@interop/wallet-core 0.66.0 → 0.67.0

package/dist/webvh/listClients.js

@@ -1,6 +1,6 @@
 import { vmFragmentOf } from '@interop/vh-resource-log';
 import { clientKeyAgreementController, effectiveParameters } from './didWebvh.js';
-import { relationIds, resolvedKeyAgreementMethods } from '../resourceLog/document.js';
+import { relationIds, resolvedKeyAgreementMethods, resolvedRelationMethods } from '../resourceLog/document.js';
 /**
  * The key multibases the document currently publishes: every verification
  * method's `publicKeyMultibase`, plus the fragment of its id (for a did:webvh
@@ -28,37 +28,28 @@ export function documentKeyMultibases({ doc }) {
  * The key multibases the document currently lists under
  * `capabilityDelegation`. A relation member is either a verification-method
  * id or an embedded method, so each is resolved both ways: the fragment of
- * its id, its own `publicKeyMultibase` when embedded, and the
- * `publicKeyMultibase` of the `verificationMethod` entry a string reference
- * names.
+ * its id, and the `publicKeyMultibase` of the method it resolves to (its own
+ * when embedded, the `verificationMethod` entry's when a string reference
+ * names one).
  *
  * @param options {object}
  * @param options.doc {PublishedKeyDocument}   a locally verified document
  * @returns {Set<string>}
  */
 function delegationRelationMultibases({ doc }) {
-    const byId = new Map();
-    for (const method of doc.verificationMethod ?? []) {
-        if (method.id && method.publicKeyMultibase) {
-            byId.set(method.id, method.publicKeyMultibase);
-        }
-    }
     const multibases = new Set();
-    for (const member of doc.capabilityDelegation ?? []) {
-        const id = typeof member === 'string' ? member : member?.id;
-        const embedded = typeof member === 'string' ? undefined : member?.publicKeyMultibase;
-        if (embedded) {
-            multibases.add(embedded);
+    for (const id of relationIds(doc.capabilityDelegation)) {
+        const fragment = vmFragmentOf(id);
+        if (fragment) {
+            multibases.add(fragment);
         }
-        if (id) {
-            const fragment = vmFragmentOf(id);
-            if (fragment) {
-                multibases.add(fragment);
-            }
-            const referenced = byId.get(id);
-            if (referenced) {
-                multibases.add(referenced);
-            }
+    }
+    for (const method of resolvedRelationMethods({
+        doc,
+        relation: 'capabilityDelegation'
+    })) {
+        if (method.publicKeyMultibase) {
+            multibases.add(method.publicKeyMultibase);
         }
     }
     return multibases;
@@ -210,41 +201,75 @@ function addedUpdateKeys(params, index) {
     return params[index].updateKeys.filter(key => !previous.has(key));
 }
 /**
- * Attributes one client's ACTIVE update key from the log: its initial key is
+ * Attributes every listed client's ACTIVE update key from the log in ONE
+ * forward pass -- the single-pass twin of {@link clientAddIndexes}, so a
+ * listing never walks the log tail once per client. A client's initial key is
  * whatever the entry publishing its verification methods revealed, and each
  * later entry that retired the attributed key while revealing exactly one
- * replacement is that client's self-rotation. Returns `undefined` on any
- * ambiguity (an entry revealing several keys beside the client's methods, a
- * retirement with several candidate replacements) or when the attributed key
- * is not authorized by the final entry.
+ * replacement is that client's self-rotation. A client attributes to
+ * `undefined` on any ambiguity (an entry revealing several keys beside the
+ * client's methods, a retirement with several candidate replacements) or when
+ * the attributed key is not authorized by the final entry.
+ *
+ * Each entry's revealed set is computed once and applied to every client
+ * whose key that entry retired, which is what the per-client walk recomputed
+ * per client. The pass starts at the earliest enrollment it is asked about
+ * and, for one client, is the tail walk from that client's add entry.
