@kubun/credential 0.17.4 → 0.18.0

package/lib/manager-types.d.ts

@@ -0,0 +1,337 @@
+import type { MethodRegistry, SigningIdentity } from '@kokuin/token';
+import type { HLC } from '@kubun/hlc';
+import type { CredentialStoreAPI } from '@kubun/store-credential';
+import type { Runtime } from '@sozai/runtime';
+import type { CredentialAuthority } from './authority.js';
+import type { ForkRepairResult } from './fork-repair.js';
+import type { PinThrottleParams } from './pin-throttle.js';
+import type { CredentialEntryProvenance } from './provenance.js';
+import type { FactorInput, FactorInputs, SecretFactorKind } from './suite.js';
+export type CreateCredentialManagerParams = {
+    store: CredentialStoreAPI;
+    /**
+     * This device's identity. NOT required to be a `KeyAgreementIdentity`: a device
+     * that cannot decrypt can still read metadata, and will be able to unwrap by
+     * passphrase once that factor exists. What it cannot do is take the `did`
+     * default in {@link CredentialManager.createKey}.
+     *
+     * It MUST be able to sign, which a reading identity need not: every row this
+     * manager writes carries a signed op, and a device that could write rows no
+     * peer can authenticate would be writing into a lane that has to drop them.
+     */
+    identity: SigningIdentity;
+    /**
+     * Host runtime, propagated rather than constructed here. This package runs on
+     * React Native and in browsers as well as on node, and content keys, IVs and
+     * factor secrets are the values that most need the platform's own CSPRNG
+     * rather than whatever `crypto` a bundler resolved.
+     */
+    runtime: Runtime;
+    /**
+     * The device's one clock, passed in rather than built here.
+     *
+     * Required, and deliberately not defaulted: a connector builds one manager per
+     * transaction, so a manager that constructed its own would start from
+     * `lastWallTime = 0` every time and two of them writing in the same
+     * millisecond would emit an identical `(wallTime, counter, nodeID)` — a
+     * colliding merkle leaf and an order tie with no tiebreak.
+     */
+    hlc: HLC;
+    /**
+     * Who this identity is relative to a key. Defaults to the device answer:
+     * it administers what it owns and nothing else.
+     *
+     * The same port the plugin's query context takes, deliberately — a device
+     * authority refuses a grant recipient gating someone else's key, and a
+     * delegation authority will let an agent gate its controller's, without
+     * either layer growing a predicate of its own.
+     */
+    authority?: CredentialAuthority;
+    /** Controller-owned writes require a recovery check; an absent check fails closed. */
+    removalRecovery?: (RecoverRemovedDevicesParams & {
+        headVersion(ownerDID: string): Promise<string>;
+    }) | {
+        ensure(): Promise<void>;
+        removedDevices?(ownerDID: string): Promise<ReadonlySet<string>>;
+    };
+    /**
+     * How long an unlocked key stays in memory. Eviction is lazy — checked when
+     * the cache is read — because a timer would keep the host process alive and
+     * make every test wait on a clock it does not control.
+     */
+    unlockTTL?: number;
+    /**
+     * Failed-PIN backoff. Its clock comes from `now`, so a caller cannot give the
+     * throttle a different notion of time from the cache's.
+     */
+    pinThrottle?: Omit<PinThrottleParams, 'now'>;
+    /** Injectable so a TTL or backoff test does not sleep. */
+    now?: () => number;
+};
+/** The device that may author a live OAuth grant and the grant's local name. */
+export type GrantEntryParams = {
+    grantDeviceDID: string;
+    grantName: string;
+    grantOwnerDID?: string;
+};
+export type CreateKeyParams = {
+    suite?: number;
+    /** One wrapping, whose factors are an AND. Shorthand for a single-entry `wrappings`. */
+    factors?: Array<FactorInput>;
+    /**
+     * Several wrappings — an OR of ANDs, one per way of opening the key.
