@interop/wallet-core 0.62.0 → 0.65.0

package/dist/webvh/standingZcap.js.map

@@ -1 +1 @@
-{"version":3,"file":"standingZcap.js","sourceRoot":"","sources":["../../src/webvh/standingZcap.ts"],"names":[],"mappings":"AAgBA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,OAAO,EACP,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAIjB;IACC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,SAAS,GAAG,GAAG,IAAI,sBAAsB,CAAA;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAiB;IACpD,MAAM,EAAE,KAAK,EAAE,GAAG,UAMjB,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACtD,OAAO,MAAM,EAAE,kBAAkB,CAAA;AACnC,CAAC"}
+{"version":3,"file":"standingZcap.js","sourceRoot":"","sources":["../../src/webvh/standingZcap.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAG1D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,OAAO,EACP,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAIjB;IACC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,SAAS,GAAG,GAAG,IAAI,sBAAsB,CAAA;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAiB;IACpD,MAAM,EAAE,KAAK,EAAE,GAAG,UAMjB,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACtD,OAAO,MAAM,EAAE,kBAAkB,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,GAAG,EACH,eAAe,EACf,OAAO,EACP,qBAAqB,GAAG,EAAE,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAOjB;IACC,IAAI,YAAY,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GACb,eAAe,KAAK,SAAS;QAC3B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,CAAA;IACxD,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CACzC,GAAG,CAAC,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,SAAS,CAC3E,CAAA;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,CAAC,uBAAuB,CAAC;YACvB,GAAG;YACH,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CACH,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,IAAI,EACJ,GAAG,EACH,qBAAqB,EACrB,GAAG,EAMJ;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,IAA4B,CAAA;IAChD,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAClD,OAAO,iBAAiB,CAAC;QACvB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAA;AACJ,CAAC"}

package/dist/webvh/verifyLog.d.ts

@@ -1,4 +1,5 @@
 import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
+import type { PublishedWebvhLog } from './didWebvh.js';
 import { type ResourceLogHeadPin, type ResourceLogPinStore } from '@interop/vh-resource-log';
 /**
  * The pin-slot key for an account's did:webvh log (`id/did.jsonl`) -- what a
@@ -45,6 +46,27 @@ export declare function checkAccountLogContinuity({ log, pin }: {
     log: DIDLog;
     pin: ResourceLogHeadPin | null;
 }): ResourceLogHeadPin;
+/**
+ * Checks a served account log against the pin held for it and advances the
+ * pin to the served head, which the check has just proven is genuinely ahead.
+ *
+ * The one implementation of the account log's check-and-advance step, shared
+ * by {@link verifyAccountLog} and by the ceremony-side reads in `didWebvh.ts`:
+ * a rollback, a fork, or an SCID / method switch refuses inside
+ * {@link checkAccountLogContinuity}, so nothing that is not ahead ever
+ * reaches the write.
+ *
+ * @param options {object}
+ * @param options.pinStore {ResourceLogPinStore}
+ * @param options.logId {string}   this log's slot in the store
+ * @param options.log {DIDLog}   the served, already-resolved log
+ * @returns {Promise<void>}
+ */
+export declare function checkAndAdvanceAccountLogPin({ pinStore, logId, log }: {
+    pinStore: ResourceLogPinStore;
+    logId: string;
+    log: DIDLog;
+}): Promise<void>;
 /**
  * Fetches and locally verifies the account's world-readable DID log.
  *
@@ -73,18 +95,50 @@ export declare function checkAccountLogContinuity({ log, pin }: {
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
  *   pins; the account log's slot is keyed by {@link accountLogPinId} over the
  *   `spaceId` above
- * @returns {Promise<object>}   the resolved document, the raw log, and the
- *   log's effective `updateKeys` / `nextKeyHashes`
+ * @param [options.published] {PublishedWebvhLog}   a head this same run
+ *   already read and resolved (an establishment handing its `accountLog`
+ *   forward), reused in place of the fetch. Every check below still runs on
+ *   it: the substituted-account refusal, and the chain-head check-and-advance
+ *   under the same slot, so a supplied head behind the pin is refused with a
+ *   {@link ResourceLogContinuityError} exactly as a served one would be.
+ *   Reuse is only ever WITHIN one run or visit, never across writers: the
+ *   head is evidence of what this client itself just saw or published, and a
+ *   head carried in from anywhere else would defeat the freshness the fetch
+ *   exists for
+ * @returns {Promise<VerifiedAccountLog>}   the resolved document, the raw
+ *   log, and the log's effective `updateKeys` / `nextKeyHashes`
  */
-export declare function verifyAccountLog({ did, spaceId, host, pinStore }: {
+export declare function verifyAccountLog({ did, spaceId, host, pinStore, published }: {
     did: string;
     spaceId: string;
     host: string;
     pinStore?: ResourceLogPinStore;
-}): Promise<{
+    published?: PublishedWebvhLog;
+}): Promise<VerifiedAccountLog>;
+/**
+ * What {@link verifyAccountLog} returns: the account document as the log
+ * resolves it, the raw log, and the log's effective update-key parameters.
+ * Named because it is also what a caller seeds a session-scoped verified-log
+ * memo with, from a head a ceremony handed it.
+ */
+export interface VerifiedAccountLog {
     doc: DIDDoc;
     log: DIDLog;
     updateKeys: string[];
     nextKeyHashes: string[];
-}>;
+}
+/**
+ * The {@link VerifiedAccountLog} view of a head a ceremony already read or
+ * published -- a projection, not a check. The caller that seeds a memo from
+ * an establishment's own `accountLog` uses it rather than re-fetching the log
+ * that run just wrote; a caller wanting the DID and pin checks too calls
+ * {@link verifyAccountLog} with the head instead.
+ *
+ * @param options {object}
+ * @param options.published {PublishedWebvhLog}   the resolved head
+ * @returns {VerifiedAccountLog}
+ */
+export declare function verifiedAccountLogOf({ published }: {
+    published: PublishedWebvhLog;
+}): VerifiedAccountLog;
 //# sourceMappingURL=verifyLog.d.ts.map

