@interop/wallet-core 0.69.0 → 0.70.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -28
- package/dist/clientAnnex/ladder.d.ts +103 -57
- package/dist/clientAnnex/ladder.d.ts.map +1 -1
- package/dist/clientAnnex/ladder.js +254 -335
- package/dist/clientAnnex/ladder.js.map +1 -1
- package/dist/clientAnnex/ladderAnchored.d.ts.map +1 -1
- package/dist/clientAnnex/ladderAnchored.js +10 -5
- package/dist/clientAnnex/ladderAnchored.js.map +1 -1
- package/dist/clientAnnex/recoveryLadderAnchored.d.ts +3 -15
- package/dist/clientAnnex/recoveryLadderAnchored.d.ts.map +1 -1
- package/dist/clientAnnex/recoveryLadderAnchored.js +22 -3
- package/dist/clientAnnex/recoveryLadderAnchored.js.map +1 -1
- package/dist/clients/grantState.d.ts +67 -0
- package/dist/clients/grantState.d.ts.map +1 -0
- package/dist/clients/grantState.js +72 -0
- package/dist/clients/grantState.js.map +1 -0
- package/dist/clients/index.d.ts +7 -0
- package/dist/clients/index.d.ts.map +1 -1
- package/dist/clients/index.js +6 -0
- package/dist/clients/index.js.map +1 -1
- package/dist/enrollment/connectCode.d.ts +4 -3
- package/dist/enrollment/connectCode.d.ts.map +1 -1
- package/dist/enrollment/connectCode.js +4 -3
- package/dist/enrollment/connectCode.js.map +1 -1
- package/dist/enrollment/index.d.ts +2 -2
- package/dist/enrollment/index.js +2 -2
- package/dist/enrollment/onboardingInvite.d.ts +1 -1
- package/dist/enrollment/onboardingInvite.js +1 -1
- package/dist/enrollment/onboardingResponse.js +1 -1
- package/dist/identity/index.d.ts +1 -1
- package/dist/identity/index.js +1 -1
- package/dist/index.d.ts +4 -8
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -8
- package/dist/index.js.map +1 -1
- package/dist/keyring/kdf.d.ts +33 -19
- package/dist/keyring/kdf.d.ts.map +1 -1
- package/dist/keyring/kdf.js +36 -25
- package/dist/keyring/kdf.js.map +1 -1
- package/dist/recovery/continuation.d.ts +5 -4
- package/dist/recovery/continuation.d.ts.map +1 -1
- package/dist/recovery/continuation.js +14 -13
- package/dist/recovery/continuation.js.map +1 -1
- package/dist/resourceLog/document.d.ts +10 -2
- package/dist/resourceLog/document.d.ts.map +1 -1
- package/dist/resourceLog/document.js +1 -2
- package/dist/resourceLog/document.js.map +1 -1
- package/dist/space/index.d.ts +4 -2
- package/dist/space/index.d.ts.map +1 -1
- package/dist/space/index.js +4 -2
- package/dist/space/index.js.map +1 -1
- package/dist/space/wasLink.d.ts +13 -2
- package/dist/space/wasLink.d.ts.map +1 -1
- package/dist/space/wasLink.js +28 -2
- package/dist/space/wasLink.js.map +1 -1
- package/dist/unlock/index.d.ts +1 -1
- package/dist/unlock/index.d.ts.map +1 -1
- package/dist/unlock/index.js.map +1 -1
- package/dist/unlock/standingWebvh.d.ts +81 -19
- package/dist/unlock/standingWebvh.d.ts.map +1 -1
- package/dist/unlock/standingWebvh.js +170 -30
- package/dist/unlock/standingWebvh.js.map +1 -1
- package/dist/webvh/did.d.ts +2 -4
- package/dist/webvh/did.d.ts.map +1 -1
- package/dist/webvh/did.js +2 -4
- package/dist/webvh/did.js.map +1 -1
- package/dist/webvh/didWebvh.d.ts +3 -2
- package/dist/webvh/didWebvh.d.ts.map +1 -1
- package/dist/webvh/didWebvh.js +2 -1
- package/dist/webvh/didWebvh.js.map +1 -1
- package/dist/webvh/revokeClient.d.ts +13 -7
- package/dist/webvh/revokeClient.d.ts.map +1 -1
- package/dist/webvh/revokeClient.js +14 -7
- package/dist/webvh/revokeClient.js.map +1 -1
- package/package.json +1 -16
- package/dist/request/appKey.d.ts +0 -295
- package/dist/request/appKey.d.ts.map +0 -1
- package/dist/request/appKey.js +0 -516
- package/dist/request/appKey.js.map +0 -1
- package/dist/request/capabilityRequest.d.ts +0 -41
- package/dist/request/capabilityRequest.d.ts.map +0 -1
- package/dist/request/capabilityRequest.js +0 -46
- package/dist/request/capabilityRequest.js.map +0 -1
- package/dist/request/classify.d.ts +0 -226
- package/dist/request/classify.d.ts.map +0 -1
- package/dist/request/classify.js +0 -416
- package/dist/request/classify.js.map +0 -1
- package/dist/request/composeVp.d.ts +0 -52
- package/dist/request/composeVp.d.ts.map +0 -1
- package/dist/request/composeVp.js +0 -176
- package/dist/request/composeVp.js.map +0 -1
- package/dist/request/ephemeralExchange.d.ts +0 -100
- package/dist/request/ephemeralExchange.d.ts.map +0 -1
- package/dist/request/ephemeralExchange.js +0 -230
- package/dist/request/ephemeralExchange.js.map +0 -1
- package/dist/request/exchangeClient.d.ts +0 -142
- package/dist/request/exchangeClient.d.ts.map +0 -1
- package/dist/request/exchangeClient.js +0 -241
- package/dist/request/exchangeClient.js.map +0 -1
- package/dist/request/index.d.ts +0 -59
- package/dist/request/index.d.ts.map +0 -1
- package/dist/request/index.js +0 -59
- package/dist/request/index.js.map +0 -1
- package/dist/request/interactionRequest.d.ts +0 -23
- package/dist/request/interactionRequest.d.ts.map +0 -1
- package/dist/request/interactionRequest.js +0 -46
- package/dist/request/interactionRequest.js.map +0 -1
- package/dist/request/interactionUrl.d.ts +0 -42
- package/dist/request/interactionUrl.d.ts.map +0 -1
- package/dist/request/interactionUrl.js +0 -104
- package/dist/request/interactionUrl.js.map +0 -1
- package/dist/request/matching.d.ts +0 -95
- package/dist/request/matching.d.ts.map +0 -1
- package/dist/request/matching.js +0 -205
- package/dist/request/matching.js.map +0 -1
- package/dist/request/onboarding.d.ts +0 -94
- package/dist/request/onboarding.d.ts.map +0 -1
- package/dist/request/onboarding.js +0 -167
- package/dist/request/onboarding.js.map +0 -1
- package/dist/request/parse.d.ts +0 -63
