@interop/wallet-core 0.107.0 → 0.107.1

package/dist/connections/grantProof.js

@@ -21,20 +21,55 @@
  * `capabilityDelegation` in the current document, and the signature must
  * verify over the capability under that key. A grant a transient session
  * minted chains under the generation delegation embedded as the last link
- * of its `proof.capabilityChain`, and the parent is what is verified: it
+ * of its `proof.capabilityChain`, and both links are verified. The parent
  * must be delegated to an annex DID in the account's auxiliary Space (the
  * Space the account's delegated-clients pointer names, compared by host and
- * Space id, so a grant minted under a generation a later GC collected still
- * passes), and its own proof must verify under a key or ladder VM the
- * current document lists. The leaf's per-visit annex VM is not verified:
- * once its generation is collected its method is gone, and the account
- * document never listed it.
+ * Space id), and its own proof must verify under a key or ladder VM the
+ * current document lists. The leaf is then verified the same way against
+ * the annex document of the parent's generation. The parent alone would not
+ * do: it is genuine and host-held, so a host could copy it under a leaf of
+ * its own naming a planted party. The caller resolves that annex document
+ * (`signerCheck.annexDocument`), since `connections` sits below the annex
+ * and cannot read the log itself; a collected generation resolves to none,
+ * and a grant minted under it is refused.
  */
 import { DataIntegrityProof } from '@interop/data-integrity-proof';
 import { createVerifyCryptosuite } from '@interop/ed25519-signature/eddsa-jcs-2022';
-import { memberKeyMultibase, relationKeyMultibases, relationMemberNamed, vmFragmentOf } from '@interop/vh-resource-log';
-import { embeddedParentCapability, firstDelegationProof } from '../webvh/index.js';
+import { delegationSignerKey, embeddedParentCapability, firstDelegationProof } from '../webvh/index.js';
 import { parseClientAnnexDid } from '../webvh/clientAnnexDid.js';
+/**
+ * The annex documents resolved under each `signerCheck` object, one promise
+ * per generation, so a renewal pass's concurrent grant checks under one
+ * generation share one read of its log. A rejected read is evicted, so a
+ * later check under the same object asks again; the checks in flight share
+ * the rejection.
+ */
+const resolvedAnnexDocuments = new WeakMap();
+/**
+ * The generation's annex document through the `signerCheck`'s resolver,
+ * memoized on the `signerCheck` object.
+ *
+ * @param options {object}
+ * @param options.signerCheck {object}   the object the memo is keyed on
+ * @param options.signerCheck.annexDocument {AnnexDocumentResolver}
+ * @param options.clientAnnexDid {string}   the generation's annex DID
+ * @returns {Promise<PublishedKeyDocument | undefined>}
+ */
+function resolveAnnexDocument({ signerCheck, clientAnnexDid }) {
+    let byGeneration = resolvedAnnexDocuments.get(signerCheck);
+    if (byGeneration === undefined) {
+        byGeneration = new Map();
+        resolvedAnnexDocuments.set(signerCheck, byGeneration);
+    }
+    const pending = byGeneration.get(clientAnnexDid);
+    if (pending !== undefined) {
+        return pending;
+    }
+    const resolving = signerCheck.annexDocument({ clientAnnexDid });
+    byGeneration.set(clientAnnexDid, resolving);
+    resolving.catch(() => byGeneration.delete(clientAnnexDid));
+    return resolving;
+}
 /**
  * The suite every delegation proof this library mints carries, and the one
  * this check verifies.
@@ -45,24 +80,23 @@ const DELEGATION_PROOF_SHAPE = {
     proofPurpose: 'capabilityDelegation'
 };
 /**
- * Verifies one capability's delegation proof against the current document:
- * the signer must stand under `capabilityDelegation`, and the signature must
+ * Verifies one capability's delegation proof against the document its signer
+ * is listed in (the account document, or a generation's annex document for
+ * an annex-arm leaf): the signer must stand under `capabilityDelegation`, and
+ * the signature must
  * verify over the capability under that key. The key material is what the
- * document publishes for the signer, so no resolver is consulted. A proof
- * naming a `capabilityDelegation` member of the document (`${did}#${fragment}`
- * dereferenced through the library's `relationMemberNamed`) verifies under
- * that member's `publicKeyMultibase`; the fragment is an opaque selector and
- * is never read as the key, the rule the library's own log verifier applies.
- * A proof naming the did:key form of a key (`did:key:<key>#<key>`, the form a
- * client signs under) verifies under that key when the relation publishes it.
- * A proof set is read by its first proof, as every other reader of a
- * delegation does.
+ * document publishes for the signer, read through `delegationSignerKey`
+ * (`webvh`), so no resolver is consulted and the renewal check cannot drift
+ * from the revocation and staleness readers over the same document. A proof
+ * set is read by its first proof, as every other reader of a delegation
+ * does.
  *