package/dist/webvh/verifyLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLog.d.ts","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAG/D,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAMxE;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0C;CAI9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAC/B,GAAG,kBAAkB,CA4CrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB,CAAC,CA6CD"}
+{"version":3,"file":"verifyLog.d.ts","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAE/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEtD,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAMxE;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAA0C;CAI9D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAC/B,GAAG,kBAAkB,CA4CrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,QAAQ,EACR,KAAK,EACL,GAAG,EACJ,EAAE;IACD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,SAAS,EACV,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0D9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,SAAS,EACV,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAA;CAC7B,GAAG,kBAAkB,CAOrB"}

package/dist/webvh/verifyLog.js

@@ -123,6 +123,31 @@ export function checkAccountLogContinuity({ log, pin }) {
     }
     return { method, scid, head: head.versionId };
 }
+/**
+ * Checks a served account log against the pin held for it and advances the
+ * pin to the served head, which the check has just proven is genuinely ahead.
+ *
+ * The one implementation of the account log's check-and-advance step, shared
+ * by {@link verifyAccountLog} and by the ceremony-side reads in `didWebvh.ts`:
+ * a rollback, a fork, or an SCID / method switch refuses inside
+ * {@link checkAccountLogContinuity}, so nothing that is not ahead ever
+ * reaches the write.
+ *
+ * @param options {object}
+ * @param options.pinStore {ResourceLogPinStore}
+ * @param options.logId {string}   this log's slot in the store
+ * @param options.log {DIDLog}   the served, already-resolved log
+ * @returns {Promise<void>}
+ */
+export async function checkAndAdvanceAccountLogPin({ pinStore, logId, log }) {
+    const pin = await pinStore.read({ logId });
+    const served = checkAccountLogContinuity({ log, pin });
+    // Advanced only when the served head is genuinely ahead of the pin: the
+    // continuity check has already refused everything that is not.
+    if (!pin || pin.head !== served.head) {
+        await pinStore.write({ logId, pin: served });
+    }
+}
 /**
  * Fetches and locally verifies the account's world-readable DID log.
  *
@@ -151,10 +176,34 @@ export function checkAccountLogContinuity({ log, pin }) {
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
  *   pins; the account log's slot is keyed by {@link accountLogPinId} over the
  *   `spaceId` above
- * @returns {Promise<object>}   the resolved document, the raw log, and the
- *   log's effective `updateKeys` / `nextKeyHashes`
+ * @param [options.published] {PublishedWebvhLog}   a head this same run
+ *   already read and resolved (an establishment handing its `accountLog`
+ *   forward), reused in place of the fetch. Every check below still runs on
+ *   it: the substituted-account refusal, and the chain-head check-and-advance
+ *   under the same slot, so a supplied head behind the pin is refused with a
+ *   {@link ResourceLogContinuityError} exactly as a served one would be.
+ *   Reuse is only ever WITHIN one run or visit, never across writers: the
+ *   head is evidence of what this client itself just saw or published, and a
+ *   head carried in from anywhere else would defeat the freshness the fetch
+ *   exists for
+ * @returns {Promise<VerifiedAccountLog>}   the resolved document, the raw
+ *   log, and the log's effective `updateKeys` / `nextKeyHashes`
  */
-export async function verifyAccountLog({ did, spaceId, host, pinStore }) {
+export async function verifyAccountLog({ did, spaceId, host, pinStore, published }) {
+    if (published !== undefined) {
+        if (published.did !== did) {
+            throw new Error('The published DID log resolves to a different DID than the account ' +
+                'pointer names.');
+        }
+        if (pinStore) {
+            await checkAndAdvanceAccountLogPin({
+                pinStore,
+                logId: accountLogPinId({ spaceId }),
+                log: published.log
+            });
+        }
+        return verifiedAccountLogOf({ published });
+    }
     const url = toUrl({
         serverUrl: host,
         path: resourcePath(spaceId, ID_COLLECTION.id, DID_LOG_RESOURCE)
@@ -176,14 +225,11 @@ export async function verifyAccountLog({ did, spaceId, host, pinStore }) {
             'pointer names.');
     }
     if (pinStore) {
-        const logId = accountLogPinId({ spaceId });
-        const pin = await pinStore.read({ logId });
-        const served = checkAccountLogContinuity({ log, pin });
