@interop/wallet-core 0.107.0 → 0.107.1

package/dist/clientAnnex/grantRevocation.d.ts

@@ -25,22 +25,26 @@
  * pointer moves to another generation.
  */
 import type { IDelegatedZcap, IZcap } from '@interop/data-integrity-core';
+import type { AnnexDocumentResolver } from '../connections/index.js';
 import { type PublishedKeyDocument } from '../webvh/index.js';
 /**
  * What a recorded grant is read against, off the session's verified account
  * document: the account DID an enrolled client's promoted verification-method
- * id is under, the enrolled clients' signing-key multibases (the two as
- * `deriveGrantSignerState` takes them), the verified document itself (what an
- * embedded generation delegation's proof key is checked against), and the
- * annex DID the document's delegated-clients pointer currently names, absent
- * when it names none. The first two settle the orphaned reading; the last two
- * settle whether an annex-signed grant's generation delegation still stands.
+ * id is under, the verified document itself (what every signer, a root
+ * grant's and an embedded generation delegation's alike, is checked against
+ * through `delegationSignerKey`), and the annex DID the document's
+ * delegated-clients pointer currently names, absent when it names none. The
+ * first two settle the orphaned reading; the last two settle whether an
+ * annex-signed grant's generation delegation still stands. The one object
+ * also serves the renewal's proof check (`verifyRecordedGrantProof`,
+ * `connections`), which is the only reader of the `annexDocument` resolver;
+ * the revocation reading does not call it.
  */
 export interface AccountSignerCheck {
     accountDid: string;
-    currentSigningKeys: Set<string>;
     doc: PublishedKeyDocument;
     clientAnnexDid?: string;
+    annexDocument: AnnexDocumentResolver;
 }
 /**
  * How a server refusal of a grant's revocation is read, when the client can

package/dist/clientAnnex/grantRevocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grantRevocation.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/grantRevocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAA;AAG1B;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC/B,GAAG,EAAE,oBAAoB,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,sBAAsB,GAChC,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,oBAAoB,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAChC,SAAS,GAAG,iBAAiB,GAAG,sBAAsB,CAAA;AAExD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,IAAI,EACJ,WAAW,EACX,GAAG,EACJ,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,sBAAsB,GAAG,SAAS,CA6BrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,MAAM,EACN,IAAI,EACJ,WAAW,EACX,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,EAAE,KAAK,CAAA;IACX,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAsBlC"}
+{"version":3,"file":"grantRevocation.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/grantRevocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAA;AAG1B;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,oBAAoB,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,qBAAqB,CAAA;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,sBAAsB,GAChC,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,oBAAoB,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAChC,SAAS,GAAG,iBAAiB,GAAG,sBAAsB,CAAA;AAExD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,8BAA8B,CAAC,EAC7C,IAAI,EACJ,WAAW,EACX,GAAG,EACJ,EAAE;IACD,IAAI,EAAE,KAAK,CAAA;IACX,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,sBAAsB,GAAG,SAAS,CA6BrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,MAAM,EACN,IAAI,EACJ,WAAW,EACX,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,EAAE,KAAK,CAAA;IACX,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAsBlC"}

package/dist/clientAnnex/grantRevocation.js

@@ -34,7 +34,7 @@ export function classifyGrantRevocationRefusal({ zcap, signerCheck, now }) {
         const state = deriveGrantSignerState({
             signerKeyIds: [delegationProofKeyId(zcap)],
             accountDid: signerCheck.accountDid,
-            currentSigningKeys: signerCheck.currentSigningKeys
+            doc: signerCheck.doc
         });
         return state === 'orphaned' ? 'orphaned' : undefined;
     }

