@interop/wallet-core 0.24.0 → 0.25.0

package/dist/request/composeVp.d.ts

@@ -1,9 +1,11 @@
 import type { IDocumentLoader } from '@interop/data-integrity-core';
 import type { IVerifiablePresentation, IVerifiableCredential, IZcap, PresentationSigner } from './types.js';
 /**
- * Shared JSON-LD document loader for presentation and credential signing.
- * Exported so single-VC issuance paths reuse the same context resolution the VP
- * compose path uses.
+ * Shared JSON-LD document loader for presentation and credential signing: the
+ * standard security contexts plus the hosted App Connect context, resolved
+ * from the bundled `byoe-context` document so neither signing nor verification
+ * fetches it. Exported so single-VC issuance paths reuse the same context
+ * resolution the VP compose path uses.
  */
 export declare const documentLoader: IDocumentLoader;
 /**
@@ -25,13 +27,11 @@ export declare const documentLoader: IDocumentLoader;
  *   VP's `zcap` array (before signing, so a DIDAuth proof covers them).
  * @param [options.appConnect] {{ firstRun: boolean }} - App Connect response
  *   marker to embed (before signing, like the grants).
- * @param [options.vocabBaseIri] {string} - Vocabulary base IRI for the embedded
- *   term definitions; defaults to Freewallet's value.
  * @param [options.documentLoader] {IDocumentLoader} - JSON-LD loader; defaults
  *   to the shared security loader.
  * @returns {Promise<IVerifiablePresentation>}
  */
-export declare function composeVp({ presentationSigner, selectedVcs, challenge, domain, didAuthRequested, cryptosuite, zcaps, appConnect, vocabBaseIri, documentLoader: loader }: {
+export declare function composeVp({ presentationSigner, selectedVcs, challenge, domain, didAuthRequested, cryptosuite, zcaps, appConnect, documentLoader: loader }: {
     presentationSigner?: PresentationSigner;
     selectedVcs?: IVerifiableCredential[];
     challenge?: string;
@@ -42,7 +42,6 @@ export declare function composeVp({ presentationSigner, selectedVcs, challenge,
     appConnect?: {
         firstRun: boolean;
     };
-    vocabBaseIri?: string;
     documentLoader?: IDocumentLoader;
 }): Promise<IVerifiablePresentation>;
 /**

package/dist/request/composeVp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composeVp.d.ts","sourceRoot":"","sources":["../../src/request/composeVp.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAGnE,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,EACL,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAEnB;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,eAEnB,CAAA;AA4GV;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,kBAAkB,EAClB,WAAgB,EAChB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,KAAU,EACV,UAAU,EACV,YAAqC,EACrC,cAAc,EAAE,MAAuB,EACxC,EAAE;IACD,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;IACf,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAyDnC;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,kBAAY,CAAA"}
+{"version":3,"file":"composeVp.d.ts","sourceRoot":"","sources":["../../src/request/composeVp.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAGnE,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,EACL,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAEnB;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,eAMzB,CAAA;AAsFJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,kBAAkB,EAClB,WAAgB,EAChB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,KAAU,EACV,UAAU,EACV,cAAc,EAAE,MAAuB,EACxC,EAAE;IACD,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IACvC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;IACf,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAA;IAClC,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAyDnC;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,kBAAY,CAAA"}

