@interop/wallet-core 0.101.1 → 0.104.0

package/dist/connections/index.d.ts

@@ -16,9 +16,21 @@
  * - The grant index the revocation orchestrators share
  *   (`connectionGrants`, `grantTargets`, `splitGrantsByExpiry`,
  *   `grantRecipientKid`), with the reader checks every reader applies.
+ * - The agent-connection readers: the received list (`receivedGrants`,
+ *   `receivedGrantLapsed`, `liveInboxChannel`), the latest grant per scope
+ *   (`latestGrantsPerScope`), a consent's renewal scope
+ *   (`renewalScopeGrants`), the renewal predicate (`agentGrantDue`,
+ *   `AGENT_GRANT_RENEWAL_WINDOW_MS`), and `agentConnectionsSignedBy`.
  * - The upsert helpers (`recordGrants`, `removeGrants`, `retireConnection`,
  *   `unretireConnection`, `setConnectionLabel`) and their kind refusal
- *   (`ConnectionKindMismatchError`).
+ *   (`ConnectionKindMismatchError`), and the agent-connection helpers
+ *   (`recordReceivedGrants`, `recordRenewedGrants`, `settleOutboxItem`,
+ *   `pruneSupersededGrants`, `dropReceivedGrant`, `clearReceivedGrants`,
+ *   `markDeclined`).
+ * - The proof check a renewal runs over a recorded grant
+ *   (`verifyRecordedGrantProof`), which verifies the delegation signature
+ *   under a key the current document lists, and the action-set readers
+ *   (`allowsAction`, `normalizedActions`).
  * - The writer arm: lazy registration (`registerConnectionWriter`), the
  *   pull-path touch (`touchConnectionWriter`), the per-entry sweep
  *   (`sweepConnectionWriters`), and `resolveWriter` for history views.
@@ -26,19 +38,21 @@
  *   and the account document, and `normalizeDisplayName`, the one name rule
  *   every producer writes `name` through.
  */
-export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_WRITER_POLICY, GRANT_KINDS, connectionKindOf, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
-export type { ConnectionEntry, ConnectionGrantRecord, ConnectionKind, ConnectionWriter, ConnectionWriterPolicy, ConnectionZcap, GrantKind } from './entry.js';
-export { CONNECTIONS_ID_PREFIX, connectionResourceId } from './resourceId.js';
+export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_SEED_BYTES, CONNECTION_WRITER_POLICY, GRANT_KINDS, RECEIVED_GRANT_KINDS, connectionKindOf, decodeConnectionSeed, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
+export type { ConnectionEntry, ConnectionGrantRecord, ConnectionKind, ConnectionOutboxItem, ConnectionReceivedGrantRecord, ConnectionWriter, ConnectionWriterPolicy, ConnectionZcap, GrantKind, ReceivedGrantKind } from './entry.js';
+export { CONNECTIONS_ID_PREFIX, connectionResourceId, connectionSeedTag, verifyConnectionSeedTag } from './resourceId.js';
 export type { ConnectionIdKey } from './resourceId.js';
 export { wasConnectionsStore } from './store.js';
 export type { ConnectionsStore, StoredConnection } from './store.js';
 export { findConnection, readConnections } from './read.js';
 export type { ConnectionsListing, ReadConnection } from './read.js';
-export { collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
-export type { ConnectionGrant } from './grants.js';
-export { connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
+export { AGENT_GRANT_RENEWAL_WINDOW_MS, agentConnectionsSignedBy, agentGrantDue, allowsAction, collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, grantScopeKey, latestGrantsPerScope, latestIndexPerScope, liveInboxChannel, normalizedActions, receivedGrantLapsed, receivedGrants, renewalScopeGrants, splitGrantsByExpiry } from './grants.js';
+export type { ConnectionGrant, ConnectionReceivedGrant } from './grants.js';
+export { verifyRecordedGrantProof } from './grantProof.js';
+export type { GrantProofRefusal, GrantProofResult } from './grantProof.js';
+export { connectionDidKey, connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
 export { ConnectionKindMismatchError } from './errors.js';
-export { recordGrants, removeGrants, retireConnection, setConnectionLabel, unretireConnection } from './upsert.js';
+export { clearReceivedGrants, dropReceivedGrant, markDeclined, pruneSupersededGrants, recordGrants, recordReceivedGrants, recordRenewedGrants, removeGrants, retireConnection, setConnectionLabel, settleOutboxItem, unretireConnection } from './upsert.js';
 export type { ConnectionWriteOutcome, ConnectionWriteResult } from './upsert.js';
 export { registerConnectionWriter, resolveWriter, sweepConnectionWriters, touchConnectionWriter } from './writers.js';
 export type { ConnectionWritersSweep, ResolvedWriter, WriterFirstSeenRecord, WriterFirstSeenStore, WriterRegistrationOutcome, WriterTouchOutcome } from './writers.js';

package/dist/connections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC7E,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACT,iBAAiB,EAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/connections/index.js