+     *
+     * A key addressed to two recipients is not two keys and is not a grant: both
+     * wrappings exist from the first write, which is what a connector needs when
+     * the account owner and the server that runs sync are different DIDs.
+     */
+    wrappings?: Array<Array<FactorInput>>;
+    /**
+     * Who may later grant, rotate and revoke. Defaults to this device, which is
+     * the peer case. A server creating a key on a viewer's behalf passes the
+     * viewer, and stays a recipient rather than the owner.
+     */
+    ownerDID?: string;
+    /**
+     * Resolvers for recipient DIDs that carry no key material of their own
+     * (`did:kokuin:`). Passed per call rather than held on the manager, so a
+     * request-scoped resolver never outlives its request in the cached manager.
+     */
+    methods?: MethodRegistry;
+};
+export type RotateKeyParams = {
+    /**
+     * Migrate to a different ciphersuite. Rotation is the only path between
+     * suites: it already re-encrypts every entry and re-makes every wrapping,
+     * which is exactly what a suite change needs.
+     */
+    suite?: number;
+    /**
+     * Secrets for the surviving factors, keyed by kind — the same prompt
+     * `addFactor` needs, for the same reason: a descriptor holds a salt and a
+     * cost, never the secret, so a wrapping carrying one cannot be re-made at the
+     * new version without it.
+     *
+     * Only the rotating identity's own wrappings can carry a secret factor, since
+     * `addFactor` refuses one on a key it does not administer — so the prompt is
+     * always one the caller is present for.
+     */
+    inputs?: FactorInputs;
+    /** Resolvers for recipient DIDs that need one (`did:kokuin:`), for re-made `did` wrappings. */
+    methods?: MethodRegistry;
+    /**
+     * Overrides the constructed authority for this one call, so a provider-cached
+     * manager holds no request state. No production caller feeds one yet — the
+     * group-grant wiring that will is a follow-up.
+     */
+    authority?: CredentialAuthority;
+};
+/** Optionals shared by the factor-editing verbs `addFactor` and `removeFactor`. */
+export type FactorChangeParams = {
+    /**
+     * Secrets for the factors that SURVIVE the change, keyed by kind — a
+     * descriptor holds a salt, never a secret, so the surviving wrapping's KEK
+     * cannot be re-derived without them.
+     */
+    inputs?: FactorInputs;
+    /** Resolvers for recipient DIDs that need one (`did:kokuin:`), for re-made `did` wrappings. */
+    methods?: MethodRegistry;
+    /** Per-call authority overriding the constructed default. See `RotateKeyParams.authority`. */
+    authority?: CredentialAuthority;
+};
+/** See `grant`. */
+export type GrantKeyParams = {
+    /** Resolvers for recipient DIDs that carry no key material of their own (`did:kokuin:`). */
+    methods?: MethodRegistry;
+    /** Per-call authority overriding the constructed default. See `RotateKeyParams.authority`. */
+    authority?: CredentialAuthority;
+};
+/** See `reKeyEntry`. */
+export type RecoverRemovedDevicesParams = {
+    /** Current-head membership resolver; a removed device resolves to null. */
+    resolveController(did: string): Promise<string | null>;
+    /** Current controller denial set, including recipients that authored no record. */
+    removedDevices?(ownerDID: string): Promise<ReadonlySet<string>>;
+    methods?: MethodRegistry;
+};
+export type ReKeyEntryParams = {
+    /** Per-call authority overriding the constructed default. See `RotateKeyParams.authority`. */
+    authority?: CredentialAuthority;
+};
+export type CredentialEntryAddress = {
+    entryID: string;
+    ownerDID: string;
+};
+export type UpdateCredentialEntryIfUnchangedParams = CredentialEntryAddress & {
+    plaintext: Uint8Array;
+    expectedHLC: string;
+};
+export type ReKeyCredentialEntryParams = CredentialEntryAddress & ReKeyEntryParams & {
+    toKeyID: string;
+};
+/**
+ * Why a key cannot be opened here, as opposed to not being open yet.
