@interop/wallet-core 0.45.0 → 0.46.0

package/dist/resourceLog/controller.d.ts

@@ -6,7 +6,9 @@
  * the profile's root of authority, resolved and verified by the reader
  * independently of the host serving the log. The interface is the seam --
  * verification consumes only the account DID, the ordered controller-log
- * version list, and per-version `assertionMethod` membership -- and the
+ * version list, per-version `assertionMethod` membership, and the
+ * per-version credential-posture view the ceremony-tail license reads -- and
+ * the
  * did:webvh adapter builds it from an already-verified account log (the
  * `verifyAccountLog` output), answering anchored-version lookups from that
  * verified history rather than from any wire fetch. Handing the verifier a
@@ -15,15 +17,38 @@
  * from.
  */
 import type { DIDLog } from '@interop/did-method-webvh';
+/**
+ * The credential-posture view at one controller-log version, consumed by the
+ * ceremony-tail license on ladder-signed appends (clause B of the ladder
+ * VM's authority clauses). `ladderKeys` holds the ladder VMs' signing-key
+ * multibases, recognized by relation asymmetry -- a `capabilityDelegation`
+ * member absent from `capabilityInvocation` is the ladder VM -- and is how a
+ * verifier tells a ladder-signed proof from an enrolled client's.
+ * `postureKeys` is S(V), the credential-posture key set: the `keyAgreement`
+ * methods whose `controller` is the account DID (the deliberately unmarked
+ * credential entries -- verbatim `Multikey` keys and `MultikeyCommitment`
+ * commitments alike, keyed by their key material), union the ladder VMs. A
+ * document entry is posture-changing iff S(V) differs from S(V-1) in either
+ * direction; ordinary client enrollment and revocation are excluded
+ * structurally, because a client's `keyAgreement` twin carries the `did:key`
+ * controller marker rather than the account DID.
+ */
+export interface ControllerPosture {
+    ladderKeys: Set<string>;
+    postureKeys: Set<string>;
+}
 /**
  * What log verification consumes of the independently verified controller
  * document: the DID the entry proofs must sign under, the verified controller
  * log's `versionId` list in order (empty for an unversioned static
  * controller, degrading every anchor rule to current-document verification),
- * and the set of `assertionMethod` key multibases at a given version --
+ * the set of `assertionMethod` key multibases at a given version --
  * membership there is the whole authorization rule, so `keyAgreement`-only
  * recovery keys and `authentication`-only convenience keys are excluded
- * structurally.
+ * structurally -- and the credential-posture view at a given version, which
+ * is what evaluating the ceremony-tail license and recognizing a
+ * ladder-signed append require (both invisible through the
+ * `assertionMethod` accessor alone).
  */
 export interface ResourceLogController {
     did: string;
@@ -37,6 +62,16 @@ export interface ResourceLogController {
      * @returns {Promise<Set<string>>}
      */
     assertionKeysAt(versionId?: string): Promise<Set<string>>;
+    /**
+     * Resolves the credential-posture view at a controller-log version
+     * (`undefined`: the current document): the ladder VM key multibases and
+     * the posture set S(V) the ceremony-tail license compares across
+     * versions.
+     *
+     * @param [versionId] {string}
+     * @returns {Promise<ControllerPosture>}
+     */
+    postureAt(versionId?: string): Promise<ControllerPosture>;
 }
 /**
  * Builds the controller view over an already-verified did:webvh account log

package/dist/resourceLog/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAGvD;;;;;;;;;GASG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;;;;;OAOG;IACH,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;CAC1D;AAmCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,qBAAqB,CA6BxB"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAGvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;;;;;OAOG;IACH,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD;;;;;;;;OAQG;IACH,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAC1D;AA6ID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,qBAAqB,CAwCxB"}