@@ -16,9 +16,21 @@
  * - The grant index the revocation orchestrators share
  *   (`connectionGrants`, `grantTargets`, `splitGrantsByExpiry`,
  *   `grantRecipientKid`), with the reader checks every reader applies.
+ * - The agent-connection readers: the received list (`receivedGrants`,
+ *   `receivedGrantLapsed`, `liveInboxChannel`), the latest grant per scope
+ *   (`latestGrantsPerScope`), a consent's renewal scope
+ *   (`renewalScopeGrants`), the renewal predicate (`agentGrantDue`,
+ *   `AGENT_GRANT_RENEWAL_WINDOW_MS`), and `agentConnectionsSignedBy`.
  * - The upsert helpers (`recordGrants`, `removeGrants`, `retireConnection`,
  *   `unretireConnection`, `setConnectionLabel`) and their kind refusal
- *   (`ConnectionKindMismatchError`).
+ *   (`ConnectionKindMismatchError`), and the agent-connection helpers
+ *   (`recordReceivedGrants`, `recordRenewedGrants`, `settleOutboxItem`,
+ *   `pruneSupersededGrants`, `dropReceivedGrant`, `clearReceivedGrants`,
+ *   `markDeclined`).
+ * - The proof check a renewal runs over a recorded grant
+ *   (`verifyRecordedGrantProof`), which verifies the delegation signature
+ *   under a key the current document lists, and the action-set readers
+ *   (`allowsAction`, `normalizedActions`).
  * - The writer arm: lazy registration (`registerConnectionWriter`), the
  *   pull-path touch (`touchConnectionWriter`), the per-entry sweep
  *   (`sweepConnectionWriters`), and `resolveWriter` for history views.
@@ -26,14 +38,15 @@
  *   and the account document, and `normalizeDisplayName`, the one name rule
  *   every producer writes `name` through.
  */
-export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_WRITER_POLICY, GRANT_KINDS, connectionKindOf, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
-export { CONNECTIONS_ID_PREFIX, connectionResourceId } from './resourceId.js';
+export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_SEED_BYTES, CONNECTION_WRITER_POLICY, GRANT_KINDS, RECEIVED_GRANT_KINDS, connectionKindOf, decodeConnectionSeed, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
+export { CONNECTIONS_ID_PREFIX, connectionResourceId, connectionSeedTag, verifyConnectionSeedTag } from './resourceId.js';
 export { wasConnectionsStore } from './store.js';
 export { findConnection, readConnections } from './read.js';
-export { collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
-export { connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
+export { AGENT_GRANT_RENEWAL_WINDOW_MS, agentConnectionsSignedBy, agentGrantDue, allowsAction, collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, grantScopeKey, latestGrantsPerScope, latestIndexPerScope, liveInboxChannel, normalizedActions, receivedGrantLapsed, receivedGrants, renewalScopeGrants, splitGrantsByExpiry } from './grants.js';
+export { verifyRecordedGrantProof } from './grantProof.js';
+export { connectionDidKey, connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
 export { ConnectionKindMismatchError } from './errors.js';
-export { recordGrants, removeGrants, retireConnection, setConnectionLabel, unretireConnection } from './upsert.js';
+export { clearReceivedGrants, dropReceivedGrant, markDeclined, pruneSupersededGrants, recordGrants, recordReceivedGrants, recordRenewedGrants, removeGrants, retireConnection, setConnectionLabel, settleOutboxItem, unretireConnection } from './upsert.js';
 export { registerConnectionWriter, resolveWriter, sweepConnectionWriters, touchConnectionWriter } from './writers.js';
 export { normalizeDisplayName } from '../labelText.js';
 export { CONNECTIONS_COLLECTION } from '../space/collections.js';

