/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * The `@interop/wallet-core/clientAnnex` subpath: the client annex -- the
 * authoring and maintenance surface of everything anchored on a standing
 * credential's ladder rather than on an enrolled client. One boundary
 * rule holds throughout: this subpath imports from the base subpaths;
 * nothing in the base imports from it (enforced in the lint pass, with one
 * pinned exception -- `unlock/standingWebvh.ts` uses the shared ladder
 * attribution helpers here, never the annex log machinery). The verify-side
 * halves every wallet needs regardless of account configuration stay in the
 * base: the resource-log ladder-append license and the account-document
 * readers its `ControllerInventory` is built on -- `ladderVmIds` recognition
 * included -- (`resourceLog`, surfaced by `webvh`),
 * the unlock-record codec with its `ladder` and `delegatedClients` members
 * (`unlock`), the standing-zcap staleness policy and the generalized log store
 * seams (`webvh`), and the `GenerationCollect` activity builder (`space`).
 *
 * - The ladder (`ladder.ts`): rung and ladder-VM derivation from the record's
 *   random seed, and the shared attribution walks (`attributeLadderRung`,
 *   `attributeLadderInventory`) that recover the ladder's state from the
 *   published log itself.
 * - The annex log (`log.ts`) and its GC (`gc.ts`): the disposable sidecar
 *   did:webvh of GC'd generations holding transient per-visit verification
 *   methods, the generation delegation, the account document's
 *   `#DelegatedClients` pointer, and the quarterly swap-and-collect.
 * - ZCap signing as the ladder VM (`zcap.ts`): `ladderVmZcapClient` and the
 *   bootstrap `ladderVmAgent`.
 * - Single-verb Space capabilities (`spaceCapability.ts`): the short-lived
 *   DELETE-only and GET-only children a transient session mints over a
 *   stored management zcap or a Space's synthesized root, plus the
 *   capability-authorized Space DELETE they are minted for
 *   (`deleteSpaceWithCapability`, defined in the base `space` subpath).
 *   `spaceVerbTarget` is the verb-to-target mapping itself, so a caller
 *   sending one of these requests asks this module for the URL rather than
 *   re-deriving it, and `mintUnlockKeyringReadCapability` is the GET-only
 *   child naming an unlock Space's keyring record.
 * - The ladder-anchored account-log ceremonies (`ladderAnchored.ts`):
 *   ladder-anchored genesis, the self-enrolling continuation, the one-entry
 *   forget -- plus the composed flows around them (`selfEnroll.ts`,
 *   `forget.ts`), the credential-anchored account genesis
 *   (`credentialAnchoredGenesis.ts`), and the transient-recovery
 *   continuation (`recoveryLadderAnchored.ts`).
 *
 * The subsystem's decision records are the subpath's reading list:
 * `decisions/0002` (annex log update authority is static rung 0),
 * `decisions/0003` (generation identity and the ladder HKDF label family),
 * `decisions/0005` (the `delegatedClients` sealed record member),
 * `decisions/0006` (generation GC observables and the `GenerationCollect`
 * digest), and `decisions/0007` (the reveal entry's hash order).
 */
export { attributeLadderInventory, attributeLadderRung, clientAnnexRung, clientAnnexRungSeed, generateLadderSeed, LADDER_MAX_SCAN, LadderAttributionError, ladderRung, ladderRungSeed, ladderVmKeyMultibase, ladderVmSeed } from './ladder.js';
export type { LadderRung, LadderRungState, LadderStandingInventory } from './ladder.js';
export { assertGenerationId, clampGrantExpires, CLIENT_ANNEX_SPACE_TYPE, clientAnnexDidParts, clientAnnexLogStore, ClientAnnexRungUncommittedError, commitClientAnnexRung, createClientAnnexLog, DELEGATED_CLIENTS_DELEGATION_ACTIONS, DELEGATED_CLIENTS_DELEGATION_TTL_MS, DELEGATED_CLIENTS_SERVICE_TYPE, delegatedClientsDelegationMinter, delegatedClientsDelegationSpaceId, delegatedClientsPointer, delegatedClientsServiceEntry, delegatedClientsSpaceHistory, embeddedGenerationDelegation, enrollClientAnnexTransientClient, enrollTransientClient, ensureClientAnnexSpace, ensureGenerationDelegationCurrent, GENERATION_DELEGATION_ACTIONS, GENERATION_DELEGATION_SERVICE_TYPE, GENERATION_DELEGATION_TTL_MS, GENERATION_ID_PREFIX, generationDelegationHistory, generationDelegationServiceEntry, mintClientAnnexGeneration, mintCredentialClientAnnexGeneration, mintDelegatedClientsDelegation, mintGenerationDelegation, mintGenerationId, mintPointedClientAnnexGeneration, readClientAnnexLogOrAbsent, retireClientAnnexRung, revokeTreatingAlreadyRevokedAsSuccess, servicesPointedAtClientAnnex, setDelegatedClientsPointer, setDelegatedClientsPointerOnce } from './log.js';
