@interop/wallet-core 0.101.1 → 0.104.0

package/dist/sync/contactsConflict.js

@@ -18,13 +18,23 @@
  *
  * **Fail-safe to remote.** Whenever the fields the rule needs are unreachable
  * -- a tombstone on either side, a missing cipher, an envelope this replica
- * holds no key for, a body that is not a valid head payload -- the remote
- * master wins. That is the always-converging default, so a malformed side
- * simply loses: a valid local over a malformed remote re-pushes and repairs the
- * server copy, a valid remote over a malformed local is adopted, and two
- * malformed sides adopt the server version rather than re-fighting the conflict
- * forever. A delete is in the same class deliberately: a tombstone carries no
- * fresher stamp (a delete does not rewrite the head payload), so deletion wins.
+ * holds no key for, a plaintext body where a cipher is configured, a body that
+ * is not a valid head payload -- the remote master wins. That is the
+ * always-converging default, so a malformed side simply loses: a valid local
+ * over a malformed remote re-pushes and repairs the server copy, a valid remote
+ * over a malformed local is adopted, and two malformed sides adopt the server
+ * version rather than re-fighting the conflict forever. A delete is in the same
+ * class deliberately: a tombstone carries no fresher stamp (a delete does not
+ * rewrite the head payload), so deletion wins.
+ *
+ * **A plaintext body under a cipher is unreachable.** When the collection is
+ * encrypted, a non-envelope body is not one of this wallet's heads: an older
+ * writer or a hostile host put it there, and the app's own reads refuse it.
+ * Comparing its stamp would let a plaintext head with a later `updatedAt` beat
+ * a valid local envelope, which then disappears for good, since no read can
+ * open the winner and no write replaces it. So it scores as unreachable, and a
+ * valid encrypted side wins over it and re-pushes. Plaintext passes through
+ * only when no cipher is passed.
  *
  * **An integrity refusal is not an unreachable side.** A decrypt refused by the
  * cipher's envelope-to-resource binding check (was-client's `IntegrityError`)
@@ -56,8 +66,10 @@ import { isEncryptedEnvelope, isIntegrityError } from '@interop/was-client/sync'
 import { isContactHeadPayload, remotePayloadWins } from '@interop/social-core';
 /**
  * Recovers a validated head payload from a stored body: decrypts an
- * envelope, passes plaintext through, and resolves `undefined` when the
- * payload (and so the fields the rule compares) cannot be reached.
+ * envelope, and resolves `undefined` when the payload (and so the fields the
+ * rule compares) cannot be reached. A plaintext body passes through only when
+ * no cipher is passed. With a cipher, a plaintext body is unreachable and is
+ * never handed to the cipher (see the module doc).
  *
  * A side this replica holds no key for is unreachable. What the fail-safe rule
  * below then does with it depends on which side it was: an unreachable local
@@ -76,7 +88,8 @@ import { isContactHeadPayload, remotePayloadWins } from '@interop/social-core';
  * @param options.data {Json}   the stored body: an encrypted envelope or a
  *   plaintext payload
  * @param [options.cipher] {DocCipher}   the collection's document cipher;
- *   absent for a plaintext store, in which case an envelope is unreachable
+ *   absent for a plaintext store, in which case an envelope is unreachable.
+ *   When present, a plaintext body is unreachable.
  * @returns {Promise<ContactHeadPayload | undefined>}
  * @throws {Error}   the cipher's `IntegrityError`: the stored envelope was
  *   sealed for a different resource than `id`
@@ -85,20 +98,26 @@ export async function contactHeadPayloadOf({ id, data, cipher }) {
     if (data === null || data === undefined) {
         return undefined;
     }
-    let body = data;
-    if (isEncryptedEnvelope(data)) {
-        if (!cipher) {
+    if (!isEncryptedEnvelope(data)) {
+        // A plaintext body counts only on a plaintext store. Under a cipher it is
+        // not one of this wallet's heads, so it must not win on its stamp.
+        if (cipher) {
             return undefined;
         }
-        try {
-            body = await cipher.decrypt({ id, envelope: data });
-        }
-        catch (err) {
-            if (isIntegrityError(err)) {
-                throw err;
-            }
-            return undefined;
+        return isContactHeadPayload(data) ? data : undefined;
+    }
+    if (!cipher) {
+        return undefined;
+    }
+    let body;
+    try {
+        body = await cipher.decrypt({ id, envelope: data });
+    }
+    catch (err) {
+        if (isIntegrityError(err)) {
+            throw err;
         }
+        return undefined;
     }
     return isContactHeadPayload(body) ? body : undefined;
 }