  * @param options {object}
  * @param options.zcap {IZcap}   the capability, proof included
- * @param options.doc {PublishedKeyDocument}   the locally verified account
- *   document
- * @returns {Promise<GrantProofResult>}
+ * @param options.doc {PublishedKeyDocument}   the locally verified document
+ *   the signer is listed in
+ * @returns {Promise<{ verified: true, signerKeyId: string } | { verified:
+ *   false, reason: DelegationProofRefusal }>}
  */
 async function verifyDelegationProof({ zcap, doc }) {
     const { proof: _proof, ...document } = zcap;
@@ -76,7 +110,7 @@ async function verifyDelegationProof({ zcap, doc }) {
         return { verified: false, reason: 'unsupported-suite' };
     }
     const signerKeyId = single.verificationMethod;
-    const keyMultibase = listedSignerKey({ doc, signerKeyId });
+    const keyMultibase = delegationSignerKey({ doc, signerKeyId });
     if (keyMultibase === undefined) {
         return { verified: false, reason: 'signer-unlisted' };
     }
@@ -108,36 +142,6 @@ async function verifyDelegationProof({ zcap, doc }) {
     }
     return { verified: true, signerKeyId };
 }
-/**
- * The key the document publishes under `capabilityDelegation` for a proof's
- * `verificationMethod` DID URL, or `undefined` when the URL names no listed
- * key. A URL under the document's DID dereferences to the member it names
- * and takes that member's published key. A did:key URL carries its key in
- * the DID itself and must name a key the relation publishes.
- *
- * @param options {object}
- * @param options.doc {PublishedKeyDocument}
- * @param options.signerKeyId {string}   the proof's `verificationMethod`
- * @returns {string | undefined}
- */
-function listedSignerKey({ doc, signerKeyId }) {
-    const hash = signerKeyId.indexOf('#');
-    const fragment = vmFragmentOf(signerKeyId);
-    if (hash === -1 || fragment === undefined) {
-        return undefined;
-    }
-    const did = signerKeyId.slice(0, hash);
-    const relation = 'capabilityDelegation';
-    const member = relationMemberNamed({ doc, relation, did, fragment });
-    if (member !== undefined) {
-        return memberKeyMultibase(member);
-    }
-    if (did === `did:key:${fragment}` &&
-        relationKeyMultibases({ doc, relation }).has(fragment)) {
-        return fragment;
-    }
-    return undefined;
-}
 /**
  * Whether two annex DIDs name the same auxiliary Space: the same host and
  * the same Space id, whatever their generations. A string that is not an
@@ -162,9 +166,13 @@ function sameAuxiliarySpace({ did, other }) {
  * parent is verified by its own proof (the root arm); a grant embedding its
  * parent delegation as the last link of its `proof.capabilityChain` is
  * verified by that parent's proof, after the parent's `controller` is found
- * to be an annex DID in the account's auxiliary Space (the annex arm). A
- * refusal says why. The check reads the current document alone, with no log
- * history and no network.
+ * to be an annex DID in the account's auxiliary Space, and then by its own
+ * proof against the annex document the caller resolves for that generation
+ * (the annex arm). A refusal says why. The root arm reads the current
+ * document alone, with no log history and no network; the annex arm's one
+ * read beyond it is the resolver's, made once per generation under one
+ * `signerCheck` object, and what the resolver throws propagates, so a caller
+ * whose annex read fails renews nothing.
  *
  * @param options {object}
  * @param options.zcap {ConnectionZcap}   the recorded capability, verbatim
@@ -174,6 +182,8 @@ function sameAuxiliarySpace({ did, other }) {
  * @param [options.signerCheck.clientAnnexDid] {string}   the annex DID the
  *   document's delegated-clients pointer currently names; absent when it
  *   names none, which refuses every annex-arm grant
+ * @param options.signerCheck.annexDocument {AnnexDocumentResolver}   the
+ *   generation's annex document, for an annex-arm grant's leaf
  * @returns {Promise<GrantProofResult>}
  */
 export async function verifyRecordedGrantProof({ zcap, signerCheck }) {
@@ -190,6 +200,27 @@ export async function verifyRecordedGrantProof({ zcap, signerCheck }) {
         !sameAuxiliarySpace({ did: controller, other: signerCheck.clientAnnexDid })) {
         return { verified: false, reason: 'parent-not-annex' };
     }
-    return verifyDelegationProof({ zcap: parent, doc: signerCheck.doc });
+    const parentResult = await verifyDelegationProof({
+        zcap: parent,
+        doc: signerCheck.doc
+    });
+    if (!parentResult.verified) {
+        return parentResult;
+    }
+    const generationDoc = await resolveAnnexDocument({
+        signerCheck,
+        clientAnnexDid: controller
+    });
+    if (generationDoc === undefined) {
+        return { verified: false, reason: 'leaf-generation-collected' };
+    }
+    const leaf = await verifyDelegationProof({
+        zcap: zcap,
+        doc: generationDoc
+    });
+    if (leaf.verified) {
+        return parentResult;
+    }
+    return { verified: false, reason: `leaf-${leaf.reason}` };
 }
 //# sourceMappingURL=grantProof.js.map