-        // Advanced only when the served head is genuinely ahead of the pin: the
-        // checks above have already refused everything that is not.
-        if (!pin || pin.head !== served.head) {
-            await pinStore.write({ logId, pin: served });
-        }
+        await checkAndAdvanceAccountLogPin({
+            pinStore,
+            logId: accountLogPinId({ spaceId }),
+            log
+        });
     }
     return {
         doc: resolved.doc,
@@ -192,4 +238,23 @@ export async function verifyAccountLog({ did, spaceId, host, pinStore }) {
         nextKeyHashes: resolved.meta.nextKeyHashes ?? []
     };
 }
+/**
+ * The {@link VerifiedAccountLog} view of a head a ceremony already read or
+ * published -- a projection, not a check. The caller that seeds a memo from
+ * an establishment's own `accountLog` uses it rather than re-fetching the log
+ * that run just wrote; a caller wanting the DID and pin checks too calls
+ * {@link verifyAccountLog} with the head instead.
+ *
+ * @param options {object}
+ * @param options.published {PublishedWebvhLog}   the resolved head
+ * @returns {VerifiedAccountLog}
+ */
+export function verifiedAccountLogOf({ published }) {
+    return {
+        doc: published.doc,
+        log: published.log,
+        updateKeys: published.updateKeys,
+        nextKeyHashes: published.nextKeyHashes
+    };
+}
 //# sourceMappingURL=verifyLog.js.map

package/dist/webvh/verifyLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLog.js","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAEhF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAGjB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,EAAE,OAAO,EAAuB;IAC9D,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,YAAY,EAAE,aAAa,CAAC,EAAE;QAC9B,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,uCAAuC;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAA;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EAMT;IAMC,MAAM,GAAG,GAAG,KAAK,CAAC;QAChB,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,CAAC,MAAM,IAAI,CACnE,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,4CACE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,uCACzB,IAAI,CACL,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gBAAgB,CACnB,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QACtD,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG;QACH,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE;QAC1C,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE;KACjD,CAAA;AACH,CAAC"}
+{"version":3,"file":"verifyLog.js","sourceRoot":"","sources":["../../src/webvh/verifyLog.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAEhF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AAE/D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAGjB,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,EAAE,OAAO,EAAuB;IAC9D,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,YAAY,EAAE,aAAa,CAAC,EAAE;QAC9B,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,uCAAuC;QAC3D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAA;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAA;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,eAAe;gBACvB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,aAAa;gBACrB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,GAAG,CAAC,IAAI;aACrB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,GAAG,CAAC,CAAE,CAAC,SAAS,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,0BAA0B,CAAC;gBACnC,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,aAAa,EAAE,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,QAAQ,EACR,KAAK,EACL,GAAG,EAKJ;IACC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,yBAAyB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IACtD,wEAAwE;IACxE,+DAA+D;IAC/D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,SAAS,EAOV;IACC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,gBAAgB,CACnB,CAAA;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,4BAA4B,CAAC;gBACjC,QAAQ;gBACR,KAAK,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC;gBACnC,GAAG,EAAE,SAAS,CAAC,GAAG;aACnB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC;QAChB,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,CAAC,MAAM,IAAI,CACnE,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,4CACE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,uCACzB,IAAI,CACL,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,gBAAgB,CACnB,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,4BAA4B,CAAC;YACjC,QAAQ;YACR,KAAK,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC;YACnC,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG;QACH,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE;QAC1C,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE;KACjD,CAAA;AACH,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,SAAS,EAGV;IACC,OAAO;QACL,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,aAAa,EAAE,SAAS,CAAC,aAAa;KACvC,CAAA;AACH,CAAC"}