  *
  * @param options {object}
  * @param options.params {Array<{ updateKeys: string[]; nextKeyHashes: string[] }>}
  *   the log's effective parameters, one entry per log entry
- * @param options.addIndex {number}   the entry that published the client's
- *   verification methods
- * @returns {string | undefined}
+ * @param options.addIndexes {Map<string, number>}   each client's
+ *   signing-key multibase to the entry that published its verification
+ *   methods
+ * @returns {Map<string, string | undefined>}   each client's signing-key
+ *   multibase to its attributed active update key, `undefined` where the
+ *   attribution cannot isolate a single key
  */
-function attributeActiveUpdateKey({ params, addIndex }) {
-    const initial = addedUpdateKeys(params, addIndex);
-    if (initial.length !== 1) {
-        return undefined;
+function attributeActiveUpdateKeys({ params, addIndexes }) {
+    const active = new Map();
+    // Clients grouped by the entry that added them, so each entry's pass picks
+    // up its own newcomers without rescanning the map.
+    const addedAt = new Map();
+    for (const [signingKeyMultibase, addIndex] of addIndexes) {
+        const group = addedAt.get(addIndex);
+        if (group) {
+            group.push(signingKeyMultibase);
+        }
+        else {
+            addedAt.set(addIndex, [signingKeyMultibase]);
+        }
     }
-    let active = initial[0];
-    for (let index = addIndex + 1; index < params.length; index++) {
-        const stillPresent = params[index].updateKeys.includes(active);
-        if (stillPresent) {
-            continue;
+    if (addedAt.size === 0) {
+        return active;
+    }
+    // Nothing before the earliest enrollment can touch a listed client.
+    const first = Math.min(...addedAt.keys());
+    for (let index = first; index < params.length; index++) {
+        // An entry's `updateKeys` is a handful of keys, so membership is a scan
+        // rather than a Set built per entry.
+        const authorized = params[index].updateKeys;
+        // Lazily computed: most entries retire nobody's key.
+        let revealed;
+        for (const [signingKeyMultibase, key] of active) {
+            if (key === undefined || authorized.includes(key)) {
+                continue;
+            }
+            revealed ??= addedUpdateKeys(params, index);
+            active.set(signingKeyMultibase, revealed.length === 1 ? revealed[0] : undefined);
+        }
+        for (const signingKeyMultibase of addedAt.get(index) ?? []) {
+            revealed ??= addedUpdateKeys(params, index);
+            active.set(signingKeyMultibase, revealed.length === 1 ? revealed[0] : undefined);
         }
-        const revealed = addedUpdateKeys(params, index);
-        if (revealed.length !== 1) {
-            return undefined;
+    }
+    const final = params[params.length - 1].updateKeys;
+    for (const [signingKeyMultibase, key] of active) {
+        if (key !== undefined && !final.includes(key)) {
+            active.set(signingKeyMultibase, undefined);
         }
-        active = revealed[0];
     }
-    return params[params.length - 1].updateKeys.includes(active)
-        ? active
-        : undefined;
+    return active;
 }
 /**
  * The index of the entry that published a client's verification methods (its
@@ -280,25 +305,35 @@ export function attributeClientUpdateKey({ log, signingKeyMultibase }) {
     const addIndex = clientAddIndex({ log, signingKeyMultibase });
     return addIndex === -1
         ? undefined
-        : attributeActiveUpdateKey({ params: effectiveParameters(log), addIndex });
+        : attributeActiveUpdateKeys({
+            params: effectiveParameters(log),
+            addIndexes: new Map([[signingKeyMultibase, addIndex]])
+        }).get(signingKeyMultibase);
 }
 /**
- * A map from an enrolled client's signing-key multibase to the index of the
- * FIRST entry that published it under `capabilityInvocation` -- the whole log's
- * enrollment moments in one forward pass, so a listing attributes every client
- * without rescanning. A multibase the log never published is absent from the
- * map.
+ * A map from each LISTED client's signing-key multibase to the index of the
+ * FIRST entry that published it under `capabilityInvocation` -- the listed
+ * clients' enrollment moments in one forward pass, so a listing attributes
+ * every client without rescanning. Clients the final document no longer lists
+ * (revoked ones) are never entered, so the attribution pass that follows never
+ * tracks them. A multibase the log never published is absent from the map.