package/dist/sync/contactsConflict.js.map

@@ -1 +1 @@
-{"version":3,"file":"contactsConflict.js","sourceRoot":"","sources":["../../src/sync/contactsConflict.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAGjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EAElB,MAAM,sBAAsB,CAAA;AAO7B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,EAAE,EACF,IAAI,EACJ,MAAM,EAKP;IACC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,IAAI,GAAY,IAAI,CAAA;IACxB,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,GAAG,CAAA;YACX,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,EAAE,EACF,MAAM,EACN,KAAK,EACL,MAAM,EACN,aAAa,GAAG,KAAK,EACrB,YAAY,GAAG,KAAK,EACpB,kBAAkB,EAYnB;IACC,IAAI,aAAa,IAAI,YAAY,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,uEAAuE;IACvE,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QAC3D,oBAAoB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAClD,oBAAoB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;KAClD,CAAC,CAAA;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,KAAK,GAAG;QACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;QACxC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE;KAC9B,CAAA;IACV,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,YAAY,CAAC,MAAM,CAAA;IAC3B,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,WAAW,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAA;IACrC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAA;IACnC,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QAC5B,OAAO,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,CAAC;IACD,4EAA4E;IAC5E,6BAA6B;IAC7B,IAAI,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"contactsConflict.js","sourceRoot":"","sources":["../../src/sync/contactsConflict.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAGjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EAElB,MAAM,sBAAsB,CAAA;AAO7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,EAAE,EACF,IAAI,EACJ,MAAM,EAKP;IACC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,EAAE,EACF,MAAM,EACN,KAAK,EACL,MAAM,EACN,aAAa,GAAG,KAAK,EACrB,YAAY,GAAG,KAAK,EACpB,kBAAkB,EAYnB;IACC,IAAI,aAAa,IAAI,YAAY,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,uEAAuE;IACvE,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QAC3D,oBAAoB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAClD,oBAAoB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;KAClD,CAAC,CAAA;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,KAAK,GAAG;QACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;QACxC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE;KAC9B,CAAA;IACV,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,kBAAkB,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,YAAY,CAAC,MAAM,CAAA;IAC3B,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,WAAW,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAA;IACrC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAA;IACnC,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QAC5B,OAAO,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,CAAC;IACD,4EAA4E;IAC5E,6BAA6B;IAC7B,IAAI,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/unlock/index.d.ts

@@ -39,7 +39,7 @@ export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentit
 export type { StandingUnlockClient, UnlockClientIdentity } from './standingClient.js';
 export { computeUnlockBinding, generateLadderSeed, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
 export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from './unlockRecord.js';
-export { assertLadderVmClaimed, ladderVmClaimOf, preflightUnlockCredentialRetirement, publishUnlockKey, removeUnlockKey, UnclaimedLadderVmRetirementError, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { assertLadderVmClaimed, attributeUnlockLadderInventory, ladderVmClaimOf, preflightUnlockCredentialRetirement, publishUnlockKey, removeUnlockKey, UnclaimedLadderVmRetirementError, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export type { CredentialKeyAgreementMethod, LadderVmRemovalReport, StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
 export { UNLOCK_MANAGEMENT_ACTIONS } from './managementZcap.js';
 export { retireUnlockCredential, UNLOCK_CREDENTIAL_RETIREMENT_STAGES } from './retire.js';

package/dist/unlock/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,mCAAmC,EACnC,gBAAgB,EAChB,eAAe,EACf,gCAAgC,EAChC,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,4BAA4B,EAC5B,qBAAqB,EACrB,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EACL,sBAAsB,EACtB,mCAAmC,EACpC,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,eAAe,EACf,mCAAmC,EACnC,gBAAgB,EAChB,eAAe,EACf,gCAAgC,EAChC,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,4BAA4B,EAC5B,qBAAqB,EACrB,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EACL,sBAAsB,EACtB,mCAAmC,EACpC,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,gCAAgC,EACjC,MAAM,aAAa,CAAA"}

package/dist/unlock/index.js

@@ -37,7 +37,7 @@
  */
 export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
 export { computeUnlockBinding, generateLadderSeed, LADDER_SEED_BYTES, recordSealedRecipientKeys, remintUnlockRecordDelegations, UnlockBindingError, unlockRecordBinding, unlockRecordSealedTo, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
-export { assertLadderVmClaimed, ladderVmClaimOf, preflightUnlockCredentialRetirement, publishUnlockKey, removeUnlockKey, UnclaimedLadderVmRetirementError, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { assertLadderVmClaimed, attributeUnlockLadderInventory, ladderVmClaimOf, preflightUnlockCredentialRetirement, publishUnlockKey, removeUnlockKey, UnclaimedLadderVmRetirementError, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
 export { UNLOCK_MANAGEMENT_ACTIONS } from './managementZcap.js';
 export { retireUnlockCredential, UNLOCK_CREDENTIAL_RETIREMENT_STAGES } from './retire.js';
 //# sourceMappingURL=index.js.map