package/dist/clientAnnex/grantRevocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"grantRevocation.js","sourceRoot":"","sources":["../../src/clientAnnex/grantRevocation.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EAEzB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AA8C7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,8BAA8B,CAAC,EAC7C,IAAI,EACJ,WAAW,EACX,GAAG,EAKJ;IACC,IAAI,kBAAkB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC;YACnC,YAAY,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1C,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;SACnD,CAAC,CAAA;QACF,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,CAAC;IACD,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACjE,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAkC,CAAA;IACzD,IACE,WAAW,CAAC,cAAc,KAAK,SAAS;QACxC,OAAO,UAAU,KAAK,QAAQ;QAC9B,gBAAgB,CAAC,UAAU,CAAC;QAC5B,UAAU,KAAK,WAAW,CAAC,cAAc,EACzC,CAAC;QACD,OAAO,oBAAoB,CAAA;IAC7B,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,MAAM,EACN,IAAI,EACJ,WAAW,EACX,GAAG,EAMJ;IACC,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAiC,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAA;QACpD,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnC,OAAO,iBAAiB,CAAA;QAC1B,CAAC;QACD,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,8BAA8B,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}
+{"version":3,"file":"grantRevocation.js","sourceRoot":"","sources":["../../src/clientAnnex/grantRevocation.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAEjE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EAEzB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAiD7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,8BAA8B,CAAC,EAC7C,IAAI,EACJ,WAAW,EACX,GAAG,EAKJ;IACC,IAAI,kBAAkB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC;YACnC,YAAY,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1C,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAA;QACF,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,CAAC;IACD,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACjE,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAkC,CAAA;IACzD,IACE,WAAW,CAAC,cAAc,KAAK,SAAS;QACxC,OAAO,UAAU,KAAK,QAAQ;QAC9B,gBAAgB,CAAC,UAAU,CAAC;QAC5B,UAAU,KAAK,WAAW,CAAC,cAAc,EACzC,CAAC;QACD,OAAO,oBAAoB,CAAA;IAC7B,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,MAAM,EACN,IAAI,EACJ,WAAW,EACX,GAAG,EAMJ;IACC,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAiC,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAA;QACpD,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnC,OAAO,iBAAiB,CAAA;QAC1B,CAAC;QACD,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,8BAA8B,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/clients/grantState.d.ts

@@ -24,6 +24,7 @@
  * embedded generation delegation instead: its signer, and the generation it
  * names.
  */
+import type { PublishedKeyDocument } from '../webvh/index.js';
 /**
  * Whether a set of recorded grants still verifies under the current-key-set
  * rule:
@@ -41,10 +42,12 @@
 export type GrantSignerState = 'active' | 'orphaned' | 'unknown';
 /**
  * Derives the {@link GrantSignerState} of a set of recorded delegation signers
- * against the enrolled clients' signing keys the account's locally verified
- * did:webvh document currently publishes. Matching is on the key-multibase
- * fragment, so a grant signed under the did:key form of a still-enrolled
- * client's key stays active.
+ * against the keys the account's locally verified did:webvh document
+ * currently publishes under `capabilityDelegation`. Each signer is read
+ * through `delegationSignerKey` (`webvh`), the one reader every
+ * delegation-signer check shares, so the document itself is taken rather
+ * than a key set a caller built by some other rule, and a grant signed under
+ * the did:key form of a still-listed key stays active.
  *
  * A signer is judged against the document only when the document could have
  * listed it: its DID is the account DID or a did:key. Any other signer (a
@@ -57,14 +60,13 @@ export type GrantSignerState = 'active' | 'orphaned' | 'unknown';
  *   grant's `proof.verificationMethod`; undefined for a summary-only record
  * @param options.accountDid {string}   the account's did:webvh, the DID an
  *   enrolled client's promoted verification-method id is under
- * @param [options.currentSigningKeys] {Set<string>}   the enrolled clients'
- *   signing-key multibases, or undefined when no verified document is
- *   available
+ * @param [options.doc] {PublishedKeyDocument}   the locally verified account
+ *   document, or undefined when none is available
  * @returns {GrantSignerState}
  */
-export declare function deriveGrantSignerState({ signerKeyIds, accountDid, currentSigningKeys }: {
+export declare function deriveGrantSignerState({ signerKeyIds, accountDid, doc }: {
     signerKeyIds: Array<string | undefined>;
     accountDid: string;
-    currentSigningKeys?: Set<string>;
+    doc?: PublishedKeyDocument;
 }): GrantSignerState;
 //# sourceMappingURL=grantState.d.ts.map

