@interop/wallet-core 0.31.0 → 0.33.0

package/dist/webvh/verifyLog.d.ts

@@ -1,4 +1,5 @@
 import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
+import type { ResourceLogHeadPin, ResourceLogPinStore } from '../resourceLog/pin.js';
 /**
  * Thrown when the account has published no DID log at all (the resource is
  * absent). Distinguished from every other failure because it is the one
@@ -9,6 +10,29 @@ import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
 export declare class AccountLogMissingError extends Error {
     constructor(message?: string);
 }
+/**
+ * Refuses a served log that conflicts with the pinned head, and returns the
+ * pin the served log establishes. A method or SCID that differs from the pin
+ * is a substituted log under the account's location; a served history shorter
+ * than the pinned ordinal is a rollback; a differing `versionId` at the pinned
+ * ordinal is a fork, whose served entries ride along as evidence (every entry
+ * is signed, so a conflicting pair under one SCID is transferable proof of
+ * equivocation). A pin whose head does not parse as `N-<hash>` is treated as
+ * a fork rather than trusted.
+ *
+ * Exported for the ceremony-side reads in `didWebvh.ts`, which take the same
+ * check on their own read of `did.jsonl`; it is deliberately absent from the
+ * module barrel.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the served, already-resolved log
+ * @param options.pin {ResourceLogHeadPin | null}   the pin held for this log
+ * @returns {ResourceLogHeadPin}   the pin the served log establishes
+ */
+export declare function checkAccountLogContinuity({ log, pin }: {
+    log: DIDLog;
+    pin: ResourceLogHeadPin | null;
+}): ResourceLogHeadPin;
 /**
  * Fetches and locally verifies the account's world-readable DID log.
  *
@@ -16,18 +40,34 @@ export declare class AccountLogMissingError extends Error {
  * an ordinary error when the fetch fails, the log does not resolve, or it
  * resolves to a DID other than the one named.
  *
+ * Supplied a `pinStore`, the resolved log is additionally checked for
+ * continuity against this client's chain-head pin and refused with a
+ * {@link ResourceLogContinuityError} when it is a rollback, a fork, or an
+ * SCID/method switch; the pin is established at first contact
+ * (trust-on-first-use) and advanced only by a log that verifies past it,
+ * never regressed. A `rollback` is the one refusal that may be nothing worse
+ * than replication lag, exactly as on a governed resource log: nothing
+ * rolled back is ever adopted here, and a caller holding a cached view of the
+ * document may treat that reason as a transport hiccup and carry on with what
+ * it has. Every other reason is a security signal. No `pinStore`, no
+ * continuity check -- the pin lives app-side beside the account-pointer pin,
+ * and a caller that has none keeps one-shot verification.
+ *
  * @param options {object}
  * @param options.did {string}   the account's did:webvh, as the caller's
  *   stored account pointer names it
  * @param options.spaceId {string}   the account's Space id
  * @param options.host {string}   the storage server the account lives on
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pin for the account log
  * @returns {Promise<object>}   the resolved document, the raw log, and the
  *   log's effective `updateKeys` / `nextKeyHashes`
  */
-export declare function verifyAccountLog({ did, spaceId, host }: {
+export declare function verifyAccountLog({ did, spaceId, host, pinStore }: {
     did: string;
     spaceId: string;
     host: string;
+    pinStore?: ResourceLogPinStore;
 }): Promise<{
     doc: DIDDoc;
     log: DIDLog;

package/dist/webvh/verifyLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLog.d.ts","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAG/D;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0C;CAI9D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACL,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB,CAAC,CAmCD"}
+{"version":3,"file":"verifyLog.d.ts","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAG/D,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAE9B;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0C;CAI9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAC/B,GAAG,kBAAkB,CA4CrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB,CAAC,CA4CD"}