package/dist/request/composeVp.js

@@ -18,23 +18,31 @@
  */
 import * as vc from '@interop/vc';
 import { securityLoader } from '@interop/security-document-loader';
+import { contexts as byoeContexts, CONTEXT_URL_V1 } from 'byoe-context';
 import { presentationSuiteFor } from './presentationSuite.js';
 import { presentationVersionFor } from './classify.js';
 /**
- * Shared JSON-LD document loader for presentation and credential signing.
- * Exported so single-VC issuance paths reuse the same context resolution the VP
- * compose path uses.
+ * Shared JSON-LD document loader for presentation and credential signing: the
+ * standard security contexts plus the hosted App Connect context, resolved
+ * from the bundled `byoe-context` document so neither signing nor verification
+ * fetches it. Exported so single-VC issuance paths reuse the same context
+ * resolution the VP compose path uses.
  */
-export const documentLoader = securityLoader({
-    fetchRemoteContexts: true
-}).build();
+export const documentLoader = (() => {
+    const loader = securityLoader({ fetchRemoteContexts: true });
+    for (const [url, context] of byoeContexts) {
+        loader.addStatic(url, context);
+    }
+    return loader.build();
+})();
 /**
- * The default JSON-LD vocabulary base IRI for the embedded-grant term
- * definitions: the shared BYOE vocabulary namespace. This IRI is canonicalized
- * into the DIDAuth proof, so it must be byte-stable. A wallet that embeds
- * grants under a different vocabulary passes its own `vocabBaseIri`.
+ * The hosted App Connect context URL appended to the VP `@context` when grants
+ * or the App Connect response marker are embedded. The context document
+ * defines the `zcap` (`@container: @set`) and `appConnect` (`@type: @json`)
+ * terms, which is what lets JSON-LD safe-mode canonicalization include (rather
+ * than reject) the members, so the authentication proof genuinely covers them.
  */
-const DEFAULT_VOCAB_BASE_IRI = 'https://w3id.org/byoe#';
+const APP_CONNECT_CONTEXT_URL = CONTEXT_URL_V1;
 /**
  * Reads a presentation's `@context` as a mutable array of entries.
  */
@@ -50,58 +58,41 @@ function setContext(presentation, entries) {
     presentation['@context'] = entries;
 }
 /**
- * The bare `zcap` term definition appended to the VP `@context` when grants are
- * embedded. Only the top-level term is defined (mapped to `${vocabBaseIri}zcap`);
- * the zcap sub-contexts are *not* hoisted -- each embedded zcap self-describes
- * via its own `@context`. Defining the term is what lets JSON-LD safe-mode
- * canonicalization include (rather than reject) the grants, so the
- * authentication proof genuinely covers them.
- */
-function zcapTermContext(vocabBaseIri) {
-    return {
-        '@protected': true,
-        zcap: { '@id': `${vocabBaseIri}zcap`, '@container': '@set' }
-    };
-}
-/**
- * The `appConnect` term definition appended to the VP `@context` when an App
- * Connect response marker is embedded. The member is a JSON literal
- * (`@type: '@json'`) so its `firstRun` boolean canonicalizes as one opaque
- * value; embedding happens before signing, so the DIDAuth proof covers the
- * marker the same way it covers the grants.
+ * Appends the hosted App Connect context URL to the presentation's `@context`,
+ * once: a response carrying both grants and the marker still appends a single
+ * entry. Each embedded zcap additionally self-describes via its own
+ * `@context`; the profile context defines only the top-level members.
  */
-function appConnectTermContext(vocabBaseIri) {
-    return {
-        '@protected': true,
-        appConnect: { '@id': `${vocabBaseIri}appConnect`, '@type': '@json' }
-    };
+function appendAppConnectContext(presentation) {
+    const entries = contextEntries(presentation);
+    if (entries.includes(APP_CONNECT_CONTEXT_URL)) {
+        return;