package/dist/unlock/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,mCAAmC,EACnC,gBAAgB,EAChB,eAAe,EACf,gCAAgC,EAChC,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAS3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EACL,sBAAsB,EACtB,mCAAmC,EACpC,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,EACzB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,eAAe,EACf,mCAAmC,EACnC,gBAAgB,EAChB,eAAe,EACf,gCAAgC,EAChC,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAS3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EACL,sBAAsB,EACtB,mCAAmC,EACpC,MAAM,aAAa,CAAA"}

package/dist/webvh/clientAnnexDid.d.ts

@@ -0,0 +1,76 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The client annex DID string's shape, on its own import-free leaf so a base
+ * module can recognize and parse an annex DID without the annex module: the
+ * generation id convention, the parse of an annex did:webvh into its host,
+ * auxiliary Space id, and generation id, and the predicate over that parse.
+ * The annex module (`clientAnnex/log.ts`, `clientAnnex/grantRevocation.ts`)
+ * re-exports these, so its public surface is unchanged.
+ */
+/**
+ * The literal prefix of every generation collection's name. Wire-level and
+ * permanent: orphan discovery is a plain prefix match over the auxiliary
+ * Space's collection listing, and the generation id embeds in every annex
+ * DID string ever published.
+ */
+export declare const GENERATION_ID_PREFIX = "gen-";
+/**
+ * Refuses anything that is not a well-formed generation id. Run by every
+ * annex builder that takes a generation id, so a malformed one is refused
+ * before it can reach a DID string, an HKDF label, or a collection id.
+ *
+ * @param generationId {string}
+ */
+export declare function assertGenerationId(generationId: string): void;
+/**
+ * The three permanent substrings of an annex DID string, as
+ * {@link parseClientAnnexDid} reads them.
+ */
+export interface ClientAnnexDidParts {
+    host: string;
+    spaceId: string;
+    generationId: string;
+}
+/**
+ * Parses the host, the auxiliary Space id and the generation id out of an
+ * annex DID string, or returns `undefined` when the string is not an annex
+ * did:webvh. All three are permanent substrings of every annex DID by
+ * construction: the generation id is the final path segment of the annex
+ * DID (`did:webvh:<scid>:<host>:...:space:<spaceId>:<generationId>`), and it
+ * is the generation-identifying half of the annex rung HKDF
+ * labels, so this parse is what lets an enrollee derive its writing key from
+ * the pointer alone -- no log read, no registry.
+ *
+ * The host is the method-specific id's second segment, percent-decoded (a
+ * port rides as `%3A` inside the one segment). A caller enumerating Spaces
+ * out of a log compares it against the deployment it is talking to: an
+ * account that has migrated hosts carries entries naming the old one, which
+ * this deployment cannot address.
+ *
+ * @param did {string}
+ * @returns {ClientAnnexDidParts | undefined}
+ */
+export declare function parseClientAnnexDid(did: string): ClientAnnexDidParts | undefined;
+/**
+ * {@link parseClientAnnexDid}, refusing with a throw: one naming the DID
+ * when its segments are not an annex did:webvh's, and the generation-id
+ * refusal when the segments are but the generation id is malformed.
+ *
+ * @param options {object}
+ * @param options.did {string}   an annex did:webvh string
+ * @returns {ClientAnnexDidParts}
+ */
+export declare function clientAnnexDidParts({ did }: {
+    did: string;
+}): ClientAnnexDidParts;
+/**
+ * Whether a DID string is a client annex did:webvh, by the same parse
+ * {@link parseClientAnnexDid} applies.
+ *
+ * @param did {string}
+ * @returns {boolean}
+ */
+export declare function isClientAnnexDid(did: string): boolean;
+//# sourceMappingURL=clientAnnexDid.d.ts.map

package/dist/webvh/clientAnnexDid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientAnnexDid.d.ts","sourceRoot":"","sources":["../../src/webvh/clientAnnexDid.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,SAAS,CAAA;AAQ1C;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAO7D;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB;AAgCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,GACV,mBAAmB,GAAG,SAAS,CAMjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,mBAAmB,CAOtB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErD"}