package/dist/connections/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAUnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAanB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE1D,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/connections/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,KAAK,EAAE,eAAe,CAAA;IACtB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;OAGG;IACH,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EACR,EAAE;IACD,IAAI,EAAE,OAAO,CAAA;IACb,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EACR,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAwCrC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,cAAc,GAAG,SAAS,CAE7B"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,KAAK,EAAE,eAAe,CAAA;IACtB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;OAGG;IACH,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EACR,EAAE;IACD,IAAI,EAAE,OAAO,CAAA;IACb,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EACR,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAwCrC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,cAAc,GAAG,SAAS,CAE7B"}

package/dist/connections/read.js

@@ -10,7 +10,8 @@
  * derives to just to look the party up, since the host would then learn which
  * id belongs to which DID and whether that DID has an entry.
  */
-import { isJsonObject, parseConnectionEntry } from './entry.js';
+import { isJsonObject } from '../jsonObject.js';
+import { parseConnectionEntry } from './entry.js';
 import { connectionResourceId } from './resourceId.js';
 /**
  * The resource id a stored body claims by its own members: its `id`, or its

package/dist/connections/read.js.map

@@ -1 +1 @@
-{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AA2CtD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EAIR;IACC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,OAAoB,CAAA;QACrC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EAIR;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAuB;QAClC,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,EAAE;KAChB,CAAA;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAChB,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CACpD,CACF,CAAA;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAA+B;SAC3C,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EAIJ;IACC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,CAAA;AAC5D,CAAC"}
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AA2CtD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EAIR;IACC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,OAAoB,CAAA;QACrC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EAIR;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAuB;QAClC,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,EAAE;KAChB,CAAA;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAChB,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CACpD,CACF,CAAA;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAA+B;SAC3C,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EAIJ;IACC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,CAAA;AAC5D,CAAC"}

package/dist/connections/resourceId.d.ts

@@ -33,4 +33,37 @@ export declare function connectionResourceId(options: {
     writerId: string;
     did?: undefined;
 }): Promise<string>;
+/**
+ * The tag an entry stores beside its pairwise `seed`: {@link seedTagBytes}
+ * in the seed's own encoding. A seed that is not 32 bytes of base64url is
+ * refused with a `TypeError`.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @param options.seed {string}   the seed, base64url with no padding
+ * @returns {Promise<string>}
+ */
+export declare function connectionSeedTag({ hmacKey, seed }: {
+    hmacKey: ConnectionIdKey;
+    seed: string;
+}): Promise<string>;
+/**
+ * Whether a stored `seedTag` is the tag of a stored `seed` under this
+ * directory's blinded-index key. A malformed seed or tag reads as `false`.
+ * Every site that turns a seed into a key asks this first and fails closed
+ * on `false`.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @param options.seed {string}   the stored seed
+ * @param options.seedTag {string}   the stored tag
+ * @returns {Promise<boolean>}
+ */
+export declare function verifyConnectionSeedTag({ hmacKey, seed, seedTag }: {
+    hmacKey: ConnectionIdKey;
+    seed: string;
+    seedTag: string;
+}): Promise<boolean>;
 //# sourceMappingURL=resourceId.d.ts.map

package/dist/connections/resourceId.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resourceId.d.ts","sourceRoot":"","sources":["../../src/connections/resourceId.ts"],"names":[],"mappings":"AAsBA;;GAEG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACzB,UAAU,GAAG;IAAE,IAAI,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAAA;AAE3E;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EACH;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAClE,OAAO,CAAC,MAAM,CAAC,CAcjB"}
+{"version":3,"file":"resourceId.d.ts","sourceRoot":"","sources":["../../src/connections/resourceId.ts"],"names":[],"mappings":"AAmCA;;GAEG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACzB,UAAU,GAAG;IAAE,IAAI,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAAA;AAsB3E;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EACH;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAClE,OAAO,CAAC,MAAM,CAAC,CAWjB;AAyBD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,IAAI,EACL,EAAE;IACD,OAAO,EAAE,eAAe,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,MAAM,CAAC,CASlB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,OAAO,EACP,IAAI,EACJ,OAAO,EACR,EAAE;IACD,OAAO,EAAE,eAAe,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnB"}