+    }
+    setContext(presentation, [...entries, APP_CONNECT_CONTEXT_URL]);
 }
 /**
- * Embeds the delegated capabilities on the presentation and adds the bare
- * `zcap` term to its `@context`.
+ * Embeds the delegated capabilities on the presentation and appends the App
+ * Connect context that defines the `zcap` term.
  */
-function embedZcaps(presentation, zcaps, vocabBaseIri) {
+function embedZcaps(presentation, zcaps) {
     if (zcaps.length === 0) {
         return;
     }
-    setContext(presentation, [
-        ...contextEntries(presentation),
-        zcapTermContext(vocabBaseIri)
-    ]);
+    appendAppConnectContext(presentation);
     presentation.zcap = zcaps;
 }
 /**
  * Embeds the App Connect response marker (the wallet-provided `firstRun`
- * signal) on the presentation and adds the `appConnect` term to its `@context`.
+ * signal) on the presentation and appends the App Connect context that defines
+ * the `appConnect` term (a JSON literal, so its `firstRun` boolean
+ * canonicalizes as one opaque value; embedding happens before signing, so the
+ * DIDAuth proof covers the marker the same way it covers the grants).
  */
-function embedAppConnect(presentation, appConnect, vocabBaseIri) {
+function embedAppConnect(presentation, appConnect) {
     if (!appConnect) {
         return;
     }
-    setContext(presentation, [
-        ...contextEntries(presentation),
-        appConnectTermContext(vocabBaseIri)
-    ]);
+    appendAppConnectContext(presentation);
     presentation.appConnect = appConnect;
 }
 /**
@@ -123,13 +114,11 @@ function embedAppConnect(presentation, appConnect, vocabBaseIri) {
  *   VP's `zcap` array (before signing, so a DIDAuth proof covers them).
  * @param [options.appConnect] {{ firstRun: boolean }} - App Connect response
  *   marker to embed (before signing, like the grants).
- * @param [options.vocabBaseIri] {string} - Vocabulary base IRI for the embedded
- *   term definitions; defaults to Freewallet's value.
  * @param [options.documentLoader] {IDocumentLoader} - JSON-LD loader; defaults
  *   to the shared security loader.
  * @returns {Promise<IVerifiablePresentation>}
  */
-export async function composeVp({ presentationSigner, selectedVcs = [], challenge, domain, didAuthRequested, cryptosuite, zcaps = [], appConnect, vocabBaseIri = DEFAULT_VOCAB_BASE_IRI, documentLoader: loader = documentLoader }) {
+export async function composeVp({ presentationSigner, selectedVcs = [], challenge, domain, didAuthRequested, cryptosuite, zcaps = [], appConnect, documentLoader: loader = documentLoader }) {
     if (!didAuthRequested && selectedVcs.length === 0 && zcaps.length === 0) {
         throw new Error('A VP requires credentials, capabilities, or a DID Auth request.');
     }
@@ -147,8 +136,8 @@ export async function composeVp({ presentationSigner, selectedVcs = [], challeng
             verify: false,
             version: presentationVersionFor(selectedVcs)
         });
-        embedZcaps(presentation, zcaps, vocabBaseIri);
-        embedAppConnect(presentation, appConnect, vocabBaseIri);
+        embedZcaps(presentation, zcaps);
+        embedAppConnect(presentation, appConnect);
         return presentation;
     }
     if (!presentationSigner) {
@@ -169,8 +158,8 @@ export async function composeVp({ presentationSigner, selectedVcs = [], challeng
     // Embed the grants (and any App Connect marker) before signing so the
     // authentication proof covers them; the grants additionally self-authenticate
     // via their own delegation proofs and carry their own `@context`.
-    embedZcaps(presentation, zcaps, vocabBaseIri);
-    embedAppConnect(presentation, appConnect, vocabBaseIri);
+    embedZcaps(presentation, zcaps);
+    embedAppConnect(presentation, appConnect);
     return (await vc.signPresentation({
         presentation,
         challenge,

