@interop/did-method-webvh 3.0.2 → 3.2.0

package/CHANGELOG.md

@@ -1,3 +1,41 @@
+## 3.2.0 - 2026-06-24
+
+### Added
+
+* export `deriveNextKeyHash` from the package entry, so callers implementing
+  key pre-rotation can compute the committed `nextKeyHashes` value
+  (`base58btc(multihash_sha2_256(sha256(utf8Bytes(publicKeyMultibase))))`)
+  without reaching into internal module paths.
+
+## 3.1.0 - 2026-06-15
+
+### Added
+
+* support `capabilityDelegation` and `capabilityInvocation` as verification
+  relationship options on `createDID` / `updateDID` (alongside the existing
+  `authentication`, `assertionMethod`, and `keyAgreement` passthroughs), so a
+  single verification method can be referenced by id across all five
+  relationships -- matching the `did:web` shape -- instead of being limited to
+  the one relationship implied by its `purpose`.
+* a verification method's `purpose` may now be an **array** of relationships
+  (`DataIntegrityProofPurpose[]`), not just a single value. A key declared with
+  `purpose: ['authentication', 'assertionMethod', 'capabilityDelegation',
+  'capabilityInvocation']` is added once to `verificationMethod` and referenced
+  by id from each listed relationship -- the ergonomic way to produce the
+  `did:web` shape without building relationship-id strings by hand. A single
+  string still works; absent (or empty) still defaults to `authentication`.
+* export `DID_PLACEHOLDER` (the `{DID}` substitution token) and `createVMID`
+  from the package entry, so callers can construct verification-method id
+  references (e.g. `` `${DID_PLACEHOLDER}#${publicKeyMultibase.slice(-8)}` ``)
+  without depending on internal magic strings.
+
+### Changed
+
+* `normalizeVMs` no longer copies the creation-time `purpose` directive onto the
+  emitted `verificationMethod` entries; `purpose` is not a DID Core
+  verification-method property and previously leaked into the published DID
+  document. The relationship arrays (`authentication`, etc.) are unaffected.
+
 ## 3.0.0-3.0.2 - 2026-06-14
 
 ### Package

package/dist/index.d.ts

@@ -2,5 +2,5 @@ export { AbstractCrypto, createDocumentSigner, createProof, createSigner, prepar
 export * from './interfaces.js';
 export { createDID, deactivateDID, resolveDID, resolveDIDFromLog, updateDID } from './method.js';
 export { MultibaseEncoding, multibaseDecode, multibaseEncode } from './utils/multiformats.js';
-export { generateParallelDidWeb, parseDidKeyDid, parseDidKeyVerificationMethod } from './utils.js';
+export { createVMID, DID_PLACEHOLDER, deriveNextKeyHash, generateParallelDidWeb, parseDidKeyDid, parseDidKeyVerificationMethod, } from './utils.js';
 export { createWitnessProof, signWitnessProofEntries, signWitnessProofEntry, } from './witness.js';

package/dist/index.js

@@ -2,5 +2,5 @@ export { AbstractCrypto, createDocumentSigner, createProof, createSigner, prepar
 export * from './interfaces.js';
 export { createDID, deactivateDID, resolveDID, resolveDIDFromLog, updateDID } from './method.js';
 export { MultibaseEncoding, multibaseDecode, multibaseEncode } from './utils/multiformats.js';
-export { generateParallelDidWeb, parseDidKeyDid, parseDidKeyVerificationMethod } from './utils.js';
+export { createVMID, DID_PLACEHOLDER, deriveNextKeyHash, generateParallelDidWeb, parseDidKeyDid, parseDidKeyVerificationMethod, } from './utils.js';
 export { createWitnessProof, signWitnessProofEntries, signWitnessProofEntry, } from './witness.js';

package/dist/interfaces.d.ts

@@ -89,7 +89,7 @@ export interface VerificationMethod {
     controller?: string;
     publicKeyMultibase?: string;
     secretKeyMultibase?: string;
-    purpose?: DataIntegrityProofPurpose;
+    purpose?: DataIntegrityProofPurpose | DataIntegrityProofPurpose[];
     publicKeyJwk?: any;
     use?: string;
 }
@@ -187,6 +187,8 @@ export interface CreateDIDInterface {
     authentication?: string[];
     assertionMethod?: string[];
     keyAgreement?: string[];
+    capabilityDelegation?: string[];
+    capabilityInvocation?: string[];
 }
 export interface SignDIDDocInterface {
     document: unknown;
@@ -209,6 +211,8 @@ export interface UpdateDIDInterface {
     authentication?: string[];
     assertionMethod?: string[];
     keyAgreement?: string[];
+    capabilityDelegation?: string[];
+    capabilityInvocation?: string[];
     witnessProofs?: WitnessProofFileEntry[];
 }
 export interface DeactivateDIDInterface {