package/dist/clients/grantState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grantState.d.ts","sourceRoot":"","sources":["../../src/clients/grantState.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,YAAY,EACZ,UAAU,EACV,kBAAkB,EACnB,EAAE;IACD,YAAY,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,kBAAkB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACjC,GAAG,gBAAgB,CA0BnB"}
+{"version":3,"file":"grantState.d.ts","sourceRoot":"","sources":["../../src/clients/grantState.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE7D;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,YAAY,EACZ,UAAU,EACV,GAAG,EACJ,EAAE;IACD,YAAY,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,oBAAoB,CAAA;CAC3B,GAAG,gBAAgB,CA4BnB"}

package/dist/clients/grantState.js

@@ -24,12 +24,16 @@
  * embedded generation delegation instead: its signer, and the generation it
  * names.
  */
+import { parseVersionedVm } from '@interop/vh-resource-log';
+import { delegationSignerKeyReader } from '../webvh/index.js';
 /**
  * Derives the {@link GrantSignerState} of a set of recorded delegation signers
- * against the enrolled clients' signing keys the account's locally verified
- * did:webvh document currently publishes. Matching is on the key-multibase
- * fragment, so a grant signed under the did:key form of a still-enrolled
- * client's key stays active.
+ * against the keys the account's locally verified did:webvh document
+ * currently publishes under `capabilityDelegation`. Each signer is read
+ * through `delegationSignerKey` (`webvh`), the one reader every
+ * delegation-signer check shares, so the document itself is taken rather
+ * than a key set a caller built by some other rule, and a grant signed under
+ * the did:key form of a still-listed key stays active.
  *
  * A signer is judged against the document only when the document could have
  * listed it: its DID is the account DID or a did:key. Any other signer (a
@@ -42,31 +46,30 @@
  *   grant's `proof.verificationMethod`; undefined for a summary-only record
  * @param options.accountDid {string}   the account's did:webvh, the DID an
  *   enrolled client's promoted verification-method id is under
- * @param [options.currentSigningKeys] {Set<string>}   the enrolled clients'
- *   signing-key multibases, or undefined when no verified document is
- *   available
+ * @param [options.doc] {PublishedKeyDocument}   the locally verified account
+ *   document, or undefined when none is available
  * @returns {GrantSignerState}
  */
-export function deriveGrantSignerState({ signerKeyIds, accountDid, currentSigningKeys }) {
-    if (!currentSigningKeys) {
+export function deriveGrantSignerState({ signerKeyIds, accountDid, doc }) {
+    if (!doc) {
         return 'unknown';
     }
     const signers = signerKeyIds.filter((keyId) => keyId !== undefined);
     if (signers.length === 0) {
         return 'unknown';
     }
+    const signerKey = delegationSignerKeyReader({ doc });
     let accountSigners = 0;
     for (const keyId of signers) {
-        const hash = keyId.indexOf('#');
-        if (hash < 0) {
-            continue;
-        }
-        const did = keyId.slice(0, hash);
-        if (did !== accountDid && !did.startsWith('did:key:')) {
+        // Split the way the reader splits it, so the two cannot disagree on
+        // which DID an id is under.
+        const did = parseVersionedVm(keyId)?.did;
+        if (did === undefined ||
+            (did !== accountDid && !did.startsWith('did:key:'))) {
             continue;
         }
         accountSigners += 1;
-        if (currentSigningKeys.has(keyId.slice(hash + 1))) {
+        if (signerKey(keyId) !== undefined) {
             return 'active';
         }
     }

package/dist/clients/grantState.js.map

@@ -1 +1 @@
-{"version":3,"file":"grantState.js","sourceRoot":"","sources":["../../src/clients/grantState.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAkBH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,YAAY,EACZ,UAAU,EACV,kBAAkB,EAKnB;IACC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CACjC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAChD,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAChC,IAAI,GAAG,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,SAAQ;QACV,CAAC;QACD,cAAc,IAAI,CAAC,CAAA;QACnB,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;AACpD,CAAC"}
+{"version":3,"file":"grantState.js","sourceRoot":"","sources":["../../src/clients/grantState.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAmB7D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CAAC,EACrC,YAAY,EACZ,UAAU,EACV,GAAG,EAKJ;IACC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CACjC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAChD,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACpD,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAA;QACxC,IACE,GAAG,KAAK,SAAS;YACjB,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EACnD,CAAC;YACD,SAAQ;QACV,CAAC;QACD,cAAc,IAAI,CAAC,CAAA;QACnB,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;AACpD,CAAC"}

