@interop/wallet-core 0.23.0 → 0.24.0

package/dist/resourceLog/pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin.d.ts","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IAC1C,KAAK,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAU/D"}

package/dist/resourceLog/pin.js

@@ -0,0 +1,32 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The chain-head pin: the client-local durable record of a resource log's
+ * verified identity and latest verified head, kept per log beside the app's
+ * other continuity pins (the account pointer, the roster epoch pin). The pin
+ * is what turns one-shot verification into continuity: a served log whose
+ * SCID or method differs from the pin outside a verified handover, or whose
+ * history is not a descendant of the pinned head, is refused instead of
+ * adopted. Storage is the app's concern (freewallet: beside its other pins in
+ * localStorage; DCW: a table row), so only the seam lives here, plus an
+ * in-memory implementation for tests and single-session use.
+ */
+/**
+ * An in-memory pin store: continuity within one session only. Tests use it
+ * as the seam's reference implementation; apps persist for real.
+ *
+ * @returns {ResourceLogPinStore}
+ */
+export function memoryResourceLogPinStore() {
+    let pin = null;
+    return {
+        async read() {
+            return pin;
+        },
+        async write(next) {
+            pin = next;
+        }
+    };
+}
+//# sourceMappingURL=pin.js.map

package/dist/resourceLog/pin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin.js","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AA0BH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,GAAG,GAA8B,IAAI,CAAA;IACzC,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAwB;YAClC,GAAG,GAAG,IAAI,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/resourceLog/verify.d.ts

@@ -0,0 +1,89 @@
+import type { ResourceLogEntry } from '@interop/was-client/log';
+import type { ResourceLogController } from './controller.js';
+import type { ResourceLogHeadPin } from './pin.js';
+/**
+ * What full verification resolves to. `state` is the profile's definition of
+ * the resource's current state -- the verified head entry's `state` -- and
+ * `pin` is the record the caller must store as its new chain-head pin.
+ * `terminal` is the head's `nextLog` when the log is closed by a handover
+ * entry (appends must be refused), `previousLog` the genesis back-reference
+ * when this log is a handover successor.
+ */
+export interface VerifiedResourceLog {
+    entries: ResourceLogEntry[];
+    method: string;
+    scid: string;
+    head: ResourceLogEntry;
+    state: ResourceLogEntry['state'];
+    pin: ResourceLogHeadPin;
+    terminal: {
+        method: string;
+        scid: string;
+    } | null;
+    previousLog: {
+        scid: string;
+        head: string;
+    } | null;
+}
+/**
+ * Whether an entry is a terminal handover entry: its `parameters` carry a
+ * `nextLog` member. Position, exact member set, and state equality are the
+ * verifier's checks; this is only the discriminant.
+ *
+ * @param entry {ResourceLogEntry}
+ * @returns {boolean}
+ */
+export declare function isTerminalResourceLogEntry(entry: ResourceLogEntry): boolean;
+/**
+ * Runs the profile's full verification over a parsed log, in order: parse
+ * shape, genesis (SCID recomputation, format identifier), chain-hash
+ * recomputation, per-entry proofs, the external-authorization rule with
+ * anchor monotonicity, termination, and continuity against the chain-head
+ * pin. Throws {@link ResourceLogIntegrityError} on fabrication-class
+ * failures, {@link ResourceLogContinuityError} on pin conflicts; any failure
+ * rejects the whole log.
+ *
+ * The controller view is the independently verified controller document --
+ * never material served beside the log. An unversioned controller (empty
+ * `versionIds`) degrades every anchor rule to current-document verification
+ * and requires anchorless proofs.
+ *
+ * @param options {object}
+ * @param options.entries {ResourceLogEntry[]}   the parsed served log
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view ({@link webvhResourceLogController})
+ * @param options.expectedMethod {string}   the format identifier this caller
+ *   expects (`WAS_RESOURCE_LOG_METHOD`; also confirmed against any `history`
+ *   dispatch hint the caller followed)
+ * @param [options.pin] {ResourceLogHeadPin}   the held chain-head pin, when
+ *   this client has verified the log before
+ * @returns {Promise<VerifiedResourceLog>}
+ */
+export declare function verifyResourceLog({ entries, controller, expectedMethod, pin }: {
+    entries: ResourceLogEntry[];
+    controller: ResourceLogController;
+    expectedMethod: string;
+    pin?: ResourceLogHeadPin | null;
+}): Promise<VerifiedResourceLog>;
+/**
+ * Verifies a handover link from both sides: the prior log's terminal entry
+ * and the successor log's genesis back-reference. Both logs must already have
+ * passed {@link verifyResourceLog}. Checks: the terminal `nextLog` names the
+ * successor's SCID and method; the successor's `previousLog` names the prior
+ * log's SCID; and the successor's `previousLog.head` is the `versionId` of
+ * the terminal entry's immediate predecessor -- the terminal entry chains
+ * directly off the head the successor references. A verified handover is the
+ * one transition that replaces a chain-head pin wholesale (the caller stores
+ * `successor.pin`).