- package/dist/request/parse.d.ts.map +0 -1
- package/dist/request/parse.js +0 -153
- package/dist/request/parse.js.map +0 -1
- package/dist/request/presentationSuite.d.ts +0 -71
- package/dist/request/presentationSuite.d.ts.map +0 -1
- package/dist/request/presentationSuite.js +0 -143
- package/dist/request/presentationSuite.js.map +0 -1
- package/dist/request/processRequest.d.ts +0 -45
- package/dist/request/processRequest.d.ts.map +0 -1
- package/dist/request/processRequest.js +0 -147
- package/dist/request/processRequest.js.map +0 -1
- package/dist/request/queryPredicates.d.ts +0 -98
- package/dist/request/queryPredicates.d.ts.map +0 -1
- package/dist/request/queryPredicates.js +0 -107
- package/dist/request/queryPredicates.js.map +0 -1
- package/dist/request/types.d.ts +0 -257
- package/dist/request/types.d.ts.map +0 -1
- package/dist/request/types.js +0 -2
- package/dist/request/types.js.map +0 -1
- package/dist/request/walletInput.d.ts +0 -93
- package/dist/request/walletInput.d.ts.map +0 -1
- package/dist/request/walletInput.js +0 -179
- package/dist/request/walletInput.js.map +0 -1
|
@@ -7,9 +7,10 @@
|
|
|
7
7
|
*
|
|
8
8
|
* It is a leaf module deliberately. Recognizing a connect code is something a
|
|
9
9
|
* paste box or a QR scanner does long before any ceremony machinery is
|
|
10
|
-
* involved
|
|
11
|
-
*
|
|
12
|
-
*
|
|
10
|
+
* involved: {@link isConnectCode} is the recognizer a wallet hands
|
|
11
|
+
* `@interop/wallet-request`'s input classifier for its `connect-code` branch,
|
|
12
|
+
* and importing it here pulls in none of the enrollment ceremony's graph --
|
|
13
|
+
* while there is still exactly one spelling of the prefix in the codebase.
|
|
13
14
|
*/
|
|
14
15
|
/**
|
|
15
16
|
* The connect-code prefix; the payload after it is base64url(JSON) of an
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connectCode.js","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"connectCode.js","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAA;AACpD,CAAC"}
|
|
@@ -19,11 +19,11 @@
|
|
|
19
19
|
* - `encodeOnboardingResponse` / `parseOnboardingResponse` -- the onboarding-
|
|
20
20
|
* response envelope, the transport that carries a connect code (verbatim)
|
|
21
21
|
* plus a suggested display label back over an exchange whose request asked
|
|
22
|
-
* with a `WalletOnboardingQuery` (`@interop/wallet-
|
|
22
|
+
* with a `WalletOnboardingQuery` (`@interop/wallet-request`).
|
|
23
23
|
* - `ONBOARDING_INVITE_TTL_MS` -- how long a wallet offers an invite for. The
|
|
24
24
|
* invite's transport (creating the ephemeral exchange that carries the
|
|
25
25
|
* query, polling it until the envelope arrives) is the generic requester in
|
|
26
|
-
* `@interop/wallet-
|
|
26
|
+
* `@interop/wallet-request` (`createEphemeralExchange` /
|
|
27
27
|
* `pollEphemeralExchange`).
|
|
28
28
|
* - `completeEnrollmentCore` -- the enrollee's half: verify from the published
|
|
29
29
|
* log, read the roster, hand back the user key and the epoch to pin. Persisting
|
package/dist/enrollment/index.js
CHANGED
|
@@ -19,11 +19,11 @@
|
|
|
19
19
|
* - `encodeOnboardingResponse` / `parseOnboardingResponse` -- the onboarding-
|
|
20
20
|
* response envelope, the transport that carries a connect code (verbatim)
|
|
21
21
|
* plus a suggested display label back over an exchange whose request asked
|
|
22
|
-
* with a `WalletOnboardingQuery` (`@interop/wallet-
|
|
22
|
+
* with a `WalletOnboardingQuery` (`@interop/wallet-request`).
|
|
23
23
|
* - `ONBOARDING_INVITE_TTL_MS` -- how long a wallet offers an invite for. The
|
|
24
24
|
* invite's transport (creating the ephemeral exchange that carries the
|
|
25
25
|
* query, polling it until the envelope arrives) is the generic requester in
|
|
26
|
-
* `@interop/wallet-
|
|
26
|
+
* `@interop/wallet-request` (`createEphemeralExchange` /
|
|
27
27
|
* `pollEphemeralExchange`).
|
|
28
28
|
* - `completeEnrollmentCore` -- the enrollee's half: verify from the published
|
|
29
29
|
* log, read the roster, hand back the user key and the epoch to pin. Persisting
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
/**
|
|
5
5
|
* The wallet-onboarding invite's one policy constant. The invite's transport
|
|
6
6
|
* is the generic ephemeral-exchange requester in
|
|
7
|
-
* `@interop/wallet-
|
|
7
|
+
* `@interop/wallet-request` (`createEphemeralExchange` /
|
|
8
8
|
* `pollEphemeralExchange`); what stays here is how long a wallet offers the
|
|
9
9
|
* invite for.
|
|
10
10
|
*/
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
/**
|
|
5
5
|
* The wallet-onboarding invite's one policy constant. The invite's transport
|
|
6
6
|
* is the generic ephemeral-exchange requester in
|
|
7
|
-
* `@interop/wallet-
|
|
7
|
+
* `@interop/wallet-request` (`createEphemeralExchange` /
|
|
8
8
|
* `pollEphemeralExchange`); what stays here is how long a wallet offers the
|
|
9
9
|
* invite for.
|
|
10
10
|
*/
|
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
/**
|
|
5
5
|
* The onboarding-response envelope: what a fresh wallet (the enrollee) POSTs
|
|
6
6
|
* back to an ephemeral exchange whose request carried a
|
|
7
|
-
* `WalletOnboardingQuery` (`@interop/wallet-
|
|
7
|
+
* `WalletOnboardingQuery` (`@interop/wallet-request`). It is transport
|
|
8
8
|
* vocabulary only -- the enrollment ceremony is untouched.
|
|
9
9
|
*
|
|
10
10
|
* The envelope carries an ordinary connect code VERBATIM as its payload, so
|
package/dist/identity/index.d.ts
CHANGED
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
* app-side derivations such as a keyring unlock identity).