package/dist/request/composeVp.js.map

@@ -1 +1 @@
-{"version":3,"file":"composeVp.js","sourceRoot":"","sources":["../../src/request/composeVp.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAQtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB,cAAc,CAAC;IAC5D,mBAAmB,EAAE,IAAI;CAC1B,CAAC,CAAC,KAAK,EAAE,CAAA;AAEV;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,wBAAwB,CAAA;AAavD;;GAEG;AACH,SAAS,cAAc,CACrB,YAAmC;IAEnC,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAoC,CAAA;IACxE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AACjD,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CACjB,YAAmC,EACnC,OAA+B;IAE/B,CAAC;IAAC,YAAwC,CAAC,UAAU,CAAC,GAAG,OAAO,CAAA;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,YAAoB;IAC3C,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE;KAC7D,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,YAAoB;IACjD,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE;KACrE,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,YAAmC,EACnC,KAAc,EACd,YAAoB;IAEpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAM;IACR,CAAC;IACD,UAAU,CAAC,YAAY,EAAE;QACvB,GAAG,cAAc,CAAC,YAAY,CAAC;QAC/B,eAAe,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAA;IACF,YAAY,CAAC,IAAI,GAAG,KAAK,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,YAAmC,EACnC,UAA6C,EAC7C,YAAoB;IAEpB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAM;IACR,CAAC;IACD,UAAU,CAAC,YAAY,EAAE;QACvB,GAAG,cAAc,CAAC,YAAY,CAAC;QAC/B,qBAAqB,CAAC,YAAY,CAAC;KACpC,CAAC,CAAA;IACF,YAAY,CAAC,UAAU,GAAG,UAAU,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,kBAAkB,EAClB,WAAW,GAAG,EAAE,EAChB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,KAAK,GAAG,EAAE,EACV,UAAU,EACV,YAAY,GAAG,sBAAsB,EACrC,cAAc,EAAE,MAAM,GAAG,cAAc,EAYxC;IACC,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAA;IACH,CAAC;IACD,IAAI,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC;YACzC,oBAAoB,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YACtE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,sBAAsB,CAAC,WAAW,CAAC;SAC7C,CAA0B,CAAA;QAC3B,UAAU,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;QAC7C,eAAe,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;QACvD,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAA;IAE7C,8DAA8D;IAC9D,yEAAyE;IACzE,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IAExE,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC;QACzC,MAAM;QACN,oBAAoB,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACtE,MAAM,EAAE,KAAK;QACb,OAAO;KACR,CAA0B,CAAA;IAE3B,sEAAsE;IACtE,8EAA8E;IAC9E,kEAAkE;IAClE,UAAU,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;IAC7C,eAAe,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;IAEvD,OAAO,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC;QAChC,YAAY;QACZ,SAAS;QACT,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,cAAc,EAAE,MAAM;QACtB,KAAK;KACN,CAAC,CAA4B,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAA"}
+{"version":3,"file":"composeVp.js","sourceRoot":"","sources":["../../src/request/composeVp.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAEvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAQtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB,CAAC,GAAG,EAAE;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,YAAY,EAAE,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,EAAE,CAAA;AACvB,CAAC,CAAC,EAAE,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,cAAc,CAAA;AAa9C;;GAEG;AACH,SAAS,cAAc,CACrB,YAAmC;IAEnC,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAoC,CAAA;IACxE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AACjD,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CACjB,YAAmC,EACnC,OAA+B;IAE/B,CAAC;IAAC,YAAwC,CAAC,UAAU,CAAC,GAAG,OAAO,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,YAAmC;IAClE,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,CAAC,CAAA;IAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9C,OAAM;IACR,CAAC;IACD,UAAU,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,YAAmC,EAAE,KAAc;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAM;IACR,CAAC;IACD,uBAAuB,CAAC,YAAY,CAAC,CAAA;IACrC,YAAY,CAAC,IAAI,GAAG,KAAK,CAAA;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACtB,YAAmC,EACnC,UAA6C;IAE7C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAM;IACR,CAAC;IACD,uBAAuB,CAAC,YAAY,CAAC,CAAA;IACrC,YAAY,CAAC,UAAU,GAAG,UAAU,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,kBAAkB,EAClB,WAAW,GAAG,EAAE,EAChB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,KAAK,GAAG,EAAE,EACV,UAAU,EACV,cAAc,EAAE,MAAM,GAAG,cAAc,EAWxC;IACC,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAA;IACH,CAAC;IACD,IAAI,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC;YACzC,oBAAoB,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YACtE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,sBAAsB,CAAC,WAAW,CAAC;SAC7C,CAA0B,CAAA;QAC3B,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAC/B,eAAe,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;QACzC,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAA;IAE7C,8DAA8D;IAC9D,yEAAyE;IACzE,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IAExE,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC;QACzC,MAAM;QACN,oBAAoB,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACtE,MAAM,EAAE,KAAK;QACb,OAAO;KACR,CAA0B,CAAA;IAE3B,sEAAsE;IACtE,8EAA8E;IAC9E,kEAAkE;IAClE,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;IAC/B,eAAe,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAEzC,OAAO,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC;QAChC,YAAY;QACZ,SAAS;QACT,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,cAAc,EAAE,MAAM;QACtB,KAAK;KACN,CAAC,CAA4B,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAA"}

package/dist/request/processRequest.d.ts

@@ -31,18 +31,15 @@ export declare function domainMatchesOrigin({ domain, origin }: {
  *   App Connect processors.
  * @param [options.cryptosuite] {string} - Cryptosuite override; when absent it
  *   is negotiated from the request's `acceptedCryptosuites`.
- * @param [options.vocabBaseIri] {string} - Vocabulary base IRI passed through to
- *   {@link composeVp} for embedded-grant term definitions.
  * @returns {Promise<WalletResponse>} The response VP (and any granted zcaps), or
  *   `{}` when there is nothing to send.
  */
-export declare function processRequest({ request, presentationSigner, selectedVCs, credentialRequestOrigin, processors, cryptosuite, vocabBaseIri }: {
+export declare function processRequest({ request, presentationSigner, selectedVCs, credentialRequestOrigin, processors, cryptosuite }: {
     request: IVPRDetails;
     presentationSigner: PresentationSigner;
     selectedVCs?: IVerifiableCredential[];
     credentialRequestOrigin?: string;
     processors?: RequestProcessors;
     cryptosuite?: string;
-    vocabBaseIri?: string;
 }): Promise<WalletResponse>;
 //# sourceMappingURL=processRequest.d.ts.map

package/dist/request/processRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"processRequest.d.ts","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EAEX,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACf,MAAM,YAAY,CAAA;AAkBnB;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAOV;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACX,YAAY,EACb,EAAE;IACD,OAAO,EAAE,WAAW,CAAA;IACpB,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmF1B"}
+{"version":3,"file":"processRequest.d.ts","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EAEX,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACf,MAAM,YAAY,CAAA;AAkBnB;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAOV;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,WAAW,CAAA;IACpB,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,cAAc,CAAC,CAkF1B"}