+ *
+ * @param options {object}
+ * @param options.prior {VerifiedResourceLog}   the closed log
+ * @param options.successor {VerifiedResourceLog}   the log its terminal entry
+ *   names
+ * @returns {void}
+ */
+export declare function verifyResourceLogHandover({ prior, successor }: {
+    prior: VerifiedResourceLog;
+    successor: VerifiedResourceLog;
+}): void;
+//# sourceMappingURL=verify.d.ts.map

package/dist/resourceLog/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/resourceLog/verify.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAalD;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAChC,GAAG,EAAE,kBAAkB,CAAA;IACvB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACjD,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CACnD;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAM3E;AAwOD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,cAAc,EACd,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+M/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,KAAK,EACL,SAAS,EACV,EAAE;IACD,KAAK,EAAE,mBAAmB,CAAA;IAC1B,SAAS,EAAE,mBAAmB,CAAA;CAC/B,GAAG,IAAI,CAqBP"}

package/dist/resourceLog/verify.js

@@ -0,0 +1,434 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The Resource Log Profile's verification algorithm (App Connect spec,
+ * `#log-verification`), end-to-end and fail-closed: entry-shape parse checks,
+ * SCID recomputation, chain-hash recomputation (never a stated head), proof
+ * verification through the did:webvh log kernel, the external-authorization
+ * rule (anchor resolution against the independently verified controller
+ * document, `assertionMethod` membership at the anchored version, anchor
+ * monotonicity), terminal-entry recognition, and continuity against the
+ * chain-head pin. Any failure rejects the LOG, not just the failing entry,
+ * and nothing served -- a stated head, a digest, a count -- is ever accepted
+ * in place of recomputation.
+ */
+import { buildVersionId, canonicalizeStrict, defaultWebvhLogVerifier, deriveHash, parseAndValidateVersionId, SCID_PLACEHOLDER, verifyEntryProofs } from '@interop/did-method-webvh';
+import { ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
+/**
+ * The five members a log entry carries, exactly.
+ */
+const ENTRY_MEMBERS = [
+    'versionId',
+    'versionTime',
+    'parameters',
+    'state',
+    'proof'
+];
+/**
+ * Whether an entry is a terminal handover entry: its `parameters` carry a
+ * `nextLog` member. Position, exact member set, and state equality are the
+ * verifier's checks; this is only the discriminant.
+ *
+ * @param entry {ResourceLogEntry}
+ * @returns {boolean}
+ */
+export function isTerminalResourceLogEntry(entry) {
+    return (typeof entry.parameters === 'object' &&
+        entry.parameters !== null &&
+        'nextLog' in entry.parameters);
+}
+/**
+ * Structural check of one member of an entry's `proof` array against the
+ * profile's fixed shape, before any cryptography runs.
+ *
+ * @param proof {unknown}
+ * @param ordinal {number}   the owning entry's 1-based position
+ * @returns {ResourceLogEntryProof}
+ */
+function checkProofShape(proof, ordinal) {
+    const candidate = proof;
+    if (candidate === null ||
+        typeof candidate !== 'object' ||
+        candidate.type !== 'DataIntegrityProof' ||
+        candidate.cryptosuite !== 'eddsa-jcs-2022' ||
+        candidate.proofPurpose !== 'assertionMethod' ||
+        typeof candidate.verificationMethod !== 'string' ||
+        typeof candidate.proofValue !== 'string') {
+        throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} carries a proof outside the profile's ` +
+            `fixed shape (DataIntegrityProof / eddsa-jcs-2022 / assertionMethod).`);
+    }
+    return candidate;
+}
+/**
+ * Shape-checks one entry (the profile's parse step): exactly the five
+ * members, `versionId` ordinal at its 1-based position, an RFC3339 UTC
+ * `versionTime` (format only -- temporal refusals are forbidden), the
+ * per-position `parameters` rules fail-closed, a `state` carrying `type` and
+ * no `history`, and a non-empty fixed-shape `proof` array.
