@interop/wallet-core 0.23.1 → 0.25.0

package/dist/resourceLog/entry.js

@@ -0,0 +1,167 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Resource-log entry construction: the two-pass SCID genesis build and the
+ * ordinary next-entry build, both signed under the writer's enrolled Ed25519
+ * key with the entry anchor riding as a `versionId` DID parameter on the
+ * proof's `verificationMethod` -- the writer anchors at the head of the
+ * controller document as it last verified it. All hashing and proof
+ * construction comes from the did:webvh log kernel; nothing is re-derived
+ * here.
+ */
+import { buildVersionId, createDataIntegrityProofTemplate, deriveHash, parseAndValidateVersionId, SCID_PLACEHOLDER, signDataIntegrityProof, signerFromExternalKey } from '@interop/did-method-webvh';
+/**
+ * The writer's anchored verification-method DID URL: the controller DID, the
+ * anchor at the controller's verified head as a `versionId` DID parameter
+ * (omitted for an unversioned controller), and the signing key's multibase as
+ * the fragment.
+ *
+ * @param options {object}
+ * @param options.controller {ResourceLogController}
+ * @param options.keyMultibase {string}
+ * @returns {string}
+ */
+function anchoredVerificationMethod({ controller, keyMultibase }) {
+    const anchor = controller.versionIds[controller.versionIds.length - 1];
+    const query = anchor === undefined ? '' : `?versionId=${anchor}`;
+    return `${controller.did}${query}#${keyMultibase}`;
+}
+/**
+ * Refuses a state document the profile forbids in an entry: one without a
+ * `type` schema identifier, or one carrying the projection-only `history`
+ * member.
+ *
+ * @param state {ResourceLogEntry['state']}
+ */
+function checkState(state) {
+    if (typeof state.type !== 'string') {
+        throw new Error('A resource log entry state must carry a type schema identifier.');
+    }
+    if ('history' in state) {
+        throw new Error('A resource log entry state must not carry a history member (the ' +
+            'profile reserves that member name).');
+    }
+}
+/**
+ * Signs a fully version-identified entry under the profile's fixed proof
+ * shape.
+ *
+ * @param options {object}
+ * @param options.entry {object}   the entry, `proof` absent
+ * @param options.signer {ResourceLogSigner}
+ * @param options.verificationMethod {string}   the anchored DID URL
+ * @param options.created {string}   the proof timestamp
+ * @returns {Promise<ResourceLogEntry>}
+ */
+async function signEntry({ entry, signer, verificationMethod, created }) {
+    const proofTemplate = createDataIntegrityProofTemplate({
+        verificationMethod,
+        created
+    });
+    const proof = await signDataIntegrityProof(entry, proofTemplate, signerFromExternalKey({
+        publicKeyMultibase: signer.keyMultibase,
+        sign: signer.sign
+    }));
+    // The kernel's proof type keeps proofPurpose as the full union; the
+    // template fixed it to the profile's assertionMethod shape.
+    return { ...entry, proof: [proof] };
+}
+/**
+ * Builds and signs a genesis entry by the profile's two-pass SCID procedure:
+ * the preliminary entry carries the `{SCID}` placeholder as `versionId` and
+ * `parameters.scid`, its hash is the SCID, and the final entry substitutes it
+ * back in before the ordinary entry hash is computed (`versionId` input
+ * value: the SCID).
+ *
+ * @param options {object}
+ * @param options.state {ResourceLogEntry['state']}   the full initial state
+ *   (with its `type`)
+ * @param options.method {string}   the format identifier
+ *   (`WAS_RESOURCE_LOG_METHOD`)
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view -- the anchor source
+ * @param options.signer {ResourceLogSigner}
+ * @param [options.previousLog] {object}   handover successors only: the prior
+ *   log's SCID and the `versionId` of its terminal entry's predecessor
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<ResourceLogEntry>}
+ */
+export async function buildResourceLogGenesis({ state, method, controller, signer, previousLog, versionTime }) {
+    checkState(state);
+    const time = versionTime ?? new Date().toISOString();
+    const parametersOf = (scid) => ({
+        method,
+        scid,
+        ...(previousLog === undefined ? {} : { previousLog })
+    });
+    const scid = await deriveHash({
+        versionId: SCID_PLACEHOLDER,
+        versionTime: time,
+        parameters: parametersOf(SCID_PLACEHOLDER),
+        state
+    });
+    const parameters = parametersOf(scid);
+    const entryHash = await deriveHash({
+        versionId: scid,
+        versionTime: time,
+        parameters,
+        state
+    });
+    return signEntry({
+        entry: {
+            versionId: buildVersionId(1, entryHash),
+            versionTime: time,
+            parameters,
+            state
+        },
+        signer,
+        verificationMethod: anchoredVerificationMethod({
+            controller,
+            keyMultibase: signer.keyMultibase
+        }),
+        created: time
+    });
+}
+/**
+ * Builds and signs the next ordinary entry against a verified head: full
+ * state, empty `parameters`, hash chained off the head's `versionId`, proof
+ * anchored at the controller's verified head. Callers hold a verified head
+ * by construction (an entry is never built on an unverified one).
+ *
+ * @param options {object}
+ * @param options.head {ResourceLogEntry}   the verified head entry
+ * @param options.state {ResourceLogEntry['state']}   the full next state
+ * @param options.controller {ResourceLogController}
+ * @param options.signer {ResourceLogSigner}
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<ResourceLogEntry>}
+ */
+export async function buildResourceLogEntry({ head, state, controller, signer, versionTime }) {
+    checkState(state);
+    const time = versionTime ?? new Date().toISOString();
+    const headOrdinal = Number.parseInt(head.versionId, 10);
+    const ordinal = headOrdinal + 1;
+    parseAndValidateVersionId(head.versionId, headOrdinal);
+    const entryHash = await deriveHash({
+        versionId: head.versionId,
+        versionTime: time,
+        parameters: {},
+        state
+    });
+    return signEntry({
+        entry: {
+            versionId: buildVersionId(ordinal, entryHash),
+            versionTime: time,
+            parameters: {},
+            state
+        },
+        signer,
+        verificationMethod: anchoredVerificationMethod({
+            controller,
+            keyMultibase: signer.keyMultibase
+        }),
+        created: time
+    });
+}
+//# sourceMappingURL=entry.js.map