|
|
17
17
|
*
|
|
18
18
|
* Kept out of the root export: this subpath pulls the webkms-client / ezcap /
|
|
19
|
-
* x25519 dependency graph
|
|
19
|
+
* x25519 dependency graph.
|
|
20
20
|
*/
|
|
21
21
|
export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed, zcapClientForSigner } from './agents.js';
|
|
22
22
|
export type { ProfileAgents } from './agents.js';
|
package/dist/identity/index.js
CHANGED
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
* app-side derivations such as a keyring unlock identity).
|
|
17
17
|
*
|
|
18
18
|
* Kept out of the root export: this subpath pulls the webkms-client / ezcap /
|
|
19
|
-
* x25519 dependency graph
|
|
19
|
+
* x25519 dependency graph.
|
|
20
20
|
*/
|
|
21
21
|
export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed, zcapClientForSigner } from './agents.js';
|
|
22
22
|
export { singleKeyResolver } from './keyResolver.js';
|
package/dist/index.d.ts
CHANGED
|
@@ -10,10 +10,6 @@
|
|
|
10
10
|
* - `@interop/wallet-core/identity` -- the WAS identity derivation
|
|
11
11
|
* (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
|
|
12
12
|
* apps must perform byte-for-byte identically.
|
|
13
|
-
* - `@interop/wallet-core/request` -- wallet-request / exchange protocol
|
|
14
|
-
* handling (classification and parsing, QueryByExample matching, cryptosuite
|
|
15
|
-
* negotiation, VP composition, the VC-API exchange client, and VCALM
|
|
16
|
-
* `interaction:` URL handling).
|
|
17
13
|
* - `@interop/wallet-core/webvh` -- the account's did:webvh identity: the
|
|
18
14
|
* hosted DID log, its per-client update-key rotation, the client enrollment
|
|
19
15
|
* entries, and ZCap signing under the did:webvh verification-method id.
|
|
@@ -40,10 +36,10 @@
|
|
|
40
36
|
* re-implementing its swallow.
|
|
41
37
|
*
|
|
42
38
|
* This root re-exports `sync` and `space` for convenience. `identity`,
|
|
43
|
-
* `
|
|
44
|
-
*
|
|
45
|
-
*
|
|
46
|
-
*
|
|
39
|
+
* `webvh`, `keys`, `descriptors`, `keyring`, `enrollment`, and `recovery`
|
|
40
|
+
* are deliberately NOT re-exported here, so plaintext consumers of the root
|
|
41
|
+
* never pull the signing / KMS dependency graph (the was-client
|
|
42
|
+
* subpath-isolation pattern).
|
|
47
43
|
*/
|
|
48
44
|
export * from './sync/index.js';
|
|
49
45
|
export * from './space/index.js';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACnD,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}
|
package/dist/index.js
CHANGED
|
@@ -10,10 +10,6 @@
|
|
|
10
10
|
* - `@interop/wallet-core/identity` -- the WAS identity derivation
|
|
11
11
|
* (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
|
|
12
12
|
* apps must perform byte-for-byte identically.
|
|
13
|
-
* - `@interop/wallet-core/request` -- wallet-request / exchange protocol
|
|
14
|
-
* handling (classification and parsing, QueryByExample matching, cryptosuite
|
|
15
|
-
* negotiation, VP composition, the VC-API exchange client, and VCALM
|
|
16
|
-
* `interaction:` URL handling).
|
|
17
13
|
* - `@interop/wallet-core/webvh` -- the account's did:webvh identity: the
|
|
18
14
|
* hosted DID log, its per-client update-key rotation, the client enrollment
|
|
19
15
|
* entries, and ZCap signing under the did:webvh verification-method id.
|
|
@@ -40,10 +36,10 @@
|
|
|
40
36
|
* re-implementing its swallow.
|
|
41
37
|
*
|
|
42
38
|
* This root re-exports `sync` and `space` for convenience. `identity`,
|
|
43
|
-
* `
|
|
44
|
-
*
|
|
45
|
-
*
|
|
46
|
-
*
|
|
39
|
+
* `webvh`, `keys`, `descriptors`, `keyring`, `enrollment`, and `recovery`
|
|
40
|
+
* are deliberately NOT re-exported here, so plaintext consumers of the root
|
|
41
|
+
* never pull the signing / KMS dependency graph (the was-client
|
|
42
|
+
* subpath-isolation pattern).
|
|
47
43
|
*/
|
|
48
44
|
export * from './sync/index.js';
|
|
49
45
|
export * from './space/index.js';
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}
|
package/dist/keyring/kdf.d.ts
CHANGED
|
@@ -10,18 +10,24 @@ import type { RecordSigner } from './record.js';
|
|
|
10
10
|
export declare const UNLOCK_HANDLE = "unlock";
|
|
11
11
|
export declare const UNLOCK_KEY_NAME = "unlock-key";
|
|
12
12
|
/**
|
|
13
|
-
* Unlock-derivation parameters, one variant per KDF family:
|
|
14
|
-
* a low-entropy passphrase; HKDF expands
|
|
15
|
-
* passkey PRF output). Each unlock method
|
|
16
|
-
* its own salt, so two methods can never
|
|
17
|
-
* The `version`
|
|
18
|
-
*
|
|
13
|
+
* Unlock-derivation parameters, one variant per KDF family: Argon2id
|
|
14
|
+
* (memory-hard) stretches a low-entropy passphrase; HKDF expands
|
|
15
|
+
* already-uniform key material (e.g. a passkey PRF output). Each unlock method
|
|
16
|
+
* pins its own parameter set -- and its own salt, so two methods can never
|
|
17
|
+
* derive the same unlock identity. The `version` is one counter per unlock
|
|
18
|
+
* method, recording which parameter set produced that method's derivation;
|
|
19
|
+
* the keyring record's own `version` is stamped separately.
|
|
20
|
+
*
|
|
21
|
+
* The Argon2id arm carries no `hash` member: Argon2 fixes Blake2b internally.
|
|
22
|
+
* `memory` is in KiB (RFC 9106's and noble's unit); the RFC's `m` / `t` / `p`
|
|
23
|
+
* are named `memory` / `passes` / `parallelism`.
