@bsv/dpp-overlay-topics 0.4.0-beta.1

package/dist/tmDpp.js

@@ -0,0 +1,397 @@
+import { Beef, LockingScript, Transaction } from '@bsv/sdk';
+import { ACCEPTANCE_COMMITMENT_REFUSAL, MANAGED_CUSTODY_PROFILE, checkGenesisState, checkOwnerConsent, checkTransition, findDppOutputs, normaliseTransferAuthorities, tryParseDppOutput, verifyServerSignature, verifyUserSignature, } from '@bsv/dpp-core';
+import { policyKeysFor } from './policyConfig.js';
+export const DPP_TOPIC = 'tm_dpp';
+/**
+ * A fresh object each time, never a shared constant: the Engine writes
+ * `coinsRemoved` onto the instructions a topic manager returns, so a shared
+ * refusal object would carry the first refusal's mutation into every later
+ * answer.
+ */
+const none = () => ({ outputsToAdmit: [], coinsToRetain: [] });
+/**
+ * How many recently inspected states the manager remembers, by txid. A
+ * synchronisation pass hands the manager one state at a time in lineage
+ * order, each as a BEEF that stops at its own proof, so the predecessor's
+ * bytes arrive one call earlier and nowhere else; this is where they wait.
+ */
+const RECENT_STATES = 4096;
+/** The most predecessors the manager walks back to find a version 1 lineage's genesis before it gives up. */
+const MAX_LINEAGE_WALK = 10_000;
+export class DppTopicManager {
+    serverIdentityKey;
+    consentSelected;
+    authorities;
+    controlAuthorities;
+    managedAcceptance;
+    policy;
+    admitted;
+    /** States inspected recently, by txid: the predecessor a synchronisation pass showed one call ago. */
+    recent = new Map();
+    constructor(serverIdentityKey, options = {}) {
+        this.serverIdentityKey = serverIdentityKey;
+        this.consentSelected = options.ownerConsent != null && options.ownerConsent !== false;
+        this.authorities =
+            typeof options.ownerConsent === 'object'
+                ? normaliseTransferAuthorities(options.ownerConsent.authorities)
+                : [];
+        this.controlAuthorities = options.controlAuthorities != null ? normaliseTransferAuthorities(options.controlAuthorities) : this.authorities;
+        this.managedAcceptance = options.managedAcceptance === true;
+        this.policy = options.publisherPolicy != null && options.publisherPolicy.length > 0 ? options.publisherPolicy : undefined;
+        this.admitted = options.admittedOutputs;
+    }
+    /**
+     * The keys this state's countersignature may come from: under a policy, the
+     * state-publisher keys active at the state's timestamp; otherwise the one
+     * configured identity key. The state's own timestamp is the instant that
+     * matters, not the admission time, because a state announced late is still
+     * the state it was when it was signed.
+     */
+    publisherKeysFor(state) {
+        if (this.policy != null) {
+            const keys = policyKeysFor(this.policy, state.timestamp, 'state-publisher', DPP_TOPIC);
+            if (keys != null)
+                return keys;
+        }
+        return this.serverIdentityKey === '' ? [] : [this.serverIdentityKey];
+    }
+    remember(tx) {
+        const txid = tx.id('hex');
+        if (this.recent.has(txid))
+            return;
+        if (this.recent.size >= RECENT_STATES) {
+            const oldest = this.recent.keys().next().value;
+            if (oldest != null)
+                this.recent.delete(oldest);
+        }
+        this.recent.set(txid, tx);
+    }
+    /**
+     * The predecessor's locking script for one input, from the nearest source
+     * that has it: the hydrated input, the submitted BEEF, the engine's storage,
+     * and, on the historical paths only, the manager's recent memory. The txid
+     * the input names commits to the bytes each source yields, so none of them
+     * is trusted more than another; they differ only in who happened to hand
+     * the bytes over. Memory is kept for the synchronisation pass, where the SDK
+     * validates a graph one state at a time before any of it reaches storage;
+     * on the live path a writer's proven state announced without its parent is
+     * judged against what the index holds, never against what it happened to
+     * see, so the contract a submitter is held to stays the one it always was.
+     */
+    async predecessorScript(input, prevTxid, parsedBeef, historical) {
+        const outputIndex = input.sourceOutputIndex;
+        const hydrated = input.sourceTransaction?.outputs[outputIndex]?.lockingScript;
+        if (hydrated != null)
+            return hydrated;
+        const fromBeef = parsedBeef?.findTxid(prevTxid)?.tx?.outputs[outputIndex]?.lockingScript;
+        if (fromBeef != null)
+            return fromBeef;
+        if (this.admitted != null) {
+            const output = await this.admitted.findOutput(prevTxid, outputIndex, DPP_TOPIC);
+            if (output != null)
+                return LockingScript.fromBinary(output.outputScript);
+        }
+        if (historical) {
+            const remembered = this.recent.get(prevTxid)?.outputs[outputIndex]?.lockingScript;
+            if (remembered != null)
+                return remembered;
+        }
+        return undefined;
+    }
+    /**
+     * The genesis outpoint of the lineage a version 2 successor must name
+     * (`spec/record-model-v2.md` §6). A version 2 predecessor carries it; the
+     * ISSUE is it. A version 1 predecessor carries none, so the manager walks
+     * the admitted history back to the genesis through the same sources the
+     * predecessor's own bytes came from: the submitted BEEF, the engine's
+     * storage, and on the historical paths its recent memory. Undefined when
+     * the walk cannot be completed, which refuses the state: a lineage this
+     * index cannot trace is not one it can vouch for.