package/dist/connections/resourceId.js

@@ -2,14 +2,24 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The directory's resource id: where one party's entry lives.
+ * The directory's two keyed values: the resource id where one party's entry
+ * lives, and the tag over an entry's pairwise seed. Both are HMAC-SHA-256
+ * under the collection's blinded-index key, domain-separated by the
+ * `connections/v1` prefix and an arm name, so one key signs no two kinds of
+ * input under the same bytes.
  *
  * The id is the first 16 bytes of
  * `HMAC-SHA-256(hmacKey, utf8('connections/v1' + '|' + armInput))`, formatted
- * with was-client's `edvIdFromBytes`. `hmacKey` is the collection's
- * blinded-index key. `armInput` is `'did:' + did` for a party with a DID and
- * `'writer:' + writerId` for a keyless writer. The account DID is not an
- * input.
+ * with was-client's `edvIdFromBytes`. `armInput` is `'did:' + did` for a
+ * party with a DID and `'writer:' + writerId` for a keyless writer. The
+ * account DID is not an input.
+ *
+ * The seed tag is the full 32 bytes of
+ * `HMAC-SHA-256(hmacKey, utf8('connections/v1' + '|' + 'seed:') || seedBytes)`,
+ * base64url with no padding. The blinded-index key is wrapped to the user
+ * key's KAK in the descriptor and the descriptor is log-governed, so the host
+ * lacks it: a seed the host planted on an entry carries no tag that verifies,
+ * and every site that turns a seed into a key checks the tag first.
  *
  * Keying the id stops the storage host from computing the id of a guessed
  * DID and probing for it. The protection lasts only while reads keep it: a
@@ -18,11 +28,27 @@
  */
 import { hmac } from '@noble/hashes/hmac.js';
 import { sha256 } from '@noble/hashes/sha2.js';
+import { equalBytes } from '@noble/ciphers/utils.js';
+import { base64urlnopad } from '@scure/base';
 import { edvIdFromBytes } from '@interop/was-client/edv/cipher';
+import { decodeConnectionSeed } from './entry.js';
 /**
  * The domain prefix of every directory resource id.
  */
 export const CONNECTIONS_ID_PREFIX = 'connections/v1';
+/**
+ * HMAC-SHA-256 under the blinded-index key, in either form.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @param options.data {Uint8Array}
+ * @returns {Promise<Uint8Array>}
+ */
+async function keyedMac({ hmacKey, data }) {
+    return hmacKey instanceof Uint8Array
+        ? hmac(sha256, hmacKey, data)
+        : hmacKey.sign({ data });
+}
 /**
  * The resource id of a party's entry (`did`) or of a keyless writer's entry
  * (`writerId`). Exactly one of the two is given.
@@ -41,9 +67,63 @@ export async function connectionResourceId(options) {
     }
     const armInput = did !== undefined ? `did:${did}` : `writer:${writerId}`;
     const data = new TextEncoder().encode(`${CONNECTIONS_ID_PREFIX}|${armInput}`);
-    const mac = hmacKey instanceof Uint8Array
-        ? hmac(sha256, hmacKey, data)
-        : await hmacKey.sign({ data });
+    const mac = await keyedMac({ hmacKey, data });
     return edvIdFromBytes(mac.subarray(0, 16));
 }
+/**
+ * The tag bytes over a seed: the full MAC over the `seed:` arm's prefix
+ * followed by the raw seed bytes.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @param options.seedBytes {Uint8Array}
+ * @returns {Promise<Uint8Array>}
+ */
+async function seedTagBytes({ hmacKey, seedBytes }) {
+    const prefix = new TextEncoder().encode(`${CONNECTIONS_ID_PREFIX}|seed:`);
+    const data = new Uint8Array(prefix.length + seedBytes.length);
+    data.set(prefix);
+    data.set(seedBytes, prefix.length);
+    return keyedMac({ hmacKey, data });
+}
+/**
+ * The tag an entry stores beside its pairwise `seed`: {@link seedTagBytes}
+ * in the seed's own encoding. A seed that is not 32 bytes of base64url is
+ * refused with a `TypeError`.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @param options.seed {string}   the seed, base64url with no padding
+ * @returns {Promise<string>}
+ */
+export async function connectionSeedTag({ hmacKey, seed }) {
+    const seedBytes = decodeConnectionSeed(seed);
+    if (seedBytes === undefined) {
+        throw new TypeError('A connection seed is 43 characters of base64url with no padding, ' +
+            'decoding to 32 bytes.');
+    }
+    return base64urlnopad.encode(await seedTagBytes({ hmacKey, seedBytes }));
+}
+/**
+ * Whether a stored `seedTag` is the tag of a stored `seed` under this
+ * directory's blinded-index key. A malformed seed or tag reads as `false`.
+ * Every site that turns a seed into a key asks this first and fails closed
+ * on `false`.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @param options.seed {string}   the stored seed
+ * @param options.seedTag {string}   the stored tag
+ * @returns {Promise<boolean>}
+ */
+export async function verifyConnectionSeedTag({ hmacKey, seed, seedTag }) {
+    const seedBytes = decodeConnectionSeed(seed);
+    const tagBytes = decodeConnectionSeed(seedTag);
+    if (seedBytes === undefined || tagBytes === undefined) {
+        return false;
+    }
+    return equalBytes(await seedTagBytes({ hmacKey, seedBytes }), tagBytes);
+}
 //# sourceMappingURL=resourceId.js.map