package/dist/clients/index.d.ts

@@ -9,16 +9,16 @@
  * - `listAccountClients` / `currentAccountSigningKeys` /
  *   `currentAccountRecordSigners` -- the listing over the locally verified
  *   did:webvh log, with names joined from the `connections` directory's
- *   wallet-client entries; the same read reduced to the key set an app
- *   grant's delegation signer is checked against; and that
- *   set widened by the document's ladder VMs, the allowlist a re-minted
- *   unlock or recovery record's proof is settled against. All take an
- *   already-verified log in place of fetching one.
+ *   wallet-client entries; the enrolled clients' signing keys as the shared
+ *   document reader publishes them; and that set widened by the document's
+ *   ladder VMs, the allowlist a re-minted unlock or recovery record's proof
+ *   is settled against. All take an already-verified log in place of
+ *   fetching one.
  * - `deriveGrantSignerState` -- the grant-state check a connected-apps
- *   surface runs over a recorded delegation's signer against that key set:
- *   active, orphaned (an enrolled client the account struck), or unknown
- *   (nothing to check against, or a client-annex per-visit signer the
- *   document never lists).
+ *   surface runs over a recorded delegation's signer against the verified
+ *   document (`delegationSignerKey`): active, orphaned (an enrolled client
+ *   the account struck), or unknown (no document to check against, or a
+ *   client-annex per-visit signer the document does not list).
  * - `disconnectEligibility` / `revokedClientKeysFor` / `cascadeCompletion` --
  *   the disconnect-eligibility policy as data and pure functions, so both
  *   surfaces refuse the same rows for the same reasons and report a partial

package/dist/clients/index.js

@@ -9,16 +9,16 @@
  * - `listAccountClients` / `currentAccountSigningKeys` /
  *   `currentAccountRecordSigners` -- the listing over the locally verified
  *   did:webvh log, with names joined from the `connections` directory's
- *   wallet-client entries; the same read reduced to the key set an app
- *   grant's delegation signer is checked against; and that
- *   set widened by the document's ladder VMs, the allowlist a re-minted
- *   unlock or recovery record's proof is settled against. All take an
- *   already-verified log in place of fetching one.
+ *   wallet-client entries; the enrolled clients' signing keys as the shared
+ *   document reader publishes them; and that set widened by the document's
+ *   ladder VMs, the allowlist a re-minted unlock or recovery record's proof
+ *   is settled against. All take an already-verified log in place of
+ *   fetching one.
  * - `deriveGrantSignerState` -- the grant-state check a connected-apps
- *   surface runs over a recorded delegation's signer against that key set:
- *   active, orphaned (an enrolled client the account struck), or unknown
- *   (nothing to check against, or a client-annex per-visit signer the
- *   document never lists).
+ *   surface runs over a recorded delegation's signer against the verified
+ *   document (`delegationSignerKey`): active, orphaned (an enrolled client
+ *   the account struck), or unknown (no document to check against, or a
+ *   client-annex per-visit signer the document does not list).
  * - `disconnectEligibility` / `revokedClientKeysFor` / `cascadeCompletion` --
  *   the disconnect-eligibility policy as data and pure functions, so both
  *   surfaces refuse the same rows for the same reasons and report a partial

