@interop/wallet-core 0.101.0 → 0.103.0

package/dist/connections/grants.js

@@ -12,9 +12,25 @@
  * one party's id cannot steer a revocation at another party's capabilities.
  * A grant whose `zcap.invocationTarget` is not under this Space's container
  * URL is dropped, so no reader acts on a capability over another Space.
+ *
+ * The agent-connection readers sit beside them: the received list (the
+ * capabilities an agent handed the wallet, over targets outside this Space),
+ * the live inbox channel, the latest grant per scope, the grants one
+ * connection request's consent produced, the agent grant renewal predicate,
+ * and the agent entries one key signed grants for.
  */
+import { vmFragmentOf } from '@interop/vh-resource-log';
 import { connectionRecipientKid } from './didKey.js';
 import { grantKindOf } from './entry.js';
+import { INBOX_COLLECTION } from '../space/collections.js';
+import { delegationProofKeyId, delegationSignerGone, embeddedParentCapability, zcapExpiring } from '../webvh/index.js';
+/**
+ * The agent grant renewal window: ninety days before its `expires`, a grant
+ * to an agent is due for renewal. Distinct from the thirty-day window the
+ * standing recorded zcaps share, since an agent cannot ask the owner for a
+ * fresh grant on its own.
+ */
+export const AGENT_GRANT_RENEWAL_WINDOW_MS = 90 * 24 * 60 * 60 * 1000;
 /**
  * Whether a capability target sits under a Space's container URL. The target
  * is normalized by URL parsing first, so a dot segment cannot climb out of
@@ -62,10 +78,8 @@ export function connectionGrants({ entry, spaceUrl }) {
             zcapId: zcap.id,
             controller: zcap.controller,
             target: zcap.invocationTarget,
-            ...(zcap.allowedAction !== undefined && {
-                allowedAction: zcap.allowedAction
-            }),
-            ...(zcap.expires !== undefined && { expires: zcap.expires }),
+            allowedAction: zcap.allowedAction,
+            expires: zcap.expires,
             grantKind: grantKindOf(grant),
             grantedAt: grant.grantedAt,
             zcap
@@ -114,8 +128,8 @@ export function grantTargets({ grants }) {
     return [...new Set(grants.map(grant => grant.target))];
 }
 /**
- * Splits grants into the live and the expired. A grant with no `expires` is
- * live. One whose `expires` is at or before `now` is expired.
+ * Splits grants into the live and the expired. A grant whose `expires` is at
+ * or before `now` is expired.
  *
  * @param options {object}
  * @param options.grants {ConnectionGrant[]}
@@ -126,8 +140,7 @@ export function splitGrantsByExpiry({ grants, now = new Date() }) {
     const live = [];
     const expired = [];
     for (const grant of grants) {
-        if (grant.expires !== undefined &&
-            Date.parse(grant.expires) <= now.getTime()) {
+        if (Date.parse(grant.expires) <= now.getTime()) {
             expired.push(grant);
         }
         else {
@@ -147,4 +160,276 @@ export function splitGrantsByExpiry({ grants, now = new Date() }) {
 export function grantRecipientKid({ grant }) {
     return connectionRecipientKid({ did: grant.controller });
 }
+/**
+ * Whether a capability's action set names a verb. A string action is a
+ * one-member set.
+ *
+ * @param options {object}
+ * @param [options.allowedAction] {string | string[]}
+ * @param options.action {string}
+ * @returns {boolean}
+ */
+export function allowsAction({ allowedAction, action }) {
+    return normalizedActions({ allowedAction }).includes(action);
+}
+/**
+ * A capability's action set as a sorted array: a string is a one-member
+ * set, and an absent member is the empty set.
+ *
+ * @param options {object}
+ * @param [options.allowedAction] {string | string[]}
+ * @returns {string[]}
+ */
+export function normalizedActions({ allowedAction }) {
+    if (allowedAction === undefined) {
+        return [];
+    }
+    if (typeof allowedAction === 'string') {
+        return [allowedAction];
+    }
+    return [...allowedAction].sort();
+}
+/**
+ * The scope key two capabilities share when one renews the other: the
+ * `controller`, the `invocationTarget` compared verbatim (a trailing `*`
+ * marker counts), and the normalized `allowedAction`. The renewal pivot and
+ * {@link latestGrantsPerScope} key on the same string.
+ *
+ * @param options {object}
+ * @param options.zcap {ConnectionZcap}
+ * @returns {string}
+ */
+export function grantScopeKey({ zcap }) {
+    return JSON.stringify([
+        zcap.controller,
+        zcap.invocationTarget,
+        normalizedActions({ allowedAction: zcap.allowedAction })
+    ]);
+}
+/**
+ * The received grants of one entry that pass the received-list checks, in
+ * stored order: the opposite rule to {@link connectionGrants}. A record is