package/dist/request/processRequest.js

@@ -70,12 +70,10 @@ export function domainMatchesOrigin({ domain, origin }) {
  *   App Connect processors.
  * @param [options.cryptosuite] {string} - Cryptosuite override; when absent it
  *   is negotiated from the request's `acceptedCryptosuites`.
- * @param [options.vocabBaseIri] {string} - Vocabulary base IRI passed through to
- *   {@link composeVp} for embedded-grant term definitions.
  * @returns {Promise<WalletResponse>} The response VP (and any granted zcaps), or
  *   `{}` when there is nothing to send.
  */
-export async function processRequest({ request, presentationSigner, selectedVCs = [], credentialRequestOrigin, processors, cryptosuite, vocabBaseIri }) {
+export async function processRequest({ request, presentationSigner, selectedVCs = [], credentialRequestOrigin, processors, cryptosuite }) {
     const { didAuth, zcapRequests } = classifyRequest(request);
     const queries = queriesOf(request);
     const { challenge, domain } = request;
@@ -137,8 +135,7 @@ export async function processRequest({ request, presentationSigner, selectedVCs
         domain,
         didAuthRequested: didAuth,
         cryptosuite: negotiatedCryptosuite,
-        zcaps,
-        ...(vocabBaseIri !== undefined && { vocabBaseIri })
+        zcaps
     });
     // Return the delegated capabilities alongside the VP so the caller can log
     // exactly what was granted from these objects, rather than reading them back

package/dist/request/processRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"processRequest.js","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAU7D;;;GAGG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;YAChB,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAA;QAC/B,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EAIP;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,CAAC,CAAC,UAAU,IAAI,UAAU,KAAK,UAAU,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAW,GAAG,EAAE,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACX,YAAY,EASb;IACC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACrC,8EAA8E;IAC9E,gCAAgC;IAChC,MAAM,qBAAqB,GAAG,WAAW,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAE1E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,IACE,MAAM;QACN,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,kCAAkC;YAC1D,IAAI,uBAAuB,IAAI,CAClC,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CACtC,KAAK,CAAC,EAAE,CAAE,KAAK,CAAC,IAAe,KAAK,iBAAiB,CACtD,CAAA;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,+DAA+D;gBAC7D,yBAAyB,CAC5B,CAAA;QACH,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,UAAU,GAAG,mBAAmB,CAAC;YACrC,OAAO;YACP,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,CAAC;YAClC,OAAO;YACP,UAAU;YACV,MAAM,EAAE,uBAAuB;YAC/B,SAAS;YACT,MAAM;YACN,gBAAgB,EAAE,OAAO;YACzB,WAAW,EAAE,qBAAqB;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,KAAK,GACT,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,YAAY;QACjD,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;QACjD,CAAC,CAAC,EAAE,CAAA;IAER,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,mEAAmE;QACnE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,SAAS,CAAC;QAC7C,kBAAkB;QAClB,WAAW,EAAE,WAAW;QACxB,SAAS;QACT,MAAM;QACN,gBAAgB,EAAE,OAAO;QACzB,WAAW,EAAE,qBAAqB;QAClC,KAAK;QACL,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;KACpD,CAAC,CAAA;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,uBAAuB;IACvB,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAA;AAC1C,CAAC"}
+{"version":3,"file":"processRequest.js","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAU7D;;;GAGG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;YAChB,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAA;QAC/B,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EAIP;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,CAAC,CAAC,UAAU,IAAI,UAAU,KAAK,UAAU,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAW,GAAG,EAAE,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EAQZ;IACC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACrC,8EAA8E;IAC9E,gCAAgC;IAChC,MAAM,qBAAqB,GAAG,WAAW,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAE1E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,IACE,MAAM;QACN,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,kCAAkC;YAC1D,IAAI,uBAAuB,IAAI,CAClC,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CACtC,KAAK,CAAC,EAAE,CAAE,KAAK,CAAC,IAAe,KAAK,iBAAiB,CACtD,CAAA;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,+DAA+D;gBAC7D,yBAAyB,CAC5B,CAAA;QACH,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,UAAU,GAAG,mBAAmB,CAAC;YACrC,OAAO;YACP,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,CAAC;YAClC,OAAO;YACP,UAAU;YACV,MAAM,EAAE,uBAAuB;YAC/B,SAAS;YACT,MAAM;YACN,gBAAgB,EAAE,OAAO;YACzB,WAAW,EAAE,qBAAqB;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,KAAK,GACT,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,YAAY;QACjD,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;QACjD,CAAC,CAAC,EAAE,CAAA;IAER,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,mEAAmE;QACnE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,SAAS,CAAC;QAC7C,kBAAkB;QAClB,WAAW,EAAE,WAAW;QACxB,SAAS;QACT,MAAM;QACN,gBAAgB,EAAE,OAAO;QACzB,WAAW,EAAE,qBAAqB;QAClC,KAAK;KACN,CAAC,CAAA;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,uBAAuB;IACvB,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAA;AAC1C,CAAC"}