package/dist/connections/grantProof.js.map

@@ -1 +1 @@
-{"version":3,"file":"grantProof.js","sourceRoot":"","sources":["../../src/connections/grantProof.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAA;AACnF,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAuChE;;;GAGG;AACH,MAAM,sBAAsB,GAAG;IAC7B,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,sBAAsB;CAC5B,CAAA;AAEV;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,qBAAqB,CAAC,EACnC,IAAI,EACJ,GAAG,EAIJ;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,IAA2B,CAAA;IAClE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAChD,CAAC;IACD,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB,CAAC,IAAI;QAC3C,MAAM,CAAC,WAAW,KAAK,sBAAsB,CAAC,WAAW;QACzD,MAAM,CAAC,YAAY,KAAK,sBAAsB,CAAC,YAAY,EAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACzD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAA;IAC7C,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC;QACnC,WAAW,EAAE,uBAAuB,EAAE;KACvC,CAAC,CAAA;IACF,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;QACrC,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;QACnC,cAAc,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE;YACpC,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAA;YACxD,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,GAAG;gBAChB,QAAQ,EAAE;oBACR,EAAE,EAAE,WAAW;oBACf,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC1D,kBAAkB,EAAE,YAAY;iBACjC;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,EACvB,GAAG,EACH,WAAW,EAIZ;IACC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IAC1C,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,sBAAsB,CAAA;IACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IACD,IACE,GAAG,KAAK,WAAW,QAAQ,EAAE;QAC7B,qBAAqB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EACtD,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,EAC1B,GAAG,EACH,KAAK,EAIN;IACC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC7C,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,UAAU,KAAK,SAAS;QACxB,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;QAC9B,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CACrC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,IAAI,EACJ,WAAW,EAIZ;IACC,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAwB,CAAC,CAAA;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,qBAAqB,CAAC;YAC3B,IAAI,EAAE,IAAwB;YAC9B,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAkC,CAAA;IACzD,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,WAAW,CAAC,cAAc,KAAK,SAAS;QACxC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,EAC3E,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACxD,CAAC;IACD,OAAO,qBAAqB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAA;AACtE,CAAC"}
+{"version":3,"file":"grantProof.js","sourceRoot":"","sources":["../../src/connections/grantProof.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAA;AAGnF,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAkEhE;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAGvC,CAAA;AAEH;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,EAC5B,WAAW,EACX,cAAc,EAIf;IACC,IAAI,YAAY,GAAG,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,YAAY,GAAG,IAAI,GAAG,EAAE,CAAA;QACxB,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;IAC/D,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAA;IAC3C,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;IAC1D,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAAG;IAC7B,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,gBAAgB;IAC7B,YAAY,EAAE,sBAAsB;CAC5B,CAAA;AAEV;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,qBAAqB,CAAC,EACnC,IAAI,EACJ,GAAG,EAIJ;IAIC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,IAA2B,CAAA;IAClE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAChD,CAAC;IACD,IACE,MAAM,CAAC,IAAI,KAAK,sBAAsB,CAAC,IAAI;QAC3C,MAAM,CAAC,WAAW,KAAK,sBAAsB,CAAC,WAAW;QACzD,MAAM,CAAC,YAAY,KAAK,sBAAsB,CAAC,YAAY,EAC3D,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACzD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAA;IAC7C,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAC9D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC;QACnC,WAAW,EAAE,uBAAuB,EAAE;KACvC,CAAC,CAAA;IACF,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;QACrC,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;QACnC,cAAc,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE;YACpC,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAAA;YACxD,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,GAAG;gBAChB,QAAQ,EAAE;oBACR,EAAE,EAAE,WAAW;oBACf,IAAI,EAAE,UAAU;oBAChB,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC1D,kBAAkB,EAAE,YAAY;iBACjC;aACF,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,EAC1B,GAAG,EACH,KAAK,EAIN;IACC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC7C,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,UAAU,KAAK,SAAS;QACxB,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;QAC9B,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CACrC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,IAAI,EACJ,WAAW,EAQZ;IACC,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAwB,CAAC,CAAA;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,qBAAqB,CAAC;YAC3B,IAAI,EAAE,IAAwB;YAC9B,GAAG,EAAE,WAAW,CAAC,GAAG;SACrB,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAkC,CAAA;IACzD,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,WAAW,CAAC,cAAc,KAAK,SAAS;QACxC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC,EAC3E,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACxD,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC;QAC/C,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,WAAW,CAAC,GAAG;KACrB,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC;QAC/C,WAAW;QACX,cAAc,EAAE,UAAU;KAC3B,CAAC,CAAA;IACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC;QACvC,IAAI,EAAE,IAAwB;QAC9B,GAAG,EAAE,aAAa;KACnB,CAAC,CAAA;IACF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAA;AAC3D,CAAC"}

package/dist/connections/grants.d.ts

@@ -319,16 +319,28 @@ export declare function agentGrantDue({ zcap, pointedDelegationId, doc, renewalW
  * parent) counts when its own proof names the key. A grant with an embedded
  * parent counts when the parent's proof names the key, the parent's minter.
  *
+ * This is an attribution read, so it has to work after the withdrawing
+ * edit has landed as well as before it (a torn ceremony's sweep holds only
+ * the post-edit document). A grant counts when its proof's method id and the
+ * given `keyId` name one signer under `sameSigner` (`webvh`): the same id
+ * verbatim, or the same named key. An id the document no longer publishes
+ * still matches the grants signed under that exact id. To reach a grant
+ * signed under the did:key form of a struck key once the edit has landed,
+ * hand the key as a bare multibase too.
+ *
  * @param options {object}
  * @param options.entries {ConnectionEntry[]}
  * @param options.keyId {string}   a verification-method id in either DID
  *   form, or a bare multibase
  * @param options.spaceUrl {string}   this Space's container URL
+ * @param options.doc {PublishedKeyDocument}   the locally verified account
+ *   document, before or after the key is withdrawn
  * @returns {ConnectionEntry[]}
  */
-export declare function agentConnectionsSignedBy({ entries, keyId, spaceUrl }: {
+export declare function agentConnectionsSignedBy({ entries, keyId, spaceUrl, doc }: {
     entries: ConnectionEntry[];
     keyId: string;
     spaceUrl: string;
+    doc: PublishedKeyDocument;
 }): ConnectionEntry[];
 //# sourceMappingURL=grants.d.ts.map