+ * kept only when its `zcap.controller` is the wallet's pairwise DID toward
+ * the party and its `invocationTarget` is outside this Space. An `'inbox'`
+ * record must also allow `POST`. A retired entry yields none, since readers
+ * ignore the received list on a retired entry.
+ *
+ * @param options {object}
+ * @param options.entry {ConnectionEntry}
+ * @param options.pairwiseDid {string}   the wallet's pairwise DID toward the
+ *   party
+ * @param options.spaceUrl {string}   this Space's container URL
+ * @returns {ConnectionReceivedGrant[]}
+ */
+export function receivedGrants({ entry, pairwiseDid, spaceUrl }) {
+    if (entry.retired !== undefined) {
+        return [];
+    }
+    const grants = [];
+    for (const record of entry.grantsReceived) {
+        const { zcap } = record;
+        if (zcap.controller !== pairwiseDid ||
+            isTargetInSpace({ target: zcap.invocationTarget, spaceUrl })) {
+            continue;
+        }
+        if (record.grantKind === 'inbox' &&
+            !allowsAction({ allowedAction: zcap.allowedAction, action: 'POST' })) {
+            continue;
+        }
+        grants.push({
+            zcapId: zcap.id,
+            controller: zcap.controller,
+            target: zcap.invocationTarget,
+            allowedAction: zcap.allowedAction,
+            expires: zcap.expires,
+            grantKind: record.grantKind,
+            receivedAt: record.receivedAt,
+            zcap
+        });
+    }
+    return grants;
+}
+/**
+ * Whether a received grant has lapsed as of `now`: it lapses at the earlier
+ * of its `expires` and `receivedAt + maxLifetimeMs`. A record with an
+ * unparseable `receivedAt` reads as lapsed.
+ *
+ * @param options {object}
+ * @param options.grant {object}   the grant's `expires` and `receivedAt`: a
+ *   `ConnectionReceivedGrant`, or a stored record's members
+ * @param options.now {Date}
+ * @param options.maxLifetimeMs {number}   the longest a received grant is
+ *   used after it was stored
+ * @returns {boolean}
+ */
+export function receivedGrantLapsed({ grant, now, maxLifetimeMs }) {
+    const receivedAt = Date.parse(grant.receivedAt);
+    if (Number.isNaN(receivedAt)) {
+        return true;
+    }
+    const lapsesAt = Math.min(receivedAt + maxLifetimeMs, Date.parse(grant.expires));
+    return lapsesAt <= now.getTime();
+}
+/**
+ * The live inbox channel: of the `'inbox'` received grants not lapsed
+ * ({@link receivedGrantLapsed}), the one with the greatest `expires`. A tie
+ * keeps the later record in stored order.
+ *
+ * @param options {object}
+ * @param options.grants {ConnectionReceivedGrant[]}   the received list, as
+ *   {@link receivedGrants} returns it
+ * @param options.now {Date}
+ * @param options.maxLifetimeMs {number}
+ * @returns {ConnectionReceivedGrant | undefined}
+ */
+export function liveInboxChannel({ grants, now, maxLifetimeMs }) {
+    let best;
+    let bestExpires = Number.NEGATIVE_INFINITY;
+    for (const grant of grants) {
+        if (grant.grantKind !== 'inbox' ||
+            receivedGrantLapsed({ grant, now, maxLifetimeMs })) {
+            continue;
+        }
+        const expiresAt = Date.parse(grant.expires);
+        if (best === undefined || expiresAt >= bestExpires) {
+            best = grant;
+            bestExpires = expiresAt;
+        }
+    }
+    return best;
+}
+/**
+ * The latest grant per scope. A scope is the grant's `controller`, its
+ * `target` compared verbatim (a trailing `*` marker included), and its
+ * action set (a string is a one-member set, and order does not matter). The
+ * latest is the one with the greatest `expires`, and a tie keeps the later
+ * record in stored order. One grant per scope, in first-seen scope order.
+ *
+ * @param options {object}
+ * @param options.grants {ConnectionGrant[]}
+ * @returns {ConnectionGrant[]}
+ */
+export function latestGrantsPerScope({ grants }) {
+    const latest = latestIndexPerScope({ zcaps: grants.map(grant => grant.zcap) });
+    return [...latest.values()].map(index => grants[index]);
+}
+/**
+ * The index of the latest capability in each scope ({@link grantScopeKey})
+ * of a list: the greatest `expires`, a tie going to the later one. Scopes
+ * come out in first-seen order.
+ *
+ * @param options {object}
+ * @param options.zcaps {ConnectionZcap[]}
+ * @returns {Map<string, number>}   scope key to the latest capability's index
+ */
+export function latestIndexPerScope({ zcaps }) {
+    const latest = new Map();
+    zcaps.forEach((zcap, index) => {
+        const scope = grantScopeKey({ zcap });
+        const held = latest.get(scope);
+        if (held === undefined ||
+            Date.parse(zcap.expires) >= Date.parse(zcaps[held].expires)) {