+     */
+    async lineageGenesisFor(prev, prevTxid, prevOutputIndex, parsedBeef, historical) {
+        if (prev.version === '2')
+            return prev.lineageGenesis ?? { txid: prevTxid, outputIndex: prevOutputIndex };
+        let state = prev;
+        let txid = prevTxid;
+        let outputIndex = prevOutputIndex;
+        for (let hops = 0; hops < MAX_LINEAGE_WALK; hops++) {
+            if (state.previousTxid === '')
+                return { txid, outputIndex };
+            const earlierTxid = state.previousTxid;
+            const earlier = await this.stateAt(earlierTxid, parsedBeef, historical);
+            if (earlier == null)
+                return undefined;
+            state = earlier.state;
+            txid = earlierTxid;
+            outputIndex = earlier.outputIndex;
+        }
+        return undefined;
+    }
+    /** The admitted DPP state a transaction carries, by txid, from the BEEF, the engine's storage or recent memory. */
+    async stateAt(txid, parsedBeef, historical) {
+        const fromBeef = parsedBeef?.findTxid(txid)?.tx;
+        const candidates = [];
+        if (fromBeef != null)
+            candidates.push(fromBeef);
+        if (historical) {
+            const remembered = this.recent.get(txid);
+            if (remembered != null)
+                candidates.push(remembered);
+        }
+        for (const tx of candidates) {
+            const refs = findDppOutputs(tx);
+            if (refs.length === 1)
+                return { state: refs[0].state, outputIndex: refs[0].outputIndex };
+        }
+        if (this.admitted?.findOutputsForTransaction != null) {
+            const outputs = await this.admitted.findOutputsForTransaction(txid);
+            for (const output of outputs) {
+                if (output.topic !== DPP_TOPIC)
+                    continue;
+                const parsed = tryParseDppOutput(LockingScript.fromBinary(output.outputScript));
+                if (parsed != null)
+                    return { state: parsed.state, outputIndex: output.outputIndex };
+            }
+        }
+        return undefined;
+    }
+    /**
+     * The inputs to treat as previously admitted coins. The Engine names them
+     * on the live path; the synchronisation emulation names only what its
+     * temporary graph holds, which for a state on top of a lineage this index
+     * already has is nothing. Then, and only when the storage is at hand, the
+     * inputs that spend an output this index has admitted for the topic stand
+     * in, which is the same question the Engine answers on the live path.
+     */
+    async previousCoinsFor(tx, state, previousCoins) {
+        if (previousCoins.length > 0 || this.admitted == null)
+            return previousCoins;
+        const found = [];
+        for (const [index, input] of tx.inputs.entries()) {
+            const sourceTxid = input.sourceTransaction?.id('hex') ?? input.sourceTXID;
+            if (sourceTxid !== state.previousTxid)
+                continue;
+            if ((await this.admitted.findOutput(sourceTxid, input.sourceOutputIndex, DPP_TOPIC)) != null)
+                found.push(index);
+        }
+        return found;
+    }
+    async identifyAdmissibleOutputs(beef, previousCoins, _offChainValues, mode) {
+        // The SDK's synchronisation names its passes: 'historical-tx' while it
+        // validates a fetched graph, 'historical-tx-no-spv' while it admits one.
+        const historical = mode === 'historical-tx' || mode === 'historical-tx-no-spv';
+        let tx;
+        try {
+            tx = Transaction.fromBEEF(beef);
+        }
+        catch {
+            return none();
+        }
+        /*
+         * A refusal keeps the coins the Engine offered. Without this the Engine
+         * reads a refused spend of an admitted tip as that tip's consumption by a
+         * transaction the topic did not care to retain, and its stale-output
+         * eviction removes the tip and, recursively, every predecessor nothing
+         * else consumes: one refused announcement emptied a passport's index
+         * entry in the 2026-08-12 rehearsal. Retaining the offered coins on
+         * refusal is the documented half of the contract that keeps the lineage.
+         * What the Engine still does with a refused transaction is written up in
+         * this package's README (a refused spend of the tip): it marks the tip
+         * spent in its own storage, tells the lookup services of the spend, and
+         * records the transaction as applied to the topic.
+         */
+        const refuse = () => previousCoins.length === 0 ? none() : { outputsToAdmit: [], coinsToRetain: [...previousCoins] };
+        const refs = findDppOutputs(tx);
+        if (refs.length !== 1)
+            return refuse();
+        const { state, outputIndex } = refs[0];
+        if (!verifyUserSignature(state))
+            return refuse();
+        if (!this.publisherKeysFor(state).some((key) => verifyServerSignature(state, key))) {
+            if (this.policy != null) {
+                // Under a policy the refusal can be a matter of time rather than of
+                // key: a writer signing with a key that has since retired, or that
+                // was not yet active at the state's timestamp, learns which from the
+                // operator's log, since the wire says only that nothing was admitted.
+                console.warn(`${DPP_TOPIC} refused ${tx.id('hex')}: server_signature is not from a state-publisher key active at ${state.timestamp}`);
+            }
+            return refuse();
+        }
+        if (state.previousTxid === '') {
+            if (checkGenesisState(state) != null)
+                return refuse();
+            if (previousCoins.length > 0) {
+                // A genesis spends no passport state. One that consumes an admitted
+                // coin would end the lineage it spends without a RETIRE and without
+                // naming it, which the chain rules refuse as a second genesis
+                // (record-model-v2.md section 6, invariant 3); the coin stays.