package/dist/resourceLog/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../src/resourceLog/entry.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EACL,cAAc,EACd,gCAAgC,EAChC,UAAU,EACV,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,2BAA2B,CAAA;AAgBlC;;;;;;;;;;GAUG;AACH,SAAS,0BAA0B,CAAC,EAClC,UAAU,EACV,YAAY,EAIb;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,MAAM,EAAE,CAAA;IAChE,OAAO,GAAG,UAAU,CAAC,GAAG,GAAG,KAAK,IAAI,YAAY,EAAE,CAAA;AACpD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAgC;IAClD,IAAI,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAA;IACH,CAAC;IACD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,qCAAqC,CACxC,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,SAAS,CAAC,EACvB,KAAK,EACL,MAAM,EACN,kBAAkB,EAClB,OAAO,EAMR;IACC,MAAM,aAAa,GAAG,gCAAgC,CAAC;QACrD,kBAAkB;QAClB,OAAO;KACR,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,MAAM,sBAAsB,CACxC,KAAK,EACL,aAAa,EACb,qBAAqB,CAAC;QACpB,kBAAkB,EAAE,MAAM,CAAC,YAAY;QACvC,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CACH,CAAA;IACD,oEAAoE;IACpE,4DAA4D;IAC5D,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,KAA0C,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,KAAK,EACL,MAAM,EACN,UAAU,EACV,MAAM,EACN,WAAW,EACX,WAAW,EAQZ;IACC,UAAU,CAAC,KAAK,CAAC,CAAA;IACjB,MAAM,IAAI,GAAG,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpD,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM;QACN,IAAI;QACJ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC;QAC5B,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,YAAY,CAAC,gBAAgB,CAAC;QAC1C,KAAK;KACN,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;QACjC,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;QACjB,UAAU;QACV,KAAK;KACN,CAAC,CAAA;IACF,OAAO,SAAS,CAAC;QACf,KAAK,EAAE;YACL,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE,SAAS,CAAC;YACvC,WAAW,EAAE,IAAI;YACjB,UAAU;YACV,KAAK;SACN;QACD,MAAM;QACN,kBAAkB,EAAE,0BAA0B,CAAC;YAC7C,UAAU;YACV,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,IAAI,EACJ,KAAK,EACL,UAAU,EACV,MAAM,EACN,WAAW,EAOZ;IACC,UAAU,CAAC,KAAK,CAAC,CAAA;IACjB,MAAM,IAAI,GAAG,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,WAAW,GAAG,CAAC,CAAA;IAC/B,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,EAAE;QACd,KAAK;KACN,CAAC,CAAA;IACF,OAAO,SAAS,CAAC;QACf,KAAK,EAAE;YACL,SAAS,EAAE,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC;YAC7C,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,EAAE;YACd,KAAK;SACN;QACD,MAAM;QACN,kBAAkB,EAAE,0BAA0B,CAAC;YAC7C,UAAU;YACV,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;AACJ,CAAC"}