package/dist/webvh/verifyLog.js

@@ -16,9 +16,19 @@
  * caller supplies the DID it expects; a resolved DID that does not match is
  * the substituted-account refusal, and the only thing the transport could
  * ever buy back.
+ *
+ * Resolution alone is one-shot verification, though: a host serving a valid
+ * PREFIX of the real log serves the same SCID and the same DID, so a
+ * truncated history passes every check above and a ceremony built on it
+ * republishes erased enrollments and undone revocations as durable state. The
+ * remedy is the same chain-head pin the governed resource logs carry, and
+ * literally the same seam and refusal class: a caller that supplies a
+ * {@link ResourceLogPinStore} gets a served log refused when it is a
+ * rollback, a fork, or an SCID/method switch relative to the pinned head.
  */
 import { readLogFromString, resolveDIDFromLog } from '@interop/did-method-webvh';
 import { DID_LOG_RESOURCE, ID_COLLECTION } from '../space/collections.js';
+import { ResourceLogContinuityError } from '../resourceLog/errors.js';
 /**
  * Thrown when the account has published no DID log at all (the resource is
  * absent). Distinguished from every other failure because it is the one
@@ -32,6 +42,70 @@ export class AccountLogMissingError extends Error {
         this.name = 'AccountLogMissingError';
     }
 }
+/**
+ * Refuses a served log that conflicts with the pinned head, and returns the
+ * pin the served log establishes. A method or SCID that differs from the pin
+ * is a substituted log under the account's location; a served history shorter
+ * than the pinned ordinal is a rollback; a differing `versionId` at the pinned
+ * ordinal is a fork, whose served entries ride along as evidence (every entry
+ * is signed, so a conflicting pair under one SCID is transferable proof of
+ * equivocation). A pin whose head does not parse as `N-<hash>` is treated as
+ * a fork rather than trusted.
+ *
+ * Exported for the ceremony-side reads in `didWebvh.ts`, which take the same
+ * check on their own read of `did.jsonl`; it is deliberately absent from the
+ * module barrel.
+ *
+ * @param options {object}
+ * @param options.log {DIDLog}   the served, already-resolved log
+ * @param options.pin {ResourceLogHeadPin | null}   the pin held for this log
+ * @returns {ResourceLogHeadPin}   the pin the served log establishes
+ */
+export function checkAccountLogContinuity({ log, pin }) {
+    const genesis = log[0];
+    const head = log[log.length - 1];
+    if (!genesis || !head) {
+        throw new Error('The account DID log is empty.');
+    }
+    const method = genesis.parameters.method ?? '';
+    const scid = genesis.parameters.scid ?? '';
+    if (pin) {
+        if (pin.method !== method) {
+            throw new ResourceLogContinuityError({
+                reason: 'method-switch',
+                pinnedHead: pin.head
+            });
+        }
+        if (pin.scid !== scid) {
+            throw new ResourceLogContinuityError({
+                reason: 'scid-switch',
+                pinnedHead: pin.head
+            });
+        }
+        const pinnedOrdinal = Number.parseInt(pin.head, 10);
+        if (!Number.isInteger(pinnedOrdinal) || pinnedOrdinal < 1) {
+            throw new ResourceLogContinuityError({
+                reason: 'fork',
+                pinnedHead: pin.head,
+                servedEntries: log
+            });
+        }
+        if (log.length < pinnedOrdinal) {
+            throw new ResourceLogContinuityError({
+                reason: 'rollback',
+                pinnedHead: pin.head
+            });
+        }
+        if (log[pinnedOrdinal - 1].versionId !== pin.head) {
+            throw new ResourceLogContinuityError({
+                reason: 'fork',
+                pinnedHead: pin.head,
+                servedEntries: log
+            });
+        }
+    }
+    return { method, scid, head: head.versionId };
+}
 /**
  * Fetches and locally verifies the account's world-readable DID log.
  *
@@ -39,15 +113,30 @@ export class AccountLogMissingError extends Error {
  * an ordinary error when the fetch fails, the log does not resolve, or it
  * resolves to a DID other than the one named.
  *
+ * Supplied a `pinStore`, the resolved log is additionally checked for
+ * continuity against this client's chain-head pin and refused with a
+ * {@link ResourceLogContinuityError} when it is a rollback, a fork, or an
+ * SCID/method switch; the pin is established at first contact
+ * (trust-on-first-use) and advanced only by a log that verifies past it,
+ * never regressed. A `rollback` is the one refusal that may be nothing worse
+ * than replication lag, exactly as on a governed resource log: nothing
+ * rolled back is ever adopted here, and a caller holding a cached view of the
+ * document may treat that reason as a transport hiccup and carry on with what
+ * it has. Every other reason is a security signal. No `pinStore`, no
+ * continuity check -- the pin lives app-side beside the account-pointer pin,
+ * and a caller that has none keeps one-shot verification.
+ *
  * @param options {object}
  * @param options.did {string}   the account's did:webvh, as the caller's
  *   stored account pointer names it
  * @param options.spaceId {string}   the account's Space id
  * @param options.host {string}   the storage server the account lives on
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pin for the account log
  * @returns {Promise<object>}   the resolved document, the raw log, and the
  *   log's effective `updateKeys` / `nextKeyHashes`
  */
-export async function verifyAccountLog({ did, spaceId, host }) {
+export async function verifyAccountLog({ did, spaceId, host, pinStore }) {
     const url = new URL(`/space/${spaceId}/${ID_COLLECTION.id}/${DID_LOG_RESOURCE}`, host);
     const response = await fetch(url);
     if (response.status === 404) {
@@ -65,6 +154,15 @@ export async function verifyAccountLog({ did, spaceId, host }) {
         throw new Error('The published DID log resolves to a different DID than the account ' +
             'pointer names.');
     }
+    if (pinStore) {
+        const pin = await pinStore.read();
+        const served = checkAccountLogContinuity({ log, pin });
+        // Advanced only when the served head is genuinely ahead of the pin: the
+        // checks above have already refused everything that is not.
+        if (!pin || pin.head !== served.head) {
+            await pinStore.write(served);
+        }
+    }
     return {
         doc: resolved.doc,
         log,

package/dist/webvh/verifyLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLog.js","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEzE;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,uCAAuC;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EAKL;IAMC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,UAAU,OAAO,IAAI,aAAa,CAAC,EAAE,IAAI,gBAAgB,EAAE,EAC3D,IAAI,CACL,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,CAAC,MAAM,IAAI,CACnE,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,4CACE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,uCACzB,IAAI,CACL,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gBAAgB,CACnB,CAAA;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG;QACH,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE;QAC1C,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE;KACjD,CAAA;AACH,CAAC"}
+{"version":3,"file":"verifyLog.js","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AAMrE;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,uCAAuC;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAA;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EAMT;IAMC,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,UAAU,OAAO,IAAI,aAAa,CAAC,EAAE,IAAI,gBAAgB,EAAE,EAC3D,IAAI,CACL,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,CAAC,MAAM,IAAI,CACnE,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,4CACE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,uCACzB,IAAI,CACL,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gBAAgB,CACnB,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,yBAAyB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QACtD,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG;QACH,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE;QAC1C,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE;KACjD,CAAA;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/wallet-core",
   "description": "Shared wallet-domain logic (WAS sync engine core and wallet Space layout contracts) for Interop wallet apps.",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",