package/dist/clients/listing.d.ts

@@ -90,17 +90,16 @@ export declare function listAccountClients({ pointer, readDirectoryEntries, ownS
 }): Promise<AccountClientView[]>;
 /**
  * The signing-key multibases of the account's currently enrolled wallet
- * clients, from the locally verified did:webvh log -- the key set a recorded
- * app grant's delegation proof must name to still verify under the
- * current-key-set rule (a grant signed by a since-disconnected client no
- * longer verifies).
+ * clients, from the locally verified did:webvh log, read by the shared
+ * `enrolledClientKeyMultibases` reader (each key is the resolved method's
+ * `publicKeyMultibase`). The app-grant signer check does not take this set:
+ * `deriveGrantSignerState` reads the verified document itself.
  *
- * This is the connected-applications surface's half of the same read: the
- * gating on whether a session HAS a promoted account to check against stays
+ * The gating on whether a session HAS a promoted account to read stays
  * app-side, since only the app knows what a guest or a storage-less session
  * looks like. Throws when the log cannot be fetched or verified; a caller
- * treating the check as best-effort catches and degrades to "unknown" rather
- * than failing its page.
+ * treating the read as best-effort catches and degrades rather than failing
+ * its page.
  *
  * @param options {object}
  * @param options.pointer {AccountLogPointer}
@@ -126,13 +125,12 @@ export declare function currentAccountSigningKeys({ pointer, verifiedLog, accoun
  * the ladder VM is the only key left that can re-sign a record, and a reader
  * that refused it would refuse every other unlock method's record after the
  * transition). The ladder VM is recognized by the relation asymmetry
- * (`ladderVmIds`), never by a marker. Same fetch-or-verified-log contract as
- * its sibling.
+ * (`ladderVmKeyMultibases`) rather than by a marker. Same
+ * fetch-or-verified-log contract as its sibling.
  *
- * Deliberately NOT the app-grant check's key set: an app grant's delegation
- * signer must be an enrolled client (or, from a transient session, the annex
- * key under the generation delegation), and widening that listing to the
- * ladder VM would misread the transition state.
+ * A record-signer allowlist rather than a delegation-signer one: a recorded
+ * grant's signer is read against the document's `capabilityDelegation`
+ * members through `delegationSignerKey`, and this set plays no part in it.
  *
  * @param options {object}
  * @param options.pointer {AccountLogPointer}

package/dist/clients/listing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listing.d.ts","sourceRoot":"","sources":["../../src/clients/listing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAGL,gBAAgB,EAChB,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAA;AAE7E;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,OAAO,CAAA;CACnB;AAsFD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAA;IACpE,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAiB/B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,OAAO,EACP,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CASvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,OAAO,EACP,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAiBvB"}
+{"version":3,"file":"listing.d.ts","sourceRoot":"","sources":["../../src/clients/listing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAIL,gBAAgB,EAChB,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAA;AAE7E;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,OAAO,CAAA;CACnB;AAsFD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAA;IACpE,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAiB/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,OAAO,EACP,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAOvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,OAAO,EACP,WAAW,EACX,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAcvB"}

