@interop/wallet-core 0.101.1 → 0.104.0

package/dist/connections/entry.js

@@ -19,6 +19,8 @@
  * its writer, so the storage host can plant one. The grant checks in
  * `grants.ts` bound what a planted grant can steer.
  */
+import { base64urlnopad } from '@scure/base';
+import { isJsonObject } from '../jsonObject.js';
 import { normalizeDisplayName } from '../labelText.js';
 /**
  * The entry version this build reads for writing and writes.
@@ -40,6 +42,19 @@ export const CONNECTION_KINDS = [
  * capability. A reader treats any other stored value as a plain grant.
  */
 export const GRANT_KINDS = ['grant', 'share'];
+/**
+ * The `grantKind` vocabulary of `grantsReceived`, the capabilities a party
+ * handed the wallet: `'inbox'` is the party's POST capability on its own
+ * inbox, the channel a push goes through. An unknown stored value is kept as
+ * stored.
+ */
+export const RECEIVED_GRANT_KINDS = ['inbox'];
+/**
+ * The byte length of the pairwise seed, and the length of its base64url
+ * no-pad text.
+ */
+export const CONNECTION_SEED_BYTES = 32;
+const CONNECTION_SEED_TEXT_LENGTH = 43;
 const DAY_MS = 24 * 60 * 60 * 1000;
 /**
  * The writer policy: inactive after 90 days, at most 8 writers per entry,
@@ -103,6 +118,8 @@ export function newConnectionEntry({ kind, did, now }) {
         firstSeen: stamp,
         lastSeen: stamp,
         grants: [],
+        grantsReceived: [],
+        outbox: [],
         writers: []
     };
 }
@@ -116,15 +133,6 @@ export function newConnectionEntry({ kind, did, now }) {
 export function isWritableConnectionEntry(entry) {
     return entry.version === CONNECTION_ENTRY_VERSION;
 }
-/**
- * Whether a value is a plain JSON object (not null, not an array).
- *
- * @param value {unknown}
- * @returns {boolean}
- */
-export function isJsonObject(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value);
-}
 /**
  * Whether a value is a string `Date.parse` reads as a time.
  *
@@ -145,7 +153,8 @@ function isOptionalString(value) {
 }
 /**
  * Reads a stored capability's known members, or `undefined` when one of them
- * has the wrong shape. The capability itself is returned verbatim.
+ * has the wrong shape or `expires` is absent. The capability itself is
+ * returned verbatim.
  *
  * @param value {unknown}
  * @returns {ConnectionZcap | undefined}
@@ -163,7 +172,7 @@ export function parseConnectionZcap(value) {
             typeof allowedAction !== 'string' &&
             !(Array.isArray(allowedAction) &&
                 allowedAction.every(action => typeof action === 'string'))) ||
-        (expires !== undefined && !isTimestamp(expires))) {
+        !isTimestamp(expires)) {
         return undefined;
     }
     return value;
@@ -181,11 +190,70 @@ function parseGrantRecord(value) {
     }
     if (parseConnectionZcap(value.zcap) === undefined ||
         typeof value.grantKind !== 'string' ||
-        !isTimestamp(value.grantedAt)) {
+        !isTimestamp(value.grantedAt) ||
+        (value.renewedAt !== undefined && !isTimestamp(value.renewedAt))) {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Reads one stored received-grant wrapper, or `undefined` when a known
+ * member has the wrong shape. The wrapper is returned verbatim, unknown
+ * members included.
+ *
+ * @param value {unknown}
+ * @returns {ConnectionReceivedGrantRecord | undefined}
+ */
+function parseReceivedGrantRecord(value) {
+    if (!isJsonObject(value)) {
+        return undefined;
+    }
+    if (parseConnectionZcap(value.zcap) === undefined ||
+        typeof value.grantKind !== 'string' ||
+        !isTimestamp(value.receivedAt)) {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Reads one stored outbox item, or `undefined` when a known member has the
+ * wrong shape: `message` must be a JSON object and `createdAt` a timestamp.
+ * The item is returned verbatim.
+ *
+ * @param value {unknown}
+ * @returns {ConnectionOutboxItem | undefined}
+ */
+function parseOutboxItem(value) {
+    if (!isJsonObject(value)) {
+        return undefined;
+    }
+    if (!isJsonObject(value.message) || !isTimestamp(value.createdAt)) {
         return undefined;
     }
     return value;
 }
+/**
+ * The seed bytes a stored `seed` member decodes to, or `undefined` when it
+ * is not 43 characters of base64url with no padding decoding to 32 bytes.