+ *
+ * @param entry {ResourceLogEntry}
+ * @param index {number}   the entry's 0-based position
+ */
+function checkEntryShape(entry, index) {
+    const ordinal = index + 1;
+    const members = Object.keys(entry);
+    if (members.length !== ENTRY_MEMBERS.length ||
+        ENTRY_MEMBERS.some(member => !(member in entry))) {
+        throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} does not carry exactly the profile's ` +
+            `five members (versionId, versionTime, parameters, state, proof).`);
+    }
+    try {
+        parseAndValidateVersionId(entry.versionId, ordinal);
+    }
+    catch (err) {
+        throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} has a malformed or misplaced versionId.`, { cause: err });
+    }
+    if (typeof entry.versionTime !== 'string' ||
+        !entry.versionTime.endsWith('Z') ||
+        Number.isNaN(Date.parse(entry.versionTime))) {
+        throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} has a malformed versionTime (RFC3339 ` +
+            `UTC required; the value itself is advisory).`);
+    }
+    const parameters = entry.parameters;
+    if (parameters === null || typeof parameters !== 'object') {
+        throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} has a non-object parameters member.`);
+    }
+    const parameterMembers = Object.keys(parameters);
+    if (index === 0) {
+        const genesis = parameters;
+        const allowed = parameterMembers.every(member => ['method', 'scid', 'previousLog'].includes(member));
+        if (!allowed ||
+            typeof genesis.method !== 'string' ||
+            typeof genesis.scid !== 'string' ||
+            (genesis.previousLog !== undefined &&
+                (genesis.previousLog === null ||
+                    typeof genesis.previousLog !== 'object' ||
+                    typeof genesis.previousLog.scid !== 'string' ||
+                    typeof genesis.previousLog.head !== 'string' ||
+                    Object.keys(genesis.previousLog).length !== 2))) {
+            throw new ResourceLogIntegrityError('The resource log genesis parameters must carry method and scid ' +
+                '(plus, on a handover successor only, previousLog) and nothing else.');
+        }
+    }
+    else if (parameterMembers.length !== 0) {
+        // The only non-genesis entry with parameters is a terminal handover
+        // entry, exactly { nextLog: { method, scid } }. Anything else -- the
+        // deleted did:webvh key-management parameters in particular -- is refused
+        // fail-closed.
+        const terminal = parameters;
+        if (parameterMembers.length !== 1 ||
+            terminal.nextLog === undefined ||
+            terminal.nextLog === null ||
+            typeof terminal.nextLog !== 'object' ||
+            typeof terminal.nextLog.method !== 'string' ||
+            typeof terminal.nextLog.scid !== 'string' ||
+            Object.keys(terminal.nextLog).length !== 2) {
+            throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} carries parameters this profile does ` +
+                `not define for its position (only a terminal entry's nextLog is ` +
+                `permitted past genesis).`);
+        }
+    }
+    const state = entry.state;
+    if (state === null ||
+        typeof state !== 'object' ||
+        typeof state.type !== 'string') {
+        throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} has no state.type schema identifier.`);
+    }
+    if ('history' in state) {
+        throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} carries a history member inside its ` +
+            `state (the profile reserves that member name).`);
+    }
+    if (!Array.isArray(entry.proof) || entry.proof.length === 0) {
+        throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} carries no proof array.`);
+    }
+    for (const proof of entry.proof) {
+        checkProofShape(proof, ordinal);
+    }
+}
+/**
+ * Deep-clones a JSON value, replacing every string equal to the SCID with the
+ * `{SCID}` placeholder -- the inverse of genesis construction, used to
+ * recompute the SCID from a served genesis entry.
+ *
+ * @param value {unknown}
+ * @param scid {string}
+ * @returns {unknown}
+ */
+function substituteScid(value, scid) {
+    if (typeof value === 'string') {
+        return value === scid ? SCID_PLACEHOLDER : value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(item => substituteScid(item, scid));
+    }
+    if (value !== null && typeof value === 'object') {
+        const result = {};
+        for (const [key, member] of Object.entries(value)) {
+            result[key] = substituteScid(member, scid);
+        }
+        return result;
+    }
+    return value;
+}
+/**
+ * The hash input of entry `n`: the entry with `proof` removed and `versionId`
+ * replaced by the predecessor's `versionId` (the SCID for the genesis entry).
+ *
+ * @param entry {ResourceLogEntry}
+ * @param predecessorVersionId {string}
+ * @returns {object}
+ */
+function hashInputOf(entry, predecessorVersionId) {
+    return {
+        versionId: predecessorVersionId,
+        versionTime: entry.versionTime,
+        parameters: entry.parameters,
+        state: entry.state
+    };
+}
+/**
+ * Splits a proof's `verificationMethod` DID URL into its base DID, its
+ * `versionId` DID parameter (the entry anchor), and its fragment (the signing
+ * key's multibase).