+            // Map.set on an existing key keeps the key's first-seen position.
+            latest.set(scope, index);
+        }
+    });
+    return latest;
+}
+/**
+ * The grants one connection request's consent produced: those sharing their
+ * `grantedAt` with an inbox grant on the same list (one targeting exactly
+ * this Space's inbox collection container and allowing `POST`), whose action
+ * set is exactly `GET` and `HEAD` on a Collection container, or exactly
+ * `POST` on the inbox. A write grant, and a read grant from another consent,
+ * are out of scope.
+ *
+ * @param options {object}
+ * @param options.grants {ConnectionGrant[]}
+ * @param options.spaceUrl {string}   this Space's container URL
+ * @returns {ConnectionGrant[]}
+ */
+export function renewalScopeGrants({ grants, spaceUrl }) {
+    const actionsOf = (grant) => normalizedActions({ allowedAction: grant.allowedAction }).join(' ');
+    const isInboxPostTarget = (grant) => collectionIdInSpace({ target: grant.target, spaceUrl }) === INBOX_COLLECTION;
+    const consentStamps = new Set(grants
+        .filter(grant => isInboxPostTarget(grant) &&
+        allowsAction({ allowedAction: grant.allowedAction, action: 'POST' }))
+        .map(grant => grant.grantedAt));
+    return grants.filter(grant => {
+        if (!consentStamps.has(grant.grantedAt)) {
+            return false;
+        }
+        const actions = actionsOf(grant);
+        if (actions === 'GET HEAD') {
+            return (collectionIdInSpace({ target: grant.target, spaceUrl }) !== undefined);
+        }
+        return actions === 'POST' && isInboxPostTarget(grant);
+    });
+}
+/**
+ * Whether a grant to an agent is due for renewal. A grant already past its
+ * `expires` is not due: it is gone, and a fresh consent replaces it. One
+ * inside the renewal window is due (`zcapExpiring`'s polarity). Past that, a
+ * grant whose embedded parent is
+ * not the generation delegation the account currently points at is dead by
+ * replacement and due, while its parent's own signer still stands under
+ * `capabilityDelegation`. When that signer has left the document the grant
+ * fails its proof check instead and is not due here. A root-anchored grant
+ * (no embedded parent) is not due on this axis. The document is consulted
+ * for the parent's signer only, since an annex VM that signs the leaf never
+ * appears in the account document.
+ *
+ * @param options {object}
+ * @param options.zcap {ConnectionZcap}
+ * @param [options.pointedDelegationId] {string}   the current generation
+ *   delegation's id, read from the account pointer's generation log head;
+ *   undefined when the document points at no generation
+ * @param options.doc {PublishedKeyDocument}   the locally verified account
+ *   document
+ * @param [options.renewalWindowMs] {number}
+ * @param [options.now] {number}   epoch milliseconds
+ * @returns {boolean}
+ */
+export function agentGrantDue({ zcap, pointedDelegationId, doc, renewalWindowMs = AGENT_GRANT_RENEWAL_WINDOW_MS, now = Date.now() }) {
+    if (Date.parse(zcap.expires) <= now) {
+        return false;
+    }
+    if (zcapExpiring({ expires: zcap.expires, windowMs: renewalWindowMs, now })) {
+        return true;
+    }
+    const parent = embeddedParentCapability(zcap);
+    if (parent === undefined) {
+        return false;
+    }
+    return (parent.id !== pointedDelegationId &&
+        !delegationSignerGone({ zcap: parent, doc }));
+}
+/**
+ * The unretired agent entries holding at least one grant (through
+ * {@link connectionGrants}) a key signed. A root-anchored grant (no embedded
+ * parent) counts when its own proof names the key. A grant with an embedded
+ * parent counts when the parent's proof names the key, the parent's minter.
+ *
+ * @param options {object}
+ * @param options.entries {ConnectionEntry[]}
+ * @param options.keyId {string}   a verification-method id in either DID
+ *   form, or a bare multibase
+ * @param options.spaceUrl {string}   this Space's container URL
+ * @returns {ConnectionEntry[]}
+ */
+export function agentConnectionsSignedBy({ entries, keyId, spaceUrl }) {
+    const key = vmFragmentOf(keyId) ?? keyId;
+    const signedBy = (zcap) => {
+        const proofKeyId = delegationProofKeyId(zcap);
+        return (proofKeyId !== undefined &&
+            (vmFragmentOf(proofKeyId) ?? proofKeyId) === key);
+    };
+    return entries.filter(entry => entry.kind === 'agent' &&
+        entry.retired === undefined &&
+        connectionGrants({ entry, spaceUrl }).some(grant => {
+            const zcap = grant.zcap;
+            const parent = embeddedParentCapability(zcap);
+            return signedBy(parent ?? zcap);
+        }));
+}
 //# sourceMappingURL=grants.js.map