package/dist/resourceLog/errors.d.ts

@@ -0,0 +1,75 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The resource-log refusal taxonomy, carried over from the roster's WC-1
+ * detached-signature design onto the log design. Two adversarial classes plus
+ * one lifecycle refusal:
+ *
+ * - {@link ResourceLogIntegrityError} -- fabrication: the served log fails
+ *   verification on its own terms (parse shape, SCID, chain hashes, proofs,
+ *   or the external-authorization rule). Whoever produced it could not make a
+ *   log the account's clients would have made.
+ * - {@link ResourceLogContinuityError} -- a served log that verifies but
+ *   conflicts with what this client has already accepted: a rollback behind
+ *   the chain-head pin, a fork off the pinned history, or an SCID/method
+ *   switch outside a verified handover. The log may be internally consistent;
+ *   it is not the continuation of the history this client pinned.
+ * - {@link ResourceLogClosedError} -- an append refused because the verified
+ *   head is a terminal handover entry. Not an attack: the log's own authors
+ *   closed it, and a verifier of this profile must refuse to extend a closed
+ *   log even though nothing currently emits terminal entries.
+ */
+/**
+ * A served log failed verification: malformed entries, a non-verifying SCID,
+ * a broken hash chain, a failing proof, or a signer the controller document
+ * does not back at the entry's anchored version. Fabrication-class: refused
+ * as something no enrolled client produced.
+ */
+export declare class ResourceLogIntegrityError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * A served log conflicts with this client's chain-head pin: `rollback` (the
+ * served head is behind the pinned head -- possibly replication lag; the pin
+ * is never regressed and the caller may retry), `fork` (the served log
+ * diverges from the pinned history -- both logs are transferable evidence of
+ * equivocation, so the served entries ride along), `scid-switch` /
+ * `method-switch` (a different log identity or format under the pinned
+ * location, outside a verified handover).
+ */
+export declare class ResourceLogContinuityError extends Error {
+    reason: 'rollback' | 'fork' | 'scid-switch' | 'method-switch';
+    pinnedHead: string;
+    /**
+     * On a `fork`, the full served log retained as evidence: every entry is
+     * signed, so a conflicting pair of logs under one SCID is transferable,
+     * independently verifiable proof of equivocation.
+     */
+    servedEntries?: unknown[];
+    constructor({ reason, pinnedHead, servedEntries }: {
+        reason: 'rollback' | 'fork' | 'scid-switch' | 'method-switch';
+        pinnedHead: string;
+        servedEntries?: unknown[];
+    });
+}
+/**
+ * An append was refused because the log's verified head is a terminal
+ * handover entry: the log is closed and names a successor, and this profile
+ * forbids extending a history its authors have closed.
+ */
+export declare class ResourceLogClosedError extends Error {
+    nextLog: {
+        method: string;
+        scid: string;
+    };
+    constructor({ nextLog }: {
+        nextLog: {
+            method: string;
+            scid: string;
+        };
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/resourceLog/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;IAC7D,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAA;gBACb,EACV,MAAM,EACN,UAAU,EACV,aAAa,EACd,EAAE;QACD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;QAC7D,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,CAAC,EAAE,OAAO,EAAE,CAAA;KAC1B;CAUF;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;gBAC7B,EAAE,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;CAQvE"}