package/dist/resourceLog/index.d.ts

@@ -7,8 +7,10 @@
  * chain verification against an adversarial host (parse shape, SCID and
  * entry-hash recomputation, entry proofs, the external-authorization rule
  * against the independently verified did:webvh controller document, terminal
- * entries), the chain-head pin with its continuity rules, and the append path
- * (verified-head build, CAS with rebase-and-retry, read-back confirmation).
+ * entries), the chain-head pin with its continuity rules, the append path
+ * (verified-head build, CAS with rebase-and-retry, read-back confirmation),
+ * and the sealing sweep (the idempotent backstop append that re-anchors a
+ * log's head past the controller's latest membership change).
  * Transport (JSON Lines, the store seam, the projection write) lives in
  * `@interop/was-client/log`; the hashing and proof kernel in
  * `@interop/did-method-webvh`. Kept out of the root export: this subpath
@@ -20,4 +22,5 @@ export { buildResourceLogEntry, buildResourceLogGenesis, type ResourceLogSigner
 export { memoryResourceLogPinStore, type ResourceLogHeadPin, type ResourceLogPinStore } from './pin.js';
 export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover, type VerifiedResourceLog } from './verify.js';
 export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
+export { latestAssertionRemovalIndex, sealResourceLog } from './seal.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/resourceLog/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA"}

package/dist/resourceLog/index.js

@@ -7,8 +7,10 @@
  * chain verification against an adversarial host (parse shape, SCID and
  * entry-hash recomputation, entry proofs, the external-authorization rule
  * against the independently verified did:webvh controller document, terminal
- * entries), the chain-head pin with its continuity rules, and the append path
- * (verified-head build, CAS with rebase-and-retry, read-back confirmation).
+ * entries), the chain-head pin with its continuity rules, the append path
+ * (verified-head build, CAS with rebase-and-retry, read-back confirmation),
+ * and the sealing sweep (the idempotent backstop append that re-anchors a
+ * log's head past the controller's latest membership change).
  * Transport (JSON Lines, the store seam, the projection write) lives in
  * `@interop/was-client/log`; the hashing and proof kernel in
  * `@interop/did-method-webvh`. Kept out of the root export: this subpath
@@ -20,4 +22,5 @@ export { buildResourceLogEntry, buildResourceLogGenesis } from './entry.js';
 export { memoryResourceLogPinStore } from './pin.js';
 export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover } from './verify.js';
 export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
+export { latestAssertionRemovalIndex, sealResourceLog } from './seal.js';
 //# sourceMappingURL=index.js.map

package/dist/resourceLog/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,0BAA0B,EAE3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EAG1B,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAE3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EAG1B,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA"}