|
|
19
24
|
*/
|
|
20
25
|
export type UnlockKdf = {
|
|
21
26
|
version: number;
|
|
22
|
-
algorithm: '
|
|
23
|
-
|
|
24
|
-
|
|
27
|
+
algorithm: 'Argon2id';
|
|
28
|
+
memory: number;
|
|
29
|
+
passes: number;
|
|
30
|
+
parallelism: number;
|
|
25
31
|
salt: string;
|
|
26
32
|
} | {
|
|
27
33
|
version: number;
|
|
@@ -31,20 +37,28 @@ export type UnlockKdf = {
|
|
|
31
37
|
info: string;
|
|
32
38
|
};
|
|
33
39
|
/**
|
|
34
|
-
*
|
|
35
|
-
* (`unlockSeed =
|
|
36
|
-
*
|
|
37
|
-
*
|
|
38
|
-
*
|
|
39
|
-
*
|
|
40
|
-
*
|
|
41
|
-
*
|
|
42
|
-
* unlock
|
|
40
|
+
* Argon2id parameters for the passphrase unlock derivation
|
|
41
|
+
* (`unlockSeed = Argon2id(passphrase)`): 64 MiB of memory, 3 passes,
|
|
42
|
+
* parallelism 1, a 32-byte tag. The memory and pass counts are those of RFC
|
|
43
|
+
* 9106 section 4's second recommended option (m = 64 MiB, t = 3, p = 4); the
|
|
44
|
+
* parallelism is a deliberate departure from that option's four lanes. It
|
|
45
|
+
* stays 1 because noble is single-threaded, so a higher value changes the
|
|
46
|
+
* bytes and buys no speed. Passphrase version 2 pins exactly
|
|
47
|
+
* these parameters; version 1 was PBKDF2-600k over SHA-256 under the salt
|
|
48
|
+
* `freewallet/keyring/unlock/v1`, and it was replaced outright rather than
|
|
49
|
+
* kept beside this set, so a passphrase bound under it no longer addresses
|
|
50
|
+
* its unlock Space. The KDF's own `version` is what records the parameter
|
|
51
|
+
* set: the keyring record's frame version is unchanged, since a record cannot
|
|
52
|
+
* be read before its derivation has already succeeded, so a version inside it
|
|
53
|
+
* could never steer a lookup. The salt is a fixed app-wide constant -- login
|
|
54
|
+
* stays passphrase-only, with no email (or other) input mixed into the
|
|
55
|
+
* derivation. Every unlock method's KDF carries a distinct salt, so two
|
|
56
|
+
* methods can never derive the same unlock Space.
|
|
43
57
|
*/
|
|
44
58
|
export declare const KEYRING_KDF: UnlockKdf;
|
|
45
59
|
/**
|
|
46
60
|
* Derives the 32-byte unlock seed from an unlock secret, branching on the KDF
|
|
47
|
-
* family:
|
|
61
|
+
* family: Argon2id stretches a passphrase, HKDF expands already-uniform key
|
|
48
62
|
* material such as a passkey PRF output.
|
|
49
63
|
*
|
|
50
64
|
* Exported for the standing-credential derivation (`unlock/standingClient`):
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAQ3C
|
|
1
|
+
{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAQ3C;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,UAAU,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAEL;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,WAAW,EAAE,SAOzB,CAAA;AAoBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,cAAc,CAAC,CAG1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4B1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,IAAI,CAC1C,aAAa,EACb,YAAY,GAAG,iBAAiB,GAAG,aAAa,CACjD;IACC,KAAK,EAAE,eAAe,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB"}
|
package/dist/keyring/kdf.js
CHANGED
|
@@ -12,13 +12,13 @@
|
|
|
12
12
|
* output for the same secret and parameter set, or the same passphrase would
|
|
13
13
|
* address two different unlock Spaces. It is therefore implemented over
|
|
14
14
|
* `@noble/hashes` rather than WebCrypto's `crypto.subtle.deriveBits`, which
|
|
15
|
-
* React Native does not provide;
|
|
16
|
-
* (RFC
|
|
15
|
+
* React Native does not provide; Argon2id and HKDF are both fully specified
|
|
16
|
+
* (RFC 9106 / RFC 5869), so any two implementations agree bit for bit.
|
|
17
17
|
*/
|
|
18
18
|
import { deriveSpaceId } from '@interop/was-client/sync';
|
|
19
19
|
import { CapabilityAgent } from '@interop/webkms-client';
|
|
20
|
+
import { argon2idAsync } from '@noble/hashes/argon2.js';
|
|
20
21
|
import { hkdf } from '@noble/hashes/hkdf.js';
|
|
21
|
-
import { pbkdf2Async } from '@noble/hashes/pbkdf2.js';
|
|
22
22
|
import { sha256, sha512 } from '@noble/hashes/sha2.js';
|
|
23
23
|
import { agentsFromKeyAgent } from '../identity/agents.js';
|
|
24
24
|
import { recordSignerFromAgent } from './record.js';
|
|
@@ -36,26 +36,36 @@ export const UNLOCK_KEY_NAME = 'unlock-key';
|
|
|
36
36
|
*/
|
|
37
37
|
const UNLOCK_SEED_BYTES = 32;
|
|
38
38
|
/**
|
|
39
|
-
*
|
|
40
|
-
* (`unlockSeed =
|
|
41
|
-
*
|
|
42
|
-
*
|
|
43
|
-
*
|
|
44
|
-
*
|
|
45
|
-
*
|
|
46
|
-
*
|
|
47
|
-
* unlock
|
|
39
|
+
* Argon2id parameters for the passphrase unlock derivation
|
|
40
|
+
* (`unlockSeed = Argon2id(passphrase)`): 64 MiB of memory, 3 passes,
|
|
41
|
+
* parallelism 1, a 32-byte tag. The memory and pass counts are those of RFC
|
|
42
|
+
* 9106 section 4's second recommended option (m = 64 MiB, t = 3, p = 4); the
|
|
43
|
+
* parallelism is a deliberate departure from that option's four lanes. It
|
|
44
|
+
* stays 1 because noble is single-threaded, so a higher value changes the
|
|
45
|
+
* bytes and buys no speed. Passphrase version 2 pins exactly
|
|
46
|
+
* these parameters; version 1 was PBKDF2-600k over SHA-256 under the salt
|
|
47
|
+
* `freewallet/keyring/unlock/v1`, and it was replaced outright rather than
|
|
48
|
+
* kept beside this set, so a passphrase bound under it no longer addresses
|
|
49
|
+
* its unlock Space. The KDF's own `version` is what records the parameter
|
|
50
|
+
* set: the keyring record's frame version is unchanged, since a record cannot
|
|
51
|
+
* be read before its derivation has already succeeded, so a version inside it
|
|
52
|
+
* could never steer a lookup. The salt is a fixed app-wide constant -- login
|
|
53
|
+
* stays passphrase-only, with no email (or other) input mixed into the
|
|
54
|
+
* derivation. Every unlock method's KDF carries a distinct salt, so two
|
|
55
|
+
* methods can never derive the same unlock Space.