package/dist/connections/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAQ5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAA2B,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAaV;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EACT,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,eAAe,EAAE,CAuBpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,MAAM,GAAG,SAAS,CAcrB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACP,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;CAC1B,GAAG,MAAM,EAAE,CAEX;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAgB,EACjB,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,GAAG;IAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CAAE,CAW1D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,MAAM,GAAG,SAAS,CAErB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,EAC3B,aAAa,EACb,MAAM,EACP,EAAE;IACD,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAEV;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,aAAa,EACd,EAAE;IACD,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAClC,GAAG,MAAM,EAAE,CAQX;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG,MAAM,CAMxE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,EAC7B,KAAK,EACL,WAAW,EACX,QAAQ,EACT,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,uBAAuB,EAAE,CA+B5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,KAAK,EACL,GAAG,EACH,aAAa,EACd,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,GAAG,YAAY,CAAC,CAAA;IAC9D,GAAG,EAAE,IAAI,CAAA;IACT,aAAa,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,GAAG,EACH,aAAa,EACd,EAAE;IACD,MAAM,EAAE,uBAAuB,EAAE,CAAA;IACjC,GAAG,EAAE,IAAI,CAAA;IACT,aAAa,EAAE,MAAM,CAAA;CACtB,GAAG,uBAAuB,GAAG,SAAS,CAiBtC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;CAC1B,GAAG,eAAe,EAAE,CAGpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,cAAc,EAAE,CAAA;CACxB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CActB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,eAAe,EAAE,CA0BpB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,aAAa,CAAC,EAC5B,IAAI,EACJ,mBAAmB,EACnB,GAAG,EACH,eAA+C,EAC/C,GAAgB,EACjB,EAAE;IACD,IAAI,EAAE,cAAc,CAAA;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,GAAG,EAAE,oBAAoB,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAeV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,KAAK,EACL,QAAQ,EACT,EAAE;IACD,OAAO,EAAE,eAAe,EAAE,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,eAAe,EAAE,CAmBpB"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAU5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAA2B,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAaV;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EACT,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,eAAe,EAAE,CAuBpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,MAAM,GAAG,SAAS,CAcrB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACP,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;CAC1B,GAAG,MAAM,EAAE,CAEX;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAgB,EACjB,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,GAAG;IAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CAAE,CAW1D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,MAAM,GAAG,SAAS,CAErB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,EAC3B,aAAa,EACb,MAAM,EACP,EAAE;IACD,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAEV;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,aAAa,EACd,EAAE;IACD,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAClC,GAAG,MAAM,EAAE,CAQX;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG,MAAM,CAMxE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,EAC7B,KAAK,EACL,WAAW,EACX,QAAQ,EACT,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,uBAAuB,EAAE,CA+B5B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,KAAK,EACL,GAAG,EACH,aAAa,EACd,EAAE;IACD,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,GAAG,YAAY,CAAC,CAAA;IAC9D,GAAG,EAAE,IAAI,CAAA;IACT,aAAa,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,GAAG,EACH,aAAa,EACd,EAAE;IACD,MAAM,EAAE,uBAAuB,EAAE,CAAA;IACjC,GAAG,EAAE,IAAI,CAAA;IACT,aAAa,EAAE,MAAM,CAAA;CACtB,GAAG,uBAAuB,GAAG,SAAS,CAiBtC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;CAC1B,GAAG,eAAe,EAAE,CAGpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,cAAc,EAAE,CAAA;CACxB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CActB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,eAAe,EAAE,CA0BpB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,aAAa,CAAC,EAC5B,IAAI,EACJ,mBAAmB,EACnB,GAAG,EACH,eAA+C,EAC/C,GAAgB,EACjB,EAAE;IACD,IAAI,EAAE,cAAc,CAAA;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,GAAG,EAAE,oBAAoB,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAeV;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,KAAK,EACL,QAAQ,EACR,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,eAAe,EAAE,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,oBAAoB,CAAA;CAC1B,GAAG,eAAe,EAAE,CAmBpB"}

package/dist/connections/grants.js

@@ -1,29 +1,7 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The grant index the revocation orchestrators share: the grants of one
- * entry that pass the reader checks, their targets, the live and expired
- * split, and the recipient kid a grant's controller derives.
- *
- * Every reader applies the same two checks, since the storage host can plant
- * an entry and also holds every capability a party ever invoked. A grant
- * whose `zcap.controller` is not the entry's `id` is dropped, so an entry at
- * one party's id cannot steer a revocation at another party's capabilities.
- * A grant whose `zcap.invocationTarget` is not under this Space's container
- * URL is dropped, so no reader acts on a capability over another Space.
- *
- * The agent-connection readers sit beside them: the received list (the
- * capabilities an agent handed the wallet, over targets outside this Space),
- * the live inbox channel, the latest grant per scope, the grants one
- * connection request's consent produced, the agent grant renewal predicate,
- * and the agent entries one key signed grants for.
- */
-import { vmFragmentOf } from '@interop/vh-resource-log';
 import { connectionRecipientKid } from './didKey.js';
 import { grantKindOf } from './entry.js';
 import { INBOX_COLLECTION } from '../space/collections.js';
-import { delegationProofKeyId, delegationSignerGone, embeddedParentCapability, zcapExpiring } from '../webvh/index.js';
+import { delegationProofKeyId, delegationSignerGone, delegationSignerKeyReader, embeddedParentCapability, sameSigner, zcapExpiring } from '../webvh/index.js';
 /**
  * The agent grant renewal window: ninety days before its `expires`, a grant
  * to an agent is due for renewal. Distinct from the thirty-day window the
@@ -410,19 +388,30 @@ export function agentGrantDue({ zcap, pointedDelegationId, doc, renewalWindowMs
  * parent) counts when its own proof names the key. A grant with an embedded
  * parent counts when the parent's proof names the key, the parent's minter.
  *
+ * This is an attribution read, so it has to work after the withdrawing
+ * edit has landed as well as before it (a torn ceremony's sweep holds only
+ * the post-edit document). A grant counts when its proof's method id and the
+ * given `keyId` name one signer under `sameSigner` (`webvh`): the same id
+ * verbatim, or the same named key. An id the document no longer publishes
+ * still matches the grants signed under that exact id. To reach a grant
+ * signed under the did:key form of a struck key once the edit has landed,
+ * hand the key as a bare multibase too.
+ *
  * @param options {object}
  * @param options.entries {ConnectionEntry[]}
  * @param options.keyId {string}   a verification-method id in either DID
  *   form, or a bare multibase
  * @param options.spaceUrl {string}   this Space's container URL
+ * @param options.doc {PublishedKeyDocument}   the locally verified account
+ *   document, before or after the key is withdrawn
  * @returns {ConnectionEntry[]}
  */
-export function agentConnectionsSignedBy({ entries, keyId, spaceUrl }) {
-    const key = vmFragmentOf(keyId) ?? keyId;
+export function agentConnectionsSignedBy({ entries, keyId, spaceUrl, doc }) {
+    const signerKey = delegationSignerKeyReader({ doc });
     const signedBy = (zcap) => {
         const proofKeyId = delegationProofKeyId(zcap);
         return (proofKeyId !== undefined &&
-            (vmFragmentOf(proofKeyId) ?? proofKeyId) === key);
+            sameSigner({ signerId: proofKeyId, otherId: keyId, signerKey }));
     };
     return entries.filter(entry => entry.kind === 'agent' &&
         entry.retired === undefined &&