+ * The same rule reads a stored `seedTag`, which has the same length.
+ *
+ * @param value {unknown}
+ * @returns {Uint8Array | undefined}
+ */
+export function decodeConnectionSeed(value) {
+    if (typeof value !== 'string' ||
+        value.length !== CONNECTION_SEED_TEXT_LENGTH) {
+        return undefined;
+    }
+    let bytes;
+    try {
+        bytes = base64urlnopad.decode(value);
+    }
+    catch {
+        return undefined;
+    }
+    return bytes.length === CONNECTION_SEED_BYTES ? bytes : undefined;
+}
 /**
  * Reads one stored writer member, or `undefined` when a known member has the
  * wrong shape. The member is returned verbatim, unknown members included.
@@ -217,9 +285,12 @@ function parseWriter(value) {
  * is not a DID, a `name`, `label`, or writer `label` outside the display-name
  * rule (1 to 64 code points once the control and bidi characters are stripped
  * and the result trimmed), a timestamp `Date.parse` cannot read, a malformed
- * grant wrapper or writer member, or no `id` beside anything but exactly one
- * writer. Every display string a view renders is held to that one rule.
- * Unknown members are ignored. A body with a `version` above this build's
+ * grant wrapper, received-grant wrapper, outbox item, or writer member, a
+ * `seed` or `seedTag` that is not 43 characters of base64url decoding to 32
+ * bytes, a `seed` with no `seedTag` (or the reverse), or no `id` beside
+ * anything but exactly one writer. Every display string a view renders is
+ * held to that one rule. An absent `grantsReceived` or `outbox` (a body an
+ * older build wrote) reads as empty. Unknown members are ignored. A body with a `version` above this build's
  * that passes every check is returned for display;
  * {@link isWritableConnectionEntry} says it cannot be written.
  *
@@ -234,7 +305,7 @@ export function parseConnectionEntry(body) {
     if (!isJsonObject(body)) {
         return undefined;
     }
-    const { version, kind, id, name, label, origin, url, appKey, firstSeen, lastSeen, retired, grants, writers } = body;
+    const { version, kind, id, name, label, origin, url, appKey, firstSeen, lastSeen, retired, declined, seed, seedTag, grants, grantsReceived, outbox, writers } = body;
     if (typeof version !== 'number' ||
         !Number.isInteger(version) ||
         version < 1 ||
@@ -249,7 +320,13 @@ export function parseConnectionEntry(body) {
         !isTimestamp(firstSeen) ||
         !isTimestamp(lastSeen) ||
         (retired !== undefined && !isTimestamp(retired)) ||
+        (declined !== undefined && !isTimestamp(declined)) ||
+        (seed !== undefined && decodeConnectionSeed(seed) === undefined) ||
+        (seedTag !== undefined && decodeConnectionSeed(seedTag) === undefined) ||
+        (seed === undefined) !== (seedTag === undefined) ||
         !Array.isArray(grants) ||
+        (grantsReceived !== undefined && !Array.isArray(grantsReceived)) ||
+        (outbox !== undefined && !Array.isArray(outbox)) ||
         !Array.isArray(writers)) {
         return undefined;
     }
@@ -260,8 +337,12 @@ export function parseConnectionEntry(body) {
         return undefined;
     }
     const parsedGrants = grants.map(parseGrantRecord);
+    const parsedReceived = (grantsReceived ?? []).map(parseReceivedGrantRecord);
+    const parsedOutbox = (outbox ?? []).map(parseOutboxItem);
     const parsedWriters = writers.map(parseWriter);
     if (parsedGrants.some(grant => grant === undefined) ||
+        parsedReceived.some(grant => grant === undefined) ||
+        parsedOutbox.some(item => item === undefined) ||
         parsedWriters.some(writer => writer === undefined)) {
         return undefined;
     }
@@ -280,7 +361,12 @@ export function parseConnectionEntry(body) {
         firstSeen,
         lastSeen,
         ...(retired !== undefined && { retired }),
+        ...(declined !== undefined && { declined }),
+        ...(seed !== undefined && { seed: seed }),
+        ...(seedTag !== undefined && { seedTag: seedTag }),
         grants: parsedGrants,
+        grantsReceived: parsedReceived,
+        outbox: parsedOutbox,
         writers: parsedWriters
     };
 }

package/dist/connections/entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../src/connections/entry.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAEtD;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK;IACL,OAAO;IACP,eAAe;IACf,SAAS;CACD,CAAA;AAOV;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAA;AAuGtD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAuBlC;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2B;IAC9D,eAAe,EAAE,EAAE,GAAG,MAAM;IAC5B,UAAU,EAAE,CAAC;IACb,eAAe,EAAE,MAAM;CACxB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwC;IAExC,OAAO,EAAE,GAAG,wBAAwB,EAAE,GAAG,MAAM,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAsB;IAEtB,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACjE,CAAC,CAAE,KAAK,CAAC,IAAuB;QAChC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAA4B;IACtD,OAAO,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,IAAI,EACJ,GAAG,EACH,GAAG,EAKJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAC/B,OAAO;QACL,OAAO,EAAE,wBAAwB;QACjC,IAAI;QACJ,EAAE,EAAE,GAAG;QACP,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;KACZ,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAsB;IAC9D,OAAO,KAAK,CAAC,OAAO,KAAK,wBAAwB,CAAA;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AACtE,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAC1E,IACE,OAAO,EAAE,KAAK,QAAQ;QACtB,EAAE,KAAK,EAAE;QACT,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,gBAAgB,KAAK,QAAQ;QACpC,CAAC,aAAa,KAAK,SAAS;YAC1B,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,CACC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;gBAC5B,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAC1D,CAAC;QACJ,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAChD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAuB,CAAA;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IACE,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;QAC7C,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,EAC7B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAA8B,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IACE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,KAAK,EAAE;QACrB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,EACjC,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;IAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAsB,CAAA;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa;IAEb,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,EACJ,OAAO,EACP,IAAI,EACJ,EAAE,EACF,IAAI,EACJ,KAAK,EACL,MAAM,EACN,GAAG,EACH,MAAM,EACN,SAAS,EACT,QAAQ,EACR,OAAO,EACP,MAAM,EACN,OAAO,EACR,GAAG,IAAI,CAAA;IACR,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1B,OAAO,GAAG,CAAC;QACX,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,EAAE;QACX,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC;QACxB,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACzB,CAAC,gBAAgB,CAAC,GAAG,CAAC;QACtB,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC,WAAW,CAAC,SAAS,CAAC;QACvB,CAAC,WAAW,CAAC,QAAQ,CAAC;QACtB,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACvB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,cAAc,GAClB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxE,MAAM,eAAe,GACnB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,IACE,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,CAAC;QACpD,CAAC,KAAK,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,CAAC,EACtD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACjD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC9C,IACE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QAC/C,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,EAClD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,OAAO;QACP,IAAI;QACJ,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/B,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC7D,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,SAAS;QACT,QAAQ;QACR,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;QACzC,MAAM,EAAE,YAAuC;QAC/C,OAAO,EAAE,aAAmC;KAC7C,CAAA;AACH,CAAC"}
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../src/connections/entry.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAEtD;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK;IACL,OAAO;IACP,eAAe;IACf,SAAS;CACD,CAAA;AAOV;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAA;AAOtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,CAAU,CAAA;AAOtD;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AACvC,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAgKtC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAuBlC;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2B;IAC9D,eAAe,EAAE,EAAE,GAAG,MAAM;IAC5B,UAAU,EAAE,CAAC;IACb,eAAe,EAAE,MAAM;CACxB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwC;IAExC,OAAO,EAAE,GAAG,wBAAwB,EAAE,GAAG,MAAM,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAsB;IAEtB,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACjE,CAAC,CAAE,KAAK,CAAC,IAAuB;QAChC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAA4B;IACtD,OAAO,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,IAAI,EACJ,GAAG,EACH,GAAG,EAKJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAC/B,OAAO;QACL,OAAO,EAAE,wBAAwB;QACjC,IAAI;QACJ,EAAE,EAAE,GAAG;QACP,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,EAAE;QACV,cAAc,EAAE,EAAE;QAClB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;KACZ,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAsB;IAC9D,OAAO,KAAK,CAAC,OAAO,KAAK,wBAAwB,CAAA;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AACtE,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAC1E,IACE,OAAO,EAAE,KAAK,QAAQ;QACtB,EAAE,KAAK,EAAE;QACT,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,gBAAgB,KAAK,QAAQ;QACpC,CAAC,aAAa,KAAK,SAAS;YAC1B,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,CACC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;gBAC5B,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAC1D,CAAC;QACJ,CAAC,WAAW,CAAC,OAAO,CAAC,EACrB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAuB,CAAA;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IACE,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;QAC7C,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC;QAC7B,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAChE,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAA8B,CAAA;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,KAAc;IAEd,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IACE,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;QAC7C,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAC9B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAsC,CAAA;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAA6B,CAAA;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,2BAA2B,EAC5C,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,KAAiB,CAAA;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACnE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IACE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,KAAK,EAAE;QACrB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,EACjC,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;IAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAsB,CAAA;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa;IAEb,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,EACJ,OAAO,EACP,IAAI,EACJ,EAAE,EACF,IAAI,EACJ,KAAK,EACL,MAAM,EACN,GAAG,EACH,MAAM,EACN,SAAS,EACT,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,IAAI,EACJ,OAAO,EACP,MAAM,EACN,cAAc,EACd,MAAM,EACN,OAAO,EACR,GAAG,IAAI,CAAA;IACR,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1B,OAAO,GAAG,CAAC;QACX,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,EAAE;QACX,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC;QACxB,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACzB,CAAC,gBAAgB,CAAC,GAAG,CAAC;QACtB,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC,WAAW,CAAC,SAAS,CAAC;QACvB,CAAC,WAAW,CAAC,QAAQ,CAAC;QACtB,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC,IAAI,KAAK,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;QAChE,CAAC,OAAO,KAAK,SAAS,IAAI,oBAAoB,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;QACtE,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;QAChD,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAChE,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACvB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,cAAc,GAClB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxE,MAAM,eAAe,GACnB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,IACE,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,CAAC;QACpD,CAAC,KAAK,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,CAAC,EACtD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACjD,MAAM,cAAc,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAC3E,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACxD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC9C,IACE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QAC/C,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACjD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,EAClD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,OAAO;QACP,IAAI;QACJ,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/B,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC7D,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,SAAS;QACT,QAAQ;QACR,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAc,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,OAAiB,EAAE,CAAC;QAC5D,MAAM,EAAE,YAAuC;QAC/C,cAAc,EAAE,cAAiD;QACjE,MAAM,EAAE,YAAsC;QAC9C,OAAO,EAAE,aAAmC;KAC7C,CAAA;AACH,CAAC"}

package/dist/connections/grantProof.d.ts

@@ -0,0 +1,64 @@
+import type { ConnectionZcap } from './entry.js';
+import type { PublishedKeyDocument } from '../webvh/index.js';
+/**
+ * Why a recorded grant's proof does not verify as this account's. On the
+ * root arm the reasons describe the grant's own proof; on the annex arm they
+ * describe the embedded parent's, since that is the proof verified there.
+ *
+ * - `unsigned` -- the proof is absent or names no `verificationMethod`.
+ * - `unsupported-suite` -- the proof is not an `eddsa-jcs-2022`
+ *   `DataIntegrityProof` for `capabilityDelegation`, the one suite every
+ *   delegation this library mints carries.
+ * - `signer-unlisted` -- the proof's `verificationMethod` dereferences to no
+ *   `capabilityDelegation` member of the current document that publishes a
+ *   key (`relationMemberNamed`, then `memberKeyMultibase`: the fragment is an
+ *   opaque selector, never read as the key), and it is not the did:key form
+ *   of a key the relation publishes: the current-key-set rule.
+ * - `signature-invalid` -- the signer is listed, and the signature does not
+ *   verify over the capability under the key the document publishes for it.
+ * - `parent-not-annex` -- the grant embeds a parent whose `controller` is
+ *   not an annex DID in the account's auxiliary Space, or the account points
+ *   at no annex generation.
+ */
+export type GrantProofRefusal = 'unsigned' | 'unsupported-suite' | 'signer-unlisted' | 'signature-invalid' | 'parent-not-annex';
+/**
+ * The outcome of {@link verifyRecordedGrantProof}: verified, with the id of
+ * the verification method whose signature was checked (the grant's own
+ * signer on the root arm, the parent's on the annex arm), or refused with
+ * the reason.
