/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * The `@interop/wallet-core/keys` subpath: the user key and its
 * wrap-set roster -- recipient zero of every encrypted collection, and the one
 * channel that delivers it to each enrolled wallet client.
 *
 * - `mintUserKey` / `userKeyVaultKeys` -- minting the account's user key and
 *   rebuilding the
 *   vault key-agreement key + resolver from stored material.
 * - `userKeySigningSeed` / `userKeyRecordSigner` /
 *   `userKeySigningKeyMultibase` / `USER_KEY_SALT` -- the user key's Ed25519
 *   signing half, derived from its X25519 secret rather than stored, and the
 *   record signer and verification allowlist an app-side record sealed to the
 *   vault KAK signs and checks its proof with.
 * - `encodeClientKeyRecord` / `decodeClientKeyRecord` -- the contents codec and
 *   strict validation of the local client-key record each client keeps its own
 *   key material in (storage and wrapping stay app-side).
 * - `ensureUserKeyRoster` / `addUserKeyRosterRecipient` / `readUserKeyRoster` /
 *   `userKeyRosterRecipientResolver` -- the user key roster over the
 *   was-client descriptor-store seam, with the client-side guards a
 *   resource-hosted descriptor needs (the governing resource log, the
 *   latest-seen epoch pin, and a recipient resolver backed by the locally
 *   verified did:webvh document).
 * - `currentEpochOf` -- the one implementation of "resolve a descriptor's
 *   current epoch, refusing a `currentEpoch` that names no epoch in its own
 *   list" (`UserKeyRosterIntegrityError`); every roster and collection
 *   descriptor read that needs the current epoch goes through it.
 * - `collectionDescriptorLogStore` -- the same store over ONE encrypted
 *   collection's governing history log (the collection's `meta/log`
 *   sub-resource, whose verified head state is its `encryption` descriptor).
 *   It derives its own chain-head pin slot from the collection handle, and
 *   carries the `collection-descriptor` log class, whose ladder-signed
 *   appends admit on `assertionMethod` membership alone.
 * - `userKeyRosterDescriptorStore` -- the same store over the user key roster:
 *   reads resolve to the roster log's verified head
 *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
 *   bare signing client for the login-time direct read. Sealable
 *   (`SealableEncryptionDescriptorStore` / `isSealableDescriptorStore`):
 *   `seal()` appends the idempotent backstop entry when the log's head still
 *   anchors before the account document's latest membership change.
 *
 *   Those two builders are the subpath's whole store surface. Each states its
 *   log class at construction, and the generic wrapper under them takes a
 *   caller-chosen class and log id, so it stays module-internal.
 * - `collectionDescriptorStores` / `accountCollectionStores` -- the
 *   `(collectionId) => store` lookup (`CollectionStoreFor`) the epoch
 *   installers, the geneses' `collectionStoreFor`, and the cascade take,
 *   over `collectionDescriptorLogStore`. The generic one takes the collection
 *   reach and the controller resolver as functions (a session's handle and
 *   verified-log memo); the account one takes the roster store's bare parts
 *   plus the account DID, builds the Space handle on the first lookup, and
 *   resolves the controller through `webvh`'s `accountControllerResolver`.
 * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
 *   the enrollment wrap and the roster read. A retiring rotation names no kid:
 *   it converges onto the account document instead.
 * - `convergeUserKeyRosterToDocument` -- the standing detector for a ceremony
 *   torn between its document edit and its roster append, in two directions
 *   and one append: a roster recipient the document no longer keys is rotated
 *   away from, and an enrolled client the document keys that holds no wrap is
 *   escrowed into every epoch.
 * - `enrolledClientRosterRecipients` -- the enrolled clients a document keys,
 *   as roster recipients; the escrow direction's candidate list.
 * - `readClientLabels` / `setClientLabel` / `removeClientLabel` /
 *   `wasClientLabelsStore` -- the enrolled-client display labels
 *   (`key-map/client-labels.json`), the record a "your wallets" surface names
 *   clients from, and the WAS-backed store they run through.