+ *
+ * Carried so that `status` can answer rather than throw: the one call whose job
+ * is to report a key as unreadable must not fail on the key that is unreadable.
+ */
+export type CredentialUnopenableReason = 
+/** A newer peer's ciphersuite. A different build could open it; this one cannot. */
+'unsupported-suite'
+/** No wrapping at the key's current version — a rotation that did not finish. */
+ | 'no-wrapping'
+/** Every wrapping belongs to another recipient. Another device can open it. */
+ | 'not-addressed' | 'revoked';
+/**
+ * Derived, never stored. A persisted `unlocked` column would be a belief that
+ * survives a restart it should not.
+ *
+ * `available` is separated from `unlocked` because they differ in what the
+ * caller must do, which is nothing, and in what the machine must do, which is
+ * one unwrap. A `did`-only key is `available` until first read, and a TTL
+ * eviction returns it there rather than to `locked` — no prompt ever becomes
+ * necessary.
+ */
+export type CredentialKeyStatus = {
+    state: 'unlocked';
+} | {
+    state: 'available';
+} | {
+    state: 'locked';
+    /**
+     * One entry per wrapping that could be opened here: an OR of ANDs. Nested
+     * because flattening loses the difference between a key openable by a pin
+     * OR a passphrase and one demanding both, and those are different prompts.
+     * `did` factors are absent — this device supplies them without asking.
+     */
+    unlockOptions: Array<Array<SecretFactorKind>>;
+} | {
+    state: 'unopenable';
+    reason: CredentialUnopenableReason;
+};
+export type CredentialGrantResult = {
+    /** The key version the recipient's wrapping sits at. */
+    version: number;
+    /**
+     * False when the recipient already held a wrapping and nothing was written.
+     * A caller broadcasting the grant emits its frame either way — that is what
+     * makes a repeat grant the retry path for a frame that never arrived.
+     */
+    created: boolean;
+};
+export type CredentialManager = {
+    /** Store instance this manager reads and writes through. */
+    readonly store: CredentialStoreAPI;
+    /** Factor kinds this device can supply. Empty means it can hold no credentials. */
+    availableFactors(): Array<string>;
+    /**
+     * Open a key and hold its content key in memory.
+     *
+     * A `did`-only key needs no call: it opens on demand. This is for the ones
+     * carrying a factor only the user can supply.
+     */
+    unlock(keyID: string, inputs?: FactorInputs): Promise<void>;
+    /** Zero the cached content key. TTL eviction does the same thing. */
+    lock(keyID: string): void;
+    lockAll(): void;
+    status(keyID: string, version?: number): Promise<CredentialKeyStatus>;
+    /**
+     * Add a factor to THIS device's wrapping, leaving every other recipient's
+     * alone. Adding a `pin` therefore gates this device and no other, which is the
+     * intended granularity.
+     *
+     * `params.inputs` must carry the secret for every factor that SURVIVES the
+     * change, not only the one being added: the new wrapping's key is derived from
+     * all of them, and a descriptor holds a salt, never a secret.
+     */
+    addFactor(keyID: string, factor: FactorInput, params?: FactorChangeParams): Promise<void>;
+    /** Remove a factor kind from this device's wrapping. See `addFactor` on `params.inputs`. */
+    removeFactor(keyID: string, kind: string, params?: FactorChangeParams): Promise<void>;
+    createKey(params?: CreateKeyParams): Promise<string>;
+    /**
+     * Retire this key's content key: mint a fresh one at `version + 1`,
+     * re-encrypt every entry under it and re-make every wrapping. Returns the new
+     * version, which a caller has to carry in the `credential:key-rotate` frame.
