@interop/wallet-core 0.23.0 → 0.24.0

package/dist/resourceLog/controller.d.ts

@@ -0,0 +1,57 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The controller-document view a resource-log verifier authorizes against:
+ * the profile's root of authority, resolved and verified by the reader
+ * independently of the host serving the log. The interface is the seam --
+ * verification consumes only the account DID, the ordered controller-log
+ * version list, and per-version `assertionMethod` membership -- and the
+ * did:webvh adapter builds it from an already-verified account log (the
+ * `verifyAccountLog` output), answering anchored-version lookups from that
+ * verified history rather than from any wire fetch. Handing the verifier a
+ * view instead of a resolver is what enforces the profile's rule that
+ * controller-document material never comes from the channel the log came
+ * from.
+ */
+import { type DIDLog } from '@interop/did-method-webvh';
+/**
+ * What log verification consumes of the independently verified controller
+ * document: the DID the entry proofs must sign under, the verified controller
+ * log's `versionId` list in order (empty for an unversioned static
+ * controller, degrading every anchor rule to current-document verification),
+ * and the set of `assertionMethod` key multibases at a given version --
+ * membership there is the whole authorization rule, so `keyAgreement`-only
+ * recovery keys and `authentication`-only convenience keys are excluded
+ * structurally.
+ */
+export interface ResourceLogController {
+    did: string;
+    versionIds: string[];
+    /**
+     * Resolves the `assertionMethod` public-key multibases at a controller-log
+     * version (`undefined`: the current document, the unversioned-controller
+     * degradation).
+     *
+     * @param [versionId] {string}
+     * @returns {Promise<Set<string>>}
+     */
+    assertionKeysAt(versionId?: string): Promise<Set<string>>;
+}
+/**
+ * Builds the controller view over an already-verified did:webvh account log
+ * (the `verifyAccountLog` output -- callers never hand this a log they have
+ * not verified against the account pointer). Anchored-version lookups
+ * re-resolve the held log at that version and are memoized: controller logs
+ * are tens of entries and anchors cluster on few versions.
+ *
+ * @param options {object}
+ * @param options.did {string}   the account's did:webvh, as verified
+ * @param options.log {DIDLog}   the verified account log
+ * @returns {ResourceLogController}
+ */
+export declare function webvhResourceLogController({ did, log }: {
+    did: string;
+    log: DIDLog;
+}): ResourceLogController;
+//# sourceMappingURL=controller.d.ts.map

package/dist/resourceLog/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAqB,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAG1E;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;;;;;OAOG;IACH,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D;AAmCD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,qBAAqB,CAkCxB"}

package/dist/resourceLog/controller.js

@@ -0,0 +1,81 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The controller-document view a resource-log verifier authorizes against:
+ * the profile's root of authority, resolved and verified by the reader
+ * independently of the host serving the log. The interface is the seam --
+ * verification consumes only the account DID, the ordered controller-log
+ * version list, and per-version `assertionMethod` membership -- and the
+ * did:webvh adapter builds it from an already-verified account log (the
+ * `verifyAccountLog` output), answering anchored-version lookups from that
+ * verified history rather than from any wire fetch. Handing the verifier a
+ * view instead of a resolver is what enforces the profile's rule that
+ * controller-document material never comes from the channel the log came
+ * from.
+ */
+import { resolveDIDFromLog } from '@interop/did-method-webvh';
+import { ResourceLogIntegrityError } from './errors.js';
+/**
+ * Collects a document's `assertionMethod` key multibases: embedded
+ * verification methods verbatim, string references resolved against
+ * `verificationMethod`.
+ *
+ * @param doc {AssertionDocument}
+ * @returns {Set<string>}
+ */
+function assertionKeysOf(doc) {
+    const byId = new Map();
+    for (const method of doc.verificationMethod ?? []) {
+        if (typeof method?.id === 'string') {
+            byId.set(method.id, method);
+        }
+    }
+    const keys = new Set();
+    for (const entry of doc.assertionMethod ?? []) {
+        const method = typeof entry === 'string' ? byId.get(entry) : entry;
+        if (method && typeof method.publicKeyMultibase === 'string') {
+            keys.add(method.publicKeyMultibase);
+        }
+    }
+    return keys;
+}
+/**
+ * Builds the controller view over an already-verified did:webvh account log
+ * (the `verifyAccountLog` output -- callers never hand this a log they have
+ * not verified against the account pointer). Anchored-version lookups
+ * re-resolve the held log at that version and are memoized: controller logs
+ * are tens of entries and anchors cluster on few versions.
+ *
+ * @param options {object}
+ * @param options.did {string}   the account's did:webvh, as verified
+ * @param options.log {DIDLog}   the verified account log
+ * @returns {ResourceLogController}
+ */
+export function webvhResourceLogController({ did, log }) {
+    const versionIds = log.map(entry => entry.versionId);
+    const memo = new Map();
+    async function resolveAssertionKeys(versionId) {
+        const resolved = await resolveDIDFromLog(log, versionId === undefined ? {} : { versionId });
+        if (resolved.meta.error || !resolved.doc) {
+            throw new ResourceLogIntegrityError(`The controller document did not resolve at version ` +
+                `"${versionId ?? '<head>'}" (${resolved.meta.error ?? 'no document returned'}).`);
+        }
+        return assertionKeysOf(resolved.doc);
+    }
+    return {
+        did,
+        versionIds,
+        assertionKeysAt(versionId) {
+            const key = versionId ?? '';
+            let pending = memo.get(key);
+            if (!pending) {
+                pending = resolveAssertionKeys(versionId);
+                memo.set(key, pending);
+                pending.catch(() => memo.delete(key));
+            }
+            return pending;
+        }
+    };
+}
+//# sourceMappingURL=controller.js.map