package/dist/webvh/wasIdStore.d.ts

@@ -10,11 +10,11 @@
  * a `gen-` collection in the auxiliary annex Space -- is served by the
  * same implementation without touching the account-log paths.
  *
- * Collections here are addressed as plaintext: `id` holds published documents
- * (world-readable by policy), an annex generation's collection holds only
- * its `did.jsonl` (capability-gated, but never encrypted -- the server
- * resolves it out of its own storage), and `key-map` holds plain JSON, so
- * none of them goes through the encryption codec.
+ * Collections here are addressed through {@link plaintextCollection}: `id`
+ * holds published documents (world-readable by policy), an annex generation's
+ * collection holds only its `did.jsonl` (capability-gated, but never
+ * encrypted -- the server resolves it out of its own storage), and `key-map`
+ * holds plain JSON, so none of them goes through the encryption codec.
  *
  * Bodies are written as raw bytes under the content type the caller states --
  * load-bearing, since the log is JSON Lines (`text/jsonl`), not JSON, and the
@@ -22,9 +22,9 @@
  *
  * Reads carry the resource's ETag and writes forward the ceremonies'
  * conditional-write preconditions, so a did:webvh ceremony's `did.jsonl`
- * publish is a compare-and-swap. A backend that does not advertise
- * `conditional-writes` serves no ETag, and the publish degrades to an
- * unconditional write.
+ * publish and the pair of `keys.json` writes are compare-and-swaps. A backend
+ * that does not advertise `conditional-writes` serves no ETag, and the writes
+ * degrade to unconditional.
  */
 import type { IZcap } from '@interop/data-integrity-core';
 import type { WasClient } from '@interop/was-client';

package/dist/webvh/wasIdStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wasIdStore.d.ts","sourceRoot":"","sources":["../../src/webvh/wasIdStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAMpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,YAAY,EACZ,kBAAkB,GAAG,eAAe,GAAG,eAAe,CACvD,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACX,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,qBAAqB,CA+CxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACH,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,YAAY,CAaf"}
+{"version":3,"file":"wasIdStore.d.ts","sourceRoot":"","sources":["../../src/webvh/wasIdStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAOpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,YAAY,EACZ,kBAAkB,GAAG,eAAe,GAAG,eAAe,CACvD,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACX,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,qBAAqB,CAiDxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACH,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,YAAY,CAsCf"}