+     *
+     * `keyID` and every `entryID` survive, so documents referencing them do not
+     * move. A wrapping survives only if this device can re-make it: `did`-only
+     * ones re-make unattended, and one carrying a secret factor needs that secret
+     * back in `params.inputs`, because re-making a wrapping derives its KEK from
+     * every surviving factor and a descriptor holds a salt, never a secret.
+     *
+     * The key, wrappings and entries commit in one store transaction.
+     */
+    rotate(keyID: string, params?: RotateKeyParams): Promise<number>;
+    repairFork(keyID: string, inputs?: FactorInputs): Promise<ForkRepairResult>;
+    /** Reconcile records authored by former members of this device's controller. */
+    recoverRemovedDevices(params: RecoverRemovedDevicesParams): Promise<number>;
+    ensureRemovalRecovery(): Promise<void>;
+    revoke(keyID: string, recipientDID: string, params?: RotateKeyParams): Promise<number>;
+    /**
+     * Address this key to one more recipient: a `did` wrapping over the SAME
+     * content key at the key's current version. Every entry already written stays
+     * as it is — the recipient opens the key, not a copy of it — and no entry
+     * plaintext is touched. Returns the version the wrapping was made at.
+     *
+     * A recipient that already holds a wrapping is a no-op, so the version alone
+     * cannot tell a fresh grant from a re-grant — `created` is what distinguishes
+     * them.
+     *
+     * `recipientWrappableDID` must be RESOLVABLE, not merely a name: a
+     * `did:peer:4` short form carries no document and so no agreement key. Working
+     * out which string that is for a given party is a group question, and this
+     * package does not know what a group is — so it takes the answer rather than
+     * asking.
+     *
+     * `administer`, and the device must be able to open the key: a locked one
+     * fails before the first write rather than persisting half a grant.
+     */
+    grant(keyID: string, recipientWrappableDID: string, params?: GrantKeyParams): Promise<CredentialGrantResult>;
+    listKeys(): Promise<Array<string>>;
+    /** How many wrappings a key carries — one per way of opening it. */
+    countWrappings(keyID: string): Promise<number>;
+    deleteKey(keyID: string): Promise<void>;
+    putEntry(keyID: string, plaintext: Uint8Array, grant?: GrantEntryParams): Promise<string>;
+    updateEntry(address: CredentialEntryAddress, plaintext: Uint8Array): Promise<void>;
+    /**
+     * As {@link updateEntry}, but never inserts: an entry gone by the time the
+     * write lands reports `'absent'` instead of raising. For a writeback racing a
+     * concurrent delete, where the caller has no `keyID` to fall back to `putEntry`
+     * with and raising would just be a `catch` the caller re-swallows.
+     */
+    updateEntryIfPresent(address: CredentialEntryAddress, plaintext: Uint8Array): Promise<'updated' | 'absent'>;
+    /**
+     * As {@link updateEntryIfPresent}, and also only while the entry still carries
+     * `expectedHLC`, the stamp its caller read it at. An entry written since reports
+     * `'superseded'` and is left as it is.
+     */
+    updateEntryIfUnchanged(params: UpdateCredentialEntryIfUnchangedParams): Promise<'updated' | 'absent' | 'superseded'>;
+    readEntry(address: CredentialEntryAddress): Promise<Uint8Array>;
+    getEntryProvenance(address: CredentialEntryAddress): Promise<CredentialEntryProvenance>;
+    /**
+     * The RAW `owner_did` off the entry's key row — never normalized. Callers
+     * comparing against another DID normalize it themselves; folding it here
+     * would make the answer wrong for whichever caller wanted the unfolded form.
+     * `null` when the entry, or the key it sits on, is absent.
+     */
+    getEntryKeyOwnerDID(address: CredentialEntryAddress): Promise<string | null>;
+    listEntries(keyID: string): Promise<Array<string>>;
+    deleteEntry(address: CredentialEntryAddress): Promise<void>;
+    /** Refresh this device's older OAuth grant entries after a received key rotation. */
+    reencryptGrantEntries(keyID: string): Promise<void>;
+    /**
+     * Move an entry onto another key: decrypt under the one it sits on, re-encrypt
+     * under the target's current version, keep the entry id.