package/dist/resourceLog/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,iBAAiB,EAAe,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAkCvD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAsB;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2C,CAAA;IAC/D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAgC,CAAA;IACpD,KAAK,UAAU,oBAAoB,CACjC,SAAkB;QAElB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,GAAG,EACH,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAC7C,CAAA;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACzC,MAAM,IAAI,yBAAyB,CACjC,qDAAqD;gBACnD,IAAI,SAAS,IAAI,QAAQ,MACvB,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,sBACzB,IAAI,CACP,CAAA;QACH,CAAC;QACD,OAAO,eAAe,CAAC,QAAQ,CAAC,GAAwB,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO;QACL,GAAG;QACH,UAAU;QACV,eAAe,CAAC,SAAkB;YAChC,MAAM,GAAG,GAAG,SAAS,IAAI,EAAE,CAAA;YAC3B,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAA;gBACzC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;gBACtB,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YACvC,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/resourceLog/entry.d.ts

@@ -0,0 +1,68 @@
+import type { ResourceLogEntry } from '@interop/was-client/log';
+import type { ResourceLogController } from './controller.js';
+/**
+ * The writer's signing seam: its enrolled Ed25519 signing key's multibase
+ * (the fragment of its verification method in the controller document) and a
+ * raw detached-signature hook over it. The multibase names the key in the
+ * proof's `verificationMethod`; membership under `assertionMethod` at the
+ * anchored version is what authorizes the append.
+ */
+export interface ResourceLogSigner {
+    keyMultibase: string;
+    sign(input: {
+        data: Uint8Array;
+    }): Promise<Uint8Array>;
+}
+/**
+ * Builds and signs a genesis entry by the profile's two-pass SCID procedure:
+ * the preliminary entry carries the `{SCID}` placeholder as `versionId` and
+ * `parameters.scid`, its hash is the SCID, and the final entry substitutes it
+ * back in before the ordinary entry hash is computed (`versionId` input
+ * value: the SCID).
+ *
+ * @param options {object}
+ * @param options.state {ResourceLogEntry['state']}   the full initial state
+ *   (with its `type`)
+ * @param options.method {string}   the format identifier
+ *   (`WAS_RESOURCE_LOG_METHOD`)
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view -- the anchor source
+ * @param options.signer {ResourceLogSigner}
+ * @param [options.previousLog] {object}   handover successors only: the prior
+ *   log's SCID and the `versionId` of its terminal entry's predecessor
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<ResourceLogEntry>}
+ */
+export declare function buildResourceLogGenesis({ state, method, controller, signer, previousLog, versionTime }: {
+    state: ResourceLogEntry['state'];
+    method: string;
+    controller: ResourceLogController;
+    signer: ResourceLogSigner;
+    previousLog?: {
+        scid: string;
+        head: string;
+    };
+    versionTime?: string;
+}): Promise<ResourceLogEntry>;
+/**
+ * Builds and signs the next ordinary entry against a verified head: full
+ * state, empty `parameters`, hash chained off the head's `versionId`, proof
+ * anchored at the controller's verified head. Callers hold a verified head
+ * by construction (an entry is never built on an unverified one).
+ *
+ * @param options {object}
+ * @param options.head {ResourceLogEntry}   the verified head entry
+ * @param options.state {ResourceLogEntry['state']}   the full next state
+ * @param options.controller {ResourceLogController}
+ * @param options.signer {ResourceLogSigner}
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<ResourceLogEntry>}
+ */
+export declare function buildResourceLogEntry({ head, state, controller, signer, versionTime }: {
+    head: ResourceLogEntry;
+    state: ResourceLogEntry['state'];
+    controller: ResourceLogController;
+    signer: ResourceLogSigner;
+    versionTime?: string;
+}): Promise<ResourceLogEntry>;
+//# sourceMappingURL=entry.d.ts.map