package/dist/webvh/wasIdStore.js

@@ -1,4 +1,5 @@
 import { DID_KEYS_RESOURCE, ID_COLLECTION, KEY_MAP_COLLECTION } from '../space/collections.js';
+import { plaintextCollection } from '../space/plaintextCollection.js';
 /**
  * Builds the parameterized log-resource store over one collection of one
  * Space: the shared implementation behind {@link wasWebvhIdStore} (the
@@ -18,10 +19,7 @@ import { DID_KEYS_RESOURCE, ID_COLLECTION, KEY_MAP_COLLECTION } from '../space/c
  * @returns {WebvhLogResourceStore}
  */
 export function wasWebvhLogStore({ was, spaceId, collectionId, capability }) {
-    const resource = (resourceId) => was
-        .space(spaceId, capability !== undefined ? { capability } : {})
-        .collection(collectionId, { encryption: 'plaintext' })
-        .resource(resourceId);
+    const resource = (resourceId) => plaintextCollection({ was, spaceId, collectionId, capability }).resource(resourceId);
     return {
         getIdResourceRaw: async ({ resourceId }) => {
             const read = await resource(resourceId).getWithEtag();
@@ -46,8 +44,11 @@ export function wasWebvhLogStore({ was, spaceId, collectionId, capability }) {
         putIdResource: async ({ resourceId, content, contentType = 'application/json', ifMatch, ifNoneMatch }) => {
             const serialized = typeof content === 'string' ? content : JSON.stringify(content);
             // was-client's own PreconditionFailedError propagates as-is: its `name`
-            // is exactly what the seam contract names.
-            await resource(resourceId).put(new TextEncoder().encode(serialized), {
+            // is exactly what the seam contract names. The PUT's own response
+            // carries the stored resource's new validator, so it is handed back
+            // rather than dropped: a ceremony that publishes can then build its
+            // next entry on the head it just wrote.
+            return resource(resourceId).put(new TextEncoder().encode(serialized), {
                 contentType,
                 ifMatch,
                 ifNoneMatch
@@ -68,15 +69,39 @@ export function wasWebvhLogStore({ was, spaceId, collectionId, capability }) {
 export function wasWebvhIdStore({ was, spaceId }) {
     return {
         ...wasWebvhLogStore({ was, spaceId, collectionId: ID_COLLECTION.id }),
-        putKeyMap: async ({ content }) => {
-            await was
-                .space(spaceId)
-                .collection(KEY_MAP_COLLECTION.id, { encryption: 'plaintext' })
+        getKeyMapRaw: async () => {
+            const read = await plaintextCollection({
+                was,
+                spaceId,
+                collectionId: KEY_MAP_COLLECTION.id
+            })
                 .resource(DID_KEYS_RESOURCE)
-                .put(new TextEncoder().encode(JSON.stringify(content)), {
-                contentType: 'application/json'
-            });
-        }
+                .getWithEtag();
+            return read === null
+                ? undefined
+                : {
+                    content: read.data,
+                    ...(read.etag !== undefined && { etag: read.etag })
+                };
+        },
+        // The caller states the precondition per write, since the two writes of
+        // one signup carry different ones: create-if-absent for the KMS stage's
+        // own write, and an If-Match on that write's ETag for the genesis'
+        // rewrite. A precondition fixed here would refuse the rewrite on every
+        // signup and strand a map with no `webvh` block. The PUT's own response
+        // carries the stored resource's new validator, so it is handed back
+        // rather than dropped.
+        putKeyMap: async ({ content, ifMatch, ifNoneMatch }) => plaintextCollection({
+            was,
+            spaceId,
+            collectionId: KEY_MAP_COLLECTION.id
+        })
+            .resource(DID_KEYS_RESOURCE)
+            .put(new TextEncoder().encode(JSON.stringify(content)), {
+            contentType: 'application/json',
+            ifMatch,
+            ifNoneMatch
+        })
     };
 }
 //# sourceMappingURL=wasIdStore.js.map