+                console.warn(`${DPP_TOPIC} refused ${tx.id('hex')}: a genesis state must not spend an admitted passport output`);
+                return refuse();
+            }
+            this.remember(tx);
+            return { outputsToAdmit: [outputIndex], coinsToRetain: [] };
+        }
+        /*
+         * The predecessor's bytes, found in the submitted BEEF by txid rather than
+         * read off `input.sourceTransaction`, and the distinction is a defect the
+         * 2026-08-12 backfill rehearsal caught: every mined event on every
+         * multi-state passport was refused, and the refusal consumed the admitted
+         * genesis coin, so one backfill pass left those passports with an empty
+         * index entry.
+         *
+         * The SDK's writer and reader agree on a rule this check used to be on the
+         * wrong side of. A transaction carrying its own merkle proof needs no
+         * ancestry for SPV, so `Beef.mergeTransaction` stops walking parents at a
+         * proof (`Beef.js:333`) and the reader symmetrically leaves
+         * `input.sourceTransaction` unset on a proven subject, even when the
+         * parent's bytes sit in the same BEEF. SPV is the wrong standard here:
+         * this check wants the predecessor's locking script to hold the transition
+         * rules against, which is a stricter need than proof of inclusion. So the
+         * BEEF is searched directly, hydration is taken when the SDK happens to
+         * provide it (a fresh unproven state, which is the live announce path),
+         * and the submitter's side of the contract is to include the predecessor's
+         * bytes, which `scripts/announce.ts` does by submitting each state atomic
+         * over the whole stored chain. Since peer synchronisation, two more
+         * sources stand behind those (`predecessorScript`).
+         */
+        let parsedBeef;
+        try {
+            parsedBeef = Beef.fromBinary(beef);
+        }
+        catch {
+            parsedBeef = undefined;
+        }
+        const coins = await this.previousCoinsFor(tx, state, previousCoins);
+        for (const inputIndex of coins) {
+            const input = tx.inputs[inputIndex];
+            if (input == null)
+                continue;
+            const prevTxid = input.sourceTransaction?.id('hex') ?? input.sourceTXID;
+            if (prevTxid !== state.previousTxid)
+                continue;
+            const prevScript = await this.predecessorScript(input, prevTxid, parsedBeef, historical);
+            if (prevScript == null)
+                continue;
+            const prev = tryParseDppOutput(prevScript);
+            if (prev == null)
+                continue;
+            const lineageGenesis = state.version === '2'
+                ? await this.lineageGenesisFor(prev.state, prevTxid, input.sourceOutputIndex, parsedBeef, historical)
+                : undefined;
+            if (state.version === '2' && lineageGenesis == null) {
+                console.warn(`${DPP_TOPIC} refused ${tx.id('hex')}: the lineage genesis could not be traced from the admitted history`);
+                return refuse();
+            }
+            const link = checkTransition(prev.state, state, prevTxid, {
+                prevOutputIndex: input.sourceOutputIndex,
+                lineageGenesis,
+                authorities: this.controlAuthorities,
+            });
+            if (link != null) {
+                // A version 2 refusal names a rule the writer may not know this
+                // instance applies (a named authority, the upgrade path), so the
+                // operator's log names it; version 1 refusals stay silent as before.
+                if (state.version === '2')
+                    console.warn(`${DPP_TOPIC} refused ${tx.id('hex')}: ${link}`);
+                return refuse();
+            }
+            if (state.version === '1' && this.consentSelected) {
+                const reason = checkOwnerConsent(prev.state, state, this.authorities);
+                if (reason != null) {
+                    // The other refusals are silent because the wire says everything a
+                    // writer needs. This one is a policy the writer may not know this
+                    // instance runs, so the operator's log names it.
+                    console.warn(`${DPP_TOPIC} refused ${tx.id('hex')}: ${reason}`);
+                    return refuse();
+                }
+            }
+            if (state.version === '2' && state.op === 'TRANSFER' && this.managedAcceptance && state.authorisationCommitment === '') {
+                console.warn(`${DPP_TOPIC} refused ${tx.id('hex')}: ${ACCEPTANCE_COMMITMENT_REFUSAL}`);
+                return refuse();
+            }
+            this.remember(tx);
+            return { outputsToAdmit: [outputIndex], coinsToRetain: [inputIndex] };
+        }
+        // No previously admitted coin matches previous_txid: not the admitted tip.
+        return refuse();
+    }
+    /**
+     * What a synchronising peer must fetch before this state can be judged: the
+     * input that spends the predecessor, when the state is not a genesis. The
+     * SDK asks this only for a proven state it could not admit alone, and drops
+     * any input this index already holds, so the answer is the predecessor and
+     * nothing else. Anything that does not decode as one DPP state needs nothing.