package/dist/connections/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AA8BxC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,iDAAiD,QAAQ,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EAIT;IACC,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;QACtB,IACE,KAAK,CAAC,EAAE,KAAK,SAAS;YACtB,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE;YAC5B,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC7D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gBACtC,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5D,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,MAAM,EAGP;IACC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAIjB;IACC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAC1C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EAGN;IACC,OAAO,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;AAC1D,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAG1B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA6BrE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,iDAAiD,QAAQ,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EAIT;IACC,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;QACtB,IACE,KAAK,CAAC,EAAE,KAAK,SAAS;YACtB,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE;YAC5B,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC7D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,MAAM,EAGP;IACC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAIjB;IACC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EAGN;IACC,OAAO,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;AAC1D,CAAC;AAiCD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,aAAa,EACb,MAAM,EAIP;IACC,OAAO,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,aAAa,EAGd;IACC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,CAAC,aAAa,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,IAAI,EAA4B;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,gBAAgB;QACrB,iBAAiB,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;KACzD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,KAAK,EACL,WAAW,EACX,QAAQ,EAKT;IACC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAA8B,EAAE,CAAA;IAC5C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;QACvB,IACE,IAAI,CAAC,UAAU,KAAK,WAAW;YAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC5D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IACE,MAAM,CAAC,SAAS,KAAK,OAAO;YAC5B,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACpE,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,KAAK,EACL,GAAG,EACH,aAAa,EAKd;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,UAAU,GAAG,aAAa,EAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1B,CAAA;IACD,OAAO,QAAQ,IAAI,GAAG,CAAC,OAAO,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,MAAM,EACN,GAAG,EACH,aAAa,EAKd;IACC,IAAI,IAAyC,CAAA;IAC7C,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAA;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,KAAK,CAAC,SAAS,KAAK,OAAO;YAC3B,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAClD,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YACnD,IAAI,GAAG,KAAK,CAAA;YACZ,WAAW,GAAG,SAAS,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9E,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,KAAK,EAGN;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC9B,IACE,IAAI,KAAK,SAAS;YAClB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,OAAO,CAAC,EAC5D,CAAC;YACD,kEAAkE;YAClE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,MAAM,EACN,QAAQ,EAIT;IACC,MAAM,SAAS,GAAG,CAAC,KAAsB,EAAU,EAAE,CACnD,iBAAiB,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,MAAM,iBAAiB,GAAG,CAAC,KAAsB,EAAW,EAAE,CAC5D,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,gBAAgB,CAAA;IAC9E,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,MAAM;SACH,MAAM,CACL,KAAK,CAAC,EAAE,CACN,iBAAiB,CAAC,KAAK,CAAC;QACxB,YAAY,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACvE;SACA,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CACjC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,OAAO,CACL,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,SAAS,CACtE,CAAA;QACH,CAAC;QACD,OAAO,OAAO,KAAK,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,IAAI,EACJ,mBAAmB,EACnB,GAAG,EACH,eAAe,GAAG,6BAA6B,EAC/C,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAOjB;IACC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;QACpC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAwB,CAAC,CAAA;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,CACL,MAAM,CAAC,EAAE,KAAK,mBAAmB;QACjC,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC7C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,OAAO,EACP,KAAK,EACL,QAAQ,EAKT;IACC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;IACxC,MAAM,QAAQ,GAAG,CAAC,IAAW,EAAW,EAAE;QACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;QAC7C,OAAO,CACL,UAAU,KAAK,SAAS;YACxB,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,GAAG,CACjD,CAAA;IACH,CAAC,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,IAAI,KAAK,OAAO;QACtB,KAAK,CAAC,OAAO,KAAK,SAAS;QAC3B,gBAAgB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAwB,CAAA;YAC3C,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;YAC7C,OAAO,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;QACjC,CAAC,CAAC,CACL,CAAA;AACH,CAAC"}

