@interop/wallet-core 0.98.0 → 0.99.0

package/dist/keyring/unlockSpace.js

@@ -80,11 +80,13 @@ async function ensurePlaintextCollection({ was, spaceId, collectionId, name }) {
         .configure({ name, force: true });
 }
 /**
- * Reads a single plaintext JSON record from a Space collection, or `null` when
- * it does not exist yet (a missing Space, collection, or resource all surface
- * as a 404-shaped `null` from `resource.get()`). A network / unreachable error
- * propagates, so callers can distinguish "no record" from "could not check".
- * The explicit `plaintext` override is load-bearing (see the module doc).
+ * Reads a single plaintext JSON record from a Space collection together with
+ * its `ETag` validator, or `null` when it does not exist yet (a missing Space,
+ * collection, or resource all surface as a 404-shaped `null` from
+ * `resource.getWithEtag()`). A network / unreachable error propagates, so
+ * callers can distinguish "no record" from "could not check". The explicit
+ * `plaintext` override is load-bearing (see the module doc): it is also what
+ * lets the validator reach the server unchanged on a conditional write.
  *
  * @param options {object}
  * @param options.was {WasClient}   the unlock Space client
@@ -93,7 +95,8 @@ async function ensurePlaintextCollection({ was, spaceId, collectionId, name }) {
  * @param options.resourceId {string}
  * @param [options.capability] {IZcap}   an invocation capability the GET
  *   rides; absent, the request invokes the root capability
- * @returns {Promise<unknown | null>}
+ * @returns {Promise<{ record: unknown; etag?: string } | null>}   `etag` is
+ *   absent only where the header did not reach the client
  */
 async function getPlaintextRecord({ was, spaceId, collectionId, resourceId, capability }) {
     const result = await plaintextCollection({
@@ -103,12 +106,20 @@ async function getPlaintextRecord({ was, spaceId, collectionId, resourceId, capa
         capability
     })
         .resource(resourceId)
-        .get();
-    return result === null ? null : result;
+        .getWithEtag();
+    if (result === null) {
+        return null;
+    }
+    return result.etag !== undefined
+        ? { record: result.data, etag: result.etag }
+        : { record: result.data };
 }
 /**
- * Writes (upserts) a single plaintext JSON record into a Space collection.
- * Serialized to bytes with an explicit `application/json` content-type.
+ * Writes a single plaintext JSON record into a Space collection. Serialized to
+ * bytes with an explicit `application/json` content-type. A plain upsert
+ * unless `ifMatch` is given, in which case the write lands only while the
+ * stored record's `ETag` still matches, and a mismatch throws was-client's
+ * `PreconditionFailedError` (412) unchanged.
  *
  * @param options {object}
  * @param options.was {WasClient}   the unlock Space client
@@ -118,13 +129,15 @@ async function getPlaintextRecord({ was, spaceId, collectionId, resourceId, capa
  * @param options.record {object}
  * @param [options.capability] {IZcap}   an invocation capability the PUT
  *   rides; absent, the request invokes the root capability
- * @returns {Promise<void>}
+ * @param [options.ifMatch] {string}   the `ETag` a prior read returned; the
+ *   write is conditional on it
+ * @returns {Promise<{ etag?: string }>}   the stored record's new `ETag`
  */
-async function putPlaintextRecord({ was, spaceId, collectionId, resourceId, record, capability }) {
+async function putPlaintextRecord({ was, spaceId, collectionId, resourceId, record, capability, ifMatch }) {
     const body = new TextEncoder().encode(JSON.stringify(record));
-    await plaintextCollection({ was, spaceId, collectionId, capability })
+    return plaintextCollection({ was, spaceId, collectionId, capability })
         .resource(resourceId)
-        .put(body, { contentType: 'application/json' });
+        .put(body, { contentType: 'application/json', ifMatch });
 }
 /**
  * Ensures the unlock Space and its single `keyring` collection exist
@@ -185,6 +198,36 @@ export async function ensureUnlockSpace({ storageServerUrl, zcapClient, serviceD
  * @returns {Promise<unknown | null>}
  */
 export async function getUnlockKeyring({ storageServerUrl, zcapClient, serviceDescription, spaceId, capability }) {
+    const result = await getUnlockKeyringWithEtag({
+        storageServerUrl,
+        zcapClient,
+        serviceDescription,
+        spaceId,
+        capability
+    });
+    return result === null ? null : result.record;
+}
+/**
+ * Reads the keyring record from the unlock Space together with its `ETag`
+ * validator, or returns `null` when it does not exist yet. The read half of a
+ * compare-and-swap re-bind: a writer that rebuilds the record from what it
+ * read passes this `etag` to {@link putUnlockKeyring}'s `ifMatch`, so a
+ * concurrent writer's record is never overwritten unseen. Same request,
+ * errors, and `capability` semantics as {@link getUnlockKeyring}.