package/dist/resourceLog/seal.d.ts

@@ -0,0 +1,86 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The sealing sweep (App Connect spec `#log-authorization`): after a
+ * controller-document edit removes a member's append authority, every
+ * co-managed resource log must gain an entry anchored at (or past) the
+ * post-removal document version -- the "sealing append" that proves the
+ * surviving writers extended the log under the new membership. An ordinary
+ * post-edit write (a roster rotation) is that append by construction; the gap
+ * this module closes is the run where no such write happens -- a rotation
+ * that no-ops because the retiree held no current-epoch wrap (an orphan
+ * client, or any re-run), leaving the log's head still anchored pre-removal.
+ *
+ * Both halves are computed from durable state alone, keeping every cascade's
+ * no-checkpoint convergence rule: the membership change is read off the
+ * controller view (the latest version whose `assertionMethod` set lost a
+ * member against its predecessor -- only assertion removals affect append
+ * authority, so a spent recovery code's `keyAgreement`-only method never
+ * registers here), and the log's side is the verified head's effective anchor
+ * ({@link VerifiedResourceLog}`.headAnchorIndex`). "Sealed" is simply "head
+ * anchor at or past the removal", so the backstop append is idempotent and a
+ * torn sweep is finished by a naive re-run.
+ */
+import type { ResourceLogStore } from '@interop/was-client/log';
+import type { ResourceLogController } from './controller.js';
+import type { ResourceLogSigner } from './entry.js';
+import type { ResourceLogPinStore } from './pin.js';
+import type { VerifiedResourceLog } from './verify.js';
+/**
+ * The controller's latest membership change: the largest index into
+ * `controller.versionIds` whose `assertionMethod` key set LOST a member
+ * against its predecessor's, or `0` when no version ever removed one (the
+ * genesis version has no predecessor and can never register as a removal, so
+ * `0` doubles as "nothing to seal against" -- every anchor satisfies it). An
+ * unversioned controller resolves `0` for the same reason: with no version
+ * history there is no removal to locate.
+ *
+ * @param options {object}
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @returns {Promise<number>}
+ */
+export declare function latestAssertionRemovalIndex({ controller }: {
+    controller: ResourceLogController;
+}): Promise<number>;
+/**
+ * Seals one resource log against the controller's latest membership change,
+ * idempotently: when the verified head already anchors at or past the latest
+ * `assertionMethod` removal (or the controller never removed one, or the log
+ * does not exist yet, or the controller is unversioned) nothing is written;
+ * otherwise the head state is re-appended VERBATIM as a no-op entry whose
+ * only job is its post-removal anchor -- ordinary entries may repeat state
+ * (only terminal entries are state-constrained), so the resource itself is
+ * untouched. A closed log that needs sealing propagates the append path's
+ * `ResourceLogClosedError`.
+ *
+ * `sealed` reports whether this call found the log unsealed (and it now is,
+ * by this call's append or a concurrent writer's -- the rebase hook converges
+ * rather than duplicating); `verified` is the log as last verified, `null`
+ * when it was never read (absent, or nothing to seal against).
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}   the log's transport seam
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @param options.expectedMethod {string}   the format identifier expected
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pin for this log
+ * @param options.signer {ResourceLogSigner}   this client's enrolled signing
+ *   key
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<{ sealed: boolean, verified: VerifiedResourceLog | null }>}
+ */
+export declare function sealResourceLog({ store, controller, expectedMethod, pinStore, signer, versionTime }: {
+    store: ResourceLogStore;
+    controller: ResourceLogController;
+    expectedMethod: string;
+    pinStore: ResourceLogPinStore;
+    signer: ResourceLogSigner;
+    versionTime?: string;
+}): Promise<{
+    sealed: boolean;
+    verified: VerifiedResourceLog | null;
+}>;
+//# sourceMappingURL=seal.d.ts.map

package/dist/resourceLog/seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;CAAE,CAAC,CAwCrE"}

package/dist/resourceLog/seal.js

@@ -0,0 +1,99 @@
+import { appendResourceLog, readResourceLog } from './append.js';
+/**
+ * The controller's latest membership change: the largest index into
+ * `controller.versionIds` whose `assertionMethod` key set LOST a member
+ * against its predecessor's, or `0` when no version ever removed one (the
+ * genesis version has no predecessor and can never register as a removal, so
+ * `0` doubles as "nothing to seal against" -- every anchor satisfies it). An
+ * unversioned controller resolves `0` for the same reason: with no version
+ * history there is no removal to locate.
+ *
+ * @param options {object}
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @returns {Promise<number>}
+ */
+export async function latestAssertionRemovalIndex({ controller }) {
+    let removalIndex = 0;
+    let previous = null;
+    for (const [index, versionId] of controller.versionIds.entries()) {
+        const keys = await controller.assertionKeysAt(versionId);
+        if (previous !== null) {
+            for (const key of previous) {
+                if (!keys.has(key)) {
+                    removalIndex = index;
+                    break;
+                }
+            }
+        }
+        previous = keys;
+    }
+    return removalIndex;
+}
+/**
+ * Seals one resource log against the controller's latest membership change,
+ * idempotently: when the verified head already anchors at or past the latest
+ * `assertionMethod` removal (or the controller never removed one, or the log
+ * does not exist yet, or the controller is unversioned) nothing is written;
+ * otherwise the head state is re-appended VERBATIM as a no-op entry whose
+ * only job is its post-removal anchor -- ordinary entries may repeat state
+ * (only terminal entries are state-constrained), so the resource itself is
+ * untouched. A closed log that needs sealing propagates the append path's
+ * `ResourceLogClosedError`.
+ *
+ * `sealed` reports whether this call found the log unsealed (and it now is,
+ * by this call's append or a concurrent writer's -- the rebase hook converges
+ * rather than duplicating); `verified` is the log as last verified, `null`
+ * when it was never read (absent, or nothing to seal against).
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}   the log's transport seam
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @param options.expectedMethod {string}   the format identifier expected
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pin for this log
+ * @param options.signer {ResourceLogSigner}   this client's enrolled signing
+ *   key
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<{ sealed: boolean, verified: VerifiedResourceLog | null }>}
+ */
+export async function sealResourceLog({ store, controller, expectedMethod, pinStore, signer, versionTime }) {
+    if (controller.versionIds.length === 0) {
+        return { sealed: false, verified: null };
+    }
+    const removalIndex = await latestAssertionRemovalIndex({ controller });
+    if (removalIndex === 0) {
+        return { sealed: false, verified: null };
+    }
+    const current = await readResourceLog({
+        store,
+        controller,
+        expectedMethod,
+        pinStore
+    });
+    if (current === null) {
+        return { sealed: false, verified: null };
+    }
+    const { verified } = current;
+    if (verified.headAnchorIndex !== null &&
+        verified.headAnchorIndex >= removalIndex) {
+        return { sealed: false, verified };
+    }
+    const confirmed = await appendResourceLog({
+        store,
+        controller,
+        expectedMethod,
+        pinStore,
+        signer,
+        // The rebase hook doubles as the convergence check: a concurrent writer
+        // whose entry already anchors past the removal sealed the log for us.
+        buildState: rebased => rebased.headAnchorIndex !== null &&
+            rebased.headAnchorIndex >= removalIndex
+            ? null
+            : rebased.head.state,
+        ...(versionTime === undefined ? {} : { versionTime })
+    });
+    return { sealed: true, verified: confirmed };
+}
+//# sourceMappingURL=seal.js.map