package/dist/connections/resourceId.js.map

@@ -1 +1 @@
-{"version":3,"file":"resourceId.js","sourceRoot":"","sources":["../../src/connections/resourceId.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAA;AAWrD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAEmE;IAEnE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC1C,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CACjB,qEAAqE,CACtE,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAA;IACxE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,qBAAqB,IAAI,QAAQ,EAAE,CAAC,CAAA;IAC7E,MAAM,GAAG,GACP,OAAO,YAAY,UAAU;QAC3B,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;QAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"resourceId.js","sourceRoot":"","sources":["../../src/connections/resourceId.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAA;AAWrD;;;;;;;GAOG;AACH,KAAK,UAAU,QAAQ,CAAC,EACtB,OAAO,EACP,IAAI,EAIL;IACC,OAAO,OAAO,YAAY,UAAU;QAClC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;QAC7B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAEmE;IAEnE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC1C,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CACjB,qEAAqE,CACtE,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAA;IACxE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,qBAAqB,IAAI,QAAQ,EAAE,CAAC,CAAA;IAC7E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,EAC1B,OAAO,EACP,SAAS,EAIV;IACC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,qBAAqB,QAAQ,CAAC,CAAA;IACzE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAC7D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAClC,OAAO,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,IAAI,EAIL;IACC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,mEAAmE;YACjE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,OAAO,EACP,IAAI,EACJ,OAAO,EAKR;IACC,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAC9C,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;AACzE,CAAC"}