+     *
+     * The key is the sharing unit, so sharing one secret means moving it onto a
+     * shared key rather than sharing the key it already sits under, which would
+     * share every other entry beneath that one too. The entry id survives because
+     * it never embedded a key id — every document referencing it stays valid. The
+     * ciphertext does not survive: it is bound to its key, so this is a genuine
+     * re-encryption and the target must be open, not merely named.
+     *
+     * `administer` on BOTH keys. Writing under the target changes what the target
+     * holds, and taking an entry out of the source changes what the source holds.
+     */
+    reKeyEntry(params: ReKeyCredentialEntryParams): Promise<void>;
+};

package/lib/manager-types.js

@@ -0,0 +1 @@
+export { };

package/lib/manager.d.ts

@@ -1,294 +1,3 @@
-import { type MethodRegistry, type SigningIdentity } from '@kokuin/token';
-import { HLC } from '@kubun/hlc';
-import type { CredentialStoreAPI } from '@kubun/store-credential';
-import type { Runtime } from '@sozai/runtime';
-import { type CredentialAuthority } from './authority.js';
-import { type PinThrottleParams } from './pin-throttle.js';
-import { type CredentialEntryProvenance } from './provenance.js';
-import { type FactorInput, type FactorInputs, type SecretFactorKind } from './suite.js';
-export type CreateCredentialManagerParams = {
-    store: CredentialStoreAPI;
-    /**
-     * This device's identity. NOT required to be a `KeyAgreementIdentity`: a device
-     * that cannot decrypt can still read metadata, and will be able to unwrap by
-     * passphrase once that factor exists. What it cannot do is take the `did`
-     * default in {@link CredentialManager.createKey}.
-     *
-     * It MUST be able to sign, which a reading identity need not: every row this
-     * manager writes carries a signed op, and a device that could write rows no
-     * peer can authenticate would be writing into a lane that has to drop them.
-     */
-    identity: SigningIdentity;
-    /**
-     * Host runtime, propagated rather than constructed here. This package runs on
-     * React Native and in browsers as well as on node, and content keys, IVs and
-     * factor secrets are the values that most need the platform's own CSPRNG
-     * rather than whatever `crypto` a bundler resolved.
-     */
-    runtime: Runtime;
-    /**
-     * The device's one clock, passed in rather than built here.
-     *
-     * Required, and deliberately not defaulted: a connector builds one manager per
-     * transaction, so a manager that constructed its own would start from
-     * `lastWallTime = 0` every time and two of them writing in the same
-     * millisecond would emit an identical `(wallTime, counter, nodeID)` — a
-     * colliding merkle leaf and an order tie with no tiebreak.
-     */
-    hlc: HLC;
-    /**
-     * Who this identity is relative to a key. Defaults to the device answer:
-     * it administers what it owns and nothing else.
-     *
-     * The same port the plugin's query context takes, deliberately — a device
-     * authority refuses a grant recipient gating someone else's key, and a
-     * delegation authority will let an agent gate its controller's, without
-     * either layer growing a predicate of its own.
-     */
-    authority?: CredentialAuthority;
-    /**
-     * How long an unlocked key stays in memory. Eviction is lazy — checked when
-     * the cache is read — because a timer would keep the host process alive and
-     * make every test wait on a clock it does not control.
-     */
-    unlockTTL?: number;
-    /**
-     * Failed-PIN backoff. Its clock comes from `now`, so a caller cannot give the
-     * throttle a different notion of time from the cache's.