+ *
+ * @param options {object}
+ * @param options.storageServerUrl {string}
+ * @param options.zcapClient {ZcapClient}
+ * @param [options.serviceDescription] {ServiceDescription}   the server's
+ *   service description a client the caller already holds discovered
+ *   (`(await was.service()).description`), so this one skips discovery
+ * @param options.spaceId {string}   the unlock Space id
+ * @param [options.capability] {IZcap}   the delegated management zcap;
+ *   absent, the read is a root invocation
+ * @returns {Promise<{ record: unknown; etag?: string } | null>}   `etag` is
+ *   absent only where the header did not reach the client
+ */
+export async function getUnlockKeyringWithEtag({ storageServerUrl, zcapClient, serviceDescription, spaceId, capability }) {
     return getPlaintextRecord({
         was: unlockSpaceClient({
             storageServerUrl,
@@ -198,7 +241,13 @@ export async function getUnlockKeyring({ storageServerUrl, zcapClient, serviceDe
     });
 }
 /**
- * Writes (upserts) the keyring record into the unlock Space as a JSON document.
+ * Writes the keyring record into the unlock Space as a JSON document. A plain
+ * upsert unless `ifMatch` is given: then the write is a compare-and-swap
+ * against the `etag` a {@link getUnlockKeyringWithEtag} read returned, and a
+ * record another writer replaced in between fails with was-client's
+ * `PreconditionFailedError` (412, matched by `err.name`) rather than being
+ * overwritten. A first bind of a fresh record has no `etag` to name and stays
+ * an upsert.
  *
  * With a `capability`, the `zcapClient` is an enrolled client's rather than
  * the unlock identity's, and the attached management zcap (delegated by the
@@ -218,10 +267,12 @@ export async function getUnlockKeyring({ storageServerUrl, zcapClient, serviceDe
  * @param options.record {object}   the keyring record
  * @param [options.capability] {IZcap}   the delegated management zcap;
  *   absent, the write is a root invocation
- * @returns {Promise<void>}
+ * @param [options.ifMatch] {string}   the `ETag` of the record this write
+ *   replaces; absent, the write is an unconditional upsert
+ * @returns {Promise<{ etag?: string }>}   the stored record's new `ETag`
  */
-export async function putUnlockKeyring({ storageServerUrl, zcapClient, serviceDescription, spaceId, record, capability }) {
-    await putPlaintextRecord({
+export async function putUnlockKeyring({ storageServerUrl, zcapClient, serviceDescription, spaceId, record, capability, ifMatch }) {
+    return putPlaintextRecord({
         was: unlockSpaceClient({
             storageServerUrl,
             zcapClient,
@@ -231,7 +282,8 @@ export async function putUnlockKeyring({ storageServerUrl, zcapClient, serviceDe
         collectionId: KEYRING_COLLECTION.id,
         resourceId: KEYRING_RESOURCE,
         record,
-        capability
+        capability,
+        ifMatch
     });
 }
 /**

package/dist/keyring/unlockSpace.js.map

@@ -1 +1 @@
-{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAA2B,MAAM,qBAAqB,CAAA;AAGxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAKnB;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,IAAI,EAML;IACC,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EAOX;IACC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,GAAG;QACH,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC;SACC,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,EAAE,CAAA;IACR,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EACN,UAAU,EAQX;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SAClE,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAQzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC3D,MAAM,yBAAyB,CAAC;QAC9B,GAAG;QACH,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EAQX;IACC,MAAM,kBAAkB,CAAC;QACvB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;QACN,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"unlockSpace.js","sourceRoot":"","sources":["../../src/keyring/unlockSpace.