|
|
48
56
|
*/
|
|
49
57
|
export const KEYRING_KDF = {
|
|
50
|
-
version:
|
|
51
|
-
algorithm: '
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
58
|
+
version: 2,
|
|
59
|
+
algorithm: 'Argon2id',
|
|
60
|
+
memory: 65_536,
|
|
61
|
+
passes: 3,
|
|
62
|
+
parallelism: 1,
|
|
63
|
+
salt: 'freewallet/keyring/unlock/argon2id/v1'
|
|
55
64
|
};
|
|
56
65
|
/**
|
|
57
|
-
* The noble hash constructor a WebCrypto hash name selects
|
|
58
|
-
* matches `crypto.subtle.deriveBits` for the same
|
|
66
|
+
* The noble hash constructor a WebCrypto hash name selects for the HKDF arm,
|
|
67
|
+
* so the derivation matches `crypto.subtle.deriveBits` for the same
|
|
68
|
+
* parameters.
|
|
59
69
|
*
|
|
60
70
|
* @param hash {string} a WebCrypto digest name (`SHA-256`, `SHA-512`)
|
|
61
71
|
* @returns {object} the noble hash
|
|
@@ -71,7 +81,7 @@ function nobleHash(hash) {
|
|
|
71
81
|
}
|
|
72
82
|
/**
|
|
73
83
|
* Derives the 32-byte unlock seed from an unlock secret, branching on the KDF
|
|
74
|
-
* family:
|
|
84
|
+
* family: Argon2id stretches a passphrase, HKDF expands already-uniform key
|
|
75
85
|
* material such as a passkey PRF output.
|
|
76
86
|
*
|
|
77
87
|
* Exported for the standing-credential derivation (`unlock/standingClient`):
|
|
@@ -90,15 +100,16 @@ export async function deriveUnlockSeed({ secret, kdf }) {
|
|
|
90
100
|
const secretBytes = typeof secret === 'string'
|
|
91
101
|
? new TextEncoder().encode(secret)
|
|
92
102
|
: new Uint8Array(secret);
|
|
93
|
-
const hash = nobleHash(kdf.hash);
|
|
94
103
|
const salt = new TextEncoder().encode(kdf.salt);
|
|
95
|
-
if (kdf.algorithm === '
|
|
96
|
-
return
|
|
97
|
-
|
|
104
|
+
if (kdf.algorithm === 'Argon2id') {
|
|
105
|
+
return argon2idAsync(secretBytes, salt, {
|
|
106
|
+
m: kdf.memory,
|
|
107
|
+
t: kdf.passes,
|
|
108
|
+
p: kdf.parallelism,
|
|
98
109
|
dkLen: UNLOCK_SEED_BYTES
|
|
99
110
|
});
|
|
100
111
|
}
|
|
101
|
-
return hkdf(hash, secretBytes, salt, new TextEncoder().encode(kdf.info), UNLOCK_SEED_BYTES);
|
|
112
|
+
return hkdf(nobleHash(kdf.hash), secretBytes, salt, new TextEncoder().encode(kdf.info), UNLOCK_SEED_BYTES);
|
|
102
113
|
}
|
|
103
114
|
/**
|
|
104
115
|
* Derives the full unlock identity from an unlock secret: the unlock
|
package/dist/keyring/kdf.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAGnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAA;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAA;AAE3C;;;GAGG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAgC5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,CAAC;IACT,WAAW,EAAE,CAAC;IACd,IAAI,EAAE,uCAAuC;CAC9C,CAAA;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,IAAI,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EACN,GAAG,EAIJ;IACC,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,WAAW,GACf,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE;YACtC,CAAC,EAAE,GAAG,CAAC,MAAM;YACb,CAAC,EAAE,GAAG,CAAC,MAAM;YACb,CAAC,EAAE,GAAG,CAAC,WAAW;YAClB,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CACT,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EACnB,WAAW,EACX,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAClC,iBAAiB,CAClB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EAIJ;IACC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpD,OAAO,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,eAAe;KACzB,CAAC,CAAA;IACF,8EAA8E;IAC9E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;QACtE,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAA;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAE/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO;QACL,KAAK;QACL,UAAU;QACV,eAAe;QACf,WAAW;QACX,YAAY;QACZ,OAAO;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,GAAG,EAAmB;IACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC"}
|
|
@@ -155,9 +155,10 @@ export type RecoveryLogStore = Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdRes
|
|
|
155
155
|
/**
|
|
156
156
|
* What a variant adds to the add-and-retire entry beyond the replacement
|
|
157
157
|
* code's own inventory, which the core appends after it: the verification
|
|
158
|
-
* methods, and the ids each relation gains.
|
|
159
|
-
*
|
|
160
|
-
*
|
|
158
|
+
* methods, and the ids each relation gains. The methods land in
|
|
159
|
+
* `verificationMethod` and each relation in the order given, with the
|
|
160
|
+
* replacement code's after them; nothing reads that order, since each
|
|
161
|
+
* credential-class member names its own ladder commitment.