package/dist/resourceLog/seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAMhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,UAAU,EAGX;IACC,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,QAAQ,GAAuB,IAAI,CAAA;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;QACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnB,YAAY,GAAG,KAAK,CAAA;oBACpB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,WAAW,EAQZ;IACC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc;QACd,QAAQ;KACT,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC5B,IACE,QAAQ,CAAC,eAAe,KAAK,IAAI;QACjC,QAAQ,CAAC,eAAe,IAAI,YAAY,EACxC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACxC,KAAK;QACL,UAAU;QACV,cAAc;QACd,QAAQ;QACR,MAAM;QACN,wEAAwE;QACxE,sEAAsE;QACtE,UAAU,EAAE,OAAO,CAAC,EAAE,CACpB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,OAAO,CAAC,eAAe,IAAI,YAAY;YACrC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK;QACxB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AAC9C,CAAC"}

package/dist/resourceLog/verify.d.ts

@@ -7,7 +7,12 @@ import type { ResourceLogHeadPin } from './pin.js';
  * `pin` is the record the caller must store as its new chain-head pin.
  * `terminal` is the head's `nextLog` when the log is closed by a handover
  * entry (appends must be refused), `previousLog` the genesis back-reference
- * when this log is a handover successor.
+ * when this log is a handover successor. `headAnchorIndex` is the head's
+ * effective anchor -- the verifier's anchor floor after the whole loop, which
+ * monotonicity makes the head entry's own anchor -- as an index into the
+ * controller's `versionIds` (`null` on an unversioned controller, whose
+ * entries carry no anchors); the sealing sweep compares it against the
+ * controller's latest membership change.
  */
 export interface VerifiedResourceLog {
     entries: ResourceLogEntry[];
@@ -16,6 +21,7 @@ export interface VerifiedResourceLog {
     head: ResourceLogEntry;
     state: ResourceLogEntry['state'];
     pin: ResourceLogHeadPin;
+    headAnchorIndex: number | null;
     terminal: {
         method: string;
         scid: string;

package/dist/resourceLog/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/resourceLog/verify.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAalD;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAChC,GAAG,EAAE,kBAAkB,CAAA;IACvB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACjD,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CACnD;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAM3E;AAwOD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,cAAc,EACd,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+M/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,KAAK,EACL,SAAS,EACV,EAAE;IACD,KAAK,EAAE,mBAAmB,CAAA;IAC1B,SAAS,EAAE,mBAAmB,CAAA;CAC/B,GAAG,IAAI,CAqBP"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/resourceLog/verify.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAalD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAChC,GAAG,EAAE,kBAAkB,CAAA;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACjD,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CACnD;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAM3E;AAwOD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,cAAc,EACd,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgN/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,KAAK,EACL,SAAS,EACV,EAAE;IACD,KAAK,EAAE,mBAAmB,CAAA;IAC1B,SAAS,EAAE,mBAAmB,CAAA;CAC/B,GAAG,IAAI,CAqBP"}

package/dist/resourceLog/verify.js

@@ -390,6 +390,7 @@ export async function verifyResourceLog({ entries, controller, expectedMethod, p
         head,
         state: head.state,
         pin: { method, scid, head: head.versionId },
+        headAnchorIndex: versioned ? anchorFloor : null,
         terminal,
         previousLog: genesisParameters.previousLog ?? null
     };