package/dist/resourceLog/entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.d.ts","sourceRoot":"","sources":["../../src/resourceLog/entry.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACvD;AAqFD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,KAAK,EACL,MAAM,EACN,UAAU,EACV,MAAM,EACN,WAAW,EACX,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,qBAAqB,CAAA;IACjC,MAAM,EAAE,iBAAiB,CAAA;IACzB,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmC5B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,IAAI,EACJ,KAAK,EACL,UAAU,EACV,MAAM,EACN,WAAW,EACZ,EAAE;IACD,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAChC,UAAU,EAAE,qBAAqB,CAAA;IACjC,MAAM,EAAE,iBAAiB,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0B5B"}

package/dist/resourceLog/entry.js

@@ -0,0 +1,167 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Resource-log entry construction: the two-pass SCID genesis build and the
+ * ordinary next-entry build, both signed under the writer's enrolled Ed25519
+ * key with the entry anchor riding as a `versionId` DID parameter on the
+ * proof's `verificationMethod` -- the writer anchors at the head of the
+ * controller document as it last verified it. All hashing and proof
+ * construction comes from the did:webvh log kernel; nothing is re-derived
+ * here.
+ */
+import { buildVersionId, createDataIntegrityProofTemplate, deriveHash, parseAndValidateVersionId, SCID_PLACEHOLDER, signDataIntegrityProof, signerFromExternalKey } from '@interop/did-method-webvh';
+/**
+ * The writer's anchored verification-method DID URL: the controller DID, the
+ * anchor at the controller's verified head as a `versionId` DID parameter
+ * (omitted for an unversioned controller), and the signing key's multibase as
+ * the fragment.
+ *
+ * @param options {object}
+ * @param options.controller {ResourceLogController}
+ * @param options.keyMultibase {string}
+ * @returns {string}
+ */
+function anchoredVerificationMethod({ controller, keyMultibase }) {
+    const anchor = controller.versionIds[controller.versionIds.length - 1];
+    const query = anchor === undefined ? '' : `?versionId=${anchor}`;
+    return `${controller.did}${query}#${keyMultibase}`;
+}
+/**
+ * Refuses a state document the profile forbids in an entry: one without a
+ * `type` schema identifier, or one carrying the projection-only `history`
+ * member.
+ *
+ * @param state {ResourceLogEntry['state']}
+ */
+function checkState(state) {
+    if (typeof state.type !== 'string') {
+        throw new Error('A resource log entry state must carry a type schema identifier.');
+    }
+    if ('history' in state) {
+        throw new Error('A resource log entry state must not carry a history member (the ' +
+            'profile reserves that member name).');
+    }
+}
+/**
+ * Signs a fully version-identified entry under the profile's fixed proof
+ * shape.
+ *
+ * @param options {object}
+ * @param options.entry {object}   the entry, `proof` absent
+ * @param options.signer {ResourceLogSigner}
+ * @param options.verificationMethod {string}   the anchored DID URL
+ * @param options.created {string}   the proof timestamp
+ * @returns {Promise<ResourceLogEntry>}
+ */
+async function signEntry({ entry, signer, verificationMethod, created }) {
+    const proofTemplate = createDataIntegrityProofTemplate({
+        verificationMethod,
+        created
+    });
+    const proof = await signDataIntegrityProof(entry, proofTemplate, signerFromExternalKey({
+        publicKeyMultibase: signer.keyMultibase,
+        sign: signer.sign
+    }));
+    // The kernel's proof type keeps proofPurpose as the full union; the