+ *
+ * @param verificationMethod {string}
+ * @param ordinal {number}   the owning entry's 1-based position
+ * @returns {object}
+ */
+function parseAnchoredVm(verificationMethod, ordinal) {
+    const hashIndex = verificationMethod.lastIndexOf('#');
+    if (hashIndex === -1 || hashIndex === verificationMethod.length - 1) {
+        throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} has a proof verificationMethod without ` +
+            `a key fragment.`);
+    }
+    const keyMultibase = verificationMethod.slice(hashIndex + 1);
+    const didUrl = verificationMethod.slice(0, hashIndex);
+    const queryIndex = didUrl.indexOf('?');
+    if (queryIndex === -1) {
+        return { did: didUrl, keyMultibase };
+    }
+    const did = didUrl.slice(0, queryIndex);
+    const params = new URLSearchParams(didUrl.slice(queryIndex + 1));
+    const anchor = params.get('versionId') ?? undefined;
+    return { did, anchor, keyMultibase };
+}
+/**
+ * Runs the profile's full verification over a parsed log, in order: parse
+ * shape, genesis (SCID recomputation, format identifier), chain-hash
+ * recomputation, per-entry proofs, the external-authorization rule with
+ * anchor monotonicity, termination, and continuity against the chain-head
+ * pin. Throws {@link ResourceLogIntegrityError} on fabrication-class
+ * failures, {@link ResourceLogContinuityError} on pin conflicts; any failure
+ * rejects the whole log.
+ *
+ * The controller view is the independently verified controller document --
+ * never material served beside the log. An unversioned controller (empty
+ * `versionIds`) degrades every anchor rule to current-document verification
+ * and requires anchorless proofs.
+ *
+ * @param options {object}
+ * @param options.entries {ResourceLogEntry[]}   the parsed served log
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view ({@link webvhResourceLogController})
+ * @param options.expectedMethod {string}   the format identifier this caller
+ *   expects (`WAS_RESOURCE_LOG_METHOD`; also confirmed against any `history`
+ *   dispatch hint the caller followed)
+ * @param [options.pin] {ResourceLogHeadPin}   the held chain-head pin, when
+ *   this client has verified the log before
+ * @returns {Promise<VerifiedResourceLog>}
+ */
+export async function verifyResourceLog({ entries, controller, expectedMethod, pin }) {
+    if (entries.length === 0) {
+        throw new ResourceLogIntegrityError('The resource log is empty (a log carries at least its genesis entry).');
+    }
+    // 1. Parse: per-entry shape, parameters rules, ordinal positions.
+    entries.forEach((entry, index) => {
+        checkEntryShape(entry, index);
+    });
+    // 2. Genesis: format identifier, then SCID recomputation.
+    const genesisParameters = entries[0].parameters;
+    const { method, scid } = genesisParameters;
+    if (method !== expectedMethod) {
+        throw new ResourceLogIntegrityError(`The resource log declares format "${method}", not the expected ` +
+            `"${expectedMethod}".`);
+    }
+    const preliminary = substituteScid(hashInputOf(entries[0], SCID_PLACEHOLDER), scid);
+    if ((await deriveHash(preliminary)) !== scid) {
+        throw new ResourceLogIntegrityError('The resource log SCID does not verify against its genesis content.');
+    }
+    // 3. Chain: recompute every entry hash from the predecessor-substituted
+    // input; never accept a stated head.
+    let predecessorVersionId = scid;
+    for (const [index, entry] of entries.entries()) {
+        const entryHash = await deriveHash(hashInputOf(entry, predecessorVersionId));
+        if (entry.versionId !== buildVersionId(index + 1, entryHash)) {
+            throw new ResourceLogIntegrityError(`Resource log entry ${index + 1} does not hash-chain to its ` +
+                `predecessor.`);
+        }
+        predecessorVersionId = entry.versionId;
+    }
+    // 4 + 5. Proofs and authorization, entry by entry, with anchor
+    // monotonicity carried along the log.