-     */
-    pinThrottle?: Omit<PinThrottleParams, 'now'>;
-    /** Injectable so a TTL or backoff test does not sleep. */
-    now?: () => number;
-};
-export type CreateKeyParams = {
-    suite?: number;
-    /** One wrapping, whose factors are an AND. Shorthand for a single-entry `wrappings`. */
-    factors?: Array<FactorInput>;
-    /**
-     * Several wrappings — an OR of ANDs, one per way of opening the key.
-     *
-     * A key addressed to two recipients is not two keys and is not a grant: both
-     * wrappings exist from the first write, which is what a connector needs when
-     * the account owner and the server that runs sync are different DIDs.
-     */
-    wrappings?: Array<Array<FactorInput>>;
-    /**
-     * Who may later grant, rotate and revoke. Defaults to this device, which is
-     * the peer case. A server creating a key on a viewer's behalf passes the
-     * viewer, and stays a recipient rather than the owner.
-     */
-    ownerDID?: string;
-    /**
-     * Resolvers for recipient DIDs that carry no key material of their own
-     * (`did:kokuin:`). Passed per call rather than held on the manager, so a
-     * request-scoped resolver never outlives its request in the cached manager.
-     */
-    methods?: MethodRegistry;
-};
-export type RotateKeyParams = {
-    /**
-     * Migrate to a different ciphersuite. Rotation is the only path between
-     * suites: it already re-encrypts every entry and re-makes every wrapping,
-     * which is exactly what a suite change needs.
-     */
-    suite?: number;
-    /**
-     * Secrets for the surviving factors, keyed by kind — the same prompt
-     * `addFactor` needs, for the same reason: a descriptor holds a salt and a
-     * cost, never the secret, so a wrapping carrying one cannot be re-made at the
-     * new version without it.
-     *
-     * Only the rotating identity's own wrappings can carry a secret factor, since
-     * `addFactor` refuses one on a key it does not administer — so the prompt is
-     * always one the caller is present for.
-     */
-    inputs?: FactorInputs;
-    /** Resolvers for recipient DIDs that need one (`did:kokuin:`), for re-made `did` wrappings. */
-    methods?: MethodRegistry;
-    /**
-     * Overrides the constructed authority for this one call, so a provider-cached
-     * manager holds no request state. No production caller feeds one yet — the
-     * group-grant wiring that will is a follow-up.
-     */
-    authority?: CredentialAuthority;
-};
-/** Optionals shared by the factor-editing verbs `addFactor` and `removeFactor`. */
-export type FactorChangeParams = {
-    /**
-     * Secrets for the factors that SURVIVE the change, keyed by kind — a
-     * descriptor holds a salt, never a secret, so the surviving wrapping's KEK
-     * cannot be re-derived without them.
-     */
-    inputs?: FactorInputs;
-    /** Resolvers for recipient DIDs that need one (`did:kokuin:`), for re-made `did` wrappings. */
-    methods?: MethodRegistry;
-    /** Per-call authority overriding the constructed default. See `RotateKeyParams.authority`. */
-    authority?: CredentialAuthority;
-};
-/** See `grant`. */
-export type GrantKeyParams = {
-    /** Resolvers for recipient DIDs that carry no key material of their own (`did:kokuin:`). */
-    methods?: MethodRegistry;
-    /** Per-call authority overriding the constructed default. See `RotateKeyParams.authority`. */
-    authority?: CredentialAuthority;
-};
-/** See `reKeyEntry`. */
-export type ReKeyEntryParams = {
-    /** Per-call authority overriding the constructed default. See `RotateKeyParams.authority`. */
-    authority?: CredentialAuthority;
-};
-/**
- * Why a key cannot be opened here, as opposed to not being open yet.
- *
- * Carried so that `status` can answer rather than throw: the one call whose job
- * is to report a key as unreadable must not fail on the key that is unreadable.