package/dist/webvh/clientAnnexDid.js

@@ -0,0 +1,117 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The client annex DID string's shape, on its own import-free leaf so a base
+ * module can recognize and parse an annex DID without the annex module: the
+ * generation id convention, the parse of an annex did:webvh into its host,
+ * auxiliary Space id, and generation id, and the predicate over that parse.
+ * The annex module (`clientAnnex/log.ts`, `clientAnnex/grantRevocation.ts`)
+ * re-exports these, so its public surface is unchanged.
+ */
+/**
+ * The literal prefix of every generation collection's name. Wire-level and
+ * permanent: orphan discovery is a plain prefix match over the auxiliary
+ * Space's collection listing, and the generation id embeds in every annex
+ * DID string ever published.
+ */
+export const GENERATION_ID_PREFIX = 'gen-';
+/**
+ * The full generation id shape: the literal prefix plus 16 base64url
+ * characters.
+ */
+const GENERATION_ID_PATTERN = /^gen-[A-Za-z0-9_-]{16}$/;
+/**
+ * Refuses anything that is not a well-formed generation id. Run by every
+ * annex builder that takes a generation id, so a malformed one is refused
+ * before it can reach a DID string, an HKDF label, or a collection id.
+ *
+ * @param generationId {string}
+ */
+export function assertGenerationId(generationId) {
+    if (!GENERATION_ID_PATTERN.test(generationId)) {
+        throw new Error(`Not a generation id: "${generationId}" (expected "gen-" plus 16 ` +
+            'base64url characters).');
+    }
+}
+/**
+ * The structural parse behind {@link parseClientAnnexDid} and
+ * {@link clientAnnexDidParts}: the segments alone, with the generation id
+ * not yet checked against its shape, so the throwing parse can name which
+ * of the two refused.
+ *
+ * @param did {string}
+ * @returns {ClientAnnexDidParts | undefined}
+ */
+function splitClientAnnexDid(did) {
+    const parts = did.split(':');
+    const generationId = parts[parts.length - 1];
+    const spaceId = parts[parts.length - 2];
+    const host = parts[3];
+    if (parts.length < 7 ||
+        parts[0] !== 'did' ||
+        parts[1] !== 'webvh' ||
+        parts[parts.length - 3] !== 'space' ||
+        generationId === undefined ||
+        spaceId === undefined ||
+        spaceId.length === 0 ||
+        host === undefined ||
+        host.length === 0) {
+        return undefined;
+    }
+    return { host: decodeURIComponent(host), spaceId, generationId };
+}
+/**
+ * Parses the host, the auxiliary Space id and the generation id out of an
+ * annex DID string, or returns `undefined` when the string is not an annex
+ * did:webvh. All three are permanent substrings of every annex DID by
+ * construction: the generation id is the final path segment of the annex
+ * DID (`did:webvh:<scid>:<host>:...:space:<spaceId>:<generationId>`), and it
+ * is the generation-identifying half of the annex rung HKDF
+ * labels, so this parse is what lets an enrollee derive its writing key from
+ * the pointer alone -- no log read, no registry.
+ *
+ * The host is the method-specific id's second segment, percent-decoded (a
+ * port rides as `%3A` inside the one segment). A caller enumerating Spaces
+ * out of a log compares it against the deployment it is talking to: an
+ * account that has migrated hosts carries entries naming the old one, which
+ * this deployment cannot address.
+ *
+ * @param did {string}
+ * @returns {ClientAnnexDidParts | undefined}
+ */
+export function parseClientAnnexDid(did) {
+    const parts = splitClientAnnexDid(did);
+    if (parts === undefined || !GENERATION_ID_PATTERN.test(parts.generationId)) {
+        return undefined;
+    }
+    return parts;
+}
+/**
+ * {@link parseClientAnnexDid}, refusing with a throw: one naming the DID
+ * when its segments are not an annex did:webvh's, and the generation-id
+ * refusal when the segments are but the generation id is malformed.
+ *
+ * @param options {object}
+ * @param options.did {string}   an annex did:webvh string
+ * @returns {ClientAnnexDidParts}
+ */
+export function clientAnnexDidParts({ did }) {
+    const parts = splitClientAnnexDid(did);
+    if (parts === undefined) {
+        throw new Error(`Not a client annex did:webvh: "${did}".`);
+    }
+    assertGenerationId(parts.generationId);
+    return parts;
+}
+/**
+ * Whether a DID string is a client annex did:webvh, by the same parse
+ * {@link parseClientAnnexDid} applies.
+ *
+ * @param did {string}
+ * @returns {boolean}
+ */
+export function isClientAnnexDid(did) {
+    return parseClientAnnexDid(did) !== undefined;
+}
+//# sourceMappingURL=clientAnnexDid.js.map