package/dist/resourceLog/errors.js

@@ -0,0 +1,76 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The resource-log refusal taxonomy, carried over from the roster's WC-1
+ * detached-signature design onto the log design. Two adversarial classes plus
+ * one lifecycle refusal:
+ *
+ * - {@link ResourceLogIntegrityError} -- fabrication: the served log fails
+ *   verification on its own terms (parse shape, SCID, chain hashes, proofs,
+ *   or the external-authorization rule). Whoever produced it could not make a
+ *   log the account's clients would have made.
+ * - {@link ResourceLogContinuityError} -- a served log that verifies but
+ *   conflicts with what this client has already accepted: a rollback behind
+ *   the chain-head pin, a fork off the pinned history, or an SCID/method
+ *   switch outside a verified handover. The log may be internally consistent;
+ *   it is not the continuation of the history this client pinned.
+ * - {@link ResourceLogClosedError} -- an append refused because the verified
+ *   head is a terminal handover entry. Not an attack: the log's own authors
+ *   closed it, and a verifier of this profile must refuse to extend a closed
+ *   log even though nothing currently emits terminal entries.
+ */
+/**
+ * A served log failed verification: malformed entries, a non-verifying SCID,
+ * a broken hash chain, a failing proof, or a signer the controller document
+ * does not back at the entry's anchored version. Fabrication-class: refused
+ * as something no enrolled client produced.
+ */
+export class ResourceLogIntegrityError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'ResourceLogIntegrityError';
+    }
+}
+/**
+ * A served log conflicts with this client's chain-head pin: `rollback` (the
+ * served head is behind the pinned head -- possibly replication lag; the pin
+ * is never regressed and the caller may retry), `fork` (the served log
+ * diverges from the pinned history -- both logs are transferable evidence of
+ * equivocation, so the served entries ride along), `scid-switch` /
+ * `method-switch` (a different log identity or format under the pinned
+ * location, outside a verified handover).
+ */
+export class ResourceLogContinuityError extends Error {
+    reason;
+    pinnedHead;
+    /**
+     * On a `fork`, the full served log retained as evidence: every entry is
+     * signed, so a conflicting pair of logs under one SCID is transferable,
+     * independently verifiable proof of equivocation.
+     */
+    servedEntries;
+    constructor({ reason, pinnedHead, servedEntries }) {
+        super(`The served resource log is not a continuation of the pinned history ` +
+            `(${reason}; pinned head ${pinnedHead}).`);
+        this.name = 'ResourceLogContinuityError';
+        this.reason = reason;
+        this.pinnedHead = pinnedHead;
+        this.servedEntries = servedEntries;
+    }
+}
+/**
+ * An append was refused because the log's verified head is a terminal
+ * handover entry: the log is closed and names a successor, and this profile
+ * forbids extending a history its authors have closed.
+ */
+export class ResourceLogClosedError extends Error {
+    nextLog;
+    constructor({ nextLog }) {
+        super('The resource log is closed by a terminal handover entry; appends must ' +
+            'go to its successor log.');
+        this.name = 'ResourceLogClosedError';
+        this.nextLog = nextLog;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/resourceLog/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,MAAM,CAAuD;IAC7D,UAAU,CAAQ;IAClB;;;;OAIG;IACH,aAAa,CAAY;IACzB,YAAY,EACV,MAAM,EACN,UAAU,EACV,aAAa,EAKd;QACC,KAAK,CACH,sEAAsE;YACpE,IAAI,MAAM,iBAAiB,UAAU,IAAI,CAC5C,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,CAAkC;IACzC,YAAY,EAAE,OAAO,EAAiD;QACpE,KAAK,CACH,wEAAwE;YACtE,0BAA0B,CAC7B,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF"}

package/dist/resourceLog/index.d.ts

@@ -0,0 +1,26 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/resourceLog` entry: the client side of the
+ * Resource Log Profile (App Connect spec `#resource-log-profile`) -- full
+ * chain verification against an adversarial host (parse shape, SCID and
+ * entry-hash recomputation, entry proofs, the external-authorization rule
+ * against the independently verified did:webvh controller document, terminal
+ * entries), the chain-head pin with its continuity rules, the append path
+ * (verified-head build, CAS with rebase-and-retry, read-back confirmation),
+ * and the sealing sweep (the idempotent backstop append that re-anchors a
+ * log's head past the controller's latest membership change).
+ * Transport (JSON Lines, the store seam, the projection write) lives in
+ * `@interop/was-client/log`; the hashing and proof kernel in
+ * `@interop/did-method-webvh`. Kept out of the root export: this subpath
+ * pulls the did:webvh and ed25519 dependency graph.
+ */
+export { webvhResourceLogController, type ResourceLogController } from './controller.js';
+export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
+export { buildResourceLogEntry, buildResourceLogGenesis, type ResourceLogSigner } from './entry.js';
+export { memoryResourceLogPinStore, type ResourceLogHeadPin, type ResourceLogPinStore } from './pin.js';
+export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover, type VerifiedResourceLog } from './verify.js';
+export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
+export { latestAssertionRemovalIndex, sealResourceLog } from './seal.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/resourceLog/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA"}