package/dist/connections/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAG1B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA6BrE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,iDAAiD,QAAQ,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EAIT;IACC,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;QACtB,IACE,KAAK,CAAC,EAAE,KAAK,SAAS;YACtB,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE;YAC5B,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC7D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,MAAM,EAGP;IACC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAIjB;IACC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EAGN;IACC,OAAO,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;AAC1D,CAAC;AAiCD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,aAAa,EACb,MAAM,EAIP;IACC,OAAO,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,aAAa,EAGd;IACC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,CAAC,aAAa,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,IAAI,EAA4B;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,gBAAgB;QACrB,iBAAiB,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;KACzD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,KAAK,EACL,WAAW,EACX,QAAQ,EAKT;IACC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAA8B,EAAE,CAAA;IAC5C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;QACvB,IACE,IAAI,CAAC,UAAU,KAAK,WAAW;YAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC5D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IACE,MAAM,CAAC,SAAS,KAAK,OAAO;YAC5B,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACpE,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,KAAK,EACL,GAAG,EACH,aAAa,EAKd;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,UAAU,GAAG,aAAa,EAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1B,CAAA;IACD,OAAO,QAAQ,IAAI,GAAG,CAAC,OAAO,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,MAAM,EACN,GAAG,EACH,aAAa,EAKd;IACC,IAAI,IAAyC,CAAA;IAC7C,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAA;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,KAAK,CAAC,SAAS,KAAK,OAAO;YAC3B,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAClD,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YACnD,IAAI,GAAG,KAAK,CAAA;YACZ,WAAW,GAAG,SAAS,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9E,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,KAAK,EAGN;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC9B,IACE,IAAI,KAAK,SAAS;YAClB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,OAAO,CAAC,EAC5D,CAAC;YACD,kEAAkE;YAClE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,MAAM,EACN,QAAQ,EAIT;IACC,MAAM,SAAS,GAAG,CAAC,KAAsB,EAAU,EAAE,CACnD,iBAAiB,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,MAAM,iBAAiB,GAAG,CAAC,KAAsB,EAAW,EAAE,CAC5D,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,gBAAgB,CAAA;IAC9E,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,MAAM;SACH,MAAM,CACL,KAAK,CAAC,EAAE,CACN,iBAAiB,CAAC,KAAK,CAAC;QACxB,YAAY,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACvE;SACA,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CACjC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,OAAO,CACL,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,SAAS,CACtE,CAAA;QACH,CAAC;QACD,OAAO,OAAO,KAAK,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,IAAI,EACJ,mBAAmB,EACnB,GAAG,EACH,eAAe,GAAG,6BAA6B,EAC/C,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAOjB;IACC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;QACpC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAwB,CAAC,CAAA;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,CACL,MAAM,CAAC,EAAE,KAAK,mBAAmB;QACjC,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC7C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,OAAO,EACP,KAAK,EACL,QAAQ,EAKT;IACC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;IACxC,MAAM,QAAQ,GAAG,CAAC,IAAW,EAAW,EAAE;QACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;QAC7C,OAAO,CACL,UAAU,KAAK,SAAS;YACxB,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,GAAG,CACjD,CAAA;IACH,CAAC,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,IAAI,KAAK,OAAO;QACtB,KAAK,CAAC,OAAO,KAAK,SAAS;QAC3B,gBAAgB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAwB,CAAA;YAC3C,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;YAC7C,OAAO,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;QACjC,CAAC,CAAC,CACL,CAAA;AACH,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,EACxB,UAAU,EACV,YAAY,EACb,MAAM,mBAAmB,CAAA;AAG1B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA6BrE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,iDAAiD,QAAQ,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EAIT;IACC,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;QACtB,IACE,KAAK,CAAC,EAAE,KAAK,SAAS;YACtB,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE;YAC5B,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC7D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,MAAM,EAGP;IACC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAIjB;IACC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EAGN;IACC,OAAO,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;AAC1D,CAAC;AAiCD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,aAAa,EACb,MAAM,EAIP;IACC,OAAO,iBAAiB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,aAAa,EAGd;IACC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,CAAC,aAAa,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,IAAI,EAA4B;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,CAAC,UAAU;QACf,IAAI,CAAC,gBAAgB;QACrB,iBAAiB,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;KACzD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,KAAK,EACL,WAAW,EACX,QAAQ,EAKT;IACC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAA8B,EAAE,CAAA;IAC5C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;QACvB,IACE,IAAI,CAAC,UAAU,KAAK,WAAW;YAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC5D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IACE,MAAM,CAAC,SAAS,KAAK,OAAO;YAC5B,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EACpE,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,KAAK,EACL,GAAG,EACH,aAAa,EAKd;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,UAAU,GAAG,aAAa,EAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1B,CAAA;IACD,OAAO,QAAQ,IAAI,GAAG,CAAC,OAAO,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,MAAM,EACN,GAAG,EACH,aAAa,EAKd;IACC,IAAI,IAAyC,CAAA;IAC7C,IAAI,WAAW,GAAG,MAAM,CAAC,iBAAiB,CAAA;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,KAAK,CAAC,SAAS,KAAK,OAAO;YAC3B,mBAAmB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAClD,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YACnD,IAAI,GAAG,KAAK,CAAA;YACZ,WAAW,GAAG,SAAS,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9E,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,KAAK,EAGN;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC9B,IACE,IAAI,KAAK,SAAS;YAClB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,OAAO,CAAC,EAC5D,CAAC;YACD,kEAAkE;YAClE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,MAAM,EACN,QAAQ,EAIT;IACC,MAAM,SAAS,GAAG,CAAC,KAAsB,EAAU,EAAE,CACnD,iBAAiB,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,MAAM,iBAAiB,GAAG,CAAC,KAAsB,EAAW,EAAE,CAC5D,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,gBAAgB,CAAA;IAC9E,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,MAAM;SACH,MAAM,CACL,KAAK,CAAC,EAAE,CACN,iBAAiB,CAAC,KAAK,CAAC;QACxB,YAAY,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACvE;SACA,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CACjC,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,OAAO,CACL,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,SAAS,CACtE,CAAA;QACH,CAAC;QACD,OAAO,OAAO,KAAK,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,IAAI,EACJ,mBAAmB,EACnB,GAAG,EACH,eAAe,GAAG,6BAA6B,EAC/C,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAOjB;IACC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC;QACpC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAwB,CAAC,CAAA;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,CACL,MAAM,CAAC,EAAE,KAAK,mBAAmB;QACjC,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC7C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,OAAO,EACP,KAAK,EACL,QAAQ,EACR,GAAG,EAMJ;IACC,MAAM,SAAS,GAAG,yBAAyB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,CAAC,IAAW,EAAW,EAAE;QACxC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;QAC7C,OAAO,CACL,UAAU,KAAK,SAAS;YACxB,UAAU,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAChE,CAAA;IACH,CAAC,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,IAAI,KAAK,OAAO;QACtB,KAAK,CAAC,OAAO,KAAK,SAAS;QAC3B,gBAAgB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACjD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAwB,CAAA;YAC3C,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;YAC7C,OAAO,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;QACjC,CAAC,CAAC,CACL,CAAA;AACH,CAAC"}