- */
-export type CredentialUnopenableReason = 
-/** A newer peer's ciphersuite. A different build could open it; this one cannot. */
-'unsupported-suite'
-/** No wrapping at the key's current version — a rotation that did not finish. */
- | 'no-wrapping'
-/** Every wrapping belongs to another recipient. Another device can open it. */
- | 'not-addressed';
-/**
- * Derived, never stored. A persisted `unlocked` column would be a belief that
- * survives a restart it should not.
- *
- * `available` is separated from `unlocked` because they differ in what the
- * caller must do, which is nothing, and in what the machine must do, which is
- * one unwrap. A `did`-only key is `available` until first read, and a TTL
- * eviction returns it there rather than to `locked` — no prompt ever becomes
- * necessary.
- */
-export type CredentialKeyStatus = {
-    state: 'unlocked';
-} | {
-    state: 'available';
-} | {
-    state: 'locked';
-    /**
-     * One entry per wrapping that could be opened here: an OR of ANDs. Nested
-     * because flattening loses the difference between a key openable by a pin
-     * OR a passphrase and one demanding both, and those are different prompts.
-     * `did` factors are absent — this device supplies them without asking.
-     */
-    unlockOptions: Array<Array<SecretFactorKind>>;
-} | {
-    state: 'unopenable';
-    reason: CredentialUnopenableReason;
-};
-export type CredentialGrantResult = {
-    /** The key version the recipient's wrapping sits at. */
-    version: number;
-    /**
-     * False when the recipient already held a wrapping and nothing was written.
-     * A caller broadcasting the grant emits its frame either way — that is what
-     * makes a repeat grant the retry path for a frame that never arrived.
-     */
-    created: boolean;
-};
-export type CredentialManager = {
-    /** Factor kinds this device can supply. Empty means it can hold no credentials. */
-    availableFactors(): Array<string>;
-    /**
-     * Open a key and hold its content key in memory.
-     *
-     * A `did`-only key needs no call: it opens on demand. This is for the ones
-     * carrying a factor only the user can supply.
-     */
-    unlock(keyID: string, inputs?: FactorInputs): Promise<void>;
-    /** Zero the cached content key. TTL eviction does the same thing. */
-    lock(keyID: string): void;
-    lockAll(): void;
-    status(keyID: string, version?: number): Promise<CredentialKeyStatus>;
-    /**
-     * Add a factor to THIS device's wrapping, leaving every other recipient's
-     * alone. Adding a `pin` therefore gates this device and no other, which is the
-     * intended granularity.
-     *
-     * `params.inputs` must carry the secret for every factor that SURVIVES the
-     * change, not only the one being added: the new wrapping's key is derived from
-     * all of them, and a descriptor holds a salt, never a secret.
-     */
-    addFactor(keyID: string, factor: FactorInput, params?: FactorChangeParams): Promise<void>;
-    /** Remove a factor kind from this device's wrapping. See `addFactor` on `params.inputs`. */
-    removeFactor(keyID: string, kind: string, params?: FactorChangeParams): Promise<void>;
-    createKey(params?: CreateKeyParams): Promise<string>;
-    /**
-     * Retire this key's content key: mint a fresh one at `version + 1`,
-     * re-encrypt every entry under it and re-make every wrapping. Returns the new
-     * version, which a caller has to carry in the `credential:key-rotate` frame.
-     *
-     * `keyID` and every `entryID` survive, so documents referencing them do not
-     * move. A wrapping survives only if this device can re-make it: `did`-only
-     * ones re-make unattended, and one carrying a secret factor needs that secret
-     * back in `params.inputs`, because re-making a wrapping derives its KEK from
-     * every surviving factor and a descriptor holds a salt, never a secret.
-     *
-     * NOT atomic. This manager holds a resolved store, not a `StoreProvider`, so
-     * it has no transaction to open — a caller wanting all-or-nothing has to build
-     * the manager inside one.