package/dist/clients/listing.js

@@ -28,8 +28,7 @@
  * re-verifying `did.jsonl` per surface. Whether such a cache is safe to hold,
  * and what invalidates it, is the caller's call.
  */
-import { ladderVmIds, listEnrolledWebvhClients, verifyAccountLog } from '../webvh/index.js';
-import { vmFragmentOf } from '@interop/vh-resource-log';
+import { enrolledClientKeyMultibases, ladderVmKeyMultibases, listEnrolledWebvhClients, verifyAccountLog } from '../webvh/index.js';
 import { signingKeyMultibaseOfDid } from '../connections/didKey.js';
 /**
  * The directory's wallet-client entries keyed by the signing-key multibase
@@ -133,17 +132,16 @@ export async function listAccountClients({ pointer, readDirectoryEntries, ownSig
 }
 /**
  * The signing-key multibases of the account's currently enrolled wallet
- * clients, from the locally verified did:webvh log -- the key set a recorded
- * app grant's delegation proof must name to still verify under the
- * current-key-set rule (a grant signed by a since-disconnected client no
- * longer verifies).
+ * clients, from the locally verified did:webvh log, read by the shared
+ * `enrolledClientKeyMultibases` reader (each key is the resolved method's
+ * `publicKeyMultibase`). The app-grant signer check does not take this set:
+ * `deriveGrantSignerState` reads the verified document itself.
  *
- * This is the connected-applications surface's half of the same read: the
- * gating on whether a session HAS a promoted account to check against stays
+ * The gating on whether a session HAS a promoted account to read stays
  * app-side, since only the app knows what a guest or a storage-less session
  * looks like. Throws when the log cannot be fetched or verified; a caller
- * treating the check as best-effort catches and degrades to "unknown" rather
- * than failing its page.
+ * treating the read as best-effort catches and degrades rather than failing
+ * its page.
  *
  * @param options {object}
  * @param options.pointer {AccountLogPointer}
@@ -154,12 +152,12 @@ export async function listAccountClients({ pointer, readDirectoryEntries, ownSig
  * @returns {Promise<Set<string>>}
  */
 export async function currentAccountSigningKeys({ pointer, verifiedLog, accountLogPinStore }) {
-    const { log } = await resolveVerifiedAccountLog({
+    const { doc } = await resolveVerifiedAccountLog({
         pointer,
         verifiedLog,
         accountLogPinStore
     });
-    return new Set(listEnrolledWebvhClients({ log }).map(client => client.signingKeyMultibase));
+    return enrolledClientKeyMultibases({ doc });
 }
 /**
  * The keys the locally verified document backs as the signer of a RE-MINTED
@@ -172,13 +170,12 @@ export async function currentAccountSigningKeys({ pointer, verifiedLog, accountL
  * the ladder VM is the only key left that can re-sign a record, and a reader
  * that refused it would refuse every other unlock method's record after the
  * transition). The ladder VM is recognized by the relation asymmetry
- * (`ladderVmIds`), never by a marker. Same fetch-or-verified-log contract as
- * its sibling.
+ * (`ladderVmKeyMultibases`) rather than by a marker. Same
+ * fetch-or-verified-log contract as its sibling.
  *
- * Deliberately NOT the app-grant check's key set: an app grant's delegation
- * signer must be an enrolled client (or, from a transient session, the annex
- * key under the generation delegation), and widening that listing to the
- * ladder VM would misread the transition state.
+ * A record-signer allowlist rather than a delegation-signer one: a recorded
+ * grant's signer is read against the document's `capabilityDelegation`
+ * members through `delegationSignerKey`, and this set plays no part in it.
  *
  * @param options {object}
  * @param options.pointer {AccountLogPointer}
@@ -198,11 +195,8 @@ export async function currentAccountRecordSigners({ pointer, verifiedLog, accoun
         pointer,
         verifiedLog: verified
     });
-    for (const id of ladderVmIds({ doc: verified.doc })) {
-        const multibase = vmFragmentOf(id);
-        if (multibase !== undefined) {
-            keys.add(multibase);
-        }
+    for (const key of ladderVmKeyMultibases({ doc: verified.doc })) {
+        keys.add(key);
     }
     return keys;
 }

package/dist/clients/listing.js.map

@@ -1 +1 @@
-{"version":3,"file":"listing.js","sourceRoot":"","sources":["../../src/clients/listing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAuCnE;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,EAChC,OAAO,EAGR;IACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAA;IAChD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC7D,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7D,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,OAAO,CACL,WAAW;QACX,CAAC,MAAM,gBAAgB,CAAC;YACtB,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC,CACJ,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,oBAAoB,EAGrB;IACC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC,EAAE,OAAO,EAAE,MAAM,oBAAoB,EAAE,EAAE,CAAC,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EAOnB;IACC,mEAAmE;IACnE,gEAAgE;IAChE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,yBAAyB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QACvE,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACzC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;QACnD,OAAO;YACL,GAAG,MAAM;YACT,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACtD,SAAS,EAAE,MAAM,CAAC,mBAAmB,KAAK,sBAAsB;SACjE,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC;QAC9C,OAAO;QACP,WAAW;QACX,kBAAkB;KACnB,CAAC,CAAA;IACF,OAAO,IAAI,GAAG,CACZ,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAC5E,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;QAC/C,OAAO;QACP,WAAW;QACX,kBAAkB;KACnB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC;QAC3C,OAAO;QACP,WAAW,EAAE,QAAQ;KACtB,CAAC,CAAA;IACF,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;QAClC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"listing.js","sourceRoot":"","sources":["../../src/clients/listing.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAuCnE;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,EAChC,OAAO,EAGR;IACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAA;IAChD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC7D,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7D,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,OAAO,CACL,WAAW;QACX,CAAC,MAAM,gBAAgB,CAAC;YACtB,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC,CACJ,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAAC,EAC5B,oBAAoB,EAGrB;IACC,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC,EAAE,OAAO,EAAE,MAAM,oBAAoB,EAAE,EAAE,CAAC,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,EACP,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EAOnB;IACC,mEAAmE;IACnE,gEAAgE;IAChE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,yBAAyB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;QACvE,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACzC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;QACnD,OAAO;YACL,GAAG,MAAM;YACT,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACtD,SAAS,EAAE,MAAM,CAAC,mBAAmB,KAAK,sBAAsB;SACjE,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC;QAC9C,OAAO;QACP,WAAW;QACX,kBAAkB;KACnB,CAAC,CAAA;IACF,OAAO,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,OAAO,EACP,WAAW,EACX,kBAAkB,EAKnB;IACC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC;QAC/C,OAAO;QACP,WAAW;QACX,kBAAkB;KACnB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC;QAC3C,OAAO;QACP,WAAW,EAAE,QAAQ;KACtB,CAAC,CAAA;IACF,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACf,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/connections/grantProof.d.ts