package/dist/resourceLog/controller.js

@@ -1,28 +1,109 @@
 import { ResourceLogIntegrityError } from './errors.js';
 /**
- * Collects a document's `assertionMethod` key multibases: embedded
- * verification methods verbatim, string references resolved against
- * `verificationMethod`.
+ * Resolves one relation entry: an embedded verification method verbatim, a
+ * string reference through the given `verificationMethod` index.
  *
- * @param doc {AssertionDocument}
- * @returns {Set<string>}
+ * @param entry {string | ControllerVerificationMethod}
+ * @param byId {Map<string, ControllerVerificationMethod>}
+ * @returns {ControllerVerificationMethod | undefined}
  */
-function assertionKeysOf(doc) {
+function resolveMethod(entry, byId) {
+    return typeof entry === 'string' ? byId.get(entry) : entry;
+}
+/**
+ * Indexes a document's `verificationMethod` array by id.
+ *
+ * @param doc {ControllerDocument}
+ * @returns {Map<string, ControllerVerificationMethod>}
+ */
+function methodsById(doc) {
     const byId = new Map();
     for (const method of doc.verificationMethod ?? []) {
         if (typeof method?.id === 'string') {
             byId.set(method.id, method);
         }
     }
+    return byId;
+}
+/**
+ * A relation entry's verification-method id: the string reference itself, or
+ * an embedded method's `id`.
+ *
+ * @param entry {string | ControllerVerificationMethod}
+ * @returns {string | undefined}
+ */
+function relationIdOf(entry) {
+    return typeof entry === 'string' ? entry : entry?.id;
+}
+/**
+ * Collects a document's `assertionMethod` key multibases: embedded
+ * verification methods verbatim, string references resolved against
+ * `verificationMethod`.
+ *
+ * @param doc {ControllerDocument}
+ * @returns {Set<string>}
+ */
+function assertionKeysOf(doc) {
+    const byId = methodsById(doc);
     const keys = new Set();
     for (const entry of doc.assertionMethod ?? []) {
-        const method = typeof entry === 'string' ? byId.get(entry) : entry;
+        const method = resolveMethod(entry, byId);
         if (method && typeof method.publicKeyMultibase === 'string') {
             keys.add(method.publicKeyMultibase);
         }
     }
     return keys;
 }
+/**
+ * Collects a document's credential-posture view (see
+ * {@link ControllerPosture}): the ladder VMs by relation asymmetry
+ * (`capabilityDelegation` members absent from `capabilityInvocation`,
+ * compared by verification-method id), and S(V) as the account-controlled
+ * `keyAgreement` methods' key material -- `publicKeyCommitment` where the
+ * entry is a commitment, `publicKeyMultibase` where it is verbatim (the two
+ * value spaces are disjoint) -- union the ladder keys. A `keyAgreement`
+ * method carrying neither is skipped: an unidentifiable entry must not make
+ * two distinct postures compare equal.
+ *
+ * @param doc {ControllerDocument}
+ * @param did {string}   the account DID posture entries are controlled by
+ * @returns {ControllerPosture}
+ */
+function postureOf(doc, did) {
+    const byId = methodsById(doc);
+    const invocable = new Set();
+    for (const entry of doc.capabilityInvocation ?? []) {
+        const id = relationIdOf(entry);
+        if (id !== undefined) {
+            invocable.add(id);
+        }
+    }
+    const ladderKeys = new Set();
+    for (const entry of doc.capabilityDelegation ?? []) {
+        const id = relationIdOf(entry);
+        if (id !== undefined && invocable.has(id)) {
+            continue;
+        }
+        const method = resolveMethod(entry, byId);
+        if (method && typeof method.publicKeyMultibase === 'string') {
+            ladderKeys.add(method.publicKeyMultibase);
+        }
+    }
+    const postureKeys = new Set(ladderKeys);
+    for (const entry of doc.keyAgreement ?? []) {
+        const method = resolveMethod(entry, byId);
+        if (!method || method.controller !== did) {
+            continue;
+        }
+        if (typeof method.publicKeyCommitment === 'string') {
+            postureKeys.add(method.publicKeyCommitment);
+        }
+        else if (typeof method.publicKeyMultibase === 'string') {
+            postureKeys.add(method.publicKeyMultibase);
+        }
+    }
+    return { ladderKeys, postureKeys };
+}
 /**
  * Builds the controller view over an already-verified did:webvh account log
  * (the `verifyAccountLog` output -- callers never hand this a log they have
@@ -41,10 +122,17 @@ function assertionKeysOf(doc) {
 export function webvhResourceLogController({ did, log }) {
     const versionIds = log.map(entry => entry.versionId);
     const keysByVersion = new Map();
+    const postureByVersion = new Map();
     for (const entry of log) {
-        keysByVersion.set(entry.versionId, assertionKeysOf(entry.state));
+        const doc = entry.state;
+        keysByVersion.set(entry.versionId, assertionKeysOf(doc));
+        postureByVersion.set(entry.versionId, postureOf(doc, did));
     }
     const head = log.length === 0 ? undefined : log[log.length - 1];
+    function versionRefusal(versionId) {
+        return new ResourceLogIntegrityError(`The controller document did not resolve at version ` +
+            `"${versionId ?? '<head>'}" (no document returned).`);
+    }
     return {
         did,
         versionIds,
@@ -53,8 +141,16 @@ export function webvhResourceLogController({ did, log }) {
                 ? head && keysByVersion.get(head.versionId)
                 : keysByVersion.get(versionId);
             if (!resolved) {
-                return Promise.reject(new ResourceLogIntegrityError(`The controller document did not resolve at version ` +
-                    `"${versionId ?? '<head>'}" (no document returned).`));
+                return Promise.reject(versionRefusal(versionId));
+            }
+            return Promise.resolve(resolved);
+        },
+        postureAt(versionId) {
+            const resolved = versionId === undefined
+                ? head && postureByVersion.get(head.versionId)
+                : postureByVersion.get(versionId);
+            if (!resolved) {
+                return Promise.reject(versionRefusal(versionId));
             }
             return Promise.resolve(resolved);
         }