  *
  * @param options {object}
  * @param options.log {DIDLog}
+ * @param options.signingKeyMultibases {Set<string>}   the listed clients
  * @returns {Map<string, number>}
  */
-function clientAddIndexes({ log }) {
+function clientAddIndexes({ log, signingKeyMultibases }) {
     const addIndexes = new Map();
     for (const [index, entry] of log.entries()) {
+        if (addIndexes.size === signingKeyMultibases.size) {
+            break;
+        }
         for (const vmId of relationIds(entry.state.capabilityInvocation)) {
             const signingKeyMultibase = vmFragmentOf(vmId);
-            if (signingKeyMultibase && !addIndexes.has(signingKeyMultibase)) {
+            if (signingKeyMultibase &&
+                signingKeyMultibases.has(signingKeyMultibase) &&
+                !addIndexes.has(signingKeyMultibase)) {
                 addIndexes.set(signingKeyMultibase, index);
             }
         }
@@ -322,27 +357,29 @@ export function listEnrolledWebvhClients({ log }) {
     }
     const doc = log[log.length - 1].state;
     const params = effectiveParameters(log);
+    const signingKeyMultibases = relationIds(doc.capabilityInvocation)
+        .map(vmId => vmFragmentOf(vmId))
+        .filter((multibase) => Boolean(multibase));
     // The entry that published each client's verification methods -- its
     // enrollment moment, and the attribution anchor for its update key.
-    const addIndexes = clientAddIndexes({ log });
+    const addIndexes = clientAddIndexes({
+        log,
+        signingKeyMultibases: new Set(signingKeyMultibases)
+    });
+    // Every client's active update key, attributed in one forward pass.
+    const updateKeys = attributeActiveUpdateKeys({ params, addIndexes });
     // Every keyAgreement method, grouped by controller, in one pass -- keying by
     // controller string picks up only MARKED methods (a client's own), since the
     // account DID controller a recovery code's unmarked method carries is never
     // looked up below.
     const keyAgreementIndex = markedKeyAgreementIndex({ doc });
     const clients = [];
-    for (const vmId of relationIds(doc.capabilityInvocation)) {
-        const signingKeyMultibase = vmFragmentOf(vmId);
-        if (!signingKeyMultibase) {
-            continue;
-        }
+    for (const signingKeyMultibase of signingKeyMultibases) {
         const addIndex = addIndexes.get(signingKeyMultibase);
         clients.push({
             signingKeyMultibase,
             keyAgreementKeyMultibases: keyAgreementIndex.get(clientKeyAgreementController({ signingKeyMultibase })) ?? [],
-            updateKeyMultibase: addIndex === undefined
-                ? undefined
-                : attributeActiveUpdateKey({ params, addIndex }),
+            updateKeyMultibase: updateKeys.get(signingKeyMultibase),
             addedAt: addIndex === undefined ? undefined : log[addIndex].versionTime
         });
     }

package/dist/webvh/listClients.js.map

@@ -1 +1 @@
-{"version":3,"file":"listClients.js","sourceRoot":"","sources":["../../src/webvh/listClients.ts"],"names":[],"mappings":"AA0DA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,WAAW,EACX,2BAA2B,EAC5B,MAAM,4BAA4B,CAAA;AAkCnC;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,GAAG,EAGJ;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,4BAA4B,CAAC,EACpC,GAAG,EAGJ;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,EAAE,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAA;QAC3D,MAAM,QAAQ,GACZ,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAA;QACrE,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1B,CAAC;QACD,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YACjC,IAAI,QAAQ,EAAE,CAAC;gBACb,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC/B,IAAI,UAAU,EAAE,CAAC;gBACf,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,GAAG,EACH,eAAe,EAIhB;IACC,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,4BAA4B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,GAAG,EACH,mBAAmB,EAIpB;IACC,MAAM,MAAM,GAAG,4BAA4B,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACpE,OAAO,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAChD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CACvC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,GAAG,EACH,mBAAmB,EAIpB;IACC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,KAAK,MAAM,MAAM,IAAI,yBAAyB,CAAC;QAC7C,GAAG;QACH,mBAAmB;KACpB,CAAC,EAAE,CAAC;QACH,MAAM,SAAS,GACb,MAAM,CAAC,kBAAkB;YACzB