package/dist/webvh/wasIdStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"wasIdStore.js","sourceRoot":"","sources":["../../src/webvh/wasIdStore.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EACnB,MAAM,yBAAyB,CAAA;AAahC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EAMX;IACC,MAAM,QAAQ,GAAG,CAAC,UAAkB,EAAE,EAAE,CACtC,GAAG;SACA,KAAK,CAAC,OAAO,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,UAAU,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SACrD,QAAQ,CAAC,UAAU,CAAC,CAAA;IAEzB,OAAO;QACL,gBAAgB,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;YACrD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;YAC3B,MAAM,IAAI,GACR,IAAI,YAAY,IAAI;gBAClB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE;gBACnB,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ;oBACxB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAA;YAC7C,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;QACzC,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,EACpB,UAAU,EACV,OAAO,EACP,WAAW,GAAG,kBAAkB,EAChC,OAAO,EACP,WAAW,EACZ,EAAE,EAAE;YACH,MAAM,UAAU,GACd,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACjE,wEAAwE;YACxE,2CAA2C;YAC3C,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;gBACnE,WAAW;gBACX,OAAO;gBACP,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,GAAG,EACH,OAAO,EAIR;IACC,OAAO;QACL,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;QACrE,SAAS,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/B,MAAM,GAAG;iBACN,KAAK,CAAC,OAAO,CAAC;iBACd,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;iBAC9D,QAAQ,CAAC,iBAAiB,CAAC;iBAC3B,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE;gBACtD,WAAW,EAAE,kBAAkB;aAChC,CAAC,CAAA;QACN,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"wasIdStore.js","sourceRoot":"","sources":["../../src/webvh/wasIdStore.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EACnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAarE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EAMX;IACC,MAAM,QAAQ,GAAG,CAAC,UAAkB,EAAE,EAAE,CACtC,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CACtE,UAAU,CACX,CAAA;IAEH,OAAO;QACL,gBAAgB,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;YACrD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,wEAAwE;YACxE,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;YAC3B,MAAM,IAAI,GACR,IAAI,YAAY,IAAI;gBAClB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE;gBACnB,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ;oBACxB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAA;YAC7C,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;QACzC,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,EACpB,UAAU,EACV,OAAO,EACP,WAAW,GAAG,kBAAkB,EAChC,OAAO,EACP,WAAW,EACZ,EAAE,EAAE;YACH,MAAM,UAAU,GACd,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YACjE,wEAAwE;YACxE,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,wCAAwC;YACxC,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;gBACpE,WAAW;gBACX,OAAO;gBACP,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,GAAG,EACH,OAAO,EAIR;IACC,OAAO;QACL,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;QACrE,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;gBACrC,GAAG;gBACH,OAAO;gBACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;aACpC,CAAC;iBACC,QAAQ,CAAC,iBAAiB,CAAC;iBAC3B,WAAW,EAAE,CAAA;YAChB,OAAO,IAAI,KAAK,IAAI;gBAClB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;iBACpD,CAAA;QACP,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,uBAAuB;QACvB,SAAS,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CACrD,mBAAmB,CAAC;YAClB,GAAG;YACH,OAAO;YACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;SACpC,CAAC;aACC,QAAQ,CAAC,iBAAiB,CAAC;aAC3B,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE;YACtD,WAAW,EAAE,kBAAkB;YAC/B,OAAO;YACP,WAAW;SACZ,CAAC;KACP,CAAA;AACH,CAAC"}

package/dist/webvh/zcap.d.ts

@@ -1,4 +1,17 @@
-import { ZcapClient } from '@interop/ezcap';
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * ZCap signing under the account's did:webvh identity. After controller
+ * promotion the data Space's controller is the did:webvh DID, whose document
+ * carries a verification method per enrolled client -- so invocations and
+ * delegations must be signed with a keyId of the form
+ * `<did:webvh>#<publicKeyMultibase>` (this client's Ed25519 key, published
+ * under `capabilityInvocation` / `capabilityDelegation`). The key material
+ * is unchanged -- the client's own Ed25519 pair -- only the keyId names the
+ * verification method in the did:webvh document instead of the did:key one.
+ */
+import type { ZcapClient } from '@interop/ezcap';
 import type { ISigner } from '@interop/data-integrity-core';
 /**
  * The minimal shape of a signing key agent this module operates on -- what

package/dist/webvh/zcap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zcap.d.ts","sourceRoot":"","sources":["../../src/webvh/zcap.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,OAAO,CAAA;IACxB,sBAAsB,EAAE,MAAM;QAC5B,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,MAAM,CAMT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,GAAG,EACJ,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ;;;oBAGmB;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC;EAO/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,EAC9B,QAAQ,EACR,GAAG,EACJ,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,UAAU,CAOb;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,UAAU,CAOb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,QAAQ,EACR,GAAG,EACJ,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,gBAAgB,CAQnB;AAID,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"zcap.d.ts","sourceRoot":"","sources":["../../src/webvh/zcap.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAG3D;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,OAAO,CAAA;IACxB,sBAAsB,EAAE,MAAM;QAC5B,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,kBAAkB,EAAE,MAAM,CAAA;QAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAA;CACF;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,MAAM,CAMT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,GAAG,EACJ,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ;;;oBAGmB;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC;EAO/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,EAC9B,QAAQ,EACR,GAAG,EACJ,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,UAAU,CAEb;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,UAAU,CAEb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,QAAQ,EACR,GAAG,EACJ,EAAE;IACD,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,gBAAgB,CAQnB;AAID,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA"}