+ */
+export type GrantProofResult = {
+    verified: true;
+    signerKeyId: string;
+} | {
+    verified: false;
+    reason: GrantProofRefusal;
+};
+/**
+ * Whether a recorded grant's delegation proof verifies as this account's,
+ * against the locally verified account document. A grant with no embedded
+ * parent is verified by its own proof (the root arm); a grant embedding its
+ * parent delegation as the last link of its `proof.capabilityChain` is
+ * verified by that parent's proof, after the parent's `controller` is found
+ * to be an annex DID in the account's auxiliary Space (the annex arm). A
+ * refusal says why. The check reads the current document alone, with no log
+ * history and no network.
+ *
+ * @param options {object}
+ * @param options.zcap {ConnectionZcap}   the recorded capability, verbatim
+ * @param options.signerCheck {object}   what the grant is read against
+ * @param options.signerCheck.doc {PublishedKeyDocument}   the locally
+ *   verified account document
+ * @param [options.signerCheck.clientAnnexDid] {string}   the annex DID the
+ *   document's delegated-clients pointer currently names; absent when it
+ *   names none, which refuses every annex-arm grant
+ * @returns {Promise<GrantProofResult>}
+ */
+export declare function verifyRecordedGrantProof({ zcap, signerCheck }: {
+    zcap: ConnectionZcap;
+    signerCheck: {
+        doc: PublishedKeyDocument;
+        clientAnnexDid?: string;
+    };
+}): Promise<GrantProofResult>;
+//# sourceMappingURL=grantProof.d.ts.map

package/dist/connections/grantProof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantProof.d.ts","sourceRoot":"","sources":["../../src/connections/grantProof.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAKhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAG7D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,kBAAkB,CAAA;AAEtB;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAA;AAuJlD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,IAAI,EACJ,WAAW,EACZ,EAAE;IACD,IAAI,EAAE,cAAc,CAAA;IACpB,WAAW,EAAE;QAAE,GAAG,EAAE,oBAAoB,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACpE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiB5B"}

package/dist/connections/grantProof.js

@@ -0,0 +1,195 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The proof check a recorded grant passes before the wallet renews it under
+ * the account's authority: whether the grant's delegation proof was signed
+ * by a key the locally verified account document lists now, with the
+ * signature verified over the capability rather than the signer's name
+ * matched alone.
+ *
+ * The check exists because only the host can plant a directory entry, and a
+ * host colluding with a withdrawn party that kept the directory's
+ * blinded-index key can write an agent entry at a valid id carrying forged
+ * grants whose proofs name a current key. A renewal pass that matched the
+ * proof's `verificationMethod` against the document and verified no
+ * signature would then sign real account delegations for the planted party.
+ *
+ * Two arms, by how the grant was delegated. A grant delegated straight under
+ * the Space root is signed by an enrolled client's key or a ladder VM, and
+ * its own proof is verified: the signer must stand under
+ * `capabilityDelegation` in the current document, and the signature must
+ * verify over the capability under that key. A grant a transient session
+ * minted chains under the generation delegation embedded as the last link
+ * of its `proof.capabilityChain`, and the parent is what is verified: it
+ * must be delegated to an annex DID in the account's auxiliary Space (the
+ * Space the account's delegated-clients pointer names, compared by host and
+ * Space id, so a grant minted under a generation a later GC collected still
+ * passes), and its own proof must verify under a key or ladder VM the
+ * current document lists. The leaf's per-visit annex VM is not verified:
+ * once its generation is collected its method is gone, and the account
+ * document never listed it.
+ */
+import { DataIntegrityProof } from '@interop/data-integrity-proof';
+import { createVerifyCryptosuite } from '@interop/ed25519-signature/eddsa-jcs-2022';
+import { memberKeyMultibase, relationKeyMultibases, relationMemberNamed, vmFragmentOf } from '@interop/vh-resource-log';
+import { embeddedParentCapability, firstDelegationProof } from '../webvh/index.js';
+import { parseClientAnnexDid } from '../webvh/clientAnnexDid.js';
+/**
+ * The suite every delegation proof this library mints carries, and the one
+ * this check verifies.