|
|
161
162
|
*/
|
|
162
163
|
export interface RecoveryAddedInventory extends RelationMembership {
|
|
163
164
|
methods: VerificationMethod[];
|
|
@@ -191,7 +192,7 @@ export interface RecoveryContinuationOutcome extends RecoverySpendRetirement {
|
|
|
191
192
|
* The reveal-and-commit entry commits, in this order, the successor key's
|
|
192
193
|
* hash, its staged partner's hash, and the replacement code's rung-0 hash --
|
|
193
194
|
* the ratified append order of `decisions/0007` (the replacement's comes
|
|
194
|
-
* LAST)
|
|
195
|
+
* LAST), which the forward ladder walk reads. The
|
|
195
196
|
* add-and-retire entry is built on the head the reveal entry's own publish
|
|
196
197
|
* leaves standing, with no read in between; against a store whose PUT serves
|
|
197
198
|
* no ETag it is re-read under the same pin instead, so its compare-and-swap
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"continuation.d.ts","sourceRoot":"","sources":["../../src/recovery/continuation.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,eAAe,EACf,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;
|
|
1
|
+
{"version":3,"file":"continuation.d.ts","sourceRoot":"","sources":["../../src/recovery/continuation.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,eAAe,EACf,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAOlC,OAAO,KAAK,EAAqB,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAG3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAgBlE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACH,qBAAqB,EACrB,SAAS,EACV,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,qBAAqB,EAAE,MAAM,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;CAClB,GAAG,MAAM,EAAE,CAeX;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,EAAE,MAAM,EAAE,CAAA;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,GAAG,EACH,GAAG,EACH,SAAS,EACT,6BAA6B,EAC7B,6BAA6B,EAC9B,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAA;IACrE,6BAA6B,EAAE,MAAM,CAAA;IACrC,6BAA6B,EAAE,MAAM,CAAA;CACtC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAqCnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,wBAAwB,EAAE,MAAM,CAAA;CACjC,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wBAAwB,EAAE,MAAM,CAAA;IAChC,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,6BAA8B,SAAQ,kBAAkB;IACvE,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;gBAEnD,OAAO,SACuC;CAKjD;AAED;;;;;;;;;GASG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAA;gBAEtB,EAAE,eAAe,EAAE,EAAE;QAAE,eAAe,EAAE,MAAM,EAAE,CAAA;KAAE;CAS/D;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,YAAY,EACZ,kBAAkB,GAAG,eAAe,GAAG,KAAK,CAC7C,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;IAChE,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAA;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,EAAE,EACxD,KAAK,EACL,QAAQ,EACR,SAAS,EACT,WAAW,EACX,WAAW,EACX,KAAK,EACL,eAAe,EACf,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,QAAQ,EAAE,kBAAkB,GAAG;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAA;IACzD,SAAS,EAAE;QACT,kBAAkB,EAAE,MAAM,CAAA;QAC1B,UAAU,EAAE,UAAU,CAAA;QACtB,kBAAkB,EAAE,MAAM,CAAA;KAC3B,CAAA;IACD,WAAW,EAAE,6BAA6B,CAAA;IAC1C,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,KAAK,OAAO,CAAC,SAAS,CAAC,CAAA;IACxB,KAAK,EAAE,CAAC,OAAO,EAAE;QACf,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,SAAS,EAAE,SAAS,CAAA;KACrB,KAAK,sBAAsB,CAAA;IAC5B,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAA;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAkQvC"}
|
|
@@ -20,9 +20,10 @@
|
|
|
20
20
|
* layer rule lets the annex import from the base and not the reverse.
|
|
21
21
|
*/
|
|
22
22
|
import { deriveNextKeyHash } from '@interop/did-method-webvh';
|
|
23
|
-
import { effectiveParameters, ladderVerificationMethod,
|
|
23
|
+
import { effectiveParameters, ladderVerificationMethod, readPublishedLogOrThrow, servedHead } from '../webvh/didWebvh.js';
|
|
24
24
|
import { accountEntryHead, signAccountEntry } from '../webvh/accountEntry.js';
|
|
25
25
|
import { mergeVerificationMethods } from '../webvh/mergeMethods.js';
|
|
26
|
+
import { unlockKeyVerificationMethod } from '../unlock/standingWebvh.js';
|
|
26
27
|
import { credentialKeyAgreementMethods, ladderVmIds, retiredCredentialKeys } from '../resourceLog/document.js';
|
|
27
28
|
// The base-side dependency the lint config pins: the ladder ATTRIBUTION
|
|
28
29
|
// helpers only, never the annex log machinery. The add-and-retire entry
|
|
@@ -196,7 +197,7 @@ export class RecoveryCredentialStandingError extends Error {
|
|
|
196
197
|
* The reveal-and-commit entry commits, in this order, the successor key's
|
|
197
198
|
* hash, its staged partner's hash, and the replacement code's rung-0 hash --
|
|
198
199
|
* the ratified append order of `decisions/0007` (the replacement's comes
|
|
199
|
-
* LAST)
|
|
200
|
+
* LAST), which the forward ladder walk reads. The
|
|
200
201
|
* add-and-retire entry is built on the head the reveal entry's own publish
|
|
201
202
|
* leaves standing, with no read in between; against a store whose PUT serves
|
|
202
203
|
* no ETag it is re-read under the same pin instead, so its compare-and-swap
|
|
@@ -361,18 +362,21 @@ export async function recoveryContinuationOnce({ store, recovery, successor, rep
|
|
|
361
362
|
// key-agreement member: a code is a standing credential with a ladder,
|
|
362
363
|
// and its own bridge delegation is signed by this VM, so a replacement
|
|
363
364
|
// without it could never spend (`decisions/0019`, `decisions/0020`).
|
|
364
|
-
// Its rung-0 hash
|
|
365
|
-
//
|
|
365
|
+
// Its rung-0 hash is committed already -- the reveal-and-commit entry
|
|
366
|
+
// did that, and this entry carries it through -- and the member names
|
|
367
|
+
// it as its ladder commitment, which is how a later recovery anchors
|
|
368
|
+
// the replacement's ladder without reading the reveal entry.
|
|
366
369
|
const replacementLadderVmId = `${did}#${replacement.ladderVmKeyMultibase}`;
|
|
367
370
|
const variant = added({ did, doc, persisted });
|
|
368
371
|
const addedMethods = [
|
|
369
372
|
...variant.methods,
|
|
370
|
-
{
|
|
371
|
-
|
|
372
|
-
|
|
373
|
-
|
|
374
|
-
|
|
375
|
-
|
|
373
|
+
unlockKeyVerificationMethod({
|
|
374
|
+
did,
|
|
375
|
+
keyAgreement: {
|
|
376
|
+
publicKeyMultibase: replacement.keyAgreementKeyMultibase
|
|
377
|
+
},
|
|
378
|
+
ladderCommitment: replacementHash
|
|
379
|
+
}),
|
|
376
380
|
ladderVerificationMethod({
|
|
377
381
|
controller: did,
|
|
378
382
|
publicKeyMultibase: replacement.ladderVmKeyMultibase
|
|
@@ -436,9 +440,6 @@ export async function recoveryContinuationOnce({ store, recovery, successor, rep
|
|
|
436
440
|
...(variant.assertionMethod ?? []),
|
|
437
441
|
replacementLadderVmId
|
|
438
442
|
],
|
|
439
|
-
// The variant's own key-agreement member precedes the replacement
|
|
440
|
-
// code's: the position `decisions/0014`'s anchor rule reads the
|
|
441
|
-
// pair by.