package/dist/webvh/zcap.js

@@ -1,18 +1,4 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * ZCap signing under the account's did:webvh identity. After controller
- * promotion the data Space's controller is the did:webvh DID, whose document
- * carries a verification method per enrolled client -- so invocations and
- * delegations must be signed with a keyId of the form
- * `<did:webvh>#<publicKeyMultibase>` (this client's Ed25519 key, published
- * under `capabilityInvocation` / `capabilityDelegation`). The key material
- * is unchanged -- the client's own Ed25519 pair -- only the keyId names the
- * verification method in the did:webvh document instead of the did:key one.
- */
-import { EddsaJcs2022 } from '@interop/ed25519-signature/eddsa-jcs-2022';
-import { ZcapClient } from '@interop/ezcap';
+import { zcapClientForSigner } from '../identity/agents.js';
 /**
  * The client's Ed25519 public key multibase (`z6Mk...`), read out of its
  * did:key id (`did:key:<publicKeyMultibase>`).
@@ -58,12 +44,7 @@ export function webvhSigner({ keyAgent, did }) {
  * @returns {ZcapClient}
  */
 export function webvhZcapClient({ keyAgent, did }) {
-    const signer = webvhSigner({ keyAgent, did });
-    return new ZcapClient({
-        SuiteClass: EddsaJcs2022,
-        invocationSigner: signer,
-        delegationSigner: signer
-    });
+    return zcapClientForSigner({ signer: webvhSigner({ keyAgent, did }) });
 }
 /**
  * A ZcapClient signing with the client's plain did:key identity -- the
@@ -76,12 +57,7 @@ export function webvhZcapClient({ keyAgent, did }) {
  * @returns {ZcapClient}
  */
 export function didKeyZcapClient({ keyAgent }) {
-    const signer = keyAgent.getSigner();
-    return new ZcapClient({
-        SuiteClass: EddsaJcs2022,
-        invocationSigner: signer,
-        delegationSigner: signer
-    });
+    return zcapClientForSigner({ signer: keyAgent.getSigner() });
 }
 /**
  * A CapabilityAgent-shaped wrapper presenting the client's key under the

package/dist/webvh/zcap.js.map

@@ -1 +1 @@
-{"version":3,"file":"zcap.js","sourceRoot":"","sources":["../../src/webvh/zcap.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAsB3C;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,QAAQ,EAGT;IACC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,kBAAkB,CAAA;AAC3B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,QAAQ,EACR,GAAG,EAIJ;IACC,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,EAG9B,CAAA;IACD,OAAO;QACL,EAAE,EAAE,GAAG,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE;QACvD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,4BAA4B;QAC/C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;KAC3B,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,QAAQ,EACR,GAAG,EAIJ;IACC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,OAAO,IAAI,UAAU,CAAC;QACpB,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,QAAQ,EAGT;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,OAAO,IAAI,UAAU,CAAC;QACpB,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,QAAQ,EACR,GAAG,EAIJ;IACC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,OAAO;QACL,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,sBAAsB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,sBAAsB,EAAE;KAChE,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"zcap.js","sourceRoot":"","sources":["../../src/webvh/zcap.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAqB3D;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,QAAQ,EAGT;IACC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,kBAAkB,CAAA;AAC3B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,QAAQ,EACR,GAAG,EAIJ;IACC,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,EAG9B,CAAA;IACD,OAAO;QACL,EAAE,EAAE,GAAG,GAAG,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE;QACvD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,4BAA4B;QAC/C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;KAC3B,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,QAAQ,EACR,GAAG,EAIJ;IACC,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,QAAQ,EAGT;IACC,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,QAAQ,EACR,GAAG,EAIJ;IACC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,OAAO;QACL,EAAE,EAAE,GAAG;QACP,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,sBAAsB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,sBAAsB,EAAE;KAChE,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/wallet-core",
   "description": "Shared wallet-domain logic (WAS sync engine core and wallet Space layout contracts) for Interop wallet apps.",
-  "version": "0.62.0",
+  "version": "0.65.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -31,7 +31,7 @@
     "@interop/storage-core": "^0.9.1",
     "@interop/vc": "^11.0.7",
     "@interop/vh-resource-log": "^0.4.1",
-    "@interop/was-client": "^0.46.1",
+    "@interop/was-client": "^0.47.0",
     "@interop/webkms-client": "^14.7.4",
     "@interop/x25519-key-agreement-key": "^5.2.2",
     "@noble/ciphers": "^2.3.0",