+    const versioned = controller.versionIds.length > 0;
+    let anchorFloor = 0;
+    for (const [index, entry] of entries.entries()) {
+        const ordinal = index + 1;
+        let entryAnchorIndex = anchorFloor;
+        const authorize = async (proof) => {
+            const { did, anchor, keyMultibase } = parseAnchoredVm(proof.verificationMethod ?? '', ordinal);
+            if (did !== controller.did) {
+                throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} is signed under a different ` +
+                    `controller than this log's account.`);
+            }
+            if (versioned && anchor === undefined) {
+                throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} carries no entry anchor against a ` +
+                    `version-resolvable controller.`);
+            }
+            if (!versioned && anchor !== undefined) {
+                throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} anchors a version on an unversioned ` +
+                    `controller.`);
+            }
+            let anchorIndex = 0;
+            if (anchor !== undefined) {
+                anchorIndex = controller.versionIds.indexOf(anchor);
+                if (anchorIndex === -1) {
+                    throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} anchors an unknown controller ` +
+                        `document version.`);
+                }
+                if (anchorIndex < anchorFloor) {
+                    throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} anchors behind its predecessor ` +
+                        `(anchors must be monotone along the log).`);
+                }
+            }
+            const assertionKeys = await controller.assertionKeysAt(anchor);
+            if (!assertionKeys.has(keyMultibase)) {
+                throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} is signed by a key the controller ` +
+                    `document does not list under assertionMethod at the anchored ` +
+                    `version.`);
+            }
+            entryAnchorIndex = Math.max(entryAnchorIndex, anchorIndex);
+        };
+        try {
+            // The wire proof type narrows the kernel's (fixed purpose, optional
+            // created); the shape check above already enforced the profile form.
+            await verifyEntryProofs(entry, {
+                verifier: defaultWebvhLogVerifier,
+                authorize,
+                resolveVM: async (verificationMethod) => ({
+                    publicKeyMultibase: parseAnchoredVm(verificationMethod, ordinal)
+                        .keyMultibase
+                })
+            });
+        }
+        catch (err) {
+            if (err instanceof ResourceLogIntegrityError) {
+                throw err;
+            }
+            throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} failed proof verification.`, { cause: err });
+        }
+        anchorFloor = entryAnchorIndex;
+    }
+    // 6. Termination: a terminal entry closes the log -- it must be last, must
+    // not be the genesis, and must change no state.
+    let terminal = null;
+    for (const [index, entry] of entries.entries()) {
+        if (!isTerminalResourceLogEntry(entry) || index === 0) {
+            continue;
+        }
+        if (index !== entries.length - 1) {
+            throw new ResourceLogIntegrityError('The resource log continues past a terminal handover entry.');
+        }
+        const predecessorState = entries[index - 1].state;
+        if (canonicalizeStrict(entry.state) !== canonicalizeStrict(predecessorState)) {
+            throw new ResourceLogIntegrityError("The terminal handover entry's state differs from its " +
+                "predecessor's (a handover changes no resource state).");
+        }
+        terminal = entry.parameters.nextLog;
+    }
+    // 7. Continuity against the chain-head pin, where one is held.
+    const head = entries[entries.length - 1];
+    if (pin) {
+        if (pin.method !== method) {
+            throw new ResourceLogContinuityError({
+                reason: 'method-switch',
+                pinnedHead: pin.head
+            });
+        }
+        if (pin.scid !== scid) {
+            throw new ResourceLogContinuityError({
+                reason: 'scid-switch',
+                pinnedHead: pin.head
+            });
+        }
+        const pinnedOrdinal = Number.parseInt(pin.head, 10);
+        if (!Number.isInteger(pinnedOrdinal) || pinnedOrdinal < 1) {
+            throw new ResourceLogContinuityError({
+                reason: 'fork',
+                pinnedHead: pin.head,
+                servedEntries: entries
+            });
+        }
+        if (entries.length < pinnedOrdinal) {
+            throw new ResourceLogContinuityError({
+                reason: 'rollback',
+                pinnedHead: pin.head
+            });
+        }
+        if (entries[pinnedOrdinal - 1].versionId !== pin.head) {
+            throw new ResourceLogContinuityError({
+                reason: 'fork',
+                pinnedHead: pin.head,
+                servedEntries: entries
+            });
+        }
+    }
+    return {
+        entries,
+        method,
+        scid,
+        head,
+        state: head.state,
+        pin: { method, scid, head: head.versionId },
+        terminal,
+        previousLog: genesisParameters.previousLog ?? null
+    };
+}
+/**
+ * Verifies a handover link from both sides: the prior log's terminal entry
+ * and the successor log's genesis back-reference. Both logs must already have
+ * passed {@link verifyResourceLog}. Checks: the terminal `nextLog` names the
+ * successor's SCID and method; the successor's `previousLog` names the prior
+ * log's SCID; and the successor's `previousLog.head` is the `versionId` of
+ * the terminal entry's immediate predecessor -- the terminal entry chains
+ * directly off the head the successor references. A verified handover is the
+ * one transition that replaces a chain-head pin wholesale (the caller stores
+ * `successor.pin`).