+    // template fixed it to the profile's assertionMethod shape.
+    return { ...entry, proof: [proof] };
+}
+/**
+ * Builds and signs a genesis entry by the profile's two-pass SCID procedure:
+ * the preliminary entry carries the `{SCID}` placeholder as `versionId` and
+ * `parameters.scid`, its hash is the SCID, and the final entry substitutes it
+ * back in before the ordinary entry hash is computed (`versionId` input
+ * value: the SCID).
+ *
+ * @param options {object}
+ * @param options.state {ResourceLogEntry['state']}   the full initial state
+ *   (with its `type`)
+ * @param options.method {string}   the format identifier
+ *   (`WAS_RESOURCE_LOG_METHOD`)
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view -- the anchor source
+ * @param options.signer {ResourceLogSigner}
+ * @param [options.previousLog] {object}   handover successors only: the prior
+ *   log's SCID and the `versionId` of its terminal entry's predecessor
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<ResourceLogEntry>}
+ */
+export async function buildResourceLogGenesis({ state, method, controller, signer, previousLog, versionTime }) {
+    checkState(state);
+    const time = versionTime ?? new Date().toISOString();
+    const parametersOf = (scid) => ({
+        method,
+        scid,
+        ...(previousLog === undefined ? {} : { previousLog })
+    });
+    const scid = await deriveHash({
+        versionId: SCID_PLACEHOLDER,
+        versionTime: time,
+        parameters: parametersOf(SCID_PLACEHOLDER),
+        state
+    });
+    const parameters = parametersOf(scid);
+    const entryHash = await deriveHash({
+        versionId: scid,
+        versionTime: time,
+        parameters,
+        state
+    });
+    return signEntry({
+        entry: {
+            versionId: buildVersionId(1, entryHash),
+            versionTime: time,
+            parameters,
+            state
+        },
+        signer,
+        verificationMethod: anchoredVerificationMethod({
+            controller,
+            keyMultibase: signer.keyMultibase
+        }),
+        created: time
+    });
+}
+/**
+ * Builds and signs the next ordinary entry against a verified head: full
+ * state, empty `parameters`, hash chained off the head's `versionId`, proof
+ * anchored at the controller's verified head. Callers hold a verified head
+ * by construction (an entry is never built on an unverified one).
+ *
+ * @param options {object}
+ * @param options.head {ResourceLogEntry}   the verified head entry
+ * @param options.state {ResourceLogEntry['state']}   the full next state
+ * @param options.controller {ResourceLogController}
+ * @param options.signer {ResourceLogSigner}
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<ResourceLogEntry>}
+ */
+export async function buildResourceLogEntry({ head, state, controller, signer, versionTime }) {
+    checkState(state);
+    const time = versionTime ?? new Date().toISOString();
+    const headOrdinal = Number.parseInt(head.versionId, 10);
+    const ordinal = headOrdinal + 1;
+    parseAndValidateVersionId(head.versionId, headOrdinal);
+    const entryHash = await deriveHash({
+        versionId: head.versionId,
+        versionTime: time,
+        parameters: {},
+        state
+    });
+    return signEntry({
+        entry: {
+            versionId: buildVersionId(ordinal, entryHash),
+            versionTime: time,
+            parameters: {},
+            state
+        },
+        signer,
+        verificationMethod: anchoredVerificationMethod({
+            controller,
+            keyMultibase: signer.keyMultibase
+        }),
+        created: time
+    });
+}
+//# sourceMappingURL=entry.js.map