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,SAAS,EAA2B,MAAM,qBAAqB,CAAA;AAGxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,EACzB,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAKnB;IACC,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,EAAE,gBAAgB;QAC3B,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,yBAAyB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,IAAI,EAML;IACC,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,CAAC;SACxB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EAOX;IACC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,GAAG;QACH,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC;SACC,QAAQ,CAAC,UAAU,CAAC;SACpB,WAAW,EAAE,CAAA;IAChB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,KAAK,SAAS;QAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;QAC5C,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,MAAM,EACN,UAAU,EACV,OAAO,EASR;IACC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,OAAO,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;SACnE,QAAQ,CAAC,UAAU,CAAC;SACpB,GAAG,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EACV,IAAI,GAAG,iBAAiB,EAQzB;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,MAAM,GAAG;SACN,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC3D,MAAM,yBAAyB,CAAC;QAC9B,GAAG;QACH,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,gBAAgB;QAChB,UAAU;QACV,kBAAkB;QAClB,OAAO;QACP,UAAU;KACX,CAAC,CAAA;IACF,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,UAAU;KACX,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,UAAU,EACV,OAAO,EASR;IACC,OAAO,kBAAkB,CAAC;QACxB,GAAG,EAAE,iBAAiB,CAAC;YACrB,gBAAgB;YAChB,UAAU;YACV,kBAAkB;SACnB,CAAC;QACF,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,gBAAgB;QAC5B,MAAM;QACN,UAAU;QACV,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,gBAAgB,EAChB,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,UAAU,EAOX;IACC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,gBAAgB;QAChB,UAAU;QACV,kBAAkB;KACnB,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAA;AAC/D,CAAC"}

package/dist/resourceLog/controller.d.ts

@@ -36,11 +36,12 @@ import { type LadderRungKeys } from './ladderRungs.js';
 /**
  * The credential-inventory view at one controller-log version, consumed by the
  * ceremony-tail license on ladder-signed appends (clause B of the ladder
- * VM's authority clauses). Both members come from the shared
- * account-document readers beside this file (`ladderVmMethods` and
- * `credentialKeyAgreementMethods` in `document.ts`), so the license reads the
- * document exactly as the client listing and the roster's recipient resolver
- * do. `ladderKeys` holds the ladder VMs' signing-key multibases, which is how
+ * VM's authority clauses). Every member comes from the shared
+ * account-document readers beside this file (`ladderVmKeyMultibases`,
+ * `enrolledClientKeyMultibases`, and `credentialKeyAgreementMethods` in
+ * `document.ts`), so the license reads the document exactly as the rung
+ * attribution, the did:key census, and the roster's recipient resolver do.
+ * `ladderKeys` holds the ladder VMs' signing-key multibases, which is how
  * a verifier tells a ladder-signed proof from an enrolled client's.