package/dist/resourceLog/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAkCvD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAsB;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2C,CAAA;IAC/D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAA;IACpD,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,aAAa,CAAC,GAAG,CACf,KAAK,CAAC,SAAS,EACf,eAAe,CAAC,KAAK,CAAC,KAA0B,CAAC,CAClD,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/D,OAAO;QACL,GAAG;QACH,UAAU;QACV,eAAe,CAAC,SAAkB;YAChC,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC3C,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,yBAAyB,CAC3B,qDAAqD;oBACnD,IAAI,SAAS,IAAI,QAAQ,2BAA2B,CACvD,CACF,CAAA;YACH,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAmFvD;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,KAA4C,EAC5C,IAA+C;IAE/C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,GAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAA;IAC5D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,KAA4C;IAE5C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAuB;IAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACzC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,GAAW;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,EAAE,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1C,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACzC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAC5D,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IACvC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACzC,SAAQ;QACV,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;YACnD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC7C,CAAC;aAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACzD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAA;IACpD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA6B,CAAA;IAC7D,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAA2B,CAAA;QAC7C,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/D,SAAS,cAAc,CAAC,SAAkB;QACxC,OAAO,IAAI,yBAAyB,CAClC,qDAAqD;YACnD,IAAI,SAAS,IAAI,QAAQ,2BAA2B,CACvD,CAAA;IACH,CAAC;IACD,OAAO;QACL,GAAG;QACH,UAAU;QACV,eAAe,CAAC,SAAkB;YAChC,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC3C,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,SAAS,CAAC,SAAkB;YAC1B,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9C,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/resourceLog/errors.d.ts