package/dist/webvh/clientAnnexDid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientAnnexDid.js","sourceRoot":"","sources":["../../src/webvh/clientAnnexDid.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAE1C;;;GAGG;AACH,MAAM,qBAAqB,GAAG,yBAAyB,CAAA;AAEvD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACrD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,yBAAyB,YAAY,6BAA6B;YAChE,wBAAwB,CAC3B,CAAA;IACH,CAAC;AACH,CAAC;AAYD;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACrB,IACE,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QACpB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO;QACnC,YAAY,KAAK,SAAS;QAC1B,OAAO,KAAK,SAAS;QACrB,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,IAAI,KAAK,SAAS;QAClB,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW;IAEX,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EAGJ;IACC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,IAAI,CAAC,CAAA;IAC5D,CAAC;IACD,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACtC,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAA;AAC/C,CAAC"}

package/dist/webvh/didWebProjection.d.ts

@@ -8,7 +8,9 @@
  * the two ways that cache is written -- the unconditional PUT every publish
  * tail makes ({@link putDidWebProjection}) and the read-then-write freshness
  * ensure a caller with no controller authority makes
- * ({@link ensureDidWebProjection}).
+ * ({@link ensureDidWebProjection}). The ensure's compare is exported on its
+ * own as {@link didWebProjectionCurrent}, for a reader that wants it without
+ * the write.
  *
  * The ensure exists because the projection is NOT republished by every entry.
  * A ladder-signed entry publishes through `publishEntryPinned`, which writes
@@ -110,10 +112,11 @@ export declare function preEntryProjectionPublisher({ store }: {
  * account Space's container URL and so may write `id/did.json` with no
  * widened bridge and no server change.
  *
- * The served document is compared as parsed JSON, key-order-insensitively, so
- * a host (or an earlier writer) that reserialized the same document does not
- * provoke a write. Absent, unparsable, and different all reach the write; only
- * an equal document is left alone.
+ * The served document is compared through {@link didWebProjectionCurrent}, as
+ * parsed JSON and key-order-insensitively, so a host (or an earlier writer)
+ * that reserialized the same document does not provoke a write. Absent,
+ * unparsable, and different all reach the write; only an equal document is
+ * left alone.
  *
  * A difference is not by itself evidence that the served projection is the
  * stale side. The caller's `doc` was resolved at some earlier point, and a
@@ -161,4 +164,34 @@ export declare function ensureDidWebProjection({ store, did, doc, refresh }: {
 }): Promise<{
     outcome: 'current' | 'republished' | 'conflict';
 }>;
+/**
+ * Whether the served projection text is the current `did:web` projection of a
+ * resolved did:webvh document. It derives the projection with
+ * `generateParallelDidWeb` and compares it against the served body as parsed
+ * JSON, key-order-insensitively. This is the compare
+ * {@link ensureDidWebProjection} runs, exported for a reader (a wallet's
+ * invariant audit) that wants the compare without the write.
+ *
+ * An absent or unparsable body reads as not current rather than as an error.
+ * Whatever it is, it is not the projection, and republishing is the answer
+ * either way.
+ *
+ * The derived document is round-tripped through JSON before the comparison,
+ * so it is compared in the form a PUT would serialize it into. A member whose
+ * value is `undefined` disappears on both sides rather than reading as a
+ * difference the write could never fix.
+ *
+ * @param options {object}
+ * @param options.text {string | undefined}   the served `did.json` body, or
+ *   `undefined` when the resource is absent
+ * @param options.did {string}   the account's did:webvh, from the resolved log
+ * @param options.doc {DIDDoc}   the resolved did:webvh document
+ * @returns {boolean}   true only when the served body parses and structurally
+ *   equals the derived projection
+ */
+export declare function didWebProjectionCurrent({ text, did, doc }: {
+    text: string | undefined;
+    did: string;
+    doc: DIDDoc;
+}): boolean;
 //# sourceMappingURL=didWebProjection.d.ts.map