|
|
442
443
|
keyAgreement: [...(variant.keyAgreement ?? []), replacementVmId],
|
|
443
444
|
capabilityInvocation: variant.capabilityInvocation,
|
|
444
445
|
capabilityDelegation: [
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"continuation.js","sourceRoot":"","sources":["../../src/recovery/continuation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAO7D,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,
|
|
1
|
+
{"version":3,"file":"continuation.js","sourceRoot":"","sources":["../../src/recovery/continuation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAO7D,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EACvB,UAAU,EACX,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AACxE,OAAO,EACL,6BAA6B,EAC7B,WAAW,EACX,qBAAqB,EACtB,MAAM,4BAA4B,CAAA;AACnC,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAChC,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACH,qBAAqB,EACrB,SAAS,EAMV;IACC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACrC,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CACzD,CAAA;IACD,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,qBAAqB,CAAC;QAC3B,GAAG,EAAE,QAAQ;QACb,OAAO,EAAE,QAAQ;QACjB,GAAG;KACJ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAAA;AACnC,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,GAAG,EACH,GAAG,EACH,SAAS,EACT,6BAA6B,EAC7B,6BAA6B,EAO9B;IACC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACvD,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAChE,CAAA;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,sBAAsB,EAAE,EAAE;YAC1B,gBAAgB,EAAE,EAAE;YACpB,wBAAwB,EAAE,EAAE;SAC7B,CAAA;IACH,CAAC;IACD,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;QAC3D,GAAG;QACH,GAAG;QACH,qBAAqB,EAAE,SAAS,CAAC,kBAAkB;QACnD,SAAS,EAAE,YAAY,CAAC;YACtB,GAAG;YACH,wBAAwB,EAAE,6BAA6B;SACxD,CAAC;KACH,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/C,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/C,iBAAiB,CAAC,6BAA6B,CAAC;KACjD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;QACnD,GAAG;QACH,sBAAsB,EAAE,SAAS,CAAC,kBAAkB;QACpD,eAAe,EAAE,sBAAsB;QACvC,eAAe;QACf,aAAa,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC;KAC9C,CAAC,CAAA;IACF,OAAO;QACL,sBAAsB;QACtB,gBAAgB,EAAE,MAAM,CAAC,YAAY;QACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;KAC1D,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,GAAG,EACH,wBAAwB,EAIzB;IACC,OAAO,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;AAC7C,CAAC;AAyBD;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrD,YACE,OAAO,GAAG,4DAA4D;QACpE,4CAA4C;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;IAC5C,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,eAAe,CAAU;IAElC,YAAY,EAAE,eAAe,EAAiC;QAC5D,KAAK,CACH,qEAAqE;YACnE,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;YACtE,eAAe,CAClB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAA;QAC7C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAA;IACxC,CAAC;CACF;AAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAY,EACxD,KAAK,EACL,QAAQ,EACR,SAAS,EACT,WAAW,EACX,WAAW,EACX,KAAK,EACL,eAAe,EACf,WAAW,EAoBZ;IACC,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAA;IACD,MAAM,cAAc,GAAG,sDAAsD,CAAA;IAE7E,4EAA4E;IAC5E,4EAA4E;IAC5E,0BAA0B;IAC1B,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,CAAC,GAC9D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC9C,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/C,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC;QAC/C,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC;KAClD,CAAC,CAAA;IACJ,MAAM,eAAe,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,eAAe,CAAC,CAAA;IACpE,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IACpD,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAClC,YAAY,CAAC;QACX,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACJ,MAAM,QAAQ,GAAG,CAAC,IAAuB,EAAE,EAAE,CAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAA;IAExD,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE;QAC9D,GAAG,MAAM;QACT,cAAc;QACd,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,IAAI,CAAC,EAAE;YACX,oEAAoE;YACpE,gEAAgE;YAChE,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,oEAAoE;YACpE,yDAAyD;YACzD,MAAM,QAAQ,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAC/D,6BAA6B,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAC3B,CACF,CAAA;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,+BAA+B,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC1E,CAAC;YACD,qEAAqE;YACrE,mDAAmD;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;YACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,4BAA4B,EAAE,CAAA;YAC1C,CAAC;YACD,OAAO,CACL,QAAQ;gBACR,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACjE,CAAA;QACH,CAAC;QACD,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,sCAAsC;QACtC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;KACjD,CAAC,CAAA;IACF,IAAI,SAAS,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IAErD,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,MAAM,8BAA8B,CAAC;YACtD,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,SAAS,EAAE;gBACT,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;gBAChD,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;aACjD;YACD,6BAA6B,EAAE,WAAW,CAAC,kBAAkB;YAC7D,6BAA6B,EAAE,QAAQ,CAAC,wBAAwB;SACjE,CAAC,CAAA;QACF,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,SAAS,EAAE,KAAK;YAChB,GAAG,UAAU;SACd,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnD,uEAAuE;QACvE,SAAS,GAAG,MAAM,uBAAuB,CAAC;YACxC,OAAO,EAAE,KAAK;YACd,GAAG,MAAM;YACT,WAAW,EAAE,SAAS,CAAC,GAAG;YAC1B,cAAc;SACf,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC;QAClC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;KACvC,CAAC,CAAA;IAEF,sEAAsE;IACtE,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,wCAAwC;IACxC,IAAI,sBAAsB,GAAa,EAAE,CAAA;IACzC,IAAI,MAAM,GAAgE;QACxE,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,EAAE;QACd,wBAAwB,EAAE,EAAE;KAC7B,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC;QACjC,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE;QAC/D,SAAS;QACT,GAAG,MAAM;QACT,WAAW,EAAE,SAAS,CAAC,GAAG;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;YACnC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;YACzB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;YAClC,MAAM,eAAe,GAAG,YAAY,CAAC;gBACnC,GAAG;gBACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;aAC/D,CAAC,CAAA;YACF,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,WAAW,CAAC,oBAAoB,EAAE,CAAA;YAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAA;YAC9C,MAAM,YAAY,GAAyB;gBACzC,GAAG,OAAO,CAAC,OAAO;gBAClB,2BAA2B,CAAC;oBAC1B,GAAG;oBACH,YAAY,EAAE;wBACZ,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;qBACzD;oBACD,gBAAgB,EAAE,eAAe;iBAClC,CAAC;gBACF,wBAAwB,CAAC;oBACvB,UAAU,EAAE,GAAG;oBACf,kBAAkB,EAAE,WAAW,CAAC,oBAAoB;iBACrD,CAAC;aACH,CAAA;YACD,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;YACtC,MAAM,UAAU,GAAG,YAAY;iBAC5B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;iBACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAA;YACvD,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;iBACtE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;iBACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;iBACpD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;YACzC,sBAAsB,GAAG,qBAAqB,CAAC,MAAM,CACnD,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,SAAS,CACvB,CAAA;YACD,yEAAyE;YACzE,+DAA+D;YAC/D,wEAAwE;YACxE,wEAAwE;YACxE,kEAAkE;YAClE,uEAAuE;YACvE,6CAA6C;YAC7C,MAAM,GAAG,MAAM,+BAA+B,CAAC;gBAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,eAAe,EAAE,sBAAsB;gBACvC,eAAe;gBACf,aAAa;aACd,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,CAAC,EAAU,EAAW,EAAE,CACrC,EAAE,KAAK,SAAS;gBAChB,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YACpC,OAAO;gBACL,kEAAkE;gBAClE,8CAA8C;gBAC9C,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAChC,GAAG,CAAC,EAAE,CACJ,GAAG,KAAK,QAAQ,CAAC,kBAAkB;oBACnC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnC;gBACD,aAAa,EAAE,yBAAyB,CAAC;oBACvC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CACtC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrE;oBACD,QAAQ,EAAE,mCAAmC;iBAC9C,CAAC;gBACF,qEAAqE;gBACrE,oEAAoE;gBACpE,qEAAqE;gBACrE,mDAAmD;gBACnD,GAAG,wBAAwB,CAAC;oBAC1B,GAAG;oBACH,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,MAAM;oBACd,SAAS,EAAE;wBACT,cAAc,EAAE,OAAO,CAAC,cAAc;wBACtC,4DAA4D;wBAC5D,+DAA+D;wBAC/D,UAAU;wBACV,eAAe,EAAE;4BACf,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;4BAClC,qBAAqB;yBACtB;wBACD,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC;wBAChE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;wBAClD,oBAAoB,EAAE;4BACpB,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;4BACvC,qBAAqB;yBACtB;qBACF;iBACF,CAAC;gBACF,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IACF,mDAAmD;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAQ,CAAA;IAC5B,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,IAAI;QACf,sBAAsB;QACtB,gBAAgB,EAAE,MAAM,CAAC,YAAY;QACrC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;KAC1D,CAAA;AACH,CAAC"}
|
|
@@ -30,6 +30,14 @@
|
|
|
30
30
|
* (`publicKeyCommitment`). The `type` rides along so a consumer can tell the
|
|
31
31
|
* two published flavors apart (`Multikey` vs `MultikeyCommitment`) instead of
|
|
32
32
|
* inferring the flavor from which property happens to be present.