@@ -4,7 +4,7 @@
 /**
  * The resource-log refusal taxonomy, carried over from the roster's WC-1
  * detached-signature design onto the log design. Two adversarial classes plus
- * one lifecycle refusal:
+ * two admission refusals:
  *
  * - {@link ResourceLogIntegrityError} -- fabrication: the served log fails
  *   verification on its own terms (parse shape, SCID, chain hashes, proofs,
@@ -19,6 +19,12 @@
  *   head is a terminal handover entry. Not an attack: the log's own authors
  *   closed it, and a verifier of this profile must refuse to extend a closed
  *   log even though nothing currently emits terminal entries.
+ * - {@link ResourceLogLicenseError} -- a ladder-signed append outside the
+ *   ceremony-tail license. An admission refusal, not log corruption: the
+ *   append (attempted, or already served) is not licensed, and the same
+ *   append can become licensed after a posture-changing controller-document
+ *   entry -- callers must not treat it with the reject-the-whole-log
+ *   severity of the integrity class.
  */
 /**
  * A served log failed verification: malformed entries, a non-verifying SCID,
@@ -55,6 +61,21 @@ export declare class ResourceLogContinuityError extends Error {
         servedEntries?: unknown[];
     });
 }
+/**
+ * A ladder-signed append outside the ceremony-tail license: it is not the
+ * log's first entry, and it does not anchor at a posture-changing controller
+ * document version no verified entry already anchors at or past. Above all
+ * this refuses the silent-rekey shape -- a ladder-signed rotation against an
+ * unchanged document. Write-time admission class: the log is not corrupt and
+ * whoever signed the append genuinely holds the credential; the append is
+ * merely unlicensed, and a retry after a posture-changing document entry may
+ * succeed.
+ */
+export declare class ResourceLogLicenseError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
 /**
  * An append was refused because the log's verified head is a terminal
  * handover entry: the log is closed and names a successor, and this profile

package/dist/resourceLog/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;IAC7D,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAA;gBACb,EACV,MAAM,EACN,UAAU,EACV,aAAa,EACd,EAAE;QACD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;QAC7D,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,CAAC,EAAE,OAAO,EAAE,CAAA;KAC1B;CAUF;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;gBAC7B,EAAE,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;CAQvE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;IAC7D,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,EAAE,CAAA;gBACb,EACV,MAAM,EACN,UAAU,EACV,aAAa,EACd,EAAE;QACD,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAA;QAC7D,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,CAAC,EAAE,OAAO,EAAE,CAAA;KAC1B;CAUF;AAED;;;;;;;;;GASG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;gBAC7B,EAAE,OAAO,EAAE,EAAE;QAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE;CAQvE"}

package/dist/resourceLog/errors.js

@@ -4,7 +4,7 @@
 /**
  * The resource-log refusal taxonomy, carried over from the roster's WC-1
  * detached-signature design onto the log design. Two adversarial classes plus
- * one lifecycle refusal:
+ * two admission refusals:
  *
  * - {@link ResourceLogIntegrityError} -- fabrication: the served log fails
  *   verification on its own terms (parse shape, SCID, chain hashes, proofs,
@@ -19,6 +19,12 @@
  *   head is a terminal handover entry. Not an attack: the log's own authors
  *   closed it, and a verifier of this profile must refuse to extend a closed
  *   log even though nothing currently emits terminal entries.
+ * - {@link ResourceLogLicenseError} -- a ladder-signed append outside the
+ *   ceremony-tail license. An admission refusal, not log corruption: the
+ *   append (attempted, or already served) is not licensed, and the same
+ *   append can become licensed after a posture-changing controller-document
+ *   entry -- callers must not treat it with the reject-the-whole-log
+ *   severity of the integrity class.
  */
 /**
  * A served log failed verification: malformed entries, a non-verifying SCID,
@@ -59,6 +65,22 @@ export class ResourceLogContinuityError extends Error {
         this.servedEntries = servedEntries;
     }
 }
+/**
+ * A ladder-signed append outside the ceremony-tail license: it is not the
+ * log's first entry, and it does not anchor at a posture-changing controller
+ * document version no verified entry already anchors at or past. Above all
+ * this refuses the silent-rekey shape -- a ladder-signed rotation against an
+ * unchanged document. Write-time admission class: the log is not corrupt and
+ * whoever signed the append genuinely holds the credential; the append is
+ * merely unlicensed, and a retry after a posture-changing document entry may
+ * succeed.
+ */
+export class ResourceLogLicenseError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'ResourceLogLicenseError';
+    }
+}
 /**
  * An append was refused because the log's verified head is a terminal
  * handover entry: the log is closed and names a successor, and this profile