+ *
+ * @param options {object}
+ * @param options.prior {VerifiedResourceLog}   the closed log
+ * @param options.successor {VerifiedResourceLog}   the log its terminal entry
+ *   names
+ * @returns {void}
+ */
+export function verifyResourceLogHandover({ prior, successor }) {
+    if (!prior.terminal) {
+        throw new ResourceLogContinuityError({
+            reason: 'scid-switch',
+            pinnedHead: prior.pin.head
+        });
+    }
+    const predecessor = prior.entries[prior.entries.length - 2];
+    if (prior.terminal.scid !== successor.scid ||
+        prior.terminal.method !== successor.method ||
+        successor.previousLog?.scid !== prior.scid ||
+        predecessor === undefined ||
+        successor.previousLog.head !== predecessor.versionId) {
+        throw new ResourceLogContinuityError({
+            reason: 'scid-switch',
+            pinnedHead: prior.pin.head,
+            servedEntries: successor.entries
+        });
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/resourceLog/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/resourceLog/verify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACV,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAMlC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AAGpB;;GAEG;AACH,MAAM,aAAa,GAAG;IACpB,WAAW;IACX,aAAa;IACb,YAAY;IACZ,OAAO;IACP,OAAO;CACR,CAAA;AAqBD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAuB;IAChE,OAAO,CACL,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,KAAK,CAAC,UAAU,KAAK,IAAI;QACzB,SAAS,IAAI,KAAK,CAAC,UAAU,CAC9B,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,KAAc,EACd,OAAe;IAEf,MAAM,SAAS,GAAG,KAA8C,CAAA;IAChE,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,IAAI,KAAK,oBAAoB;QACvC,SAAS,CAAC,WAAW,KAAK,gBAAgB;QAC1C,SAAS,CAAC,YAAY,KAAK,iBAAiB;QAC5C,OAAO,SAAS,CAAC,kBAAkB,KAAK,QAAQ;QAChD,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,EACxC,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,yCAAyC;YACpE,sEAAsE,CACzE,CAAA;IACH,CAAC;IACD,OAAO,SAAkC,CAAA;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,KAAuB,EAAE,KAAa;IAC7D,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAA;IACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClC,IACE,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;QACvC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,EAChD,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,wCAAwC;YACnE,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,yBAAyB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,0CAA0C,EACvE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IACE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,wCAAwC;YACnE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;IACnC,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,sCAAsC,CACpE,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,UAIf,CAAA;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAC9C,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACnD,CAAA;QACD,IACE,CAAC,OAAO;YACR,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAClC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAChC,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI;oBAC3B,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;oBACvC,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;oBAC5C,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;oBAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,iEAAiE;gBAC/D,qEAAqE,CACxE,CAAA;QACH,CAAC;IACH,CAAC;SAAM,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,oEAAoE;QACpE,qEAAqE;QACrE,0EAA0E;QAC1E,eAAe;QACf,MAAM,QAAQ,GAAG,UAEhB,CAAA;QACD,IACE,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAC7B,QAAQ,CAAC,OAAO,KAAK,SAAS;YAC9B,QAAQ,CAAC,OAAO,KAAK,IAAI;YACzB,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;YACpC,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ;YAC3C,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;YACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,wCAAwC;gBACnE,kEAAkE;gBAClE,0BAA0B,CAC7B,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,EACtD,CAAC;QACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,uCAAuC,CACrE,CAAA;IACH,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,uCAAuC;YAClE,gDAAgD,CACnD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,0BAA0B,CACxD,CAAA;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAA;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,KAAuB,EACvB,oBAA4B;IAE5B,OAAO;QACL,SAAS,EAAE,oBAAoB;QAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,kBAA0B,EAC1B,OAAe;IAEf,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrD,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,0CAA0C;YACrE,iBAAiB,CACpB,CAAA;IACH,CAAC;IACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IACtC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;IACnD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,cAAc,EACd,GAAG,EAMJ;IACC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,uEAAuE,CACxE,CAAA;IACH,CAAC;IAED,kEAAkE;IAClE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/B,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,0DAA0D;IAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,UAIrC,CAAA;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAA;IAC1C,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,IAAI,yBAAyB,CACjC,qCAAqC,MAAM,sBAAsB;YAC/D,IAAI,cAAc,IAAI,CACzB,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAChC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,gBAAgB,CAAC,EAC1C,IAAI,CACL,CAAA;IACD,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,yBAAyB,CACjC,oEAAoE,CACrE,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,oBAAoB,GAAG,IAAI,CAAA;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAA;QAC5E,IAAI,KAAK,CAAC,SAAS,KAAK,cAAc,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,KAAK,GAAG,CAAC,8BAA8B;gBAC3D,cAAc,CACjB,CAAA;QACH,CAAC;QACD,oBAAoB,GAAG,KAAK,CAAC,SAAS,CAAA;IACxC,CAAC;IAED,+DAA+D;IAC/D,sCAAsC;IACtC,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IAClD,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAA;QACzB,IAAI,gBAAgB,GAAG,WAAW,CAAA;QAClC,MAAM,SAAS,GAAG,KAAK,EAAE,KAExB,EAAiB,EAAE;YAClB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,eAAe,CACnD,KAAK,CAAC,kBAAkB,IAAI,EAAE,EAC9B,OAAO,CACR,CAAA;YACD,IAAI,GAAG,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC3B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,+BAA+B;oBAC1D,qCAAqC,CACxC,CAAA;YACH,CAAC;YACD,IAAI,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,qCAAqC;oBAChE,gCAAgC,CACnC,CAAA;YACH,CAAC;YACD,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,uCAAuC;oBAClE,aAAa,CAChB,CAAA;YACH,CAAC;YACD,IAAI,WAAW,GAAG,CAAC,CAAA;YACnB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACnD,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;oBACvB,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,iCAAiC;wBAC5D,mBAAmB,CACtB,CAAA;gBACH,CAAC;gBACD,IAAI,WAAW,GAAG,WAAW,EAAE,CAAC;oBAC9B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,kCAAkC;wBAC7D,2CAA2C,CAC9C,CAAA;gBACH,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;YAC9D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,qCAAqC;oBAChE,+DAA+D;oBAC/D,UAAU,CACb,CAAA;YACH,CAAC;YACD,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAA;QAC5D,CAAC,CAAA;QACD,IAAI,CAAC;YACH,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,iBAAiB,CACrB,KAAgD,EAChD;gBACE,QAAQ,EAAE,uBAAuB;gBACjC,SAAS;gBACT,SAAS,EAAE,KAAK,EAAC,kBAAkB,EAAC,EAAE,CAAC,CAAC;oBACtC,kBAAkB,EAAE,eAAe,CAAC,kBAAkB,EAAE,OAAO,CAAC;yBAC7D,YAAY;iBAChB,CAAC;aACH,CACF,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,MAAM,GAAG,CAAA;YACX,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,OAAO,6BAA6B,EAC1D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,WAAW,GAAG,gBAAgB,CAAA;IAChC,CAAC;IAED,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,QAAQ,GAA4C,IAAI,CAAA;IAC5D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACtD,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CACjC,4DAA4D,CAC7D,CAAA;QACH,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,KAAK,CAAA;QAClD,IACE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,kBAAkB,CAAC,gBAAgB,CAAC,EACxE,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,uDAAuD;gBACrD,uDAAuD,CAC1D,CAAA;QACH,CAAC;QACD,QAAQ,GACN,KAAK,CAAC,UACP,CAAC,OAAO,CAAA;IACX,CAAC;IAED,+DAA+D;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IACzC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,OAAO;aACvB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,OAAO;aACvB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,MAAM;QACN,IAAI;QACJ,IAAI;QACJ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;QAC3C,QAAQ;QACR,WAAW,EAAE,iBAAiB,CAAC,WAAW,IAAI,IAAI;KACnD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,KAAK,EACL,SAAS,EAIV;IACC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAAC;YACnC,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;SAC3B,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3D,IACE,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;QACtC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAC1C,SAAS,CAAC,WAAW,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI;QAC1C,WAAW,KAAK,SAAS;QACzB,SAAS,CAAC,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,SAAS,EACpD,CAAC;QACD,MAAM,IAAI,0BAA0B,CAAC;YACnC,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;YAC1B,aAAa,EAAE,SAAS,CAAC,OAAO;SACjC,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/space/collections.d.ts

@@ -91,8 +91,9 @@ export declare const CONTACTS_HISTORY_SPACE_COLLECTION_SPEC: SpaceCollectionSpec
  *   document, so the did:web id is `did:web:<host>:space:<spaceId>:id` and
  *   resolves to `https://<host>/space/<spaceId>/id/did.json`.
  * - `key-map` -- private and capability-gated: the key-id map (`keys.json`)
- *   and the user key wrap-set roster (`user-key.json`). Kept separate from `id` exactly
- *   so `id` can be made world-readable without ever exposing key material.
+ *   and the user key wrap-set roster log (`user-key.jsonl`). Kept separate from
+ *   `id` exactly so `id` can be made world-readable without ever exposing key
+ *   material.
  * - `keyring` -- the unlock Space's single collection, holding the one
  *   keyring record (`keyring.json`). It lives in the minimal unlock Space
  *   controlled by an unlock identity, never in the wallet data Space.