package/dist/connections/upsert.d.ts

@@ -1,4 +1,7 @@
-import type { ConnectionEntry, ConnectionKind, GrantKind } from './entry.js';
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+import type { ConnectionEntry, ConnectionKind, GrantKind, ReceivedGrantKind } from './entry.js';
 import type { ConnectionIdKey } from './resourceId.js';
 import type { ConnectionsStore } from './store.js';
 /**
@@ -83,9 +86,33 @@ export declare function writeConnection<Stop>({ store, hmacKey, resourceId, chan
  * it. Each new grant is added by its capability id (one already recorded is
  * left as stored), `name` is set when it passes the display-name rule (left
  * as it was otherwise), `origin`, `url`, and `appKey` are set when given,
- * `retired` is cleared, and `lastSeen` moves to `now`. `firstSeen` is set
- * only on create, and `label` is never touched. A zero-grant consent writes
- * too, so an App Connect app with no grants is indexed by its key.
+ * `retired` and `declined` are cleared, and `lastSeen` moves to `now`.
+ * `firstSeen` is set only on create, and `label` is never touched. Every
+ * grant of one call carries the same `grantedAt`. A zero-grant consent
+ * writes too, so an App Connect app with no grants is indexed by its key.
+ *
+ * With `unlessRetired`, a retired entry is left as stored and the result's
+ * outcome is `unchanged`. A party's own fresh consent un-retires its entry,
+ * and a restore the owner runs from a listing does not: the entry was
+ * retired by a revoke that landed after that listing was read, and the
+ * restore must not undo it. The check runs inside the compare-and-swap, so
+ * a revoke racing the write is met on the re-read.
+ *
+ * A `message` (an envelope carrying exactly the grants of this call) is
+ * queued on `outbox` in the same write, stamped `now`, so a restore that
+ * records fresh grants and owes the party their envelope has no tear between
+ * the two. Each zcap of this call is first removed from every pending
+ * envelope that carries it (an envelope left with none is dropped), so no
+ * two pending envelopes name one zcap id. A consent torn after its write
+ * lands and re-run therefore leaves one pending envelope, the re-run's, and
+ * a grant recorded earlier with no envelope is told on the first call that
+ * brings one.
+ *
+ * A `seed` and its `seedTag` (both or neither) are written when the entry
+ * carries no seed, and left as stored when it carries the same one. An entry
+ * carrying a different seed is refused with an `Error`, since the seed is
+ * written once. A tag that does not verify under `hmacKey` is refused with a
+ * `TypeError` before anything is read.
  *
  * Refuses an entry of another kind with {@link ConnectionKindMismatchError},
  * and a grant delegated to another party or targeting another Space with a
@@ -105,10 +132,17 @@ export declare function writeConnection<Stop>({ store, hmacKey, resourceId, chan
  * @param [options.origin] {string}   the attested Web origin (App Connect)
  * @param [options.url] {string}   the canonical app URL (App Connect)
  * @param [options.appKey] {string}   the app-key Resource id (App Connect)
+ * @param [options.seed] {string}   the wallet's pairwise seed toward the
+ *   party, base64url with no padding
+ * @param [options.seedTag] {string}   the seed's tag (`connectionSeedTag`)
+ * @param [options.message] {object}   an envelope to queue on `outbox` with
+ *   the consent, carrying exactly the grants of this call
+ * @param [options.unlessRetired] {boolean}   leave a retired entry as
+ *   stored, with the outcome `unchanged`
  * @param [options.now] {Date}
  * @returns {Promise<ConnectionWriteResult>}
  */
-export declare function recordGrants({ store, hmacKey, did, kind, spaceUrl, grants, name, origin, url, appKey, now }: {
+export declare function recordGrants({ store, hmacKey, did, kind, spaceUrl, grants, name, origin, url, appKey, seed, seedTag, message, unlessRetired, now }: {
     store: ConnectionsStore;
     hmacKey: ConnectionIdKey;
     did: string;
@@ -122,6 +156,10 @@ export declare function recordGrants({ store, hmacKey, did, kind, spaceUrl, gran
     origin?: string;
     url?: string;
     appKey?: string;
+    seed?: string;
+    seedTag?: string;
+    message?: Record<string, unknown>;
+    unlessRetired?: boolean;
     now?: Date;
 }): Promise<ConnectionWriteResult>;
 /**
@@ -145,8 +183,9 @@ export declare function removeGrants({ store, hmacKey, did, zcapIds }: {
 }): Promise<ConnectionWriteResult>;
 /**
  * Retires the party's entry, of any kind, once a revocation has handled its
- * grants: empties `grants`, drops `appKey`, and stamps `retired`. `name`,
- * `label`, `origin`, `url`, `firstSeen`, `lastSeen`, and `writers` stay, so a
+ * grants: empties `grants`, `grantsReceived`, and `outbox`, drops `appKey`,
+ * and stamps `retired`. `name`, `label`, `origin`, `url`, `firstSeen`,
+ * `lastSeen`, `writers`, `seed`, `seedTag`, and `declined` stay, so a
  * departed party keeps resolving. An entry already retired with nothing left