+     */
+    async identifyNeededInputs(beef) {
+        let tx;
+        try {
+            tx = Transaction.fromBEEF(beef);
+        }
+        catch {
+            return [];
+        }
+        const refs = findDppOutputs(tx);
+        if (refs.length !== 1 || refs[0].state.previousTxid === '')
+            return [];
+        const prevTxid = refs[0].state.previousTxid;
+        return tx.inputs
+            .filter((input) => (input.sourceTransaction?.id('hex') ?? input.sourceTXID) === prevTxid)
+            .map((input) => ({ txid: prevTxid, outputIndex: input.sourceOutputIndex }));
+    }
+    async getDocumentation() {
+        const lines = [
+            `# ${DPP_TOPIC}`,
+            '',
+            'Admission for DPP Token Standard passports, record versions 1 and 2',
+            '(spec/record-model.md, spec/record-model-v2.md). One DPP output per',
+            'transaction; signatures over the version\'s own preimage (unframed for',
+            'version 1, framed and domain-tagged for version 2); non-genesis states',
+            'must spend the admitted tip; spent states are retained as lifecycle',
+            'history. A version 2 state also binds the predecessor outpoint and the',
+            'lineage genesis, proves control of the predecessor on every UPDATE,',
+            'TRANSFER and RETIRE, and nothing is admitted after a RETIRE. A version 2',
+            'UPDATE may spend a version 1 tip, which upgrades the lineage; a version 1',
+            'state never spends a version 2 tip. Admission additionally requires a',
+            'valid publisher signature (deployment policy, spec/record-model.md §8).',
+            'A refused state that spends the admitted tip leaves the tip and its',
+            'history in place. The same rules judge a state a peer offers during',
+            'synchronisation as one a writer announces.',
+            '',
+            '## The publisher key',
+            '',
+        ];
+        if (this.policy != null) {
+            const newest = this.policy[this.policy.length - 1];
+            lines.push(`This index admits under a publisher key policy (spec/services.md section 1, dpp-publisher-policy@1), currently version ${newest.policyVersion} for the ${newest.scope.operatorProfile} scope. A state's server_signature must come from a state-publisher key that was active at the state's own timestamp: a retired key still admits the states it signed while active, and a key admits nothing timestamped before its activation. GET /capabilities lists the keys active now.`);
+        }
+        else {
+            lines.push('This index admits states countersigned by its one configured service identity key, an implicit single-operator policy with no rotation history. GET /capabilities names the key.');
+        }
+        lines.push('', '## Control authorities (version 2)', '');
+        lines.push(this.controlAuthorities.length === 0
+            ? 'Control authorities: none. Every version 2 UPDATE, TRANSFER and RETIRE proves control of the predecessor by equality or by control_linkage.'
+            : `Control authorities: ${this.controlAuthorities.join(', ')}. A version 2 UPDATE, TRANSFER or RETIRE by one of these keys is admitted without a control proof; the profile expects it to be attested on the anchor rail.`);
+        lines.push('', `## The managed-custody profile (${MANAGED_CUSTODY_PROFILE})`, '');
+        lines.push(this.managedAcceptance
+            ? 'This index is deployed for the managed-custody profile (spec/managed-custody.md): a version 2 TRANSFER is admitted only when its authorisation_commitment names the acceptance record the custodian retained.'
+            : 'Not enforced by this index, which admits a version 2 TRANSFER with an empty authorisation_commitment: the record model baseline. The managed-custody profile is switched on when the topic manager is configured for it (ACCEPTANCE_COMMITMENT=required).');
+        lines.push('', '## The owner-signed transfer (version 1)', '');
+        if (this.consentSelected) {
+            lines.push('This index is deployed for a profile that selects the owner-signed transfer (spec/custody.md section 4). A TRANSFER is admitted only when its actor is the previous owner, proven by equality (actor_identity_key equals the previous owner_identity_key) or by linkage (event_data carries owner_linkage, 64 lower-case hex characters, with the previous owner_identity_key equal to actor_identity_key plus owner_linkage times G), or when the actor is a transfer authority named below. The predicate is evaluated in that order: equality, authorities, linkage.', '', this.authorities.length === 0
+                ? 'Transfer authorities: none. Every TRANSFER must prove consent.'
+                : `Transfer authorities: ${this.authorities.join(', ')}. A TRANSFER by one of these keys is admitted without proof of consent; the profile expects it to be attested on the anchor rail.`);
+        }
+        else {
+            lines.push('Not enforced by this index, which admits any signed TRANSFER that spends the tip: the record model baseline. The owner-signed transfer (spec/custody.md section 4) is a profile choice, switched on when the topic manager is configured for it.');
+        }
+        return lines.join('\n');
+    }
+    async getMetaData() {
+        return {
+            name: DPP_TOPIC,
+            shortDescription: 'Digital Product Passport token admission (DPP Standard record versions 1 and 2)',
+            version: '2.0.0',
+        };
+    }
+}
+//# sourceMappingURL=tmDpp.js.map