package/dist/resourceLog/index.js

@@ -0,0 +1,26 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/resourceLog` entry: the client side of the
+ * Resource Log Profile (App Connect spec `#resource-log-profile`) -- full
+ * chain verification against an adversarial host (parse shape, SCID and
+ * entry-hash recomputation, entry proofs, the external-authorization rule
+ * against the independently verified did:webvh controller document, terminal
+ * entries), the chain-head pin with its continuity rules, the append path
+ * (verified-head build, CAS with rebase-and-retry, read-back confirmation),
+ * and the sealing sweep (the idempotent backstop append that re-anchors a
+ * log's head past the controller's latest membership change).
+ * Transport (JSON Lines, the store seam, the projection write) lives in
+ * `@interop/was-client/log`; the hashing and proof kernel in
+ * `@interop/did-method-webvh`. Kept out of the root export: this subpath
+ * pulls the did:webvh and ed25519 dependency graph.
+ */
+export { webvhResourceLogController } from './controller.js';
+export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
+export { buildResourceLogEntry, buildResourceLogGenesis } from './entry.js';
+export { memoryResourceLogPinStore } from './pin.js';
+export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover } from './verify.js';
+export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
+export { latestAssertionRemovalIndex, sealResourceLog } from './seal.js';
+//# sourceMappingURL=index.js.map

package/dist/resourceLog/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAE3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EAG1B,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA"}

package/dist/resourceLog/pin.d.ts

@@ -0,0 +1,44 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The chain-head pin: the client-local durable record of a resource log's
+ * verified identity and latest verified head, kept per log beside the app's
+ * other continuity pins (the account pointer, the roster epoch pin). The pin
+ * is what turns one-shot verification into continuity: a served log whose
+ * SCID or method differs from the pin outside a verified handover, or whose
+ * history is not a descendant of the pinned head, is refused instead of
+ * adopted. Storage is the app's concern (freewallet: beside its other pins in
+ * localStorage; DCW: a table row), so only the seam lives here, plus an
+ * in-memory implementation for tests and single-session use.
+ */
+/**
+ * One log's pin: the format identifier from the genesis `parameters.method`,
+ * the SCID, and the `versionId` of the latest verified head. Established at
+ * first contact (trust-on-first-use of the log's identity), advanced only
+ * after a full verification whose head is the pinned head or a descendant,
+ * and replaced wholesale only across a verified handover.
+ */
+export interface ResourceLogHeadPin {
+    method: string;
+    scid: string;
+    head: string;
+}
+/**
+ * Where a client keeps its chain-head pins, one record per log. `read`
+ * resolves `null` before first contact. Writes happen only on the two legal
+ * transitions (advance after full verification, replace across a verified
+ * handover) -- the verifier never regresses a pin.
+ */
+export interface ResourceLogPinStore {
+    read(): Promise<ResourceLogHeadPin | null>;
+    write(pin: ResourceLogHeadPin): Promise<void>;
+}
+/**
+ * An in-memory pin store: continuity within one session only. Tests use it
+ * as the seam's reference implementation; apps persist for real.
+ *
+ * @returns {ResourceLogPinStore}
+ */
+export declare function memoryResourceLogPinStore(): ResourceLogPinStore;
+//# sourceMappingURL=pin.d.ts.map

package/dist/resourceLog/pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin.d.ts","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IAC1C,KAAK,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAU/D"}

package/dist/resourceLog/pin.js

@@ -0,0 +1,32 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The chain-head pin: the client-local durable record of a resource log's
+ * verified identity and latest verified head, kept per log beside the app's
+ * other continuity pins (the account pointer, the roster epoch pin). The pin
+ * is what turns one-shot verification into continuity: a served log whose
+ * SCID or method differs from the pin outside a verified handover, or whose
+ * history is not a descendant of the pinned head, is refused instead of
+ * adopted. Storage is the app's concern (freewallet: beside its other pins in
+ * localStorage; DCW: a table row), so only the seam lives here, plus an
+ * in-memory implementation for tests and single-session use.
+ */
+/**
+ * An in-memory pin store: continuity within one session only. Tests use it
+ * as the seam's reference implementation; apps persist for real.
+ *
+ * @returns {ResourceLogPinStore}
+ */
+export function memoryResourceLogPinStore() {
+    let pin = null;
+    return {
+        async read() {
+            return pin;
+        },
+        async write(next) {
+            pin = next;
+        }
+    };
+}
+//# sourceMappingURL=pin.js.map

package/dist/resourceLog/pin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin.js","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AA0BH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,GAAG,GAA8B,IAAI,CAAA;IACzC,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAwB;YAClC,GAAG,GAAG,IAAI,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/resourceLog/seal.d.ts