package/dist/connections/index.d.ts

@@ -16,9 +16,16 @@
  * - The grant index the revocation orchestrators share
  *   (`connectionGrants`, `grantTargets`, `splitGrantsByExpiry`,
  *   `grantRecipientKid`), with the reader checks every reader applies.
+ * - The agent-connection readers: the received list (`receivedGrants`,
+ *   `receivedGrantLapsed`, `liveInboxChannel`), the latest grant per scope
+ *   (`latestGrantsPerScope`), a consent's renewal scope
+ *   (`renewalScopeGrants`), the renewal predicate (`agentGrantDue`,
+ *   `AGENT_GRANT_RENEWAL_WINDOW_MS`), and `agentConnectionsSignedBy`.
  * - The upsert helpers (`recordGrants`, `removeGrants`, `retireConnection`,
  *   `unretireConnection`, `setConnectionLabel`) and their kind refusal
- *   (`ConnectionKindMismatchError`).
+ *   (`ConnectionKindMismatchError`), and the agent-connection helpers
+ *   (`recordReceivedGrants`, `recordRenewedGrants`, `settleOutboxItem`,
+ *   `pruneSupersededGrants`, `clearReceivedGrants`, `markDeclined`).
  * - The writer arm: lazy registration (`registerConnectionWriter`), the
  *   pull-path touch (`touchConnectionWriter`), the per-entry sweep
  *   (`sweepConnectionWriters`), and `resolveWriter` for history views.
@@ -26,19 +33,19 @@
  *   and the account document, and `normalizeDisplayName`, the one name rule
  *   every producer writes `name` through.
  */
-export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_WRITER_POLICY, GRANT_KINDS, connectionKindOf, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
-export type { ConnectionEntry, ConnectionGrantRecord, ConnectionKind, ConnectionWriter, ConnectionWriterPolicy, ConnectionZcap, GrantKind } from './entry.js';
-export { CONNECTIONS_ID_PREFIX, connectionResourceId } from './resourceId.js';
+export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_SEED_BYTES, CONNECTION_WRITER_POLICY, GRANT_KINDS, RECEIVED_GRANT_KINDS, connectionKindOf, decodeConnectionSeed, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
+export type { ConnectionEntry, ConnectionGrantRecord, ConnectionKind, ConnectionOutboxItem, ConnectionReceivedGrantRecord, ConnectionWriter, ConnectionWriterPolicy, ConnectionZcap, GrantKind, ReceivedGrantKind } from './entry.js';
+export { CONNECTIONS_ID_PREFIX, connectionResourceId, connectionSeedTag, verifyConnectionSeedTag } from './resourceId.js';
 export type { ConnectionIdKey } from './resourceId.js';
 export { wasConnectionsStore } from './store.js';
 export type { ConnectionsStore, StoredConnection } from './store.js';
 export { findConnection, readConnections } from './read.js';
 export type { ConnectionsListing, ReadConnection } from './read.js';
-export { collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
-export type { ConnectionGrant } from './grants.js';
-export { connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
+export { AGENT_GRANT_RENEWAL_WINDOW_MS, agentConnectionsSignedBy, agentGrantDue, collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, grantScopeKey, latestGrantsPerScope, latestIndexPerScope, liveInboxChannel, receivedGrantLapsed, receivedGrants, renewalScopeGrants, splitGrantsByExpiry } from './grants.js';
+export type { ConnectionGrant, ConnectionReceivedGrant } from './grants.js';
+export { connectionDidKey, connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
 export { ConnectionKindMismatchError } from './errors.js';
-export { recordGrants, removeGrants, retireConnection, setConnectionLabel, unretireConnection } from './upsert.js';
+export { clearReceivedGrants, markDeclined, pruneSupersededGrants, recordGrants, recordReceivedGrants, recordRenewedGrants, removeGrants, retireConnection, setConnectionLabel, settleOutboxItem, unretireConnection } from './upsert.js';
 export type { ConnectionWriteOutcome, ConnectionWriteResult } from './upsert.js';
 export { registerConnectionWriter, resolveWriter, sweepConnectionWriters, touchConnectionWriter } from './writers.js';
 export type { ConnectionWritersSweep, ResolvedWriter, WriterFirstSeenRecord, WriterFirstSeenStore, WriterRegistrationOutcome, WriterTouchOutcome } from './writers.js';