@@ -129,7 +130,7 @@ export declare const WALLET_SPACE_SYNCED_SPECS: SpaceCollectionSpec[];
 /**
  * The provisioned-but-not-synced system collections: part of every wallet
  * Space's layout, but no wallet mints a replication feed for them -- their
- * resources (`did.json`, `keys.json`, `user-key.json`, ...) are read and
+ * resources (`did.json`, `keys.json`, `user-key.jsonl`, ...) are read and
  * written directly. `keyring` is deliberately absent: it lives in the separate
  * unlock Space, never in the wallet data Space this roster lays out.
  */
@@ -159,17 +160,19 @@ export declare const DID_LOG_RESOURCE = "did.jsonl";
  */
 export declare const DID_KEYS_RESOURCE = "keys.json";
 /**
- * The per-user-key (user key) wrap-set roster, sibling of `keys.json` in the
- * same private `key-map` collection: a `CollectionEncryption` descriptor stored
- * verbatim as the resource body, whose current epoch IS the current user key
- * (the epoch id is the user key's did:key; the wrapped secret is the user key's
- * raw key, wrapped to each enrolled client's key-agreement key). Read directly
- * with a compare-and-swap etag -- never replicated.
+ * The resource log governing the user key wrap-set roster, sibling of
+ * `keys.json` in the same private `key-map` collection: the hash-linked
+ * history of the roster descriptor (the Resource Log Profile), JSON Lines,
+ * one signed entry per line. The verified head entry's state is the roster --
+ * a `CollectionEncryption` descriptor whose current epoch IS the current user
+ * key (the epoch id is the user key's did:key; the wrapped secret is the user
+ * key's raw key, wrapped to each enrolled client's key-agreement key). Read
+ * directly with a compare-and-swap etag -- never replicated.
  */
-export declare const USER_KEY_ROSTER_RESOURCE = "user-key.json";
+export declare const USER_KEY_ROSTER_LOG_RESOURCE = "user-key.jsonl";
 /**
  * The enrolled-client display labels, sibling of `keys.json` and
- * `user-key.json` in the same private `key-map` collection: a plain-JSON map
+ * `user-key.jsonl` in the same private `key-map` collection: a plain-JSON map
  * from a client's signing-key multibase to its human-chosen label. Display
  * metadata only -- the did:webvh document carries key material, never labels --
  * and plaintext by the collection's convention: the storage host can read the

package/dist/space/collections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../../src/space/collections.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,iBAAiB,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,8BAA8B,wBAAwB,CAAA;AACnE;;GAEG;AACH,eAAO,MAAM,6BAA6B,uBAAuB,CAAA;AACjE;;GAEG;AACH,eAAO,MAAM,0BAA0B,oBAAoB,CAAA;AAE3D;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,KAAK,GAAG,WAAW,CAAA;IAC/B,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,YAAY,EAAE,SAAS,GAAG,QAAQ,CAAA;IAClC,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAE,mBAOjD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,EAAE,mBAOhD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,EAAE,mBAO7C,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,mBAK5C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,EAAE,mBAKpD,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa;;;CAAiC,CAAA;AAC3D,eAAO,MAAM,kBAAkB;;;CAAqC,CAAA;AACpE,eAAO,MAAM,kBAAkB;;;CAAqC,CAAA;AAEpE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,kBAKhC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,kBAKrC,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAAmB,EAM1D,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,kBAAkB,EAGzD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,kBAAkB,EAG7D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAA;AAC/C;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAC5C;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,kBAAkB,CAAA;AACvD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAA;AAC1D;;GAEG;AACH,eAAO,MAAM,gBAAgB,iBAAiB,CAAA"}
+{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../../src/space/collections.ts"],"names":[],"mappings":"AAyBA;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,iBAAiB,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,8BAA8B,wBAAwB,CAAA;AACnE;;GAEG;AACH,eAAO,MAAM,6BAA6B,uBAAuB,CAAA;AACjE;;GAEG;AACH,eAAO,MAAM,0BAA0B,oBAAoB,CAAA;AAE3D;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,KAAK,GAAG,WAAW,CAAA;IAC/B,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,YAAY,EAAE,SAAS,GAAG,QAAQ,CAAA;IAClC,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAE,mBAOjD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,EAAE,mBAOhD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,EAAE,mBAO7C,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,mBAK5C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,EAAE,mBAKpD,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa;;;CAAiC,CAAA;AAC3D,eAAO,MAAM,kBAAkB;;;CAAqC,CAAA;AACpE,eAAO,MAAM,kBAAkB;;;CAAqC,CAAA;AAEpE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,kBAKhC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,kBAKrC,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAAmB,EAM1D,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,kBAAkB,EAGzD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,kBAAkB,EAG7D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAA;AAC/C;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAC5C;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAA;AAC5D;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAA;AAC1D;;GAEG;AACH,eAAO,MAAM,gBAAgB,iBAAiB,CAAA"}