", "client-key-record-matches-the-pointed-account", "this-browser-is-still-an-enrolled-client", "no-client-key-record-stays-pending", "recovery-spend-is-completed", "retired-credential-leaves-no-annex-inventory", "document-lists-the-acting-credential", "keystore-controller-is-the-account-did", "account-document-publishes-an-authentication-key", "every-document-key-agreement-entry-has-a-locatable-credential", "no-unlock-space-outlives-its-credential", "no-keystore-outlives-its-account", "saved-recovery-codes-locate-their-account", "standard-collections-are-provisioned", "no-auxiliary-space-stands-unnamed", "no-registered-writer-outlives-its-expiry", "every-party-with-authority-has-a-connection-entry"];
 /**
  * One id from {@link INVARIANT_IDS}.
  */