package/dist/tmDpp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmDpp.js","sourceRoot":"","sources":["../src/tmDpp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAyB,MAAM,UAAU,CAAA;AAElF,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GAIpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,IAAI,GAAG,GAA2B,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAA;AAEtF;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,CAAA;AAE1B,6GAA6G;AAC7G,MAAM,gBAAgB,GAAG,MAAM,CAAA;AA6E/B,MAAM,OAAO,eAAe;IAWP;IAVF,eAAe,CAAS;IACxB,WAAW,CAAU;IACrB,kBAAkB,CAAU;IAC5B,iBAAiB,CAAS;IAC1B,MAAM,CAAoB;IAC1B,QAAQ,CAAoF;IAC7G,sGAAsG;IACrF,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAExD,YACmB,iBAAyB,EAC1C,UAA+B,EAAE;QADhB,sBAAiB,GAAjB,iBAAiB,CAAQ;QAG1C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAA;QACrF,IAAI,CAAC,WAAW;YACd,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;gBACtC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,CAAC;gBAChE,CAAC,CAAC,EAAE,CAAA;QACR,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QAC1I,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAA;QAC3D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;QACzH,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAA;IACzC,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,KAAe;QACtC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAA;YACtF,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAA;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACtE,CAAC;IAEO,QAAQ,CAAC,EAAe;QAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAA;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAM;QACjC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;YAC9C,IAAI,MAAM,IAAI,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC3B,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,iBAAiB,CAC7B,KAAuB,EACvB,QAAgB,EAChB,UAA4B,EAC5B,UAAmB;QAEnB,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAA;QAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,aAAa,CAAA;QAC7E,IAAI,QAAQ,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAA;QACrC,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,aAAa,CAAA;QACxF,IAAI,QAAQ,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAA;QACrC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;YAC/E,IAAI,MAAM,IAAI,IAAI;gBAAE,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,aAAa,CAAA;YACjF,IAAI,UAAU,IAAI,IAAI;gBAAE,OAAO,UAAU,CAAA;QAC3C,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,iBAAiB,CAC7B,IAAc,EACd,QAAgB,EAChB,eAAuB,EACvB,UAA4B,EAC5B,UAAmB;QAEnB,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,cAAc,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAA;QACxG,IAAI,KAAK,GAAa,IAAI,CAAA;QAC1B,IAAI,IAAI,GAAG,QAAQ,CAAA;QACnB,IAAI,WAAW,GAAG,eAAe,CAAA;QACjC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;YACnD,IAAI,KAAK,CAAC,YAAY,KAAK,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;YAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAA;YACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;YACvE,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,SAAS,CAAA;YACrC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;YACrB,IAAI,GAAG,WAAW,CAAA;YAClB,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;QACnC,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,mHAAmH;IAC3G,KAAK,CAAC,OAAO,CACnB,IAAY,EACZ,UAA4B,EAC5B,UAAmB;QAEnB,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,CAAA;QAC/C,MAAM,UAAU,GAAkB,EAAE,CAAA;QACpC,IAAI,QAAQ,IAAI,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,UAAU,IAAI,IAAI;gBAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACrD,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;YAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1F,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,yBAAyB,IAAI,IAAI,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAA;YACnE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAQ;gBACxC,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;gBAC/E,IAAI,MAAM,IAAI,IAAI;oBAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;YACrF,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,gBAAgB,CAAC,EAAe,EAAE,KAAe,EAAE,aAAuB;QACtF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI;YAAE,OAAO,aAAa,CAAA;QAC3E,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAA;YACzE,IAAI,UAAU,KAAK,KAAK,CAAC,YAAY;gBAAE,SAAQ;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,IAAc,EACd,aAAuB,EACvB,eAA0B,EAC1B,IAA8D;QAE9D,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,sBAAsB,CAAA;QAC9E,IAAI,EAAe,CAAA;QACnB,IAAI,CAAC;YACH,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QAED;;;;;;;;;;;;WAYG;QACH,MAAM,MAAM,GAAG,GAA2B,EAAE,CAC1C,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,aAAa,CAAC,EAAE,CAAA;QAEjG,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,EAAE,CAAA;QACtC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QAEtC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,EAAE,CAAA;QAChD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACnF,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBACxB,oEAAoE;gBACpE,mEAAmE;gBACnE,qEAAqE;gBACrE,sEAAsE;gBACtE,OAAO,CAAC,IAAI,CACV,GAAG,SAAS,YAAY,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,kEAAkE,KAAK,CAAC,SAAS,EAAE,CACxH,CAAA;YACH,CAAC;YACD,OAAO,MAAM,EAAE,CAAA;QACjB,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YAC9B,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,IAAI;gBAAE,OAAO,MAAM,EAAE,CAAA;YACrD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,oEAAoE;gBACpE,oEAAoE;gBACpE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAA;gBAChH,OAAO,MAAM,EAAE,CAAA;YACjB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YACjB,OAAO,EAAE,cAAc,EAAE,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;QAC7D,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,IAAI,UAA4B,CAAA;QAChC,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,SAAS,CAAA;QACxB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;QACnE,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YACnC,IAAI,KAAK,IAAI,IAAI;gBAAE,SAAQ;YAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAA;YACvE,IAAI,QAAQ,KAAK,KAAK,CAAC,YAAY;gBAAE,SAAQ;YAC7C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;YACxF,IAAI,UAAU,IAAI,IAAI;gBAAE,SAAQ;YAChC,MAAM,IAAI,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;YAC1C,IAAI,IAAI,IAAI,IAAI;gBAAE,SAAQ;YAC1B,MAAM,cAAc,GAClB,KAAK,CAAC,OAAO,KAAK,GAAG;gBACnB,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,CAAC;gBACrG,CAAC,CAAC,SAAS,CAAA;YACf,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAA;gBACvH,OAAO,MAAM,EAAE,CAAA;YACjB,CAAC;YACD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE;gBACxD,eAAe,EAAE,KAAK,CAAC,iBAAiB;gBACxC,cAAc;gBACd,WAAW,EAAE,IAAI,CAAC,kBAAkB;aACrC,CAAC,CAAA;YACF,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACjB,gEAAgE;gBAChE,iEAAiE;gBACjE,qEAAqE;gBACrE,