package/dist/resourceLog/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../src/resourceLog/entry.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EACL,cAAc,EACd,gCAAgC,EAChC,UAAU,EACV,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,2BAA2B,CAAA;AAgBlC;;;;;;;;;;GAUG;AACH,SAAS,0BAA0B,CAAC,EAClC,UAAU,EACV,YAAY,EAIb;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,MAAM,EAAE,CAAA;IAChE,OAAO,GAAG,UAAU,CAAC,GAAG,GAAG,KAAK,IAAI,YAAY,EAAE,CAAA;AACpD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAgC;IAClD,IAAI,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAA;IACH,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,qCAAqC,CACxC,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,SAAS,CAAC,EACvB,KAAK,EACL,MAAM,EACN,kBAAkB,EAClB,OAAO,EAMR;IACC,MAAM,aAAa,GAAG,gCAAgC,CAAC;QACrD,kBAAkB;QAClB,OAAO;KACR,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,MAAM,sBAAsB,CACxC,KAAK,EACL,aAAa,EACb,qBAAqB,CAAC;QACpB,kBAAkB,EAAE,MAAM,CAAC,YAAY;QACvC,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CACH,CAAA;IACD,oEAAoE;IACpE,4DAA4D;IAC5D,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,KAA0C,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,KAAK,EACL,MAAM,EACN,UAAU,EACV,MAAM,EACN,WAAW,EACX,WAAW,EAQZ;IACC,UAAU,CAAC,KAAK,CAAC,CAAA;IACjB,MAAM,IAAI,GAAG,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpD,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM;QACN,IAAI;QACJ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC;QAC5B,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,YAAY,CAAC,gBAAgB,CAAC;QAC1C,KAAK;KACN,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;QACjC,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;QACjB,UAAU;QACV,KAAK;KACN,CAAC,CAAA;IACF,OAAO,SAAS,CAAC;QACf,KAAK,EAAE;YACL,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE,SAAS,CAAC;YACvC,WAAW,EAAE,IAAI;YACjB,UAAU;YACV,KAAK;SACN;QACD,MAAM;QACN,kBAAkB,EAAE,0BAA0B,CAAC;YAC7C,UAAU;YACV,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,IAAI,EACJ,KAAK,EACL,UAAU,EACV,MAAM,EACN,WAAW,EAOZ;IACC,UAAU,CAAC,KAAK,CAAC,CAAA;IACjB,MAAM,IAAI,GAAG,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,WAAW,GAAG,CAAC,CAAA;IAC/B,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,EAAE;QACd,KAAK;KACN,CAAC,CAAA;IACF,OAAO,SAAS,CAAC;QACf,KAAK,EAAE;YACL,SAAS,EAAE,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC;YAC7C,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,EAAE;YACd,KAAK;SACN;QACD,MAAM;QACN,kBAAkB,EAAE,0BAA0B,CAAC;YAC7C,UAAU;YACV,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC"}

package/dist/resourceLog/errors.d.ts

@@ -0,0 +1,75 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The resource-log refusal taxonomy, carried over from the roster's WC-1
+ * detached-signature design onto the log design. Two adversarial classes plus
+ * one lifecycle refusal:
+ *
+ * - {@link ResourceLogIntegrityError} -- fabrication: the served log fails
+ *   verification on its own terms (parse shape, SCID, chain hashes, proofs,
+ *   or the external-authorization rule). Whoever produced it could not make a
+ *   log the account's clients would have made.
+ * - {@link ResourceLogContinuityError} -- a served log that verifies but
+ *   conflicts with what this client has already accepted: a rollback behind
+ *   the chain-head pin, a fork off the pinned history, or an SCID/method
+ *   switch outside a verified handover. The log may be internally consistent;
+ *   it is not the continuation of the history this client pinned.
+ * - {@link ResourceLogClosedError} -- an append refused because the verified
+ *   head is a terminal handover entry. Not an attack: the log's own authors
+ *   closed it, and a verifier of this profile must refuse to extend a closed
+ *   log even though nothing currently emits terminal entries.
+ */
+/**
+ * A served log failed verification: malformed entries, a non-verifying SCID,
+ * a broken hash chain, a failing proof, or a signer the controller document
+ * does not back at the entry's anchored version. Fabrication-class: refused
+ * as something no enrolled client produced.
+ */
+export declare class ResourceLogIntegrityError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * A served log conflicts with this client's chain-head pin: `rollback` (the
+ * served head is behind the pinned head -- possibly replication lag; the pin
+ * is never regressed and the caller may retry), `fork` (the served log
+ * diverges from the pinned history -- both logs are transferable evidence of
+ * equivocation, so the served entries ride along), `scid-switch` /
+ * `method-switch` (a different log identity or format under the pinned
+ * location, outside a verified handover).
+ */
+export declare class ResourceLogContinuityError extends Error {
+    reason: 'rollback' | 'fork' | 'scid-switch' | 'method-switch';
+    pinnedHead: string;
+    /**
+     * On a `fork`, the full served log retained as evidence: every entry is
+     * signed, so a conflicting pair of logs under one SCID is transferable,
+     * independently verifiable proof of equivocation.
+     */
+    servedEntries?: unknown[];
+    constructor({ reason, pinnedHead, servedEntries }: {
+        reason: 'rollback' | 'fork' | 'scid-switch' | 'method-switch';
+        pinnedHead: string;
+        servedEntries?: unknown[];
+    });
+}
+/**
+ * An append was refused because the log's verified head is a terminal
+ * handover entry: the log is closed and names a successor, and this profile
+ * forbids extending a history its authors have closed.
+ */
+export declare class ResourceLogClosedError extends Error {
+    nextLog: {
+        method: string;
+        scid: string;
+    };
+    constructor({ nextLog }: {
+        nextLog: {
+            method: string;
+            scid: string;
+        };
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/resourceLog/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;IAC7D,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAA;gBACb,EACV,MAAM,EACN,UAAU,EACV,aAAa,EACd,EAAE;QACD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;QAC7D,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,CAAC,EAAE,OAAO,EAAE,CAAA;KAC1B;CAUF;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;gBAC7B,EAAE,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;CAQvE"}