package/dist/connections/index.d.ts

@@ -29,8 +29,9 @@
  *   `markDeclined`).
  * - The proof check a renewal runs over a recorded grant
  *   (`verifyRecordedGrantProof`), which verifies the delegation signature
- *   under a key the current document lists, and the action-set readers
- *   (`allowsAction`, `normalizedActions`).
+ *   under a key the current document lists, and an annex-signed grant's
+ *   leaf under the generation's annex document the caller resolves, and
+ *   the action-set readers (`allowsAction`, `normalizedActions`).
  * - The writer arm: lazy registration (`registerConnectionWriter`), the
  *   pull-path touch (`touchConnectionWriter`), the per-entry sweep
  *   (`sweepConnectionWriters`), and `resolveWriter` for history views.
@@ -49,7 +50,7 @@ export type { ConnectionsListing, ReadConnection } from './read.js';
 export { AGENT_GRANT_RENEWAL_WINDOW_MS, agentConnectionsSignedBy, agentGrantDue, allowsAction, collectionIdInSpace, connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, grantScopeKey, latestGrantsPerScope, latestIndexPerScope, liveInboxChannel, normalizedActions, receivedGrantLapsed, receivedGrants, renewalScopeGrants, splitGrantsByExpiry } from './grants.js';
 export type { ConnectionGrant, ConnectionReceivedGrant } from './grants.js';
 export { verifyRecordedGrantProof } from './grantProof.js';
-export type { GrantProofRefusal, GrantProofResult } from './grantProof.js';
+export type { AnnexDocumentResolver, GrantProofRefusal, GrantProofResult } from './grantProof.js';
 export { connectionDidKey, connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
 export { ConnectionKindMismatchError } from './errors.js';
 export { clearReceivedGrants, dropReceivedGrant, markDeclined, pruneSupersededGrants, recordGrants, recordReceivedGrants, recordRenewedGrants, removeGrants, retireConnection, setConnectionLabel, settleOutboxItem, unretireConnection } from './upsert.js';

package/dist/connections/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACT,iBAAiB,EAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACT,iBAAiB,EAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAC1D,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/connections/index.js

@@ -29,8 +29,9 @@
  *   `markDeclined`).
  * - The proof check a renewal runs over a recorded grant
  *   (`verifyRecordedGrantProof`), which verifies the delegation signature
- *   under a key the current document lists, and the action-set readers
- *   (`allowsAction`, `normalizedActions`).
+ *   under a key the current document lists, and an annex-signed grant's
+ *   leaf under the generation's annex document the caller resolves, and
+ *   the action-set readers (`allowsAction`, `normalizedActions`).
  * - The writer arm: lazy registration (`registerConnectionWriter`), the
  *   pull-path touch (`touchConnectionWriter`), the per-entry sweep
  *   (`sweepConnectionWriters`), and `resolveWriter` for history views.

package/dist/connections/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAanB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE1D,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAanB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAM1D,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/testing/signerFixture.d.ts

@@ -37,9 +37,9 @@ export declare const ENROLLED_SIGNER: string;
 export declare const LADDER_SIGNER: string;
 export declare const GONE_SIGNER: string;
 /**
- * A fresh {@link AccountSignerCheck} over {@link SIGNER_FIXTURE}: the
- * enrolled key as the one current signing key, both VMs published under
- * `capabilityDelegation`, and the pointer naming the current annex DID.
+ * A fresh {@link AccountSignerCheck} over {@link SIGNER_FIXTURE}: both VMs
+ * published under `capabilityDelegation`, and the pointer naming the current
+ * annex DID.
  *
  * @returns {AccountSignerCheck}
  */

package/dist/testing/signerFixture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signerFixture.d.ts","sourceRoot":"","sources":["../../src/testing/signerFixture.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;CAQjB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,eAAe,QAA+D,CAAA;AAC3F,eAAO,MAAM,aAAa,QAA4D,CAAA;AACtF,eAAO,MAAM,WAAW,QAA0C,CAAA;AAElE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,kBAAkB,CAcvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,EAC5B,EAAmB,EACnB,UAAkC,EAClC,gBAAoE,EACpE,OAAgC,EAChC,WAAW,EACX,MAAM,EACP,GAAE;IACD,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD,GAAG,KAAK,CAuBb"}
+{"version":3,"file":"signerFixture.d.ts","sourceRoot":"","sources":["../../src/testing/signerFixture.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;CAQjB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,eAAe,QAA+D,CAAA;AAC3F,eAAO,MAAM,aAAa,QAA4D,CAAA;AACtF,eAAO,MAAM,WAAW,QAA0C,CAAA;AAElE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,kBAAkB,CAgBvD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAAC,EAC5B,EAAmB,EACnB,UAAkC,EAClC,gBAAoE,EACpE,OAAgC,EAChC,WAAW,EACX,MAAM,EACP,GAAE;IACD,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD,GAAG,KAAK,CAuBb"}