@@ -0,0 +1,86 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The sealing sweep (App Connect spec `#log-authorization`): after a
+ * controller-document edit removes a member's append authority, every
+ * co-managed resource log must gain an entry anchored at (or past) the
+ * post-removal document version -- the "sealing append" that proves the
+ * surviving writers extended the log under the new membership. An ordinary
+ * post-edit write (a roster rotation) is that append by construction; the gap
+ * this module closes is the run where no such write happens -- a rotation
+ * that no-ops because the retiree held no current-epoch wrap (an orphan
+ * client, or any re-run), leaving the log's head still anchored pre-removal.
+ *
+ * Both halves are computed from durable state alone, keeping every cascade's
+ * no-checkpoint convergence rule: the membership change is read off the
+ * controller view (the latest version whose `assertionMethod` set lost a
+ * member against its predecessor -- only assertion removals affect append
+ * authority, so a spent recovery code's `keyAgreement`-only method never
+ * registers here), and the log's side is the verified head's effective anchor
+ * ({@link VerifiedResourceLog}`.headAnchorIndex`). "Sealed" is simply "head
+ * anchor at or past the removal", so the backstop append is idempotent and a
+ * torn sweep is finished by a naive re-run.
+ */
+import type { ResourceLogStore } from '@interop/was-client/log';
+import type { ResourceLogController } from './controller.js';
+import type { ResourceLogSigner } from './entry.js';
+import type { ResourceLogPinStore } from './pin.js';
+import type { VerifiedResourceLog } from './verify.js';
+/**
+ * The controller's latest membership change: the largest index into
+ * `controller.versionIds` whose `assertionMethod` key set LOST a member
+ * against its predecessor's, or `0` when no version ever removed one (the
+ * genesis version has no predecessor and can never register as a removal, so
+ * `0` doubles as "nothing to seal against" -- every anchor satisfies it). An
+ * unversioned controller resolves `0` for the same reason: with no version
+ * history there is no removal to locate.
+ *
+ * @param options {object}
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @returns {Promise<number>}
+ */
+export declare function latestAssertionRemovalIndex({ controller }: {
+    controller: ResourceLogController;
+}): Promise<number>;
+/**
+ * Seals one resource log against the controller's latest membership change,
+ * idempotently: when the verified head already anchors at or past the latest
+ * `assertionMethod` removal (or the controller never removed one, or the log
+ * does not exist yet, or the controller is unversioned) nothing is written;
+ * otherwise the head state is re-appended VERBATIM as a no-op entry whose
+ * only job is its post-removal anchor -- ordinary entries may repeat state
+ * (only terminal entries are state-constrained), so the resource itself is
+ * untouched. A closed log that needs sealing propagates the append path's
+ * `ResourceLogClosedError`.
+ *
+ * `sealed` reports whether this call found the log unsealed (and it now is,
+ * by this call's append or a concurrent writer's -- the rebase hook converges
+ * rather than duplicating); `verified` is the log as last verified, `null`
+ * when it was never read (absent, or nothing to seal against).
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}   the log's transport seam
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @param options.expectedMethod {string}   the format identifier expected
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pin for this log
+ * @param options.signer {ResourceLogSigner}   this client's enrolled signing
+ *   key
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<{ sealed: boolean, verified: VerifiedResourceLog | null }>}
+ */
+export declare function sealResourceLog({ store, controller, expectedMethod, pinStore, signer, versionTime }: {
+    store: ResourceLogStore;
+    controller: ResourceLogController;
+    expectedMethod: string;
+    pinStore: ResourceLogPinStore;
+    signer: ResourceLogSigner;
+    versionTime?: string;
+}): Promise<{
+    sealed: boolean;
+    verified: VerifiedResourceLog | null;
+}>;
+//# sourceMappingURL=seal.d.ts.map

package/dist/resourceLog/seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;CAAE,CAAC,CAwCrE"}