  * `inventoryKeys` is S(V), the credential-inventory key set: the
  * credential-class `keyAgreement` methods keyed by their key material,

package/dist/resourceLog/controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AACpE,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,0BAA0B,CAAA;AAOjC,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AAGzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC/B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC5B,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,0BAA2B,SAAQ,qBAAqB;IACvE;;;;;;;;OAQG;IACH,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC7D,WAAW,EAAE,WAAW,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAA;CAC/D;AA2FD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,0BAA0B,CA+E7B"}
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AACpE,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,0BAA0B,CAAA;AAQjC,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AAGzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC/B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC5B,cAAc,EAAE,cAAc,CAAA;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,0BAA2B,SAAQ,qBAAqB;IACvE;;;;;;;;OAQG;IACH,WAAW,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC7D,WAAW,EAAE,WAAW,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAA;CAC/D;AAgFD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,0BAA0B,CA+E7B"}

package/dist/resourceLog/controller.js

@@ -1,5 +1,5 @@
 import { ResourceLogIntegrityError } from '@interop/vh-resource-log';
-import { credentialKeyAgreementMethods, ladderVmMethods, resolvedRelationMethods } from './document.js';
+import { credentialKeyAgreementMethods, enrolledClientKeyMultibases, ladderVmKeyMultibases, resolvedRelationMethods } from './document.js';
 import { attributeLadderRungsPerVersion, entrySignerKeysOf } from './ladderRungs.js';
 import { assertLadderAppendLicensed } from './license.js';
 /**
@@ -26,9 +26,10 @@ function assertionKeysOf(doc) {
  * Collects a document's credential-inventory view (see
  * {@link ControllerInventory}) over the shared account-document readers, so
  * ladder recognition and the credential class have one definition here and in
- * every other reader: `ladderVmMethods` names the ladder VMs by relation
- * asymmetry, and `credentialKeyAgreementMethods` names the account-controlled
- * `keyAgreement` methods. S(V) is those methods' key material --
+ * every other reader: `ladderVmKeyMultibases` names the ladder VMs' keys by
+ * relation asymmetry under the library's one key-multibase rule, and
+ * `credentialKeyAgreementMethods` names the account-controlled `keyAgreement`
+ * methods. S(V) is those methods' key material --
  * `publicKeyCommitment` where the entry is a commitment,
  * `publicKeyMultibase` where it is verbatim (the two value spaces are
  * disjoint) -- union the ladder keys. A `keyAgreement` method carrying
@@ -36,8 +37,9 @@ function assertionKeysOf(doc) {
  * inventories compare equal.
  *
  * The enrolled-client set the license's third shape compares across versions
- * is read from the same document in the same pass: the `capabilityInvocation`
- * methods' key multibases. That relation is the client census by definition --
+ * is read from the same document in the same pass, by
+ * `enrolledClientKeyMultibases` under the same key-multibase rule. That
+ * relation is the client census by definition --
  * a ladder VM is absent from it by the recognition asymmetry, and a
  * credential's `keyAgreement` entry was never in it -- so the two sets this
  * function returns cannot overlap by construction.
@@ -51,12 +53,7 @@ function assertionKeysOf(doc) {
  * @returns {Omit<ControllerInventory, 'ladderRungKeys'>}
  */
 function inventoryOf({ doc, did, entry }) {
-    const ladderKeys = new Set();
-    for (const method of ladderVmMethods({ doc })) {
-        if (typeof method.publicKeyMultibase === 'string') {
-            ladderKeys.add(method.publicKeyMultibase);
-        }
-    }
+    const ladderKeys = ladderVmKeyMultibases({ doc });
     const inventoryKeys = new Set(ladderKeys);
     for (const method of credentialKeyAgreementMethods({ doc, did })) {
         if (typeof method.publicKeyCommitment === 'string') {
@@ -66,15 +63,7 @@ function inventoryOf({ doc, did, entry }) {
             inventoryKeys.add(method.publicKeyMultibase);
         }
     }
-    const enrolledClientKeys = new Set();
-    for (const method of resolvedRelationMethods({
-        doc,
-        relation: 'capabilityInvocation'
-    })) {