package/dist/resourceLog/errors.js

@@ -0,0 +1,76 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The resource-log refusal taxonomy, carried over from the roster's WC-1
+ * detached-signature design onto the log design. Two adversarial classes plus
+ * one lifecycle refusal:
+ *
+ * - {@link ResourceLogIntegrityError} -- fabrication: the served log fails
+ *   verification on its own terms (parse shape, SCID, chain hashes, proofs,
+ *   or the external-authorization rule). Whoever produced it could not make a
+ *   log the account's clients would have made.
+ * - {@link ResourceLogContinuityError} -- a served log that verifies but
+ *   conflicts with what this client has already accepted: a rollback behind
+ *   the chain-head pin, a fork off the pinned history, or an SCID/method
+ *   switch outside a verified handover. The log may be internally consistent;
+ *   it is not the continuation of the history this client pinned.
+ * - {@link ResourceLogClosedError} -- an append refused because the verified
+ *   head is a terminal handover entry. Not an attack: the log's own authors
+ *   closed it, and a verifier of this profile must refuse to extend a closed
+ *   log even though nothing currently emits terminal entries.
+ */
+/**
+ * A served log failed verification: malformed entries, a non-verifying SCID,
+ * a broken hash chain, a failing proof, or a signer the controller document
+ * does not back at the entry's anchored version. Fabrication-class: refused
+ * as something no enrolled client produced.
+ */
+export class ResourceLogIntegrityError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'ResourceLogIntegrityError';
+    }
+}
+/**
+ * A served log conflicts with this client's chain-head pin: `rollback` (the
+ * served head is behind the pinned head -- possibly replication lag; the pin
+ * is never regressed and the caller may retry), `fork` (the served log
+ * diverges from the pinned history -- both logs are transferable evidence of
+ * equivocation, so the served entries ride along), `scid-switch` /
+ * `method-switch` (a different log identity or format under the pinned
+ * location, outside a verified handover).
+ */
+export class ResourceLogContinuityError extends Error {
+    reason;
+    pinnedHead;
+    /**
+     * On a `fork`, the full served log retained as evidence: every entry is
+     * signed, so a conflicting pair of logs under one SCID is transferable,
+     * independently verifiable proof of equivocation.
+     */
+    servedEntries;
+    constructor({ reason, pinnedHead, servedEntries }) {
+        super(`The served resource log is not a continuation of the pinned history ` +
+            `(${reason}; pinned head ${pinnedHead}).`);
+        this.name = 'ResourceLogContinuityError';
+        this.reason = reason;
+        this.pinnedHead = pinnedHead;
+        this.servedEntries = servedEntries;
+    }
+}
+/**
+ * An append was refused because the log's verified head is a terminal
+ * handover entry: the log is closed and names a successor, and this profile
+ * forbids extending a history its authors have closed.
+ */
+export class ResourceLogClosedError extends Error {
+    nextLog;
+    constructor({ nextLog }) {
+        super('The resource log is closed by a terminal handover entry; appends must ' +
+            'go to its successor log.');
+        this.name = 'ResourceLogClosedError';
+        this.nextLog = nextLog;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/resourceLog/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,MAAM,CAAuD;IAC7D,UAAU,CAAQ;IAClB;;;;OAIG;IACH,aAAa,CAAY;IACzB,YAAY,EACV,MAAM,EACN,UAAU,EACV,aAAa,EAKd;QACC,KAAK,CACH,sEAAsE;YACpE,IAAI,MAAM,iBAAiB,UAAU,IAAI,CAC5C,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,CAAkC;IACzC,YAAY,EAAE,OAAO,EAAiD;QACpE,KAAK,CACH,wEAAwE;YACtE,0BAA0B,CAC7B,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF"}