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;gBACxF,OAAO,MAAM,EAAE,CAAA;YACjB,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;gBACrE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,mEAAmE;oBACnE,kEAAkE;oBAClE,iDAAiD;oBACjD,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC,CAAA;oBAC/D,OAAO,MAAM,EAAE,CAAA;gBACjB,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,KAAK,UAAU,IAAI,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,EAAE,CAAC;gBACvH,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,6BAA6B,EAAE,CAAC,CAAA;gBACtF,OAAO,MAAM,EAAE,CAAA;YACjB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YACjB,OAAO,EAAE,cAAc,EAAE,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,UAAU,CAAC,EAAE,CAAA;QACvE,CAAC;QAED,2EAA2E;QAC3E,OAAO,MAAM,EAAE,CAAA;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAc;QACvC,IAAI,EAAe,CAAA;QACnB,IAAI,CAAC;YACH,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAA;QAC3C,OAAO,EAAE,CAAC,MAAM;aACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC;aACxF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAA;IAC/E,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,KAAK,GAAG;YACZ,KAAK,SAAS,EAAE;YAChB,EAAE;YACF,qEAAqE;YACrE,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,0EAA0E;YAC1E,2EAA2E;YAC3E,uEAAuE;YACvE,yEAAyE;YACzE,qEAAqE;YACrE,qEAAqE;YACrE,4CAA4C;YAC5C,EAAE;YACF,sBAAsB;YACtB,EAAE;SACH,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAClD,KAAK,CAAC,IAAI,CACR,0HAA0H,MAAM,CAAC,aAAa,YAAY,MAAM,CAAC,KAAK,CAAC,eAAe,8RAA8R,CACrd,CAAA;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CACR,kLAAkL,CACnL,CAAA;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,oCAAoC,EAAE,EAAE,CAAC,CAAA;QACxD,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAClC,CAAC,CAAC,6IAA6I;YAC/I,CAAC,CAAC,wBAAwB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,8JAA8J,CAC7N,CAAA;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,mCAAmC,uBAAuB,GAAG,EAAE,EAAE,CAAC,CAAA;QACjF,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,iBAAiB;YACpB,CAAC,CAAC,+MAA+M;YACjN,CAAC,CAAC,2PAA2P,CAChQ,CAAA;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,0CAA0C,EAAE,EAAE,CAAC,CAAA;QAC9D,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CACR,yiBAAyiB,EACziB,EAAE,EACF,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;gBAC3B,CAAC,CAAC,gEAAgE;gBAClE,CAAC,CAAC,yBAAyB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,mIAAmI,CAC5L,CAAA;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CACR,kPAAkP,CACnP,CAAA;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,WAAW;QAKf,OAAO;YACL,IAAI,EAAE,SAAS;YACf,gBAAgB,EAAE,iFAAiF;YACnG,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;CACF"}

package/dist/tmUoraDpp.d.ts

@@ -0,0 +1,73 @@
+import type { AdmittanceInstructions, TopicManager } from '@bsv/overlay';
+/**
+ * `tm_uora_dpp`: admission for UORA attestation anchors.
+ *
+ * The second rail. `tm_dpp` admits the passport itself, a chain of states each
+ * spending the last; this one admits the anchors that say what a named party
+ * claimed about a passport and when. They are deliberately separate topics
+ * rather than one: they carry different formats, they are written by different
+ * treasuries, and an instance may reasonably want one and not the other.
+ *
+ * ## How this differs from `tm_dpp`, and why the rules are shorter
+ *
+ * An anchor is a leaf. It is never spent, it has no predecessor and no
+ * transition rules apply, so `previousCoins` is not consulted and nothing is
+ * retained. Everything admissible about one is legible in the output itself,
+ * which is the property that makes the format worth versioning.
+ *
+ * **Every valid anchor in the transaction is admitted, not exactly one.**
+ * `tm_dpp` insists on exactly one output because a second passport state in the
+ * same transaction would make "the tip" ambiguous. Anchors have no such
+ * relation to each other: each is independent and self-validating. Admitting
+ * all of them means a service can batch a fleet's worth of attestations into
+ * one transaction later without the topic needing to change, which at battery
+ * scale is the difference between one anchor per event being affordable and not.
+ *
+ * ## The admission policy
+ *
+ * Structural validity is `tryParseUoraAnchor`, and it already includes the
+ * attribution: the prefix, a 64-character digest, a resolvable `did:key`
+ * issuer, a subject, a type, the anchoring service's identity key, the appended
+ * signature sealing all seven **at the boundaries they were written at**, and
+ * the locking key being the BRC-42 child of the service key the output itself
+ * names. Producing an output that passes needs that key's private half, so
+ * every admitted anchor is attributable without this topic being told anything.
+ *
+ * That is the part v1 could not express, and the reason the service key is a
+ * field rather than a configuration value. A shared overlay serving several DPP
+ * deployments should not need a key list amended every time one is added, and a
+ * key list is not a security boundary anyway: it is a preference about whose
+ * anchors to carry.
+ *
+ * Which is exactly what the optional list is. Name services and this instance
+ * carries only theirs; name none and it carries any well-formed anchor, each of
+ * which still says whose it is.
+ *
+ * ## Only v3
+ *
+ * v2 is not admitted, and the reason is not tidiness. A v2 signature covers the
+ * field bytes run together, so it does not fix where the subject stops and the
+ * type starts, and any holder of a v2 anchor can re-cut that boundary and keep
+ * the signature. An index built on those fields would then be keyed on a
+ * subject nobody signed. `uoraAnchor.ts` sets out the whole of it.
+ *
+ * Nothing in the `TopicManager` contract lets a topic explain a refusal: the
+ * answer is a list of indices, and an absent index says only "not this one". So
+ * a v2 anchor is also warned about on the node's own console, because a
+ * treasury still writing v2 would otherwise get a 200 and an empty list back
+ * and have no way to tell that from a transaction carrying no anchors. A
+ * submitter that cares still has to read the admitted list rather than the HTTP
+ * status.