package/dist/connections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC7E,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACT,iBAAiB,EAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/connections/index.js

@@ -16,9 +16,16 @@
  * - The grant index the revocation orchestrators share
  *   (`connectionGrants`, `grantTargets`, `splitGrantsByExpiry`,
  *   `grantRecipientKid`), with the reader checks every reader applies.
+ * - The agent-connection readers: the received list (`receivedGrants`,
+ *   `receivedGrantLapsed`, `liveInboxChannel`), the latest grant per scope
+ *   (`latestGrantsPerScope`), a consent's renewal scope
+ *   (`renewalScopeGrants`), the renewal predicate (`agentGrantDue`,
+ *   `AGENT_GRANT_RENEWAL_WINDOW_MS`), and `agentConnectionsSignedBy`.
  * - The upsert helpers (`recordGrants`, `removeGrants`, `retireConnection`,
  *   `unretireConnection`, `setConnectionLabel`) and their kind refusal
- *   (`ConnectionKindMismatchError`).
+ *   (`ConnectionKindMismatchError`), and the agent-connection helpers
+ *   (`recordReceivedGrants`, `recordRenewedGrants`, `settleOutboxItem`,
+ *   `pruneSupersededGrants`, `clearReceivedGrants`, `markDeclined`).
  * - The writer arm: lazy registration (`registerConnectionWriter`), the
  *   pull-path touch (`touchConnectionWriter`), the per-entry sweep
  *   (`sweepConnectionWriters`), and `resolveWriter` for history views.
@@ -26,14 +33,14 @@
  *   and the account document, and `normalizeDisplayName`, the one name rule
  *   every producer writes `name` through.
  */
-export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_WRITER_POLICY, GRANT_KINDS, connectionKindOf, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
-export { CONNECTIONS_ID_PREFIX, connectionResourceId } from './resourceId.js';
+export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_SEED_BYTES, CONNECTION_WRITER_POLICY, GRANT_KINDS, RECEIVED_GRANT_KINDS, connectionKindOf, decodeConnectionSeed, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
+export { CONNECTIONS_ID_PREFIX, connectionResourceId, connectionSeedTag, verifyConnectionSeedTag } from './resourceId.js';
 export { wasConnectionsStore } from './store.js';
 export { findConnection, readConnections } from './read.js';
-export { collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
-export { connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
+export { AGENT_GRANT_RENEWAL_WINDOW_MS, agentConnectionsSignedBy, agentGrantDue, collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, grantScopeKey, latestGrantsPerScope, latestIndexPerScope, liveInboxChannel, receivedGrantLapsed, receivedGrants, renewalScopeGrants, splitGrantsByExpiry } from './grants.js';
+export { connectionDidKey, connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
 export { ConnectionKindMismatchError } from './errors.js';
-export { recordGrants, removeGrants, retireConnection, setConnectionLabel, unretireConnection } from './upsert.js';
+export { clearReceivedGrants, markDeclined, pruneSupersededGrants, recordGrants, recordReceivedGrants, recordRenewedGrants, removeGrants, retireConnection, setConnectionLabel, settleOutboxItem, unretireConnection } from './upsert.js';
 export { registerConnectionWriter, resolveWriter, sweepConnectionWriters, touchConnectionWriter } from './writers.js';
 export { normalizeDisplayName } from '../labelText.js';
 export { CONNECTIONS_COLLECTION } from '../space/collections.js';