package/dist/testing/signerFixture.js

@@ -21,9 +21,9 @@ export const ENROLLED_SIGNER = `${SIGNER_FIXTURE.accountDid}#${SIGNER_FIXTURE.en
 export const LADDER_SIGNER = `${SIGNER_FIXTURE.accountDid}#${SIGNER_FIXTURE.ladderVm}`;
 export const GONE_SIGNER = `${SIGNER_FIXTURE.accountDid}#z6MkGone`;
 /**
- * A fresh {@link AccountSignerCheck} over {@link SIGNER_FIXTURE}: the
- * enrolled key as the one current signing key, both VMs published under
- * `capabilityDelegation`, and the pointer naming the current annex DID.
+ * A fresh {@link AccountSignerCheck} over {@link SIGNER_FIXTURE}: both VMs
+ * published under `capabilityDelegation`, and the pointer naming the current
+ * annex DID.
  *
  * @returns {AccountSignerCheck}
  */
@@ -31,7 +31,6 @@ export function accountSignerCheck() {
     const { accountDid, enrolledKey, ladderVm, annexDid } = SIGNER_FIXTURE;
     return {
         accountDid,
-        currentSigningKeys: new Set([enrolledKey]),
         doc: {
             verificationMethod: [
                 { id: ENROLLED_SIGNER, publicKeyMultibase: enrolledKey },
@@ -39,7 +38,10 @@ export function accountSignerCheck() {
             ],
             capabilityDelegation: [ENROLLED_SIGNER, LADDER_SIGNER]
         },
-        clientAnnexDid: annexDid
+        clientAnnexDid: annexDid,
+        // The revocation reading never resolves the annex; the proof check's
+        // own tests build the generation documents they need.
+        annexDocument: async () => undefined
     };
 }
 /**

package/dist/testing/signerFixture.js.map

@@ -1 +1 @@
-{"version":3,"file":"signerFixture.js","sourceRoot":"","sources":["../../src/testing/signerFixture.ts"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,oBAAoB;IACjC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,yDAAyD;IACnE,WAAW,EAAE,yDAAyD;IACtE,IAAI,EAAE,qDAAqD;IAC3D,MAAM,EAAE,wBAAwB;CACxB,CAAA;AAEV;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,WAAW,EAAE,CAAA;AAC3F,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAA;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,cAAc,CAAC,UAAU,WAAW,CAAA;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAA;IACtE,OAAO;QACL,UAAU;QACV,kBAAkB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1C,GAAG,EAAE;YACH,kBAAkB,EAAE;gBAClB,EAAE,EAAE,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE;gBACxD,EAAE,EAAE,EAAE,aAAa,EAAE,kBAAkB,EAAE,QAAQ,EAAE;aACpD;YACD,oBAAoB,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC;SACvD;QACD,cAAc,EAAE,QAAQ;KACzB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,EAAE,GAAG,cAAc,EACnB,UAAU,GAAG,cAAc,CAAC,MAAM,EAClC,gBAAgB,GAAG,iDAAiD,EACpE,OAAO,GAAG,sBAAsB,EAChC,WAAW,EACX,MAAM,KAQJ,EAAE;IACJ,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAA;IAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI;QACzB,EAAE,EAAE,+BAA+B;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,gBAAgB,EAAE,IAAI;QACtB,GAAG,CAAC,MAAM,CAAC,WAAW;YACpB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,OAAO;QACL,UAAU,EAAE,CAAC,0BAA0B,CAAC;QACxC,EAAE;QACF,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC/C,UAAU;QACV,gBAAgB;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QAC9B,OAAO;QACP,KAAK,EAAE;YACL,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D;KACkB,CAAA;AACvB,CAAC"}
+{"version":3,"file":"signerFixture.js","sourceRoot":"","sources":["../../src/testing/signerFixture.ts"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,oBAAoB;IACjC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,yDAAyD;IACnE,WAAW,EAAE,yDAAyD;IACtE,IAAI,EAAE,qDAAqD;IAC3D,MAAM,EAAE,wBAAwB;CACxB,CAAA;AAEV;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,WAAW,EAAE,CAAA;AAC3F,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,cAAc,CAAC,UAAU,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAA;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,cAAc,CAAC,UAAU,WAAW,CAAA;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAA;IACtE,OAAO;QACL,UAAU;QACV,GAAG,EAAE;YACH,kBAAkB,EAAE;gBAClB,EAAE,EAAE,EAAE,eAAe,EAAE,kBAAkB,EAAE,WAAW,EAAE;gBACxD,EAAE,EAAE,EAAE,aAAa,EAAE,kBAAkB,EAAE,QAAQ,EAAE;aACpD;YACD,oBAAoB,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC;SACvD;QACD,cAAc,EAAE,QAAQ;QACxB,qEAAqE;QACrE,sDAAsD;QACtD,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;KACrC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,EAAE,GAAG,cAAc,EACnB,UAAU,GAAG,cAAc,CAAC,MAAM,EAClC,gBAAgB,GAAG,iDAAiD,EACpE,OAAO,GAAG,sBAAsB,EAChC,WAAW,EACX,MAAM,KAQJ,EAAE;IACJ,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,CAAA;IAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI;QACzB,EAAE,EAAE,+BAA+B;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,gBAAgB,EAAE,IAAI;QACtB,GAAG,CAAC,MAAM,CAAC,WAAW;YACpB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,OAAO;QACL,UAAU,EAAE,CAAC,0BAA0B,CAAC;QACxC,EAAE;QACF,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAC/C,UAAU;QACV,gBAAgB;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QAC9B,OAAO;QACP,KAAK,EAAE;YACL,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D;KACkB,CAAA;AACvB,CAAC"}