+ */
+export declare class UoraAnchorTopicManager implements TopicManager {
+    private readonly accepted;
+    constructor(anchorServiceKeys?: readonly string[]);
+    identifyAdmissibleOutputs(beef: number[]): Promise<AdmittanceInstructions>;
+    getDocumentation(): Promise<string>;
+    getMetaData(): Promise<{
+        name: string;
+        shortDescription: string;
+        version?: string;
+    }>;
+}
+//# sourceMappingURL=tmUoraDpp.d.ts.map

package/dist/tmUoraDpp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmUoraDpp.d.ts","sourceRoot":"","sources":["../src/tmUoraDpp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAUxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,qBAAa,sBAAuB,YAAW,YAAY;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;gBAEhC,iBAAiB,GAAE,SAAS,MAAM,EAAO;IAI/C,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAmC1E,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IA0CnC,WAAW,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAO3F"}

package/dist/tmUoraDpp.js

@@ -0,0 +1,150 @@
+import { Transaction } from '@bsv/sdk';
+import { tryParseUoraAnchor, uoraAnchorPrefix, UORA_ANCHOR_PREFIX, UORA_ANCHOR_PREFIX_V2, } from './uoraAnchor.js';
+const NONE = { outputsToAdmit: [], coinsToRetain: [] };
+/**
+ * `tm_uora_dpp`: admission for UORA attestation anchors.
+ *
+ * The second rail. `tm_dpp` admits the passport itself, a chain of states each
+ * spending the last; this one admits the anchors that say what a named party
+ * claimed about a passport and when. They are deliberately separate topics
+ * rather than one: they carry different formats, they are written by different
+ * treasuries, and an instance may reasonably want one and not the other.
+ *
+ * ## How this differs from `tm_dpp`, and why the rules are shorter
+ *
+ * An anchor is a leaf. It is never spent, it has no predecessor and no
+ * transition rules apply, so `previousCoins` is not consulted and nothing is
+ * retained. Everything admissible about one is legible in the output itself,
+ * which is the property that makes the format worth versioning.
+ *
+ * **Every valid anchor in the transaction is admitted, not exactly one.**
+ * `tm_dpp` insists on exactly one output because a second passport state in the
+ * same transaction would make "the tip" ambiguous. Anchors have no such
+ * relation to each other: each is independent and self-validating. Admitting
+ * all of them means a service can batch a fleet's worth of attestations into
+ * one transaction later without the topic needing to change, which at battery
+ * scale is the difference between one anchor per event being affordable and not.
+ *
+ * ## The admission policy
+ *
+ * Structural validity is `tryParseUoraAnchor`, and it already includes the
+ * attribution: the prefix, a 64-character digest, a resolvable `did:key`
+ * issuer, a subject, a type, the anchoring service's identity key, the appended
+ * signature sealing all seven **at the boundaries they were written at**, and
+ * the locking key being the BRC-42 child of the service key the output itself
+ * names. Producing an output that passes needs that key's private half, so
+ * every admitted anchor is attributable without this topic being told anything.
+ *
+ * That is the part v1 could not express, and the reason the service key is a
+ * field rather than a configuration value. A shared overlay serving several DPP
+ * deployments should not need a key list amended every time one is added, and a
+ * key list is not a security boundary anyway: it is a preference about whose
+ * anchors to carry.
+ *
+ * Which is exactly what the optional list is. Name services and this instance
+ * carries only theirs; name none and it carries any well-formed anchor, each of
+ * which still says whose it is.
+ *
+ * ## Only v3
+ *
+ * v2 is not admitted, and the reason is not tidiness. A v2 signature covers the
+ * field bytes run together, so it does not fix where the subject stops and the
+ * type starts, and any holder of a v2 anchor can re-cut that boundary and keep
+ * the signature. An index built on those fields would then be keyed on a
+ * subject nobody signed. `uoraAnchor.ts` sets out the whole of it.
+ *
+ * Nothing in the `TopicManager` contract lets a topic explain a refusal: the
+ * answer is a list of indices, and an absent index says only "not this one". So
+ * a v2 anchor is also warned about on the node's own console, because a
+ * treasury still writing v2 would otherwise get a 200 and an empty list back
+ * and have no way to tell that from a transaction carrying no anchors. A
+ * submitter that cares still has to read the admitted list rather than the HTTP
+ * status.
+ */
+export class UoraAnchorTopicManager {
+    accepted;
+    constructor(anchorServiceKeys = []) {
+        this.accepted = [...anchorServiceKeys].filter((key) => key !== '');
+    }
+    async identifyAdmissibleOutputs(beef) {
+        let tx;
+        try {
+            tx = Transaction.fromBEEF(beef);
+        }
+        catch {
+            return NONE;
+        }
+        const outputsToAdmit = [];
+        for (const [outputIndex, output] of tx.outputs.entries()) {
+            const anchor = tryParseUoraAnchor(output.lockingScript);
+            if (anchor == null) {
+                // A v2 anchor is turned away out loud. `outputsToAdmit` cannot tell a
+                // refusal from an output that was never an anchor, and a treasury still
+                // writing v2 would otherwise see a 200 and an empty list and read it as
+                // "nothing to index here". Everything else that fails to parse is
+                // somebody else's output and is not worth a line.