package/dist/resourceLog/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,MAAM,CAAuD;IAC7D,UAAU,CAAQ;IAClB;;;;OAIG;IACH,aAAa,CAAY;IACzB,YAAY,EACV,MAAM,EACN,UAAU,EACV,aAAa,EAKd;QACC,KAAK,CACH,sEAAsE;YACpE,IAAI,MAAM,iBAAiB,UAAU,IAAI,CAC5C,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,CAAkC;IACzC,YAAY,EAAE,OAAO,EAAiD;QACpE,KAAK,CACH,wEAAwE;YACtE,0BAA0B,CAC7B,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;GAKG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,MAAM,CAAuD;IAC7D,UAAU,CAAQ;IAClB;;;;OAIG;IACH,aAAa,CAAY;IACzB,YAAY,EACV,MAAM,EACN,UAAU,EACV,aAAa,EAKd;QACC,KAAK,CACH,sEAAsE;YACpE,IAAI,MAAM,iBAAiB,UAAU,IAAI,CAC5C,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,OAAO,CAAkC;IACzC,YAAY,EAAE,OAAO,EAAiD;QACpE,KAAK,CACH,wEAAwE;YACtE,0BAA0B,CAC7B,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF"}

package/dist/resourceLog/index.d.ts

@@ -7,17 +7,19 @@
  * chain verification against an adversarial host (parse shape, SCID and
  * entry-hash recomputation, entry proofs, the external-authorization rule
  * against the independently verified did:webvh controller document, terminal
- * entries), the chain-head pin with its continuity rules, the append path
- * (verified-head build, CAS with rebase-and-retry, read-back confirmation),
- * and the sealing sweep (the idempotent backstop append that re-anchors a
- * log's head past the controller's latest membership change).
+ * entries), the ceremony-tail license on ladder-signed appends, the
+ * chain-head pin with its continuity rules, the append path (verified-head
+ * build, CAS with rebase-and-retry, read-back confirmation), and the sealing
+ * sweep (the idempotent backstop append that re-anchors a log's head past
+ * the controller's latest membership change).
  * Transport (JSON Lines, the store seam, the projection write) lives in
  * `@interop/was-client/log`; the hashing and proof kernel in
  * `@interop/did-method-webvh`. Kept out of the root export: this subpath
  * pulls the did:webvh and ed25519 dependency graph.
  */
-export { webvhResourceLogController, type ResourceLogController } from './controller.js';
-export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
+export { webvhResourceLogController, type ControllerPosture, type ResourceLogController } from './controller.js';
+export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError, ResourceLogLicenseError } from './errors.js';
+export { assertLadderAppendLicensed } from './license.js';
 export { buildResourceLogEntry, buildResourceLogGenesis, type ResourceLogSigner } from './entry.js';
 export { memoryResourceLogPinStore, resourceLogPinId, type ResourceLogHeadPin, type ResourceLogPinStore } from './pin.js';
 export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover, type VerifiedResourceLog } from './verify.js';

package/dist/resourceLog/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/resourceLog/index.js

@@ -7,17 +7,19 @@
  * chain verification against an adversarial host (parse shape, SCID and
  * entry-hash recomputation, entry proofs, the external-authorization rule
  * against the independently verified did:webvh controller document, terminal
- * entries), the chain-head pin with its continuity rules, the append path
- * (verified-head build, CAS with rebase-and-retry, read-back confirmation),
- * and the sealing sweep (the idempotent backstop append that re-anchors a
- * log's head past the controller's latest membership change).
+ * entries), the ceremony-tail license on ladder-signed appends, the
+ * chain-head pin with its continuity rules, the append path (verified-head
+ * build, CAS with rebase-and-retry, read-back confirmation), and the sealing
+ * sweep (the idempotent backstop append that re-anchors a log's head past
+ * the controller's latest membership change).
  * Transport (JSON Lines, the store seam, the projection write) lives in
  * `@interop/was-client/log`; the hashing and proof kernel in
  * `@interop/did-method-webvh`. Kept out of the root export: this subpath
  * pulls the did:webvh and ed25519 dependency graph.
  */
 export { webvhResourceLogController } from './controller.js';
-export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
+export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError, ResourceLogLicenseError } from './errors.js';
+export { assertLadderAppendLicensed } from './license.js';
 export { buildResourceLogEntry, buildResourceLogGenesis } from './entry.js';
 export { memoryResourceLogPinStore, resourceLogPinId } from './pin.js';
 export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover } from './verify.js';