  * to empty writes nothing, and an absent entry writes nothing.
  *
@@ -241,4 +280,210 @@ export declare function setConnectionLabel({ store, hmacKey, did, kind, label, n
     enrolledSigningKeys?: ReadonlySet<string>;
     now?: Date;
 }): Promise<ConnectionWriteResult>;
+/**
+ * Records the capabilities a party handed the wallet on its entry's
+ * `grantsReceived`. Each new record is merged in turn: one whose capability
+ * id is already held is left as stored, so the drain's re-run is a no-op;
+ * one with the `grantKind` and `invocationTarget` of a held record replaces
+ * it when its `expires` is strictly later or when the held record has
+ * lapsed as of `now` (at the earlier of its `expires` and `receivedAt` plus
+ * `channelMaxLifetimeMs`), and leaves the held record otherwise; any other
+ * is appended. Every record whose `expires`
+ * is past by more than the revocation clock skew is then dropped. A new
+ * record carries `receivedAt: now`.
+ *
+ * Each grant is checked strictly before anything is read, refused with a
+ * `TypeError`: its known members well-formed, its `controller` the wallet's
+ * pairwise DID toward the party, its `invocationTarget` outside this Space,
+ * its kind one of `RECEIVED_GRANT_KINDS`, an `'inbox'` grant allowing POST,
+ * and an `expires` in strict ISO 8601 form, with any number of fractional
+ * second digits (a format one engine's `Date.parse` accepts and another's
+ * refuses would make the entry unparseable there). A retired entry is refused
+ * with an `Error`, and an absent entry writes nothing.
+ *
+ * @param options {object}
+ * @param options.store {ConnectionsStore}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @param options.did {string}   the party's DID
+ * @param options.pairwiseDid {string}   the wallet's pairwise did:key toward
+ *   the party, every received grant's controller
+ * @param options.spaceUrl {string}   this Space's container URL, which no
+ *   received grant may target
+ * @param options.grants {Array<object>}   `{ zcap, grantKind }` per grant
+ * @param options.channelMaxLifetimeMs {number}   how long after `receivedAt`
+ *   a received record lapses at the latest
+ * @param [options.now] {Date}
+ * @returns {Promise<ConnectionWriteResult>}
+ */
+export declare function recordReceivedGrants({ store, hmacKey, did, pairwiseDid, spaceUrl, grants, channelMaxLifetimeMs, now }: {
+    store: ConnectionsStore;
+    hmacKey: ConnectionIdKey;
+    did: string;
+    pairwiseDid: string;
+    spaceUrl: string;
+    grants: Array<{
+        zcap: object;
+        grantKind: ReceivedGrantKind;
+    }>;
+    channelMaxLifetimeMs: number;
+    now?: Date;
+}): Promise<ConnectionWriteResult>;
+/**
+ * The renewal's pivot: appends the renewed grant records and queues the
+ * envelope that carries them to the party, in one compare-and-swap. Each
+ * renewed record keeps its source's `grantKind` and `grantedAt` and carries
+ * `renewedAt: now`; the source record stays as stored. On `outbox`, every
+ * zcap sharing a renewed zcap's scope is removed from the envelopes already
+ * pending, an envelope left with none is dropped, and `message` is appended
+ * with `createdAt: now`.
+ *
+ * A renewed zcap must copy its source's `invocationTarget` as stored, since
+ * the scope compares it verbatim (a trailing `*` marker included).
+ *
+ * Refuses with an `Error`, writing nothing: a retired entry (whose `retired`
+ * stays), an entry with no live inbox channel (`receivedGrants`, then
+ * `liveInboxChannel`), a renewal whose source record is gone, a renewal
+ * whose source is no longer the latest record of its scope (a concurrent
+ * renewal ran), and a renewal whose `expires` is not strictly later than its
+ * source's. The last is what keeps a renewal minted under a short-lived parent from
+ * being appended at every login. A renewed zcap not delegated to the party,
+ * not targeting this Space, or of another scope than its source, and a
+ * `message` whose zcap ids are not exactly the renewed zcap ids, are refused
+ * with a `TypeError`. An absent entry writes nothing.
+ *
+ * @param options {object}
+ * @param options.store {ConnectionsStore}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @param options.did {string}   the party's DID, every renewed grant's
+ *   controller
+ * @param options.pairwiseDid {string}   the wallet's pairwise did:key toward
+ *   the party, the inbox channel's controller
+ * @param options.spaceUrl {string}   this Space's container URL
+ * @param options.renewals {Array<object>}   `{ zcap, sourceZcapId }` per
+ *   renewed grant: the new capability and the id of the record it renews
+ * @param options.message {object}   the envelope to queue, verbatim
+ * @param options.channelMaxLifetimeMs {number}   how long after `receivedAt`
+ *   an inbox record lapses at the latest
+ * @param [options.now] {Date}
+ * @returns {Promise<ConnectionWriteResult>}
+ */
+export declare function recordRenewedGrants({ store, hmacKey, did, pairwiseDid, spaceUrl, renewals, message, channelMaxLifetimeMs, now }: {
+    store: ConnectionsStore;