-        if (typeof method.publicKeyMultibase === 'string') {
-            enrolledClientKeys.add(method.publicKeyMultibase);
-        }
-    }
+    const enrolledClientKeys = enrolledClientKeyMultibases({ doc });
     return {
         ladderKeys,
         inventoryKeys,

package/dist/resourceLog/controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAiCA,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,6BAA6B,EAC7B,eAAe,EACf,uBAAuB,EAExB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EAElB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAmEzD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,MAAM,IAAI,uBAAuB,CAAC;QAC3C,GAAG;QACH,QAAQ,EAAE,iBAAiB;KAC5B,CAAC,EAAE,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,WAAW,CAAC,EACnB,GAAG,EACH,GAAG,EACH,KAAK,EAKN;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9C,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IACzC,KAAK,MAAM,MAAM,IAAI,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;YACnD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC/C,CAAC;aAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACzD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC5C,KAAK,MAAM,MAAM,IAAI,uBAAuB,CAAC;QAC3C,GAAG;QACH,QAAQ,EAAE,sBAAsB;KACjC,CAAC,EAAE,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU;QACV,aAAa;QACb,kBAAkB;QAClB,eAAe,EAAE,iBAAiB,CAAC,KAAK,CAAC;KAC1C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAA;IACpD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAG/B,CAAA;IACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACnD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAwB,CAAA;QAC1C,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACzE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAClD,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,oCAAoC;IACpC,IAAI,aAAoD,CAAA;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/D,SAAS,cAAc,CAAC,SAAkB;QACxC,OAAO,IAAI,yBAAyB,CAClC,qDAAqD;YACnD,IAAI,SAAS,IAAI,QAAQ,2BAA2B,CACvD,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAA+B;QACvC,GAAG;QACH,UAAU;QACV,eAAe,CAAC,SAAkB;YAChC,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC3C,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAkB;YAClC,MAAM,iBAAiB,GACrB,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;YACvD,MAAM,QAAQ,GACZ,iBAAiB,KAAK,SAAS;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC/C,MAAM,QAAQ,GACZ,iBAAiB,KAAK,SAAS;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC9C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAA;YACjC,CAAC;YACD,aAAa,KAAK,8BAA8B,CAAC,GAAG,CAAC,CAAA;YACrD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAA;YACrC,OAAO;gBACL,GAAG,QAAQ;gBACX,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE;aACjD,CAAA;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAChB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EACV;YACC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAA;YAC7D,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3C,MAAM,0BAA0B,CAAC;oBAC/B,UAAU,EAAE,IAAI;oBAChB,sBAAsB;oBACtB,0BAA0B;oBAC1B,SAAS;iBACV,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/resourceLog/controller.ts"],"names":[],"mappings":"AAiCA,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EAElB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAoEzD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,MAAM,IAAI,uBAAuB,CAAC;QAC3C,GAAG;QACH,QAAQ,EAAE,iBAAiB;KAC5B,CAAC,EAAE,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,WAAW,CAAC,EACnB,GAAG,EACH,GAAG,EACH,KAAK,EAKN;IACC,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACjD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IACzC,KAAK,MAAM,MAAM,IAAI,6BAA6B,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,EAAE,CAAC;YACnD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC/C,CAAC;aAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACzD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAC/D,OAAO;QACL,UAAU;QACV,aAAa;QACb,kBAAkB;QAClB,eAAe,EAAE,iBAAiB,CAAC,KAAK,CAAC;KAC1C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,GAAG,EAIJ;IACC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAA;IACpD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAG/B,CAAA;IACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACnD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAwB,CAAA;QAC1C,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACzE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAClD,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,oCAAoC;IACpC,IAAI,aAAoD,CAAA;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/D,SAAS,cAAc,CAAC,SAAkB;QACxC,OAAO,IAAI,yBAAyB,CAClC,qDAAqD;YACnD,IAAI,SAAS,IAAI,QAAQ,2BAA2B,CACvD,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAA+B;QACvC,GAAG;QACH,UAAU;QACV,eAAe,CAAC,SAAkB;YAChC,MAAM,QAAQ,GACZ,SAAS,KAAK,SAAS;gBACrB,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC3C,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAA;YAClD,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAkB;YAClC,MAAM,iBAAiB,GACrB,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;YACvD,MAAM,QAAQ,GACZ,iBAAiB,KAAK,SAAS;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC/C,MAAM,QAAQ,GACZ,iBAAiB,KAAK,SAAS;gBAC7B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;YAC9C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAA;YACjC,CAAC;YACD,aAAa,KAAK,8BAA8B,CAAC,GAAG,CAAC,CAAA;YACrD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAA;YACrC,OAAO;gBACL,GAAG,QAAQ;gBACX,cAAc,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE;aACjD,CAAA;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAChB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,SAAS,EACV;YACC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAA;YAC7D,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3C,MAAM,0BAA0B,CAAC;oBAC/B,UAAU,EAAE,IAAI;oBAChB,sBAAsB;oBACtB,0BAA0B;oBAC1B,SAAS;iBACV,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;KACF,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/resourceLog/document.d.ts

@@ -3,26 +3,33 @@
  */
 /**
  * The account-document reading conventions every reader shares, in one place:
- * how a verification relation resolves (string references into
- * `verificationMethod`, embedded methods verbatim), which
- * `capabilityDelegation` members are ladder VMs, and which `keyAgreement`
- * methods are the account's credential inventory.
+ * which `capabilityDelegation` members are ladder VMs, which `keyAgreement`
+ * methods are the account's credential inventory, and which key multibases
+ * the two account-document key classes (the enrolled clients' signing keys,
+ * the ladder VMs' keys) publish. How a verification relation resolves, and
+ * which key multibase a relation member names, are the generic rules every
+ * consumer of the stack shares; they come from `@interop/vh-resource-log`
+ * and are re-exported here under the names this module always had.
  *
  * Each of those rules is a wire-level convention of the account document, so
  * a second implementation of one is a place the readers can disagree: the
  * ceremony-tail license's inventory comparison and the client listing's
  * ladder-VM recognition must answer identically over the same document, and
  * so must the roster's recipient resolver and the client listing's marker
- * filter. They are consumers of the readers here rather than re-readings of
+ * filter, and so must the ladder-rung attribution and the account's did:key
+ * census. They are consumers of the readers here rather than re-readings of
  * the document.
  *
- * Deliberately dependency-light -- it imports nothing at all -- so both the
- * layer-0 controller adapter beside it and the `webvh` and `keys` layers
- * above can share the readers without pulling the ceremony or signing graph.
- * Its public home is `@interop/wallet-core/webvh`, which re-exports the
- * `keyAgreement` readers and the ladder recognition; this subpath exports
- * none of them, so each name has one owner.
+ * Deliberately dependency-light -- it imports only the resource-log library
+ * the layer beside it already sits over -- so both the layer-0 controller
+ * adapter and the `webvh` and `keys` layers above can share the readers
+ * without pulling the ceremony or signing graph. Its public home is
+ * `@interop/wallet-core/webvh`, which re-exports the `keyAgreement` readers,
+ * the ladder recognition, and the two key-class readers; this subpath
+ * exports none of them, so each name has one owner.
  */
+import { relationIds, resolvedRelationMethods, type ControllerDocument, type VerificationRelation } from '@interop/vh-resource-log';
+export { relationIds, resolvedRelationMethods };
 /**
  * The materialized shape the relation readers return: a verification method
  * carrying either the key itself (`publicKeyMultibase`) or, for a
@@ -49,17 +56,12 @@ export interface ResolvedKeyAgreementMethod {
 }
 /**
  * A locally verified did:webvh document, read for the verification relations
- * it publishes and the methods they resolve to. Structural on purpose: a
- * resolved `DIDDoc` satisfies it, and so does any narrower document shape a
- * wallet already holds.