package/dist/resourceLog/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAE3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAGjB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,0BAA0B,EAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAGjB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/resourceLog/license.d.ts

@@ -0,0 +1,44 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The ceremony-tail license on ladder-signed resource-log appends (clause B
+ * of the ladder VM's authority clauses). A ladder-signed append is accepted
+ * in exactly two shapes: the log's first entry (creation, never extension --
+ * callers admit that shape by not calling this check on a genesis entry),
+ * or a rotation anchored at a posture-changing controller-document version,
+ * one-shot -- refused when the verified log head already carries an entry
+ * anchored at that version or later. Everything else, above all a rotation
+ * against an unchanged document (the silent-rekey shape), is refused with
+ * {@link ResourceLogLicenseError}. Anchors compare by position in the
+ * controller's verified version history, the structural twin of the sealing
+ * sweep's `headAnchorIndex >= removalIndex` check.
+ */
+import type { ResourceLogController } from './controller.js';
+/**
+ * Evaluates the ceremony-tail license's second shape for one ladder-signed
+ * append: the append must anchor at a posture-changing document version V --
+ * S(V) differs from S(V-1) in either direction, with S(-1) empty for a
+ * genesis-version anchor -- and no verified entry may already anchor at V or
+ * later (`headAnchorIndex >= anchorIndex` refuses; the license is one-shot,
+ * so a torn ceremony's late-arriving tail still passes while a second
+ * rotation against the same anchor does not). A `null` anchor index (an
+ * unversioned controller, where no anchor exists to license against) is
+ * refused fail-closed.
+ *
+ * @param options {object}
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @param options.anchorIndex {number | null}   the append's anchor as an
+ *   index into `controller.versionIds` (`null`: unanchored)
+ * @param options.headAnchorIndex {number | null}   the verified log head's
+ *   effective anchor before this append (`null`: the log has no anchored
+ *   entries yet)
+ * @returns {Promise<void>}
+ */
+export declare function assertLadderAppendLicensed({ controller, anchorIndex, headAnchorIndex }: {
+    controller: ResourceLogController;
+    anchorIndex: number | null;
+    headAnchorIndex: number | null;
+}): Promise<void>;
+//# sourceMappingURL=license.d.ts.map

package/dist/resourceLog/license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAsB5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,UAAU,EACV,WAAW,EACX,eAAe,EAChB,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB"}