package/dist/webvh/didWebProjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"didWebProjection.d.ts","sourceRoot":"","sources":["../../src/webvh/didWebProjection.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAIxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,MAAM,EACP,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAC1C,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,KAAK,EACN,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;CAChE,GAAG,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,eAAe,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAgBzD;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,KAAK,EACL,GAAG,EACH,GAAG,EACH,OAAO,EACR,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC/D,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,GAAG,aAAa,GAAG,UAAU,CAAA;CAAE,CAAC,CAyC/D"}
+{"version":3,"file":"didWebProjection.d.ts","sourceRoot":"","sources":["../../src/webvh/didWebProjection.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAIxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,KAAK,EACL,MAAM,EACP,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAC1C,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,KAAK,EACN,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;CAChE,GAAG,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,eAAe,CAAA;CAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAgBzD;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,KAAK,EACL,GAAG,EACH,GAAG,EACH,OAAO,EACR,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC/D,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,GAAG,aAAa,GAAG,UAAU,CAAA;CAAE,CAAC,CAqC/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,IAAI,EACJ,GAAG,EACH,GAAG,EACJ,EAAE;IACD,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAcV"}

package/dist/webvh/didWebProjection.js

@@ -87,10 +87,11 @@ const PRECONDITION_FAILED_ERROR_NAME = 'PreconditionFailedError';
  * account Space's container URL and so may write `id/did.json` with no
  * widened bridge and no server change.
  *
- * The served document is compared as parsed JSON, key-order-insensitively, so
- * a host (or an earlier writer) that reserialized the same document does not
- * provoke a write. Absent, unparsable, and different all reach the write; only
- * an equal document is left alone.
+ * The served document is compared through {@link didWebProjectionCurrent}, as
+ * parsed JSON and key-order-insensitively, so a host (or an earlier writer)
+ * that reserialized the same document does not provoke a write. Absent,
+ * unparsable, and different all reach the write; only an equal document is
+ * left alone.
  *
  * A difference is not by itself evidence that the served projection is the
  * stale side. The caller's `doc` was resolved at some earlier point, and a
@@ -131,22 +132,20 @@ export async function ensureDidWebProjection({ store, did, doc, refresh }) {
     const served = await store.getIdResourceRaw({
         resourceId: DID_DOCUMENT_RESOURCE
     });
-    let expected = generateParallelDidWeb(did, doc);
-    if (served !== undefined && servedMatches({ text: served.text, expected })) {
+    let resolved = { did, doc };
+    if (didWebProjectionCurrent({ text: served?.text, ...resolved })) {
         return { outcome: 'current' };
     }
     if (refresh) {
-        const fresh = await refresh();
-        expected = generateParallelDidWeb(fresh.did, fresh.doc);
-        if (served !== undefined &&
-            servedMatches({ text: served.text, expected })) {
+        resolved = await refresh();
+        if (didWebProjectionCurrent({ text: served?.text, ...resolved })) {
             return { outcome: 'current' };
         }
     }
     try {
         await store.putIdResource({
             resourceId: DID_DOCUMENT_RESOURCE,
-            content: expected,
+            content: generateParallelDidWeb(resolved.did, resolved.doc),
             contentType: 'application/did+json',
             // Absent, the write is a create; present, an update-if-unchanged. A
             // backend serving no ETag versions nothing, so that write degrades to
@@ -169,21 +168,34 @@ export async function ensureDidWebProjection({ store, did, doc, refresh }) {
     return { outcome: 'republished' };
 }
 /**
- * Whether the served projection text is the expected document. An unparsable
- * body reads as a mismatch rather than an error: whatever it is, it is not the
- * projection, and republishing is the answer either way.
+ * Whether the served projection text is the current `did:web` projection of a
+ * resolved did:webvh document. It derives the projection with
+ * `generateParallelDidWeb` and compares it against the served body as parsed
+ * JSON, key-order-insensitively. This is the compare
+ * {@link ensureDidWebProjection} runs, exported for a reader (a wallet's
+ * invariant audit) that wants the compare without the write.
  *
- * The expected document is round-tripped through JSON before the comparison,
- * so it is compared in the form the PUT would serialize it into -- a member
- * whose value is `undefined` disappears on both sides rather than reading as a
+ * An absent or unparsable body reads as not current rather than as an error.
+ * Whatever it is, it is not the projection, and republishing is the answer
+ * either way.
+ *
+ * The derived document is round-tripped through JSON before the comparison,
+ * so it is compared in the form a PUT would serialize it into. A member whose
+ * value is `undefined` disappears on both sides rather than reading as a
  * difference the write could never fix.
  *
  * @param options {object}
- * @param options.text {string}   the served body
- * @param options.expected {object}   the freshly derived projection
- * @returns {boolean}
+ * @param options.text {string | undefined}   the served `did.json` body, or
+ *   `undefined` when the resource is absent
+ * @param options.did {string}   the account's did:webvh, from the resolved log
+ * @param options.doc {DIDDoc}   the resolved did:webvh document
+ * @returns {boolean}   true only when the served body parses and structurally
+ *   equals the derived projection
  */
-function servedMatches({ text, expected }) {
+export function didWebProjectionCurrent({ text, did, doc }) {
+    if (text === undefined) {
+        return false;
+    }
     let parsed;
     try {
         parsed = JSON.parse(text);
@@ -191,7 +203,8 @@ function servedMatches({ text, expected }) {
     catch {
         return false;
     }
-    return sameJsonValue(JSON.parse(JSON.stringify(expected)), parsed);
+    const expected = JSON.parse(JSON.stringify(generateParallelDidWeb(did, doc)));
+    return sameJsonValue(expected, parsed);
 }
 /**
  * Structural JSON equality: object key order is immaterial, array order is