package/dist/resourceLog/index.d.ts

@@ -0,0 +1,23 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/resourceLog` entry: the client side of the
+ * Resource Log Profile (App Connect spec `#resource-log-profile`) -- full
+ * chain verification against an adversarial host (parse shape, SCID and
+ * entry-hash recomputation, entry proofs, the external-authorization rule
+ * against the independently verified did:webvh controller document, terminal
+ * entries), the chain-head pin with its continuity rules, and the append path
+ * (verified-head build, CAS with rebase-and-retry, read-back confirmation).
+ * Transport (JSON Lines, the store seam, the projection write) lives in
+ * `@interop/was-client/log`; the hashing and proof kernel in
+ * `@interop/did-method-webvh`. Kept out of the root export: this subpath
+ * pulls the did:webvh and ed25519 dependency graph.
+ */
+export { webvhResourceLogController, type ResourceLogController } from './controller.js';
+export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
+export { buildResourceLogEntry, buildResourceLogGenesis, type ResourceLogSigner } from './entry.js';
+export { memoryResourceLogPinStore, type ResourceLogHeadPin, type ResourceLogPinStore } from './pin.js';
+export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover, type VerifiedResourceLog } from './verify.js';
+export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/resourceLog/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA"}

package/dist/resourceLog/index.js

@@ -0,0 +1,23 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/resourceLog` entry: the client side of the
+ * Resource Log Profile (App Connect spec `#resource-log-profile`) -- full
+ * chain verification against an adversarial host (parse shape, SCID and
+ * entry-hash recomputation, entry proofs, the external-authorization rule
+ * against the independently verified did:webvh controller document, terminal
+ * entries), the chain-head pin with its continuity rules, and the append path
+ * (verified-head build, CAS with rebase-and-retry, read-back confirmation).
+ * Transport (JSON Lines, the store seam, the projection write) lives in
+ * `@interop/was-client/log`; the hashing and proof kernel in
+ * `@interop/did-method-webvh`. Kept out of the root export: this subpath
+ * pulls the did:webvh and ed25519 dependency graph.
+ */
+export { webvhResourceLogController } from './controller.js';
+export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
+export { buildResourceLogEntry, buildResourceLogGenesis } from './entry.js';
+export { memoryResourceLogPinStore } from './pin.js';
+export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover } from './verify.js';
+export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
+//# sourceMappingURL=index.js.map

package/dist/resourceLog/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,0BAA0B,EAE3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EAG1B,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA"}

package/dist/resourceLog/pin.d.ts

@@ -0,0 +1,44 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The chain-head pin: the client-local durable record of a resource log's
+ * verified identity and latest verified head, kept per log beside the app's
+ * other continuity pins (the account pointer, the roster epoch pin). The pin
+ * is what turns one-shot verification into continuity: a served log whose
+ * SCID or method differs from the pin outside a verified handover, or whose
+ * history is not a descendant of the pinned head, is refused instead of
+ * adopted. Storage is the app's concern (freewallet: beside its other pins in
+ * localStorage; DCW: a table row), so only the seam lives here, plus an
+ * in-memory implementation for tests and single-session use.
+ */
+/**
+ * One log's pin: the format identifier from the genesis `parameters.method`,
+ * the SCID, and the `versionId` of the latest verified head. Established at
+ * first contact (trust-on-first-use of the log's identity), advanced only
+ * after a full verification whose head is the pinned head or a descendant,
+ * and replaced wholesale only across a verified handover.
+ */
+export interface ResourceLogHeadPin {
+    method: string;
+    scid: string;
+    head: string;
+}
+/**
+ * Where a client keeps its chain-head pins, one record per log. `read`
+ * resolves `null` before first contact. Writes happen only on the two legal
+ * transitions (advance after full verification, replace across a verified
+ * handover) -- the verifier never regresses a pin.
+ */
+export interface ResourceLogPinStore {
+    read(): Promise<ResourceLogHeadPin | null>;
+    write(pin: ResourceLogHeadPin): Promise<void>;
+}
+/**
+ * An in-memory pin store: continuity within one session only. Tests use it
+ * as the seam's reference implementation; apps persist for real.
+ *
+ * @returns {ResourceLogPinStore}
+ */
+export declare function memoryResourceLogPinStore(): ResourceLogPinStore;
+//# sourceMappingURL=pin.d.ts.map