package/dist/resourceLog/license.js

@@ -0,0 +1,63 @@
+import { ResourceLogLicenseError } from './errors.js';
+/**
+ * Set equality over posture members.
+ *
+ * @param left {Set<string>}
+ * @param right {Set<string>}
+ * @returns {boolean}
+ */
+function setsEqual(left, right) {
+    if (left.size !== right.size) {
+        return false;
+    }
+    for (const member of left) {
+        if (!right.has(member)) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Evaluates the ceremony-tail license's second shape for one ladder-signed
+ * append: the append must anchor at a posture-changing document version V --
+ * S(V) differs from S(V-1) in either direction, with S(-1) empty for a
+ * genesis-version anchor -- and no verified entry may already anchor at V or
+ * later (`headAnchorIndex >= anchorIndex` refuses; the license is one-shot,
+ * so a torn ceremony's late-arriving tail still passes while a second
+ * rotation against the same anchor does not). A `null` anchor index (an
+ * unversioned controller, where no anchor exists to license against) is
+ * refused fail-closed.
+ *
+ * @param options {object}
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @param options.anchorIndex {number | null}   the append's anchor as an
+ *   index into `controller.versionIds` (`null`: unanchored)
+ * @param options.headAnchorIndex {number | null}   the verified log head's
+ *   effective anchor before this append (`null`: the log has no anchored
+ *   entries yet)
+ * @returns {Promise<void>}
+ */
+export async function assertLadderAppendLicensed({ controller, anchorIndex, headAnchorIndex }) {
+    if (anchorIndex === null ||
+        anchorIndex < 0 ||
+        anchorIndex >= controller.versionIds.length) {
+        throw new ResourceLogLicenseError('A ladder-signed append past the genesis entry cannot be licensed ' +
+            'without an anchor into the controller document version history.');
+    }
+    const current = (await controller.postureAt(controller.versionIds[anchorIndex])).postureKeys;
+    const previous = anchorIndex === 0
+        ? new Set()
+        : (await controller.postureAt(controller.versionIds[anchorIndex - 1]))
+            .postureKeys;
+    if (setsEqual(current, previous)) {
+        throw new ResourceLogLicenseError('The ladder-signed append anchors at a controller document version ' +
+            'that did not change the credential posture (a rotation against an ' +
+            'unchanged document is never licensed).');
+    }
+    if (headAnchorIndex !== null && headAnchorIndex >= anchorIndex) {
+        throw new ResourceLogLicenseError('The verified log head already carries an entry anchored at or past ' +
+            'this posture-changing document version (the license is one-shot).');
+    }
+}
+//# sourceMappingURL=license.js.map

package/dist/resourceLog/license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.js","sourceRoot":"","sources":["../../src/resourceLog/license.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAErD;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAkB;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,UAAU,EACV,WAAW,EACX,eAAe,EAKhB;IACC,IACE,WAAW,KAAK,IAAI;QACpB,WAAW,GAAG,CAAC;QACf,WAAW,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,EAC3C,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mEAAmE;YACjE,iEAAiE,CACpE,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CACd,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAE,CAAC,CAChE,CAAC,WAAW,CAAA;IACb,MAAM,QAAQ,GACZ,WAAW,KAAK,CAAC;QACf,CAAC,CAAC,IAAI,GAAG,EAAU;QACnB,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,GAAG,CAAC,CAAE,CAAC,CAAC;aAClE,WAAW,CAAA;IACpB,IAAI,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAC/B,oEAAoE;YAClE,oEAAoE;YACpE,wCAAwC,CAC3C,CAAA;IACH,CAAC;IACD,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,IAAI,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,uBAAuB,CAC/B,qEAAqE;YACnE,mEAAmE,CACtE,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/resourceLog/verify.d.ts

@@ -46,8 +46,9 @@ export declare function isTerminalResourceLogEntry(entry: ResourceLogEntry): boo
  * recomputation, per-entry proofs, the external-authorization rule with
  * anchor monotonicity, termination, and continuity against the chain-head
  * pin. Throws {@link ResourceLogIntegrityError} on fabrication-class
- * failures, {@link ResourceLogContinuityError} on pin conflicts; any failure
- * rejects the whole log.
+ * failures, {@link ResourceLogContinuityError} on pin conflicts, and
+ * `ResourceLogLicenseError` on a ladder-signed append outside the
+ * ceremony-tail license; any failure rejects the whole log.
  *
  * The controller view is the independently verified controller document --
  * never material served beside the log. An unversioned controller (empty

package/dist/resourceLog/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/resourceLog/verify.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAclD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAChC,GAAG,EAAE,kBAAkB,CAAA;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACjD,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CACnD;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAM3E;AA0OD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,cAAc,EACd,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkO/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,KAAK,EACL,SAAS,EACV,EAAE;IACD,KAAK,EAAE,mBAAmB,CAAA;IAC1B,SAAS,EAAE,mBAAmB,CAAA;CAC/B,GAAG,IAAI,CAqBP"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/resourceLog/verify.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EACV,gBAAgB,EAEjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAO5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAclD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,gBAAgB,CAAA;IACtB,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAChC,GAAG,EAAE,kBAAkB,CAAA;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IACjD,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CACnD;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAM3E;AA0OD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,UAAU,EACV,cAAc,EACd,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqP/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,KAAK,EACL,SAAS,EACV,EAAE;IACD,KAAK,EAAE,mBAAmB,CAAA;IAC1B,SAAS,EAAE,mBAAmB,CAAA;CAC/B,GAAG,IAAI,CAqBP"}