package/dist/webvh/didWebProjection.js.map

@@ -1 +1 @@
-{"version":3,"file":"didWebProjection.js","sourceRoot":"","sources":["../../src/webvh/didWebProjection.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAG/D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,MAAM,EAIP;IACC,MAAM,KAAK,CAAC,aAAa,CAAC;QACxB,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,sBAAsB;KACpC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,KAAK,EAGN;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAgC,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,kEAAkE;gBAClE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAA;gBACxE,OAAM;YACR,CAAC;YACD,MAAM,mBAAmB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE;gBAClE,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,yBAAyB,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,KAAK,EACL,GAAG,EACH,GAAG,EACH,OAAO,EAMR;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC1C,UAAU,EAAE,qBAAqB;KAClC,CAAC,CAAA;IACF,IAAI,QAAQ,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IAC/B,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAA;QAC7B,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;QACvD,IACE,MAAM,KAAK,SAAS;YACpB,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAC9C,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,CAAC;YACxB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,sBAAsB;YACnC,oEAAoE;YACpE,sEAAsE;YACtE,0DAA0D;YAC1D,GAAG,CAAC,MAAM,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;gBACvB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBACzB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;oBAC1B,CAAC,CAAC,EAAE,CAAC;SACV,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,gEAAgE;QAChE,IAAK,GAAa,EAAE,IAAI,KAAK,8BAA8B,EAAE,CAAC;YAC5D,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,EACrB,IAAI,EACJ,QAAQ,EAIT;IACC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,IAAa,EAAE,KAAc;IAClD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CACnE,CAAA;IACH,CAAC;IACD,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,OAAO,KAAK,KAAK,QAAQ;QACzB,IAAI,KAAK,IAAI;QACb,KAAK,KAAK,IAAI,EACd,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAA;IACnE,MAAM,WAAW,GAAG,KAAgC,CAAA;IACpD,OAAO,CACL,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;QACtD,WAAW,CAAC,KAAK,CACf,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC;YACtD,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CACzC,CACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"didWebProjection.js","sourceRoot":"","sources":["../../src/webvh/didWebProjection.ts"],"names":[],"mappings":"AAiDA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAG/D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,KAAK,EACL,MAAM,EAIP;IACC,MAAM,KAAK,CAAC,aAAa,CAAC;QACxB,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,sBAAsB;KACpC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,KAAK,EAGN;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAgC,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,kEAAkE;gBAClE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAA;gBACxE,OAAM;YACR,CAAC;YACD,MAAM,mBAAmB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE;gBAClE,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,yBAAyB,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,KAAK,EACL,GAAG,EACH,GAAG,EACH,OAAO,EAMR;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;QAC1C,UAAU,EAAE,qBAAqB;KAClC,CAAC,CAAA;IACF,IAAI,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IAC3B,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IAC/B,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAA;QAC1B,IAAI,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,CAAC;YACxB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC;YAC3D,WAAW,EAAE,sBAAsB;YACnC,oEAAoE;YACpE,sEAAsE;YACtE,0DAA0D;YAC1D,GAAG,CAAC,MAAM,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;gBACvB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBACzB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;oBAC1B,CAAC,CAAC,EAAE,CAAC;SACV,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,gEAAgE;QAChE,IAAK,GAAa,EAAE,IAAI,KAAK,8BAA8B,EAAE,CAAC;YAC5D,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,IAAI,EACJ,GAAG,EACH,GAAG,EAKJ;IACC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAClC,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CACjD,CAAA;IACD,OAAO,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,aAAa,CAAC,IAAa,EAAE,KAAc;IAClD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CACnE,CAAA;IACH,CAAC;IACD,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,OAAO,KAAK,KAAK,QAAQ;QACzB,IAAI,KAAK,IAAI;QACb,KAAK,KAAK,IAAI,EACd,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAA;IACnE,MAAM,WAAW,GAAG,KAAgC,CAAA;IACpD,OAAO,CACL,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;QACtD,WAAW,CAAC,KAAK,CACf,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC;YACtD,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CACzC,CACF,CAAA;AACH,CAAC"}

