v0.66.0

Added

• issueAppKeyCredential (/request): the caller-supplied-seed app-key
  credential issuer under mintAppKeyCredential and reissueAppKeyCredential
  is now exported, so an application's own self-issue path signs the same
  credential shape instead of maintaining a copy. It takes an optional
  documentLoader (defaulting to the shared security loader) and an optional
  description (defaulting to the wallet's consent sentence).
• retireRosterRecipientAndCascade (/keys): the recipient-naming twin of
  rotateRosterToDocumentAndCascade, for a ceremony that rotates the roster
  before its own document edit. It retires one named roster recipient, reads the
  fresh key back through a caller-supplied key-agreement key, and runs the same
  collection fan-out, with no seal backstop.
• anchorRosterStoreAt (/keys): sets a log-governed roster store's minimum
  controller version from a given account log; shared by both cascade entry
  points.
• rosterWrapsRecipient (/keys): the shared "does the current epoch wrap to
  this recipient" probe, now also used by addUserKeyRosterRecipient.
• UserKeyAdoptedHook (/keys): the named type for the roster-adoption
  persistence callback both cascade entry points take.

Fixed

• The enrollment wrap (addUserKeyRosterRecipient, /keys) now refuses a
  roster whose currentEpoch names no epoch in its own list, instead of
  proceeding to addRecipient. The collection cascade's per-collection op
  raises UserKeyRosterIntegrityError for the same shape rather than a bare
  Error. The new currentEpochOf (/keys) is the one implementation both
  sites, and the roster read, now share.

Changed

• The seeded ladder-rung scans (/clientAnnex, attributeLadderRung and
  attributeLadderInventory) derive the scanned range concurrently rather than
  one rung per await. Each rung is an HKDF expansion plus an Ed25519 keygen,
  and the default range is 128 rungs. The full range is still scanned, the
  classification order is unchanged, and no refusal changes.
• The client-annex generation minters (/clientAnnex,
  mintClientAnnexGeneration and mintCredentialClientAnnexGeneration) return
  the published head of the genesis log they just wrote -- the log, the DID and
  document, the effective update-key parameters, and the PUT's own ETag when the
  store hands one back -- rather than the log and document alone.
• The credential-anchored establishment's generation-delegation install stands
  on that head instead of re-fetching and re-resolving the log the mint wrote a
  moment earlier: one fewer serialized request on every signup. The GC
  generation swap and the annex heal's fresh-generation arm do the same.
• A head carrying no ETag is not carried forward, since the install's entry
  publishes under a compare-and-swap and a head with no validator would degrade
  that to an unconditional write. The install then reads for itself, as before.
  Either way its own publish advances the generation's chain-head pin.
• The fresh-generation block the credential-anchored paths share -- mint the
  generation, install its generation delegation, append the account document's
  pointer entry -- is one helper, mintPointedClientAnnexGeneration
  (/clientAnnex), with the pointer write injected: the establishment's two
  arms sign it as a client, the transient visit's fresh-generation arm moves it
  as the ladder. The establishment's bootstrap arm runs its controller flip
  through the helper's beforePointerEntry seam, between the install and the
  pointer entry, as before.
• rebindCredentialAnchoredRecord and credentialAnchoredStandingFields
  (/clientAnnex) are the one builder of the ladder-VM-signed bridge, sibling,
  and record re-bind, and the one builder of the standing fields a registry
  entry records; the establishment's stage 4 and the mend's record-downgrade
  re-bind and registry arm now share them.
• The annex heal's two pre-flight attributions merge into
  attributePointerEntryRung (/clientAnnex), the one place a
  LadderAttributionError maps onto ClientAnnexGenerationUnavailableError;
  pointerEntryUpdateKeys is a wrapper over it that still refuses a
  committed-only rung.
• The controller flip's error-handling asymmetry is now stated in code: the
  establishment's bootstrap arm swallows an authorization-class refusal because
  its Space may be one a concurrent run already flipped, while the annex heal's
  fresh-Space flip acts on a Space id minted a moment ago that no other run can
  hold, so it propagates every failure.
• forgetEnrolledClient and forgetLastEnrolledClient (/clientAnnex) now run
  their roster rotation and collection fan-out through
  retireRosterRecipientAndCascade instead of restating it, so both forgets set
  the roster store's minimum controller version the same way the revocation
  cascade does.
• BREAKING: forgetLastEnrolledClient takes a
  rosterStore: EncryptionDescriptorStore option instead of a
  rosterStoreFor: ({ did, log }) => store factory. The ceremony now anchors
  the roster store's minimum controller version itself -- at the pre-transition
  head for the opening read, at the post-reinstall head for the rotation -- so a
  store wired over a cached pre-transition view still anchors the transition's
  one ladder-signed roster append past the reinstall entry. Callers building a
  rosterStoreFor factory must pass one store instead. The store must be
  anchorable (SealableEncryptionDescriptorStore); one without
  setMinimumControllerVersion is refused with a TypeError before any read,
  since the strike-and-reinstall pair would otherwise publish two entries per
  attempt ahead of a rotation the ceremony-tail license refuses every time.
• isSealableDescriptorStore (/keys) probes both interface members (seal
  and setMinimumControllerVersion) rather than seal alone.