export type { ClientAnnexWriteStore, PointerEntryOutcome, RevokeGenerationDelegationOutcome } from './log.js';
export { classifyGrantRevocationRefusal, embeddedParentCapability, isClientAnnexDid, revokeRecordedGrant } from './grantRevocation.js';
export type { AccountSignerCheck, GrantRevocationOutcome, GrantRevocationRefusal } from './grantRevocation.js';
export { clientAnnexGcDue, delegatedClientsPointerEstablishedAt, GENERATION_GC_PERIOD_MS, GENERATION_QUIET_BOUND_MS, GENERATION_QUIET_GRACE_MS, generationQuiet, runClientAnnexGc, swapClientAnnexGeneration } from './gc.js';
export type { ClientAnnexGcReport, ClientAnnexGcSwapOutcome, ClientAnnexGenerationSwap } from './gc.js';
export { ladderVmAgent, ladderVmSigners, ladderVmZcapClient } from './zcap.js';
export { DELETION_ZCAP_TTL_MS, ExpiredParentCapabilityError, mintSpaceRootVerbCapability, mintSpaceVerbCapability, mintUnlockKeyringReadCapability, spaceVerbTarget } from './spaceCapability.js';
export type { SpaceCapabilityVerb } from './spaceCapability.js';
export { deleteSpaceWithCapability } from '../space/deleteSpace.js';
export { attributePointerEntryRung, ClientAnnexGenerationUnavailableError, ensureCredentialClientAnnexGeneration, ladderSignedGenerationDelegationMinter, movePointerAsLadder, resolveClientAnnexSpaceId } from './heal.js';
export type { ClientAnnexGenerationEnsureOutcome, ClientAnnexGenerationUnavailableReason } from './heal.js';
export { credentialAnchoredStandingFields, ensurePointedClientAnnexGeneration, establishCredentialAnchoredAccount, rebindCredentialAnchoredRecord } from './establish.js';
export type { CredentialAnchoredBindRecordHook, CredentialAnchoredBindResult, CredentialAnchoredEstablishment, CredentialAnchoredStandingFields } from './establish.js';
export { CONTROLLER_PROMOTION_STAGE, CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGE_ALIASES, CREDENTIAL_ANCHORED_ESTABLISHMENT_STAGES, CREDENTIAL_ANCHORED_GENESIS_STAGES, KMS_AUTHENTICATION_STAGE } from './stages.js';
export type { CredentialAnchoredEstablishmentStage, CredentialAnchoredEstablishmentStageName, CredentialAnchoredGenesisStage } from './stages.js';
export { ensureRosterDeliveredEpochs } from './rosterDeliveredEpochs.js';
export type { RosterDeliveredEpochsResult } from './rosterDeliveredEpochs.js';
export { mendCredentialAnchoredAccount } from './mend.js';
export type { CredentialAnchoredAccountCore, CredentialAnchoredMendReport, CredentialAnchoredRegistryContext } from './mend.js';
export { BuiltOnHeadNotReachedError, createLadderAnchoredAccountLog, ensureLadderAnchoredDidWebvh, forgetWebvhClient, installLadderVmWebvh, ladderSignedAccountEntry, LastEnrolledClientForgetError, revealLadderRungWebvh, selfEnrollWebvhClient, strikeLadderVmWebvh } from './ladderAnchored.js';
export type { LadderSignedEntry, LadderSignedEntryOutcome } from './ladderAnchored.js';
export { signAccountEntry } from '../webvh/accountEntry.js';
export type { AccountEntryFields, AccountEntryOutcome, AccountLogSigner, AccountLogStore } from '../webvh/accountEntry.js';
export { selfEnrollClientCore } from './selfEnroll.js';
export { forgetEnrolledClient } from './forget.js';
export type { EnrolledClientForgetResult } from './forget.js';
export { forgetLastEnrolledClient, forgetLastWebvhClient } from './forgetLast.js';
export type { GenerationDelegationRetirement, LastEnrolledClientForgetResult } from './forgetLast.js';
export { ensureCredentialAnchoredAccountGenesis, mintCredentialAnchoredAccountKeySet } from './credentialAnchoredGenesis.js';
export { recoverWebvhLadderAnchored } from './recoveryLadderAnchored.js';
export { createLadderAnchoredWebvhLog, ladderVerificationMethod } from '../webvh/didWebvh.js';
export type { PublishedWebvhLog } from '../webvh/didWebvh.js';
export type { KmsAuthenticationBinding } from '../webvh/didWebvh.js';
//# sourceMappingURL=index.d.ts.map