package/dist/webvh/documentDids.d.ts

@@ -29,9 +29,9 @@ export declare function walletClientDid({ signingKeyMultibase }: {
  * enrolled client's ({@link enrolledClientKeyMultibases}) and each ladder
  * VM's ({@link ladderVmKeyMultibases}) bare did:key, from the key multibase
  * the shared readers name for the method. A member the readers name no key
- * for (no fragment and no `publicKeyMultibase`, or the two disagreeing) is
- * skipped, the same answer the ladder-rung attribution gives it. An entry
- * carrying no document state is skipped too.
+ * for (one resolving to no method, or to a method publishing no
+ * `publicKeyMultibase`) is skipped, the same answer the ladder-rung
+ * attribution gives it. An entry carrying no document state is skipped too.
  *
  * @param options {object}
  * @param options.log {DIDLog}   the VERIFIED account log

package/dist/webvh/documentDids.js

@@ -21,9 +21,9 @@ export function walletClientDid({ signingKeyMultibase }) {
  * enrolled client's ({@link enrolledClientKeyMultibases}) and each ladder
  * VM's ({@link ladderVmKeyMultibases}) bare did:key, from the key multibase
  * the shared readers name for the method. A member the readers name no key
- * for (no fragment and no `publicKeyMultibase`, or the two disagreeing) is
- * skipped, the same answer the ladder-rung attribution gives it. An entry
- * carrying no document state is skipped too.
+ * for (one resolving to no method, or to a method publishing no
+ * `publicKeyMultibase`) is skipped, the same answer the ladder-rung
+ * attribution gives it. An entry carrying no document state is skipped too.
  *
  * @param options {object}
  * @param options.log {DIDLog}   the VERIFIED account log

package/dist/webvh/index.d.ts

@@ -63,7 +63,8 @@
  *   through, over the parameterized `wasWebvhLogStore` (any collection's
  *   `did.jsonl`), which also serves a client-annex generation's log.
  * - `ensureDidWebProjection` / `putDidWebProjection` -- the `did:web`
- *   projection (`id/did.json`) writers. The publish tails PUT it
+ *   projection (`id/did.json`) writers, with the ensure's compare exported on
+ *   its own as `didWebProjectionCurrent`. The publish tails PUT it
  *   unconditionally behind a won log compare-and-swap; the ensure compares
  *   the served document against the one the resolved log derives and writes
  *   only on a difference -- re-resolving through the caller's optional
@@ -96,10 +97,10 @@ export { accountControllerResolver, accountLogPinId, logResourcePinId, AccountLo
 export type { VerifiedAccountLog } from './verifyLog.js';
 export { wasWebvhIdStore, wasWebvhLogStore } from './wasIdStore.js';
 export type { WebvhLogResourceStore } from './wasIdStore.js';
-export { ensureDidWebProjection, putDidWebProjection } from './didWebProjection.js';
+export { didWebProjectionCurrent, ensureDidWebProjection, putDidWebProjection } from './didWebProjection.js';
 export { delegatedWebvhLogStore } from './delegatedLogStore.js';
 export type { DelegatedWebvhLogStore } from './delegatedLogStore.js';
-export { delegationAtExpiry, delegationExpired, delegationProofKeyId, delegationSignerGone, recordedZcapStale, REVOCATION_CLOCK_SKEW_MS, STANDING_ZCAP_TTL_MS, standingZcapStale, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './standingZcap.js';
+export { delegationAtExpiry, delegationExpired, delegationProofKeyId, delegationSignerGone, recordedZcapStale, REVOCATION_CLOCK_SKEW_MS, STANDING_ZCAP_TTL_MS, standingZcapStale, embeddedParentCapability, firstDelegationProof, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './standingZcap.js';
 export { attributeClientUpdateKey, delegationKeyInDocument, documentKeyMultibases, enrolledClientVmIds, isLastEnrolledClient, listEnrolledWebvhClients, markedKeyAgreementMethods, markedKeyAgreementMultibases } from './listClients.js';
 export type { EnrolledWebvhClient, PublishedKeyDocument } from './listClients.js';
 export { mergeVerificationMethods } from './mergeMethods.js';

package/dist/webvh/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webvh/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACnE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,cAAc,EACd,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,YAAY,EACb,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webvh/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AACH,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACnE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,cAAc,EACd,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,YAAY,EACb,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA"}