@@ -2,30 +2,55 @@ import type { ConnectionZcap } from './entry.js';
 import type { PublishedKeyDocument } from '../webvh/index.js';
 /**
  * Why a recorded grant's proof does not verify as this account's. On the
- * root arm the reasons describe the grant's own proof; on the annex arm they
- * describe the embedded parent's, since that is the proof verified there.
+ * root arm the unprefixed reasons describe the grant's own proof; on the
+ * annex arm they describe the embedded parent's, and the `leaf-` reasons
+ * describe the grant's own proof against the generation's annex document.
  *
  * - `unsigned` -- the proof is absent or names no `verificationMethod`.
  * - `unsupported-suite` -- the proof is not an `eddsa-jcs-2022`
  *   `DataIntegrityProof` for `capabilityDelegation`, the one suite every
  *   delegation this library mints carries.
- * - `signer-unlisted` -- the proof's `verificationMethod` dereferences to no
- *   `capabilityDelegation` member of the current document that publishes a
- *   key (`relationMemberNamed`, then `memberKeyMultibase`: the fragment is an
- *   opaque selector, never read as the key), and it is not the did:key form
- *   of a key the relation publishes: the current-key-set rule.
+ * - `signer-unlisted` -- the proof's `verificationMethod` names no key the
+ *   current document publishes under `capabilityDelegation`
+ *   (`delegationSignerKey`, the one reader every delegation-signer check
+ *   shares: the member's `publicKeyMultibase`, or the did:key form of a key
+ *   the relation publishes): the current-key-set rule.
  * - `signature-invalid` -- the signer is listed, and the signature does not
  *   verify over the capability under the key the document publishes for it.
  * - `parent-not-annex` -- the grant embeds a parent whose `controller` is
  *   not an annex DID in the account's auxiliary Space, or the account points
  *   at no annex generation.
+ * - `leaf-generation-collected` -- the parent verified, and no annex
+ *   document resolves for its generation: the generation was collected.
+ * - `leaf-unsigned`, `leaf-unsupported-suite`, `leaf-signer-unlisted`,
+ *   `leaf-signature-invalid` -- the parent verified, and the leaf's own
+ *   proof fails the same check, read against the generation's annex
+ *   document instead of the account's.
  */
-export type GrantProofRefusal = 'unsigned' | 'unsupported-suite' | 'signer-unlisted' | 'signature-invalid' | 'parent-not-annex';
+export type GrantProofRefusal = DelegationProofRefusal | 'parent-not-annex' | 'leaf-generation-collected' | `leaf-${DelegationProofRefusal}`;
+/**
+ * Why one capability's own delegation proof does not verify against the
+ * document it is read under; the unprefixed half of {@link GrantProofRefusal}.
+ */
+type DelegationProofRefusal = 'unsigned' | 'unsupported-suite' | 'signer-unlisted' | 'signature-invalid';
+/**
+ * Resolves the verified annex document of the generation an annex DID names,
+ * read under that log's chain-head pin, or `undefined` when the generation's
+ * log is absent (collected). The wallet supplies it. The proof check calls
+ * it once per generation per `signerCheck` object, whatever the number of
+ * grants checked under that object, concurrently or not; a wallet therefore
+ * builds one `signerCheck` per renewal pass, since a longer-lived one would
+ * keep serving a generation's document after a GC collected it.
+ */
+export type AnnexDocumentResolver = (options: {
+    clientAnnexDid: string;
+}) => Promise<PublishedKeyDocument | undefined>;
 /**
  * The outcome of {@link verifyRecordedGrantProof}: verified, with the id of
- * the verification method whose signature was checked (the grant's own
- * signer on the root arm, the parent's on the annex arm), or refused with
- * the reason.
+ * the account-listed verification method whose signature was checked (the
+ * grant's own signer on the root arm, the parent's on the annex arm), or
+ * refused with the reason. The annex arm checks the leaf's per-visit signer
+ * too, but only the annex document lists it.
  */
 export type GrantProofResult = {
     verified: true;
@@ -40,9 +65,13 @@ export type GrantProofResult = {
  * parent is verified by its own proof (the root arm); a grant embedding its
  * parent delegation as the last link of its `proof.capabilityChain` is
  * verified by that parent's proof, after the parent's `controller` is found
- * to be an annex DID in the account's auxiliary Space (the annex arm). A
- * refusal says why. The check reads the current document alone, with no log
- * history and no network.
+ * to be an annex DID in the account's auxiliary Space, and then by its own
+ * proof against the annex document the caller resolves for that generation
+ * (the annex arm). A refusal says why. The root arm reads the current
+ * document alone, with no log history and no network; the annex arm's one
+ * read beyond it is the resolver's, made once per generation under one
+ * `signerCheck` object, and what the resolver throws propagates, so a caller
+ * whose annex read fails renews nothing.
  *
  * @param options {object}
  * @param options.zcap {ConnectionZcap}   the recorded capability, verbatim
@@ -52,6 +81,8 @@ export type GrantProofResult = {
  * @param [options.signerCheck.clientAnnexDid] {string}   the annex DID the
  *   document's delegated-clients pointer currently names; absent when it
  *   names none, which refuses every annex-arm grant
+ * @param options.signerCheck.annexDocument {AnnexDocumentResolver}   the
+ *   generation's annex document, for an annex-arm grant's leaf
  * @returns {Promise<GrantProofResult>}
  */
 export declare function verifyRecordedGrantProof({ zcap, signerCheck }: {
@@ -59,6 +90,8 @@ export declare function verifyRecordedGrantProof({ zcap, signerCheck }: {
     signerCheck: {
         doc: PublishedKeyDocument;
         clientAnnexDid?: string;
+        annexDocument: AnnexDocumentResolver;
     };
 }): Promise<GrantProofResult>;
+export {};
 //# sourceMappingURL=grantProof.d.ts.map