package/dist/webvh/index.d.ts

@@ -45,10 +45,17 @@
  *   no-pad, over a key-agreement key's decoded multikey bytes, and the
  *   decode-based check that verifies a candidate key against a published
  *   commitment.
- * - `delegationKeyInDocument` -- the current-key-set rule for one recorded
- *   delegation: does the document still list the key that signed it under
- *   `capabilityDelegation` (a key kept under another relation alone does not
- *   count, and a missing key id reads as "cannot be checked", so: no).
+ * - `delegationSignerKey` / `delegationSignerKeyReader` /
+ *   `delegationKeyInDocument` -- the one reader of a delegation signer's
+ *   published key (and its memoized form over one document), and the
+ *   current-key-set rule for one recorded delegation: does the document
+ *   still list the key that signed it under `capabilityDelegation` (a key
+ *   kept under another relation alone does not count, and a missing key id
+ *   reads as "cannot be checked", so: no). `signerKeyNamed`, `sameSigner`,
+ *   and `didKeyMultibase` are the attribution-side readings beside it: the
+ *   key an id names for "who signed this", which a did:key id carries by
+ *   spec whether or not the document still lists it, and whether two ids
+ *   name one signer (the same id, or the same named key).
  * - `standingZcapStale` / `recordedZcapStale` -- the composed house staleness
  *   rule every re-mint pass and renewal stage asks (expiry, signer death, and
  *   the caller's retiring set), over a delegation in hand or over the
@@ -104,8 +111,8 @@ export { didWebProjectionCurrent, ensureDidWebProjection, putDidWebProjection }
 export { delegatedWebvhLogStore } from './delegatedLogStore.js';
 export type { DelegatedWebvhLogStore } from './delegatedLogStore.js';
 export { delegationAtExpiry, delegationExpired, delegationProofKeyId, delegationSignerGone, recordedZcapStale, REVOCATION_CLOCK_SKEW_MS, STANDING_ZCAP_TTL_MS, standingZcapStale, embeddedParentCapability, firstDelegationProof, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './standingZcap.js';
-export { attributeClientUpdateKey, delegationKeyInDocument, documentKeyMultibases, enrolledClientVmIds, isLastEnrolledClient, listEnrolledWebvhClients, markedKeyAgreementMethods, markedKeyAgreementMultibases } from './listClients.js';
-export type { EnrolledWebvhClient, PublishedKeyDocument } from './listClients.js';
+export { attributeClientUpdateKey, delegationKeyInDocument, delegationSignerKey, delegationSignerKeyReader, didKeyMultibase, documentKeyMultibases, sameSigner, signerKeyNamed, enrolledClientVmIds, isLastEnrolledClient, listEnrolledWebvhClients, markedKeyAgreementMethods, markedKeyAgreementMultibases } from './listClients.js';
+export type { EnrolledWebvhClient, DelegationSignerReader, PublishedKeyDocument } from './listClients.js';
 export { mergeVerificationMethods } from './mergeMethods.js';
 export { accountLogDids, walletClientDid } from './documentDids.js';
 export type { RelationMembership } from './mergeMethods.js';

package/dist/webvh/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webvh/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACnE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,cAAc,EACd,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,YAAY,EACb,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webvh/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;AACH,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACnE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,cAAc,EACd,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,YAAY,EACb,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA"}

package/dist/webvh/index.js

@@ -45,10 +45,17 @@
  *   no-pad, over a key-agreement key's decoded multikey bytes, and the
  *   decode-based check that verifies a candidate key against a published
  *   commitment.
- * - `delegationKeyInDocument` -- the current-key-set rule for one recorded
- *   delegation: does the document still list the key that signed it under
- *   `capabilityDelegation` (a key kept under another relation alone does not
- *   count, and a missing key id reads as "cannot be checked", so: no).
+ * - `delegationSignerKey` / `delegationSignerKeyReader` /
+ *   `delegationKeyInDocument` -- the one reader of a delegation signer's
+ *   published key (and its memoized form over one document), and the
+ *   current-key-set rule for one recorded delegation: does the document
+ *   still list the key that signed it under `capabilityDelegation` (a key
+ *   kept under another relation alone does not count, and a missing key id
+ *   reads as "cannot be checked", so: no). `signerKeyNamed`, `sameSigner`,
+ *   and `didKeyMultibase` are the attribution-side readings beside it: the
+ *   key an id names for "who signed this", which a did:key id carries by
+ *   spec whether or not the document still lists it, and whether two ids
+ *   name one signer (the same id, or the same named key).
  * - `standingZcapStale` / `recordedZcapStale` -- the composed house staleness
  *   rule every re-mint pass and renewal stage asks (expiry, signer death, and
  *   the caller's retiring set), over a delegation in hand or over the
@@ -101,7 +108,7 @@ export { wasWebvhIdStore, wasWebvhLogStore } from './wasIdStore.js';
 export { didWebProjectionCurrent, ensureDidWebProjection, putDidWebProjection } from './didWebProjection.js';
 export { delegatedWebvhLogStore } from './delegatedLogStore.js';
 export { delegationAtExpiry, delegationExpired, delegationProofKeyId, delegationSignerGone, recordedZcapStale, REVOCATION_CLOCK_SKEW_MS, STANDING_ZCAP_TTL_MS, standingZcapStale, embeddedParentCapability, firstDelegationProof, ZCAP_RENEWAL_WINDOW_MS, zcapExpiring } from './standingZcap.js';
-export { attributeClientUpdateKey, delegationKeyInDocument, documentKeyMultibases, enrolledClientVmIds, isLastEnrolledClient, listEnrolledWebvhClients, markedKeyAgreementMethods, markedKeyAgreementMultibases } from './listClients.js';
+export { attributeClientUpdateKey, delegationKeyInDocument, delegationSignerKey, delegationSignerKeyReader, didKeyMultibase, documentKeyMultibases, sameSigner, signerKeyNamed, enrolledClientVmIds, isLastEnrolledClient, listEnrolledWebvhClients, markedKeyAgreementMethods, markedKeyAgreementMultibases } from './listClients.js';
 export { mergeVerificationMethods } from './mergeMethods.js';
 export { accountLogDids, walletClientDid } from './documentDids.js';
 export { credentialKeyAgreementMethods, enrolledClientKeyMultibases, introducedCredentialKeys, ladderVmIds, ladderVmKeyMultibases, relationIds, resolvedKeyAgreementMethods, retiredCredentialKeys } from '../resourceLog/document.js';

package/dist/webvh/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webvh/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEnE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAE/D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnE,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AAKnC,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AAsBzB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGzC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webvh/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;AACH,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,UAAU,EACV,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEnE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAE/D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC7B,MAAM,kBAAkB,CAAA;AAMzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnE,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,WAAW,EACX,qBAAqB,EACrB,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AAKnC,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EACL,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AAsBzB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAGzC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,WAAW,EACX,eAAe,EAChB,MAAM,WAAW,CAAA"}