package/dist/utils.js

@@ -524,6 +524,12 @@ export const createDIDDoc = async (options) => {
     if (options.keyAgreement) {
         doc.keyAgreement = options.keyAgreement;
     }
+    if (options.capabilityDelegation) {
+        doc.capabilityDelegation = options.capabilityDelegation;
+    }
+    if (options.capabilityInvocation) {
+        doc.capabilityInvocation = options.capabilityInvocation;
+    }
     if (options.alsoKnownAs) {
         doc.alsoKnownAs = options.alsoKnownAs;
     }
@@ -557,30 +563,35 @@ export const normalizeVMs = (verificationMethod, did = null) => {
     if (!verificationMethod || verificationMethod.length === 0) {
         return all;
     }
-    // First collect all VMs
-    const vms = verificationMethod.map((vm) => ({
+    // First collect all VMs. `purpose` is a creation-time directive for the
+    // relationship wiring below, not a DID Core verification-method property, so
+    // it is dropped from the emitted entries.
+    const vms = verificationMethod.map(({ purpose, ...vm }) => ({
         ...vm,
         id: vm.id ?? createVMID(vm, did),
         // Default controller to the DID — required by W3C DID Core §5.2
         controller: vm.controller ?? did,
     }));
     all.verificationMethod = vms;
+    // A VM's `purpose` may name a single relationship or several; an absent (or
+    // empty) purpose defaults the key into authentication.
+    const purposesOf = (vm) => vm.purpose == null ? [] : Array.isArray(vm.purpose) ? vm.purpose : [vm.purpose];
+    const idOf = (vm) => vm.id ?? createVMID(vm, did);
     // Then handle relationships - default to authentication if no purpose is specified
     all.authentication = verificationMethod
-        .filter((vm) => !vm.purpose || vm.purpose === 'authentication')
-        .map((vm) => vm.id ?? createVMID(vm, did));
-    all.assertionMethod = verificationMethod
-        .filter((vm) => vm.purpose === 'assertionMethod')
-        .map((vm) => vm.id ?? createVMID(vm, did));
-    all.keyAgreement = verificationMethod
-        .filter((vm) => vm.purpose === 'keyAgreement')
-        .map((vm) => vm.id ?? createVMID(vm, did));
+        .filter((vm) => {
+        const purposes = purposesOf(vm);
+        return purposes.length === 0 || purposes.includes('authentication');
+    })
+        .map(idOf);
+    all.assertionMethod = verificationMethod.filter((vm) => purposesOf(vm).includes('assertionMethod')).map(idOf);
+    all.keyAgreement = verificationMethod.filter((vm) => purposesOf(vm).includes('keyAgreement')).map(idOf);
     all.capabilityDelegation = verificationMethod
-        .filter((vm) => vm.purpose === 'capabilityDelegation')
-        .map((vm) => vm.id ?? createVMID(vm, did));
+        .filter((vm) => purposesOf(vm).includes('capabilityDelegation'))
+        .map(idOf);
     all.capabilityInvocation = verificationMethod
-        .filter((vm) => vm.purpose === 'capabilityInvocation')
-        .map((vm) => vm.id ?? createVMID(vm, did));
+        .filter((vm) => purposesOf(vm).includes('capabilityInvocation'))
+        .map(idOf);
     return all;
 };
 export const resolveVM = async (vm) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/did-method-webvh",
   "type": "module",
-  "version": "3.0.2",
+  "version": "3.2.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -24,7 +24,7 @@
     "lint:fix": "biome check --write .",
     "format": "biome format .",
     "format:fix": "biome format --write .",
-    "test": "rm -rf ./test/logs && NODE_ENV=test vitest run",
+    "test": "npm run lint:fix && rm -rf ./test/logs && NODE_ENV=test vitest run",
     "test:watch": "rm -rf ./test/logs && NODE_ENV=test vitest",
     "test:bail": "rm -rf ./test/logs && NODE_ENV=test vitest --bail=1",
     "test:coverage": "rm -rf ./test/logs && NODE_ENV=test vitest run --coverage",