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACnD,IAAI,SAAS,EAAE,CAAC;YACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,uBAAuB,CAAC,EAC/B,GAAG,EAGJ;IACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAA;IACzC,KAAK,MAAM,MAAM,IAAI,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GACb,MAAM,CAAC,kBAAkB;YACzB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,MAAuC,EACvC,KAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACxE,OAAO,MAAM,CAAC,KAAK,CAAE,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB,CAAC,EAChC,MAAM,EACN,QAAQ,EAIT;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;IACxB,KAAK,IAAI,KAAK,GAAG,QAAQ,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/D,IAAI,YAAY,EAAE,CAAC;YACjB,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3D,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,EACtB,GAAG,EACH,mBAAmB,EAIpB;IACC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC3B,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAChD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,mBAAmB,CACnD,CACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,GAAG,EACH,mBAAmB,EAIpB;IACC,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC7D,OAAO,QAAQ,KAAK,CAAC,CAAC;QACpB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AAC9E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,EAAE,GAAG,EAAmB;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACjE,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAC9C,IAAI,mBAAmB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAChE,UAAU,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,GAAG,EAGJ;IACC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,KAAK,CAAA;IACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,MAAM,OAAO,GAA0B,EAAE,CAAA;IACzC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACzD,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,mBAAmB;YACnB,yBAAyB,EACvB,iBAAiB,CAAC,GAAG,CACnB,4BAA4B,CAAC,EAAE,mBAAmB,EAAE,CAAC,CACtD,IAAI,EAAE;YACT,kBAAkB,EAChB,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACpD,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,WAAW;SACzE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"listClients.js","sourceRoot":"","sources":["../../src/webvh/listClients.ts"],"names":[],"mappings":"AA0DA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,4BAA4B,CAAA;AAkCnC;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,GAAG,EAGJ;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,4BAA4B,CAAC,EACpC,GAAG,EAGJ;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,uBAAuB,CAAC;QAC3C,GAAG;QACH,QAAQ,EAAE,sBAAsB;KACjC,CAAC,EAAE,CAAC;QACH,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,GAAG,EACH,eAAe,EAIhB;IACC,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,4BAA4B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,GAAG,EACH,mBAAmB,EAIpB;IACC,MAAM,MAAM,GAAG,4BAA4B,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACpE,OAAO,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAChD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,MAAM,CACvC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,GAAG,EACH,mBAAmB,EAIpB;IACC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,KAAK,MAAM,MAAM,IAAI,yBAAyB,CAAC;QAC7C,GAAG;QACH,mBAAmB;KACpB,CAAC,EAAE,CAAC;QACH,MAAM,SAAS,GACb,MAAM,CAAC,kBAAkB;YACzB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACnD,IAAI,SAAS,EAAE,CAAC;YACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,uBAAuB,CAAC,EAC/B,GAAG,EAGJ;IACC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAA;IACzC,KAAK,MAAM,MAAM,IAAI,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GACb,MAAM,CAAC,kBAAkB;YACzB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CACtB,MAAuC,EACvC,KAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACxE,OAAO,MAAM,CAAC,KAAK,CAAE,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,yBAAyB,CAAC,EACjC,MAAM,EACN,UAAU,EAIX;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAA;IACpD,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC3C,KAAK,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IACzC,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAE,CAAC,UAAU,CAAA;QAC5C,qDAAqD;QACrD,IAAI,QAA8B,CAAA;QAClC,KAAK,MAAM,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;YAChD,IAAI,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,SAAQ;YACV,CAAC;YACD,QAAQ,KAAK,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,CACR,mBAAmB,EACnB,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAChD,CAAA;QACH,CAAC;QACD,KAAK,MAAM,