package/dist/connections/grantProof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grantProof.d.ts","sourceRoot":"","sources":["../../src/connections/grantProof.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAKhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAG7D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,kBAAkB,CAAA;AAEtB;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAA;AAuJlD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,IAAI,EACJ,WAAW,EACZ,EAAE;IACD,IAAI,EAAE,cAAc,CAAA;IACpB,WAAW,EAAE;QAAE,GAAG,EAAE,oBAAoB,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACpE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiB5B"}
+{"version":3,"file":"grantProof.d.ts","sourceRoot":"","sources":["../../src/connections/grantProof.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAMhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAG7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,iBAAiB,GACzB,sBAAsB,GACtB,kBAAkB,GAClB,2BAA2B,GAC3B,QAAQ,sBAAsB,EAAE,CAAA;AAEpC;;;GAGG;AACH,KAAK,sBAAsB,GACzB,UAAU,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,mBAAmB,CAAA;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE;IAC5C,cAAc,EAAE,MAAM,CAAA;CACvB,KAAK,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;AAE/C;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAA;AA8JlD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,IAAI,EACJ,WAAW,EACZ,EAAE;IACD,IAAI,EAAE,cAAc,CAAA;IACpB,WAAW,EAAE;QACX,GAAG,EAAE,oBAAoB,CAAA;QACzB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,aAAa,EAAE,qBAAqB,CAAA;KACrC,CAAA;CACF,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsC5B"}