package/dist/webvh/keyAgreement.d.ts

@@ -1,97 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The ONE reference-resolving reader for a did:webvh document's `keyAgreement`
- * relation, and the document shape it reads.
- *
- * The relation may carry either form the DID Core data model allows -- a string
- * reference into `verificationMethod`, or an embedded method -- so every
- * consumer that asks "which key-agreement methods does this document publish"
- * must resolve references first. That resolution lives here once, and the
- * consumers are plain filters over its result: the client listing and the
- * revocation removal keep only the methods carrying a client's controller
- * marker, while the user key roster's recipient resolver deliberately keeps
- * unmarked methods too.
- *
- * Deliberately dependency-light -- it imports nothing at all -- so the `keys`
- * layer can share the reader without pulling the ceremony or signing graph.
- */
-/**
- * A locally verified did:webvh document, read for the `keyAgreement` methods it
- * publishes and the controller each one carries. Structural on purpose: a
- * resolved `DIDDoc` satisfies it, and so does any narrower document shape a
- * wallet already holds.
- */
-export interface KeyAgreementDocument {
-    verificationMethod?: Array<{
-        id?: string;
-        type?: string;
-        controller?: string;
-        publicKeyMultibase?: string;
-        publicKeyCommitment?: string;
-    }>;
-    keyAgreement?: Array<string | {
-        id?: string;
-        type?: string;
-        controller?: string;
-        publicKeyMultibase?: string;
-        publicKeyCommitment?: string;
-    }>;
-}
-/**
- * The materialized shape {@link resolvedKeyAgreementMethods} returns: a
- * `keyAgreement` verification method carrying either the key itself
- * (`publicKeyMultibase`) or, for a low-entropy-derived standing unlock
- * credential, its hash commitment (`publicKeyCommitment`). The `type` rides
- * along so a consumer can tell the two published flavors apart (`Multikey` vs
- * `MultikeyCommitment`) instead of inferring the flavor from which property
- * happens to be present.
- */
-export interface ResolvedKeyAgreementMethod {
-    id?: string;
-    type?: string;
-    controller?: string;
-    publicKeyMultibase?: string;
-    publicKeyCommitment?: string;
-}
-/**
- * The `keyAgreement` verification methods a document publishes, materialized:
- * string references resolved against `verificationMethod` (a reference nothing
- * backs is dropped), embedded methods taken verbatim. Document order is
- * preserved, and nothing is filtered -- deciding which of these methods belongs
- * to whom is each caller's own rule.
- *
- * @param options {object}
- * @param options.doc {KeyAgreementDocument}   a locally verified document
- * @returns {ResolvedKeyAgreementMethod[]}
- */
-export declare function resolvedKeyAgreementMethods({ doc }: {
-    doc: KeyAgreementDocument;
-}): ResolvedKeyAgreementMethod[];
-/**
- * The CREDENTIAL-CLASS `keyAgreement` methods a document publishes: those the
- * account DID itself controls. The rule is structural, and it is the exact
- * complement of the client marker: an enrolled client's key-agreement method
- * carries `controller: did:key:<its signing multibase>`
- * (`clientKeyAgreementController`), while a standing unlock credential's
- * carries the account DID. Both published flavors match -- a passphrase's
- * `MultikeyCommitment` and the verbatim `Multikey` a passkey or a recovery
- * code publishes -- because the class is decided by the controller alone.
- *
- * Nothing here tells one credential from another. A recovery code's entry is
- * indistinguishable from a passkey's by construction (both are unmarked and
- * verbatim), so a caller retiring this class retires every credential the
- * account stands on, which is what the transient and remembered recovery
- * continuations want.
- *
- * @param options {object}
- * @param options.doc {KeyAgreementDocument}   a locally verified document
- * @param options.did {string}   the account DID the document resolves to
- * @returns {ResolvedKeyAgreementMethod[]}   in document order
- */
-export declare function credentialKeyAgreementMethods({ doc, did }: {
-    doc: KeyAgreementDocument;
-    did: string;
-}): ResolvedKeyAgreementMethod[];
-//# sourceMappingURL=keyAgreement.d.ts.map

package/dist/webvh/keyAgreement.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"keyAgreement.d.ts","sourceRoot":"","sources":["../../src/webvh/keyAgreement.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,kBAAkB,CAAC,EAAE,KAAK,CAAC;QACzB,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAC7B,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAChB,MAAM,GACN;QACE,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAC7B,CACJ,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;CAC1B,GAAG,0BAA0B,EAAE,CAe/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,0BAA0B,EAAE,CAI/B"}