+ */
+const DELEGATION_PROOF_SHAPE = {
+    type: 'DataIntegrityProof',
+    cryptosuite: 'eddsa-jcs-2022',
+    proofPurpose: 'capabilityDelegation'
+};
+/**
+ * Verifies one capability's delegation proof against the current document:
+ * the signer must stand under `capabilityDelegation`, and the signature must
+ * verify over the capability under that key. The key material is what the
+ * document publishes for the signer, so no resolver is consulted. A proof
+ * naming a `capabilityDelegation` member of the document (`${did}#${fragment}`
+ * dereferenced through the library's `relationMemberNamed`) verifies under
+ * that member's `publicKeyMultibase`; the fragment is an opaque selector and
+ * is never read as the key, the rule the library's own log verifier applies.
+ * A proof naming the did:key form of a key (`did:key:<key>#<key>`, the form a
+ * client signs under) verifies under that key when the relation publishes it.
+ * A proof set is read by its first proof, as every other reader of a
+ * delegation does.
+ *
+ * @param options {object}
+ * @param options.zcap {IZcap}   the capability, proof included
+ * @param options.doc {PublishedKeyDocument}   the locally verified account
+ *   document
+ * @returns {Promise<GrantProofResult>}
+ */
+async function verifyDelegationProof({ zcap, doc }) {
+    const { proof: _proof, ...document } = zcap;
+    const single = firstDelegationProof(zcap);
+    if (single === undefined || typeof single.verificationMethod !== 'string') {
+        return { verified: false, reason: 'unsigned' };
+    }
+    if (single.type !== DELEGATION_PROOF_SHAPE.type ||
+        single.cryptosuite !== DELEGATION_PROOF_SHAPE.cryptosuite ||
+        single.proofPurpose !== DELEGATION_PROOF_SHAPE.proofPurpose) {
+        return { verified: false, reason: 'unsupported-suite' };
+    }
+    const signerKeyId = single.verificationMethod;
+    const keyMultibase = listedSignerKey({ doc, signerKeyId });
+    if (keyMultibase === undefined) {
+        return { verified: false, reason: 'signer-unlisted' };
+    }
+    const suite = new DataIntegrityProof({
+        cryptosuite: createVerifyCryptosuite()
+    });
+    // The suite's verify step edits the document's `@context` in place and
+    // the proof's copy is read beside it, so both are handed over as copies.
+    const result = await suite.verifyProof({
+        proof: structuredClone(single),
+        document: structuredClone(document),
+        documentLoader: async (url) => {
+            if (url !== signerKeyId) {
+                throw new Error(`No document is served for "${url}".`);
+            }
+            return {
+                documentUrl: url,
+                document: {
+                    id: signerKeyId,
+                    type: 'Multikey',
+                    controller: signerKeyId.slice(0, signerKeyId.indexOf('#')),
+                    publicKeyMultibase: keyMultibase
+                }
+            };
+        }
+    });
+    if (!result.verified) {
+        return { verified: false, reason: 'signature-invalid' };
+    }
+    return { verified: true, signerKeyId };
+}
+/**
+ * The key the document publishes under `capabilityDelegation` for a proof's
+ * `verificationMethod` DID URL, or `undefined` when the URL names no listed
+ * key. A URL under the document's DID dereferences to the member it names
+ * and takes that member's published key. A did:key URL carries its key in
+ * the DID itself and must name a key the relation publishes.
+ *
+ * @param options {object}
+ * @param options.doc {PublishedKeyDocument}
+ * @param options.signerKeyId {string}   the proof's `verificationMethod`
+ * @returns {string | undefined}
+ */
+function listedSignerKey({ doc, signerKeyId }) {
+    const hash = signerKeyId.indexOf('#');
+    const fragment = vmFragmentOf(signerKeyId);
+    if (hash === -1 || fragment === undefined) {
+        return undefined;
+    }
+    const did = signerKeyId.slice(0, hash);
+    const relation = 'capabilityDelegation';
+    const member = relationMemberNamed({ doc, relation, did, fragment });
+    if (member !== undefined) {
+        return memberKeyMultibase(member);
+    }
+    if (did === `did:key:${fragment}` &&
+        relationKeyMultibases({ doc, relation }).has(fragment)) {
+        return fragment;
+    }
+    return undefined;
+}
+/**
+ * Whether two annex DIDs name the same auxiliary Space: the same host and
+ * the same Space id, whatever their generations. A string that is not an
+ * annex DID names no Space.