+ * it publishes and the methods they resolve to: the library's
+ * `ControllerDocument` over this module's method shape. Structural on
+ * purpose: a resolved `DIDDoc` satisfies it, and so does any narrower
+ * document shape a wallet already holds.
  */
-export interface AccountDocument {
-    verificationMethod?: ResolvedKeyAgreementMethod[];
-    assertionMethod?: Array<string | ResolvedKeyAgreementMethod>;
-    keyAgreement?: Array<string | ResolvedKeyAgreementMethod>;
-    capabilityInvocation?: Array<string | ResolvedKeyAgreementMethod>;
-    capabilityDelegation?: Array<string | ResolvedKeyAgreementMethod>;
-}
+export type AccountDocument = ControllerDocument<ResolvedKeyAgreementMethod>;
 /**
  * The document shape the `keyAgreement` readers take, kept as the published
  * name the `webvh` and `keys` subpaths surface. It is {@link AccountDocument}
@@ -70,33 +72,7 @@ export type KeyAgreementDocument = AccountDocument;
 /**
  * The verification relations a document reader may resolve.
  */
-export type DocumentRelation = Exclude<keyof AccountDocument, 'verificationMethod'>;
-/**
- * The relationship references of a resolved document as verification-method
- * ids, tolerating embedded objects beside string references.
- *
- * @param relation {Array}   the relationship array, when present
- * @returns {string[]}
- */
-export declare function relationIds(relation: Array<string | {
-    id?: string;
-}> | undefined): string[];
-/**
- * The verification methods one relation publishes, materialized: string
- * references resolved against `verificationMethod` (a reference nothing backs
- * is dropped), embedded methods taken verbatim. Document order is preserved,
- * and nothing is filtered -- deciding which of these methods belongs to whom
- * is each caller's own rule.
- *
- * @param options {object}
- * @param options.doc {AccountDocument}   a locally verified document
- * @param options.relation {DocumentRelation}   the relation to resolve
- * @returns {ResolvedKeyAgreementMethod[]}
- */
-export declare function resolvedRelationMethods({ doc, relation }: {
-    doc: AccountDocument;
-    relation: DocumentRelation;
-}): ResolvedKeyAgreementMethod[];
+export type DocumentRelation = VerificationRelation;
 /**
  * The `keyAgreement` verification methods a document publishes, materialized:
  * string references resolved against `verificationMethod` (a reference nothing
@@ -212,12 +188,16 @@ export declare function ladderVmIds({ doc }: {
  * The ladder VMs' verification methods, materialized: the
  * `capabilityDelegation` methods {@link ladderVmIds} names, resolved the way
  * every other relation read resolves. Recognition therefore has exactly one
- * definition -- a reader needing the ladder keys themselves (their
- * `publicKeyMultibase`) asks here rather than re-deriving the asymmetry.
+ * definition -- a reader needing the ladder VMs' resolved methods asks here
+ * rather than re-deriving the asymmetry. A reader needing the ladder KEYS
+ * asks {@link ladderVmKeyMultibases} instead, which applies the library's one
+ * key-multibase rule; this reader hands back the methods as resolved, with no
+ * fragment check.
  *
  * A method the recognition cannot name -- an embedded `capabilityDelegation`
- * entry carrying no `id`, or a reference nothing backs -- is not a ladder VM
- * here, the same refuse-not-guess answer the id-keyed recognition gives.
+ * entry carrying no `id`, or a reference nothing backs -- has no resolved
+ * method here, the same refuse-not-guess answer the id-keyed recognition
+ * gives. (The key reader names such a reference's key by fragment alone.)