 * - `rotateUserKeyRoster` / `unwrapUserKeyGenerations` /
 *   `rotateCollectionEpochsToUserKey`
 *   / `cascadeCollectionsToUserKey` / `userKeyAsRecipient` -- the user key rotation
 *   cascade: the roster rotation off a revoked recipient, the per-collection
 *   re-epoch that brings an encrypted collection onto the roster's current
 *   user key, and the parallel best-effort fan-out over the collections the wallet
 *   names (also the completion sweep's driver).
 * - `rotateRosterToDocumentAndCascade` -- the shared roster-and-cascade tail
 *   every account-membership ceremony ends with (a client disconnected, a
 *   standing unlock credential retired): the post-edit minimum controller
 *   version on the roster store AND on every log-governed collection store
 *   the fan-out touches, the convergence rotation with its seal backstop, and
 *   the collection fan-out onto the fresh user key.
 * - `retireRosterRecipientAndCascade` -- the same tail for a ceremony that
 *   rotates BEFORE its document edit (the two forgets): the minimum
 *   controller version at the caller's anchor, one named recipient retired
 *   (`rosterWrapsRecipient` deciding whether the append is still owed), the
 *   fresh key read back through a surviving recipient's wrap, and the same
 *   fan-out; no seal backstop.
 * - `ensureWalletSpaceEpochs` -- the provision-time epoch[0] install for the
 *   wallet Space's encrypted collections, the EDV-bearing second step of
 *   `provisionWalletSpace`.
 * - `ensureIndexedFirstEpoch` -- one collection's epoch[0] plus its
 *   blinded-index HMAC key, adopting a pre-blind-index roster as-is.
 * - `walletSpaceProvisioner` -- the sync engine's `ensureProvisioned` closure
 *   over both steps, single-flight across the app's engines, refusing with
 *   `WalletSpaceProvisioningError` when a collection was left without its
 *   epoch so the engine never memoizes a torn run.
 */
export { mintUserKey, USER_KEY_SALT, userKeyVaultKeys } from './userKey.js';
export { userKeyRecordSigner, userKeySigningKeyMultibase, userKeySigningSeed } from './userKeySigning.js';
export type { UserKey } from './userKey.js';
export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRecord, isEnrolledClientKeyRecord, parseClientRecordPending, parseClientRecordUserKey, parseClientRecordWebvhKeys } from './clientKeyRecord.js';
export type { ClientKeyRecord, ClientKeyRecordJson, ClientKeyRecordPending, EnrolledClientKeyRecord } from './clientKeyRecord.js';
export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
export { rosterRecipientKid } from './rosterRecipientKid.js';
export { cascadeCollectionsToUserKey, rotateCollectionEpochsToUserKey } from './userKeyCascade.js';
export { unwrapUserKeyGenerations, userKeyAsRecipient } from './userKeyGenerations.js';
export type { CollectionUserKeyRotationOutcome, UserKeyCascadeResult } from './userKeyCascade.js';
export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
export type { CascadeCollections, RosterCascadeResult, RosterSealReport, UserKeyAdoptedHook } from './userKeyRosterCascade.js';
export type { DescriptorStoreRead, UserKeyRosterReadResult } from './userKeyRoster.js';
export type { KeyAgreementDocument } from '../resourceLog/document.js';
export { accountCollectionStores, collectionDescriptorLogStore, collectionDescriptorStores } from './collectionLogStore.js';
export type { CollectionStoreFor } from './collectionLogStore.js';
export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
export { isSealableDescriptorStore } from './rosterLogStore.js';
export type { SealableEncryptionDescriptorStore } from './rosterLogStore.js';
export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs, WalletSpaceProvisioningError, walletSpaceProvisioner } from './spaceEpochs.js';
export type { WalletSpaceEpochsResult } from './spaceEpochs.js';
export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';
export type { ClientLabelsRecord, ClientLabelsStore } from './clientLabels.js';
export { wasClientLabelsStore } from './wasLabelsStore.js';
//# sourceMappingURL=index.d.ts.map