-     */
-    rotate(keyID: string, params?: RotateKeyParams): Promise<number>;
-    /**
-     * Address this key to one more recipient: a `did` wrapping over the SAME
-     * content key at the key's current version. Every entry already written stays
-     * as it is — the recipient opens the key, not a copy of it — and no entry
-     * plaintext is touched. Returns the version the wrapping was made at, which a
-     * caller has to carry in the `credential:key-grant` frame.
-     *
-     * A recipient that already holds a wrapping is a no-op, so the version alone
-     * cannot tell a fresh grant from a re-grant — `created` is what distinguishes
-     * them.
-     *
-     * `recipientWrappableDID` must be RESOLVABLE, not merely a name: a
-     * `did:peer:4` short form carries no document and so no agreement key. Working
-     * out which string that is for a given party is a group question, and this
-     * package does not know what a group is — so it takes the answer rather than
-     * asking.
-     *
-     * `administer`, and the device must be able to open the key: a locked one
-     * fails before the first write rather than persisting half a grant.
-     */
-    grant(keyID: string, recipientWrappableDID: string, params?: GrantKeyParams): Promise<CredentialGrantResult>;
-    listKeys(): Promise<Array<string>>;
-    /** How many wrappings a key carries — one per way of opening it. */
-    countWrappings(keyID: string): Promise<number>;
-    deleteKey(keyID: string): Promise<void>;
-    putEntry(keyID: string, plaintext: Uint8Array): Promise<string>;
-    updateEntry(entryID: string, plaintext: Uint8Array): Promise<void>;
-    /**
-     * As {@link updateEntry}, but never inserts: an entry gone by the time the
-     * write lands reports `'absent'` instead of raising. For a writeback racing a
-     * concurrent delete, where the caller has no `keyID` to fall back to `putEntry`
-     * with and raising would just be a `catch` the caller re-swallows.
-     */
-    updateEntryIfPresent(entryID: string, plaintext: Uint8Array): Promise<'updated' | 'absent'>;
-    readEntry(entryID: string): Promise<Uint8Array>;
-    getEntryProvenance(entryID: string): Promise<CredentialEntryProvenance>;
-    /**
-     * The RAW `owner_did` off the entry's key row — never normalized. Callers
-     * comparing against another DID normalize it themselves; folding it here
-     * would make the answer wrong for whichever caller wanted the unfolded form.
-     * `null` when the entry, or the key it sits on, is absent.
-     */
-    getEntryKeyOwnerDID(entryID: string): Promise<string | null>;
-    listEntries(keyID: string): Promise<Array<string>>;
-    deleteEntry(entryID: string): Promise<void>;
-    /**
-     * Move an entry onto another key: decrypt under the one it sits on, re-encrypt
-     * under the target's current version, keep the entry id.
-     *
-     * The key is the sharing unit, so sharing one secret means moving it onto a
-     * shared key rather than sharing the key it already sits under, which would
-     * share every other entry beneath that one too. The entry id survives because
-     * it never embedded a key id — every document referencing it stays valid. The
-     * ciphertext does not survive: it is bound to its key, so this is a genuine
-     * re-encryption and the target must be open, not merely named.
-     *
-     * `administer` on BOTH keys. Writing under the target changes what the target
-     * holds, and taking an entry out of the source changes what the source holds.
-     */
-    reKeyEntry(entryID: string, toKeyID: string, params?: ReKeyEntryParams): Promise<void>;
-};
+import type { CreateCredentialManagerParams, CredentialManager } from './manager-types.js';
+export type { CreateCredentialManagerParams, CreateKeyParams, CredentialEntryAddress, CredentialGrantResult, CredentialKeyStatus, CredentialManager, CredentialUnopenableReason, FactorChangeParams, GrantEntryParams, GrantKeyParams, RecoverRemovedDevicesParams, ReKeyCredentialEntryParams, ReKeyEntryParams, RotateKeyParams, UpdateCredentialEntryIfUnchangedParams, } from './manager-types.js';
 export declare function createCredentialManager(params: CreateCredentialManagerParams): CredentialManager;