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3D,QAAQ,KAAK,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,CACR,mBAAmB,EACnB,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAChD,CAAA;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,UAAU,CAAA;IACnD,KAAK,MAAM,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,EACtB,GAAG,EACH,mBAAmB,EAIpB;IACC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAC3B,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAChD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,mBAAmB,CACnD,CACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,GAAG,EACH,mBAAmB,EAIpB;IACC,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC7D,OAAO,QAAQ,KAAK,CAAC,CAAC;QACpB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,yBAAyB,CAAC;YACxB,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;YAChC,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC;SACvD,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,EACxB,GAAG,EACH,oBAAoB,EAIrB;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,IAAI,UAAU,CAAC,IAAI,KAAK,oBAAoB,CAAC,IAAI,EAAE,CAAC;YAClD,MAAK;QACP,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACjE,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAC9C,IACE,mBAAmB;gBACnB,oBAAoB,CAAC,GAAG,CAAC,mBAAmB,CAAC;gBAC7C,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,EACpC,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,GAAG,EAGJ;IACC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,KAAK,CAAA;IACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,oBAAoB,GAAG,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC;SAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;SAC/B,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,GAAG;QACH,oBAAoB,EAAE,IAAI,GAAG,CAAC,oBAAoB,CAAC;KACpD,CAAC,CAAA;IACF,oEAAoE;IACpE,MAAM,UAAU,GAAG,yBAAyB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IACpE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,MAAM,OAAO,GAA0B,EAAE,CAAA;IACzC,KAAK,MAAM,mBAAmB,IAAI,oBAAoB,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QACpD,OAAO,CAAC,IAAI,CAAC;YACX,mBAAmB;YACnB,yBAAyB,EACvB,iBAAiB,CAAC,GAAG,CACnB,4BAA4B,CAAC,EAAE,mBAAmB,EAAE,CAAC,CACtD,IAAI,EAAE;YACT,kBAAkB,EAAE,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACvD,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,WAAW;SACzE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/webvh/mergeMethods.d.ts

@@ -0,0 +1,84 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The one merge of new verification methods into a published account
+ * document, shared by every entry builder that ADDS methods: the enrollment
+ * add entry, the self-enrollment add entry, and the recovery continuation's
+ * add-and-retire entry. Each site hands over its methods and the ids each
+ * relation gains; the merge replaces a method already published under the
+ * same id, dedupes each relation's references, and applies one optional
+ * retirement predicate over the EXISTING document alone.
+ *
+ * Shared because a drift here is silent: a relation missed at one site or a
+ * filter run in a different order publishes a document the other replica
+ * would not have written, and nothing refuses it. Deliberately dependency-
+ * light -- the relation reader and the method type only -- so the layers
+ * that build entries can take it without the ceremony graph.
+ */
+import type { VerificationMethod } from '@interop/did-method-webvh';
+/**
+ * The ids a merge adds to each verification relation. Order is load-bearing
+ * on the wire: each relation gains the ids in the order given, after the
+ * references the document already carries.
+ */
+export interface RelationMembership {
+    authentication?: string[];
+    assertionMethod?: string[];
+    keyAgreement?: string[];
+    capabilityInvocation?: string[];
+    capabilityDelegation?: string[];
+}
+/**
+ * Merges verification methods into a published document across the five
+ * relations. `verificationMethod` keeps every existing method the predicate
+ * does not retire and that no added method replaces by id, then the added
+ * methods in order; each relation keeps its existing references (retired ones
+ * dropped) and then the ids `relations` names for it, deduped.
+ *
+ * The retirement predicate runs over the existing document only, and the
+ * added ids join afterwards: a method this entry publishes may already stand
+ * in a relation (a reinstalled ladder VM, say), and filtering the union would
+ * strike the very method being published.