package/dist/resourceLog/verify.js

@@ -8,13 +8,17 @@
  * verification through the did:webvh log kernel, the external-authorization
  * rule (anchor resolution against the independently verified controller
  * document, `assertionMethod` membership at the anchored version, anchor
- * monotonicity), terminal-entry recognition, and continuity against the
- * chain-head pin. Any failure rejects the LOG, not just the failing entry,
- * and nothing served -- a stated head, a digest, a count -- is ever accepted
- * in place of recomputation.
+ * monotonicity), the ceremony-tail license on ladder-signed appends,
+ * terminal-entry recognition, and continuity against the chain-head pin. Any
+ * failure rejects the LOG, not just the failing entry, and nothing served --
+ * a stated head, a digest, a count -- is ever accepted in place of
+ * recomputation; a license refusal keeps its own class
+ * (`ResourceLogLicenseError`) so callers can tell an unlicensed append from
+ * a corrupt log.
  */
 import { buildVersionId, canonicalizeStrict, defaultWebvhLogVerifier, deriveHash, parseAndValidateVersionId, SCID_PLACEHOLDER, verifyEntryProofs } from '@interop/did-method-webvh';
-import { ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
+import { ResourceLogContinuityError, ResourceLogIntegrityError, ResourceLogLicenseError } from './errors.js';
+import { assertLadderAppendLicensed } from './license.js';
 import { vmFragmentOf } from './vmFragment.js';
 /**
  * The five members a log entry carries, exactly.
@@ -219,8 +223,9 @@ function parseAnchoredVm(verificationMethod, ordinal) {
  * recomputation, per-entry proofs, the external-authorization rule with
  * anchor monotonicity, termination, and continuity against the chain-head
  * pin. Throws {@link ResourceLogIntegrityError} on fabrication-class
- * failures, {@link ResourceLogContinuityError} on pin conflicts; any failure
- * rejects the whole log.
+ * failures, {@link ResourceLogContinuityError} on pin conflicts, and
+ * `ResourceLogLicenseError` on a ladder-signed append outside the
+ * ceremony-tail license; any failure rejects the whole log.
  *
  * The controller view is the independently verified controller document --
  * never material served beside the log. An unversioned controller (empty
@@ -325,6 +330,22 @@ export async function verifyResourceLog({ entries, controller, expectedMethod, p
                     `document does not list under assertionMethod at the anchored ` +
                     `version.`);
             }
+            // The ceremony-tail license: a ladder-signed proof (the anchored
+            // version's relation-asymmetry ladder VM) is admitted only on the
+            // genesis entry, or anchored at a posture-changing version no prior
+            // entry anchors at or past. The floor at this point is still the
+            // previous entries' effective anchor -- the verified head this append
+            // extended.
+            if (index > 0) {
+                const posture = await controller.postureAt(anchor);
+                if (posture.ladderKeys.has(keyMultibase)) {
+                    await assertLadderAppendLicensed({
+                        controller,
+                        anchorIndex: versioned ? anchorIndex : null,
+                        headAnchorIndex: anchorFloor
+                    });
+                }
+            }
             entryAnchorIndex = Math.max(entryAnchorIndex, anchorIndex);
         };
         try {
@@ -339,7 +360,8 @@ export async function verifyResourceLog({ entries, controller, expectedMethod, p
             });
         }
         catch (err) {
-            if (err instanceof ResourceLogIntegrityError) {
+            if (err instanceof ResourceLogIntegrityError ||
+                err instanceof ResourceLogLicenseError) {
                 throw err;
             }
             throw new ResourceLogIntegrityError(`Resource log entry ${ordinal} failed proof verification.`, { cause: err });