+                if (uoraAnchorPrefix(output.lockingScript) === UORA_ANCHOR_PREFIX_V2) {
+                    console.warn(`tm_uora_dpp: refused output ${outputIndex}, a ${UORA_ANCHOR_PREFIX_V2} anchor. ` +
+                        'Its signature covers the field bytes run together, so the boundary between the ' +
+                        `subject and the type is unsigned. Rewrite it as ${UORA_ANCHOR_PREFIX}.`);
+                }
+                continue;
+            }
+            if (this.accepted.length > 0 && !this.accepted.includes(anchor.anchoredBy))
+                continue;
+            outputsToAdmit.push(outputIndex);
+        }
+        // Nothing is ever retained: an anchor is never spent, so there is no
+        // history for a spend to consume.
+        return { outputsToAdmit, coinsToRetain: [] };
+    }
+    async getDocumentation() {
+        return [
+            `# tm_uora_dpp`,
+            '',
+            `Admission for UORA attestation anchors in the ${UORA_ANCHOR_PREFIX} format.`,
+            '',
+            'An anchor is a 1-satoshi PushDrop output carrying, in order: the version',
+            'prefix, the SHA-256 digest of the attestation in lower-case hex, the',
+            "attestation id, the issuer's did:key, the subject passport id, the UORA",
+            "attestation type, and the anchoring service's identity key. An eighth",
+            'field holds an ECDSA signature by the key that locks the output, over',
+            'each of the seven preceded by its length as a varint. The lengths are',
+            'the point: the signature fixes where every field stops, so no reader can',
+            'be shown the same bytes cut into a different subject and type.',
+            '',
+            'Admitted when all seven parse, the issuer resolves to a compressed',
+            'secp256k1 key, that signature verifies against the locking key, and the',
+            'locking key is the BRC-42 child of the service key in field 6 at protocol',
+            "[1, 'uora anchor v3'], key id the attestation id, counterparty 'anyone'.",
+            'The derivation is reproducible by anyone holding the output, and both it',
+            "and the signature need the service key's private half, so an admitted",
+            'anchor names its author checkably and carries no field its author did not',
+            'sign at the boundary it is read at.',
+            '',
+            `${UORA_ANCHOR_PREFIX_V2} is superseded and is not admitted. Its signature`,
+            'covered the field bytes run together, which left the boundary between the',
+            'subject and the type unsigned and re-cuttable by any holder.',
+            '',
+            'The issuer in field 3 is signed but not proved: anyone able to write an',
+            'anchor can write any DID there, and the signature says only that the',
+            'anchoring service wrote that DID and not that the party consented. What',
+            "the claim itself is worth is settled by the attestation's own signature,",
+            'which is not on chain.',
+            '',
+            'An instance may narrow to named anchoring services. That is a preference',
+            'about whose anchors to carry, not a security boundary.',
+            '',
+            'Anchors are leaves: never spent, nothing retained, no transition rules.',
+            'Every valid anchor in a transaction is admitted, so anchors may be batched.',
+        ].join('\n');
+    }
+    async getMetaData() {
+        return {
+            name: 'tm_uora_dpp',
+            shortDescription: `UORA attestation anchor admission (${UORA_ANCHOR_PREFIX})`,
+            version: '3.0.0',
+        };
+    }
+}
+//# sourceMappingURL=tmUoraDpp.js.map

package/dist/tmUoraDpp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tmUoraDpp.js","sourceRoot":"","sources":["../src/tmUoraDpp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAEtC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAA;AAExB,MAAM,IAAI,GAA2B,EAAE,cAAc,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,OAAO,sBAAsB;IAChB,QAAQ,CAAmB;IAE5C,YAAY,oBAAuC,EAAE;QACnD,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,IAAc;QAC5C,IAAI,EAAe,CAAA;QACnB,IAAI,CAAC;YACH,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,cAAc,GAAa,EAAE,CAAA;QACnC,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YACvD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,sEAAsE;gBACtE,wEAAwE;gBACxE,wEAAwE;gBACxE,kEAAkE;gBAClE,kDAAkD;gBAClD,IAAI,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,qBAAqB,EAAE,CAAC;oBACrE,OAAO,CAAC,IAAI,CACV,+BAA+B,WAAW,OAAO,qBAAqB,WAAW;wBAC/E,iFAAiF;wBACjF,mDAAmD,kBAAkB,GAAG,CAC3E,CAAA;gBACH,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;gBAAE,SAAQ;YACpF,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClC,CAAC;QAED,qEAAqE;QACrE,kCAAkC;QAClC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,OAAO;YACL,eAAe;YACf,EAAE;YACF,iDAAiD,kBAAkB,UAAU;YAC7E,EAAE;YACF,0EAA0E;YAC1E,sEAAsE;YACtE,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,gEAAgE;YAChE,EAAE;YACF,oEAAoE;YACpE,yEAAyE;YACzE,2EAA2E;YAC3E,0EAA0E;YAC1E,0EAA0E;YAC1E,uEAAuE;YACvE,2EAA2E;YAC3E,qCAAqC;YACrC,EAAE;YACF,GAAG,qBAAqB,mDAAmD;YAC3E,2EAA2E;YAC3E,8DAA8D;YAC9D,EAAE;YACF,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;YAC1E,wBAAwB;YACxB,EAAE;YACF,0EAA0E;YAC1E,wDAAwD;YACxD,EAAE;YACF,yEAAyE;YACzE,6EAA6E;SAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,gBAAgB,EAAE,sCAAsC,kBAAkB,GAAG;YAC7E,OAAO,EAAE,OAAO;SACjB,CAAA;IACH,CAAC;CACF"}