+ *
+ * @param options {object}
+ * @param options.did {string}
+ * @param options.other {string}
+ * @returns {boolean}
+ */
+function sameAuxiliarySpace({ did, other }) {
+    const parts = parseClientAnnexDid(did);
+    const otherParts = parseClientAnnexDid(other);
+    return (parts !== undefined &&
+        otherParts !== undefined &&
+        parts.host === otherParts.host &&
+        parts.spaceId === otherParts.spaceId);
+}
+/**
+ * Whether a recorded grant's delegation proof verifies as this account's,
+ * against the locally verified account document. A grant with no embedded
+ * parent is verified by its own proof (the root arm); a grant embedding its
+ * parent delegation as the last link of its `proof.capabilityChain` is
+ * verified by that parent's proof, after the parent's `controller` is found
+ * to be an annex DID in the account's auxiliary Space (the annex arm). A
+ * refusal says why. The check reads the current document alone, with no log
+ * history and no network.
+ *
+ * @param options {object}
+ * @param options.zcap {ConnectionZcap}   the recorded capability, verbatim
+ * @param options.signerCheck {object}   what the grant is read against
+ * @param options.signerCheck.doc {PublishedKeyDocument}   the locally
+ *   verified account document
+ * @param [options.signerCheck.clientAnnexDid] {string}   the annex DID the
+ *   document's delegated-clients pointer currently names; absent when it
+ *   names none, which refuses every annex-arm grant
+ * @returns {Promise<GrantProofResult>}
+ */
+export async function verifyRecordedGrantProof({ zcap, signerCheck }) {
+    const parent = embeddedParentCapability(zcap);
+    if (parent === undefined) {
+        return verifyDelegationProof({
+            zcap: zcap,
+            doc: signerCheck.doc
+        });
+    }
+    const { controller } = parent;
+    if (typeof controller !== 'string' ||
+        signerCheck.clientAnnexDid === undefined ||
+        !sameAuxiliarySpace({ did: controller, other: signerCheck.clientAnnexDid })) {
+        return { verified: false, reason: 'parent-not-annex' };
+    }
+    return verifyDelegationProof({ zcap: parent, doc: signerCheck.doc });
+}
+//# sourceMappingURL=grantProof.js.map

package/dist/connections/grantProof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grantProof.js","sourceRoot":"","sources":["../../src/connections/grantProof.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAA;AACnF,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAuChE;;;GAGG;AACH,MAAM,sBAAsB,GAAG;IAC7B,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,sBAAsB;CAC5B,CAAA;AAEV;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,qBAAqB,CAAC,EACnC,IAAI,EACJ,GAAG,EAIJ;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,IAA2B,CAAA;IAClE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAChD,CAAC;IACD,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB,CAAC,IAAI;QAC3C,MAAM,CAAC,WAAW,KAAK,sBAAsB,CAAC,WAAW;QACzD,MAAM,CAAC,YAAY,KAAK,sBAAsB,CAAC,YAAY,EAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACzD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAA;IAC7C,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC;QACnC,WAAW,EAAE,uBAAuB,EAAE;KACvC,CAAC,CAAA;IACF,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;QACrC,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;QACnC,cAAc,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE;YACpC,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAA;YACxD,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,GAAG;gBAChB,QAAQ,EAAE;oBACR,EAAE,EAAE,WAAW;oBACf,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC1D,kBAAkB,EAAE,YAAY;iBACjC;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,EACvB,GAAG,EACH,WAAW,EAIZ;IACC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IAC1C,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,sBAAsB,CAAA;IACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IACD,IACE,GAAG,KAAK,WAAW,QAAQ,EAAE;QAC7B,qBAAqB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EACtD,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,EAC1B,GAAG,EACH,KAAK,EAIN;IACC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC7C,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,UAAU,KAAK,SAAS;QACxB,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;QAC9B,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CACrC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,IAAI,EACJ,WAAW,EAIZ;IACC,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAwB,CAAC,CAAA;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,qBAAqB,CAAC;YAC3B,IAAI,EAAE,IAAwB;YAC9B,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAkC,CAAA;IACzD,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,WAAW,CAAC,cAAc,KAAK,SAAS;QACxC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,EAC3E,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACxD,CAAC;IACD,OAAO,qBAAqB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAA;AACtE,CAAC"}