|
|
33
|
+
*
|
|
34
|
+
* A credential-class member of either flavor also names its ladder's rung-0
|
|
35
|
+
* commitment (`ladderCommitment`): `hash(rung 0)` in the multihash form
|
|
36
|
+
* `nextKeyHashes` carries, the value a seedless reader anchors the
|
|
37
|
+
* credential's ladder walk on. It is a plain JSON member with no JSON-LD
|
|
38
|
+
* term: nothing processes the account document as JSON-LD, and every
|
|
39
|
+
* signature over it is JCS-canonicalized. An enrolled client's marked twin
|
|
40
|
+
* never carries it.
|
|
33
41
|
*/
|
|
34
42
|
export interface ResolvedKeyAgreementMethod {
|
|
35
43
|
id?: string;
|
|
@@ -37,6 +45,7 @@ export interface ResolvedKeyAgreementMethod {
|
|
|
37
45
|
controller?: string;
|
|
38
46
|
publicKeyMultibase?: string;
|
|
39
47
|
publicKeyCommitment?: string;
|
|
48
|
+
ladderCommitment?: string;
|
|
40
49
|
}
|
|
41
50
|
/**
|
|
42
51
|
* A locally verified did:webvh document, read for the verification relations
|
|
@@ -133,8 +142,7 @@ export declare function credentialKeyAgreementMethods({ doc, did }: {
|
|
|
133
142
|
* did not. Credential-class means account-controlled
|
|
134
143
|
* (`credentialKeyAgreementMethods`), so an enrolled client's marked twin
|
|
135
144
|
* never counts. The co-introduction arm of the ladder-VM attribution reads
|
|
136
|
-
* this and refuses to act unless the answer is exactly this credential
|
|
137
|
-
* the bind-anchor rule reads it to find a credential's bind entry.
|
|
145
|
+
* this and refuses to act unless the answer is exactly this credential.
|
|
138
146
|
*
|
|
139
147
|
* @param options {object}
|
|
140
148
|
* @param options.doc {KeyAgreementDocument} the entry's document
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/resourceLog/document.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH
|
|
1
|
+
{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/resourceLog/document.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,0BAA0B;IACzC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,EAAE,0BAA0B,EAAE,CAAA;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;IAC5D,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;IACzD,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;IACjE,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;CAClE;AAED;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAElD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CACpC,MAAM,eAAe,EACrB,oBAAoB,CACrB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,GACpD,MAAM,EAAE,CASV;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,GAAG,EACH,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,eAAe,CAAA;IACpB,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,0BAA0B,EAAE,CAe/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;CAC1B,GAAG,0BAA0B,EAAE,CAE/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,0BAA0B,EAAE,CAI/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACzC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,EAAE,CASX;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,GAAG,EACH,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACzC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,EAAE,CAOX;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CAAC,EAC1B,GAAG,EACJ,EAAE;IACD,GAAG,EAAE;QACH,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QACtD,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACvD,CAAA;CACF,GAAG,MAAM,EAAE,CAGX;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,eAAe,CAAA;CACrB,GAAG,0BAA0B,EAAE,CAM/B"}
|
|
@@ -112,8 +112,7 @@ export function credentialKeyAgreementMethods({ doc, did }) {
|
|
|
112
112
|
* did not. Credential-class means account-controlled
|
|
113
113
|
* (`credentialKeyAgreementMethods`), so an enrolled client's marked twin
|
|
114
114
|
* never counts. The co-introduction arm of the ladder-VM attribution reads
|
|
115
|
-
* this and refuses to act unless the answer is exactly this credential
|
|
116
|
-
* the bind-anchor rule reads it to find a credential's bind entry.
|
|
115
|
+
* this and refuses to act unless the answer is exactly this credential.
|
|
117
116
|
*
|
|
118
117
|
* @param options {object}
|
|
119
118
|
* @param options.doc {KeyAgreementDocument} the entry's document
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"document.js","sourceRoot":"","sources":["../../src/resourceLog/document.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;
|
|
1
|
+
{"version":3,"file":"document.js","sourceRoot":"","sources":["../../src/resourceLog/document.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AAyDH;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,QAAqD;IAErD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAA;QACxD,IAAI,EAAE,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,GAAG,EACH,QAAQ,EAIT;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsC,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAiC,EAAE,CAAA;IAChD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAClE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,GAAG,EAGJ;IACC,OAAO,uBAAuB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EAIJ;IACC,OAAO,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAChD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,GAAG,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,GAAG,EAKJ;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CACvE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CACpB,CACF,CAAA;IACD,OAAO,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SAC/C,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AACtE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,GAAG,EACH,OAAO,EACP,GAAG,EAKJ;IACC,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CACrE,CAAA;IACD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,GAAG,EAMJ;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAA;IAChE,OAAO,WAAW,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,GAAG,EAGJ;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IACzC,OAAO,uBAAuB,CAAC;QAC7B,GAAG;QACH,QAAQ,EAAE,sBAAsB;KACjC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;AAC1E,CAAC"}
|