+ *
+ * @param options {object}
+ * @param options.doc {object}   the published document the entry extends
+ * @param options.methods {VerificationMethod[]}   the methods to publish, in
+ *   the order they land in `verificationMethod`
+ * @param options.relations {RelationMembership}   the ids each relation gains
+ * @param [options.retire] {(id: string) => boolean}   which existing method
+ *   ids and relation references leave the document in the same entry
+ * @returns {object}   the merged `verificationMethods` and the five relations,
+ *   as the account-entry seam takes them
+ */
+export declare function mergeVerificationMethods({ doc, methods, relations, retire }: {
+    doc: {
+        verificationMethod?: VerificationMethod[];
+        authentication?: Array<string | {
+            id?: string;
+        }>;
+        assertionMethod?: Array<string | {
+            id?: string;
+        }>;
+        keyAgreement?: Array<string | {
+            id?: string;
+        }>;
+        capabilityInvocation?: Array<string | {
+            id?: string;
+        }>;
+        capabilityDelegation?: Array<string | {
+            id?: string;
+        }>;
+    };
+    methods: VerificationMethod[];
+    relations: RelationMembership;
+    retire?: (id: string) => boolean;
+}): {
+    verificationMethods: VerificationMethod[];
+    authentication: string[];
+    assertionMethod: string[];
+    keyAgreement: string[];
+    capabilityInvocation: string[];
+    capabilityDelegation: string[];
+};
+//# sourceMappingURL=mergeMethods.d.ts.map

package/dist/webvh/mergeMethods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeMethods.d.ts","sourceRoot":"","sources":["../../src/webvh/mergeMethods.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAGnE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,SAAS,EACT,MAAoB,EACrB,EAAE;IACD,GAAG,EAAE;QACH,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,CAAA;QACzC,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAChD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QACjD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QAC9C,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QACtD,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACvD,CAAA;IACD,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,SAAS,EAAE,kBAAkB,CAAA;IAC7B,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAA;CACjC,GAAG;IACF,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;IACzC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAA;CAC/B,CAwCA"}

package/dist/webvh/mergeMethods.js

@@ -0,0 +1,46 @@
+import { relationIds } from '../resourceLog/document.js';
+/**
+ * Merges verification methods into a published document across the five
+ * relations. `verificationMethod` keeps every existing method the predicate
+ * does not retire and that no added method replaces by id, then the added
+ * methods in order; each relation keeps its existing references (retired ones
+ * dropped) and then the ids `relations` names for it, deduped.
+ *
+ * The retirement predicate runs over the existing document only, and the
+ * added ids join afterwards: a method this entry publishes may already stand
+ * in a relation (a reinstalled ladder VM, say), and filtering the union would
+ * strike the very method being published.
+ *
+ * @param options {object}
+ * @param options.doc {object}   the published document the entry extends
+ * @param options.methods {VerificationMethod[]}   the methods to publish, in
+ *   the order they land in `verificationMethod`
+ * @param options.relations {RelationMembership}   the ids each relation gains
+ * @param [options.retire] {(id: string) => boolean}   which existing method
+ *   ids and relation references leave the document in the same entry
+ * @returns {object}   the merged `verificationMethods` and the five relations,
+ *   as the account-entry seam takes them
+ */
+export function mergeVerificationMethods({ doc, methods, relations, retire = () => false }) {
+    const retired = (id) => id !== undefined && retire(id);
+    const existingMethods = doc.verificationMethod ?? [];
+    const verificationMethods = [
+        ...existingMethods.filter(method => !retired(method.id) && !methods.some(added => added.id === method.id)),
+        ...methods
+    ];
+    const withReferences = (relation, ids) => [
+        ...new Set([
+            ...relationIds(relation).filter(id => !retired(id)),
+            ...(ids ?? [])
+        ])
+    ];
+    return {
+        verificationMethods,
+        authentication: withReferences(doc.authentication, relations.authentication),
+        assertionMethod: withReferences(doc.assertionMethod, relations.assertionMethod),
+        keyAgreement: withReferences(doc.keyAgreement, relations.keyAgreement),
+        capabilityInvocation: withReferences(doc.capabilityInvocation, relations.capabilityInvocation),
+        capabilityDelegation: withReferences(doc.capabilityDelegation, relations.capabilityDelegation)
+    };
+}
+//# sourceMappingURL=mergeMethods.js.map

package/dist/webvh/mergeMethods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mergeMethods.js","sourceRoot":"","sources":["../../src/webvh/mergeMethods.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAexD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,SAAS,EACT,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,EAarB;IAQC,MAAM,OAAO,GAAG,CAAC,EAAsB,EAAW,EAAE,CAClD,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,eAAe,GAAG,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAA;IACpD,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CACxE;QACD,GAAG,OAAO;KACX,CAAA;IACD,MAAM,cAAc,GAAG,CACrB,QAAqD,EACrD,GAAyB,EACzB,EAAE,CAAC;QACH,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACnD,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACf,CAAC;KACH,CAAA;IACD,OAAO;QACL,mBAAmB;QACnB,cAAc,EAAE,cAAc,CAC5B,GAAG,CAAC,cAAc,EAClB,SAAS,CAAC,cAAc,CACzB;QACD,eAAe,EAAE,cAAc,CAC7B,GAAG,CAAC,eAAe,EACnB,SAAS,CAAC,eAAe,CAC1B;QACD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC;QACtE,oBAAoB,EAAE,cAAc,CAClC,GAAG,CAAC,oBAAoB,EACxB,SAAS,CAAC,oBAAoB,CAC/B;QACD,oBAAoB,EAAE,cAAc,CAClC,GAAG,CAAC,oBAAoB,EACxB,SAAS,CAAC,oBAAoB,CAC/B;KACF,CAAA;AACH,CAAC"}

package/dist/webvh/revokeClient.d.ts

@@ -86,12 +86,22 @@ export declare function clientRemovalTarget({ published, client }: {
  * these to `updateDID` beside its own signer -- an enrolled client's update
  * key for a revocation, a revealed ladder rung for a forget.