package/dist/connections/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAUnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAanB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/connections/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,KAAK,EAAE,eAAe,CAAA;IACtB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;OAGG;IACH,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EACR,EAAE;IACD,IAAI,EAAE,OAAO,CAAA;IACb,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EACR,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAwCrC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,cAAc,GAAG,SAAS,CAE7B"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,KAAK,EAAE,eAAe,CAAA;IACtB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;OAGG;IACH,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EACR,EAAE;IACD,IAAI,EAAE,OAAO,CAAA;IACb,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EACR,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAwCrC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,cAAc,GAAG,SAAS,CAE7B"}

package/dist/connections/read.js

@@ -10,7 +10,8 @@
  * derives to just to look the party up, since the host would then learn which
  * id belongs to which DID and whether that DID has an entry.
  */
-import { isJsonObject, parseConnectionEntry } from './entry.js';
+import { isJsonObject } from '../jsonObject.js';
+import { parseConnectionEntry } from './entry.js';
 import { connectionResourceId } from './resourceId.js';
 /**
  * The resource id a stored body claims by its own members: its `id`, or its

package/dist/connections/read.js.map

@@ -1 +1 @@
-{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AA2CtD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EAIR;IACC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,OAAoB,CAAA;QACrC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EAIR;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAuB;QAClC,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,EAAE;KAChB,CAAA;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAChB,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CACpD,CACF,CAAA;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAA+B;SAC3C,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EAIJ;IACC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,CAAA;AAC5D,CAAC"}
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AA2CtD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EAIR;IACC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,OAAoB,CAAA;QACrC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EAIR;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAuB;QAClC,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,EAAE;KAChB,CAAA;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAChB,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CACpD,CACF,CAAA;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAA+B;SAC3C,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EAIJ;IACC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,CAAA;AAC5D,CAAC"}

package/dist/connections/resourceId.d.ts

@@ -33,4 +33,37 @@ export declare function connectionResourceId(options: {
     writerId: string;
     did?: undefined;
 }): Promise<string>;
+/**
+ * The tag an entry stores beside its pairwise `seed`: {@link seedTagBytes}
+ * in the seed's own encoding. A seed that is not 32 bytes of base64url is
+ * refused with a `TypeError`.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @param options.seed {string}   the seed, base64url with no padding
+ * @returns {Promise<string>}
+ */
+export declare function connectionSeedTag({ hmacKey, seed }: {
+    hmacKey: ConnectionIdKey;
+    seed: string;
+}): Promise<string>;
+/**
+ * Whether a stored `seedTag` is the tag of a stored `seed` under this
+ * directory's blinded-index key. A malformed seed or tag reads as `false`.
+ * Every site that turns a seed into a key asks this first and fails closed
+ * on `false`.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @param options.seed {string}   the stored seed
+ * @param options.seedTag {string}   the stored tag
+ * @returns {Promise<boolean>}
+ */
+export declare function verifyConnectionSeedTag({ hmacKey, seed, seedTag }: {
+    hmacKey: ConnectionIdKey;
+    seed: string;
+    seedTag: string;
+}): Promise<boolean>;
 //# sourceMappingURL=resourceId.d.ts.map

package/dist/connections/resourceId.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resourceId.d.ts","sourceRoot":"","sources":["../../src/connections/resourceId.ts"],"names":[],"mappings":"AAsBA;;GAEG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACzB,UAAU,GAAG;IAAE,IAAI,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAAA;AAE3E;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EACH;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAClE,OAAO,CAAC,MAAM,CAAC,CAcjB"}
+{"version":3,"file":"resourceId.d.ts","sourceRoot":"","sources":["../../src/connections/resourceId.ts"],"names":[],"mappings":"AAmCA;;GAEG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACzB,UAAU,GAAG;IAAE,IAAI,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAAA;AAsB3E;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EACH;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAClE,OAAO,CAAC,MAAM,CAAC,CAWjB;AAyBD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,IAAI,EACL,EAAE;IACD,OAAO,EAAE,eAAe,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,MAAM,CAAC,CASlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,OAAO,EACP,IAAI,EACJ,OAAO,EACR,EAAE;IACD,OAAO,EAAE,eAAe,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnB"}