+    hmacKey: ConnectionIdKey;
+    did: string;
+    pairwiseDid: string;
+    spaceUrl: string;
+    renewals: Array<{
+        zcap: object;
+        sourceZcapId: string;
+    }>;
+    message: Record<string, unknown>;
+    channelMaxLifetimeMs: number;
+    now?: Date;
+}): Promise<ConnectionWriteResult>;
+/**
+ * Removes the outbox item(s) queued at `createdAt`, once a push delivered
+ * them. None queued then writes nothing, and an absent entry writes nothing.
+ *
+ * @param options {object}
+ * @param options.store {ConnectionsStore}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @param options.did {string}   the party's DID
+ * @param options.createdAt {string}   the delivered item's `createdAt`
+ * @returns {Promise<ConnectionWriteResult>}
+ */
+export declare function settleOutboxItem({ store, hmacKey, did, createdAt }: {
+    store: ConnectionsStore;
+    hmacKey: ConnectionIdKey;
+    did: string;
+    createdAt: string;
+}): Promise<ConnectionWriteResult>;
+/**
+ * Drops the grant records renewal superseded, and the outbox items no push
+ * can still deliver. In each scope holding more than one record, every
+ * record but the latest is dropped when its `expires` is past by more than
+ * the revocation clock skew, or when its capability id is among
+ * `deadChainZcapIds`. The latest record of a scope always stays. An outbox
+ * item is discarded when every zcap its envelope carries is past `expires` by
+ * more than the skew; an item carrying a zcap this build cannot read stays.
+ * Nothing to drop writes nothing, and an absent
+ * entry writes nothing.
+ *
+ * @param options {object}
+ * @param options.store {ConnectionsStore}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @param options.did {string}   the party's DID
+ * @param [options.deadChainZcapIds] {Iterable<string>}   ids of superseded
+ *   records whose chain revocation reads as dead (the signer gone from the
+ *   account document, or the parent naming another annex generation) and
+ *   whose successor's outbox item was settled. A grant `agentGrantDue` reads
+ *   as due by replacement does not qualify on that alone: a grant under an
+ *   in-place-renewed delegation stays live until that delegation expires.
+ * @param [options.now] {Date}
+ * @returns {Promise<ConnectionWriteResult>}
+ */
+export declare function pruneSupersededGrants({ store, hmacKey, did, deadChainZcapIds, now }: {
+    store: ConnectionsStore;
+    hmacKey: ConnectionIdKey;
+    did: string;
+    deadChainZcapIds?: Iterable<string>;
+    now?: Date;
+}): Promise<ConnectionWriteResult>;
+/**
+ * Empties the party's `grantsReceived` and `outbox`: the agent revoke's
+ * first write, so no client pushes to the party once it starts. Both already
+ * empty writes nothing, and an absent entry writes nothing.
+ *
+ * @param options {object}
+ * @param options.store {ConnectionsStore}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @param options.did {string}   the party's DID
+ * @returns {Promise<ConnectionWriteResult>}
+ */
+export declare function clearReceivedGrants({ store, hmacKey, did }: {
+    store: ConnectionsStore;
+    hmacKey: ConnectionIdKey;
+    did: string;
+}): Promise<ConnectionWriteResult>;
+/**
+ * Drops one record from the party's `grantsReceived` by its capability id,
+ * and leaves `outbox` as it is: what a push refused by the party's server
+ * (a 401, a 403, or a WAS host's masked 404) does with the channel it went
+ * through, since the refusal says the capability is expired or revoked. The
+ * queued envelopes stay for the party's next invitation, and a replacement
+ * channel the party then hands over is stored by `recordReceivedGrants`
+ * whatever its `expires`, since the dropped record is gone. A record not
+ * held writes nothing, and an absent entry writes nothing.
+ *
+ * @param options {object}
+ * @param options.store {ConnectionsStore}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @param options.did {string}   the party's DID
+ * @param options.zcapId {string}   the `id` of the received capability
+ * @returns {Promise<ConnectionWriteResult>}
+ */
+export declare function dropReceivedGrant({ store, hmacKey, did, zcapId }: {
+    store: ConnectionsStore;
+    hmacKey: ConnectionIdKey;
+    did: string;
+    zcapId: string;
+}): Promise<ConnectionWriteResult>;
+/**
+ * Records the owner's decline of the party's offer: sets `declined` to
+ * `now`. An entry already declined keeps its time and writes nothing, and an
+ * absent entry writes nothing. A later consent (`recordGrants`) clears it.
+ *
+ * @param options {object}
+ * @param options.store {ConnectionsStore}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @param options.did {string}   the party's DID
+ * @param [options.now] {Date}
+ * @returns {Promise<ConnectionWriteResult>}
+ */
+export declare function markDeclined({ store, hmacKey, did, now }: {
+    store: ConnectionsStore;
+    hmacKey: ConnectionIdKey;
+    did: string;
+    now?: Date;
+}): Promise<ConnectionWriteResult>;
 //# sourceMappingURL=upsert.d.ts.map