  *
+ * The latent commitments excluded from that attribution are derived here
+ * from the log (`standingCredentialLatentHashes`), so no caller has to know
+ * the account's standing credentials to remove a client correctly; a caller's
+ * own list is excluded beside them as a cross-check and vouches for what the
+ * walk could not read (a credential an earlier recovery's add-and-retire
+ * entry introduced has no anchor, and a registry still names its hash). The
+ * derived set never overrides the decision-0007 position, so a walk that
+ * over-claimed cannot leave the client's own staged hash standing.
+ *
  * @param options {object}
  * @param options.published {PublishedWebvhLog}
  * @param options.target {ClientRemovalTarget}
  * @param [options.knownLatentHashes] {string[]}   standing latent commitments
- *   the caller vouches for (the recovery registry's update-key hashes),
- *   excluded from the staged-hash attribution
+ *   the caller vouches for beyond the derived set (a recovery registry's
+ *   update-key hashes, a ladder's own rung hashes), excluded from the
+ *   staged-hash attribution alongside it
  * @returns {Promise<object>}   the `updateDID` field bundle
  */
 export declare function clientRemovalFields({ published, target, knownLatentHashes }: {

package/dist/webvh/revokeClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revokeClient.d.ts","sourceRoot":"","sources":["../../src/webvh/revokeClient.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAGnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAazD,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,UAAU,EAAE,MAAM,EAAE,CAAA;gBACR,EAAE,UAAU,EAAE,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;CAUrD;AAqMD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,SAAS,EAAE,OAAO,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,SAAS,EACT,MAAM,EACP,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAA;IAC5B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyC/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,SAAS,EACT,MAAM,EACN,iBAAsB,EACvB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAA;IAC5B,MAAM,EAAE,mBAAmB,CAAA;IAC3B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC7B,GAAG,OAAO,CAAC;IACV,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;IACzC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAA;CAC/B,CAAC,CA8CD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAErD;AAkGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,GAAG,EACH,YAAiB,EACjB,iBAAsB,EACvB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC7B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA6C3E"}
+{"version":3,"file":"revokeClient.d.ts","sourceRoot":"","sources":["../../src/webvh/revokeClient.ts"],"names":[],"mappings":"AAoDA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAQnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAYzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,UAAU,EAAE,MAAM,EAAE,CAAA;gBACR,EAAE,UAAU,EAAE,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;CAUrD;AA0ND;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,SAAS,EAAE,OAAO,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,SAAS,EACT,MAAM,EACP,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAA;IAC5B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyC/B;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,SAAS,EACT,MAAM,EACN,iBAAsB,EACvB,EAAE;IACD,SAAS,EAAE,iBAAiB,CAAA;IAC5B,MAAM,EAAE,mBAAmB,CAAA;IAC3B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC7B,GAAG,OAAO,CAAC;IACV,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;IACzC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAA;CAC/B,CAAC,CAoDD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAErD;AAgGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,4BAA4B,CAAC,EACjD,GAAG,EACH,YAAiB,EACjB,iBAAsB,EACvB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC7B,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAiD3E"}