  *
  * @param options {object}
  * @param options.doc {AccountDocument}   a locally verified document
@@ -226,4 +206,41 @@ export declare function ladderVmIds({ doc }: {
 export declare function ladderVmMethods({ doc }: {
     doc: AccountDocument;
 }): ResolvedKeyAgreementMethod[];
+/**
+ * The enrolled clients' signing-key multibases a document publishes: the
+ * keys of its `capabilityInvocation` members, which is the relation an
+ * enrolled client publishes its signing key under and a ladder VM, a
+ * credential's key-agreement key, a transient annex VM, and the KMS
+ * convenience key deliberately do not (`enrolledClientVmIds` is the same
+ * convention read as ids). Each member is read under the library's one
+ * key-multibase rule (`memberKeyMultibase`): its id fragment and its
+ * resolved method's `publicKeyMultibase` must agree when both are present,
+ * either alone is the key, and a member whose two readings disagree names no
+ * key. The ladder-rung attribution and the account's did:key census both read
+ * this set, so a malformed member drops out of both rather than naming a
+ * different key in each.
+ *
+ * @param options {object}
+ * @param options.doc {AccountDocument}   a locally verified document
+ * @returns {Set<string>}
+ */
+export declare function enrolledClientKeyMultibases({ doc }: {
+    doc: AccountDocument;
+}): Set<string>;
+/**
+ * The ladder VMs' key multibases a document publishes: the keys of the
+ * `capabilityDelegation` members {@link ladderVmIds} recognizes, each read
+ * under the same one key-multibase rule as
+ * {@link enrolledClientKeyMultibases}. Recognition stays id-keyed, so an
+ * id-less embedded delegation member is not a ladder VM here either; a
+ * recognized member that is a reference nothing backs names its key by
+ * fragment alone.
+ *
+ * @param options {object}
+ * @param options.doc {AccountDocument}   a locally verified document
+ * @returns {Set<string>}
+ */
+export declare function ladderVmKeyMultibases({ doc }: {
+    doc: AccountDocument;
+}): Set<string>;
 //# sourceMappingURL=document.d.ts.map

package/dist/resourceLog/document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/resourceLog/document.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,0BAA0B;IACzC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,kBAAkB,CAAC,EAAE,0BAA0B,EAAE,CAAA;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;IAC5D,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;IACzD,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;IACjE,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,0BAA0B,CAAC,CAAA;CAClE;AAED;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAElD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CACpC,MAAM,eAAe,EACrB,oBAAoB,CACrB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,GACpD,MAAM,EAAE,CASV;AAsCD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,GAAG,EACH,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,eAAe,CAAA;IACpB,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,0BAA0B,EAAE,CAU/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;CAC1B,GAAG,0BAA0B,EAAE,CAE/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,0BAA0B,EAAE,CAI/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACzC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,EAAE,CASX;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,GAAG,EACH,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACzC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,EAAE,CAOX;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CAAC,EAC1B,GAAG,EACJ,EAAE;IACD,GAAG,EAAE;QACH,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QACtD,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACvD,CAAA;CACF,GAAG,MAAM,EAAE,CAGX;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,eAAe,CAAA;CACrB,GAAG,0BAA0B,EAAE,CAM/B"}
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/resourceLog/document.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAEL,WAAW,EAGX,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAA;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,0BAA0B;IACzC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;AAE5E;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAElD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAA;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;CAC1B,GAAG,0BAA0B,EAAE,CAE/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,GAAG,EACH,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,0BAA0B,EAAE,CAI/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,GAAG,EACH,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACzC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,EAAE,CASX;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,GAAG,EACH,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,oBAAoB,CAAA;IACzB,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACzC,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,EAAE,CAOX;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CAAC,EAC1B,GAAG,EACJ,EAAE;IACD,GAAG,EAAE;QACH,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;QACtD,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACvD,CAAA;CACF,GAAG,MAAM,EAAE,CAGX;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAAC,EAC9B,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,eAAe,CAAA;CACrB,GAAG,0BAA0B,EAAE,CAM/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,eAAe,CAAA;CACrB,GAAG,GAAG,CAAC,MAAM,CAAC,CAEd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,eAAe,CAAA;CACrB,GAAG,GAAG,CAAC,MAAM,CAAC,CAgBd"}