@keetanetwork/keetanet-client 0.18.0 → 0.18.1

package/client/builder.d.ts

@@ -3,7 +3,7 @@ import { Account, AccountKeyAlgorithm } from '../lib/account';
 import type { AdjustMethod, BlockHash } from '../lib/block';
 import { Block } from '../lib/block';
 import type { IdentifierCreateArguments, BlockJSONOperations } from '../lib/block/operations';
-import type { AccountInfo, AccountInfoWithoutAccount } from '../lib/ledger/types';
+import type { AccountInfo, AccountInfoWithoutAccount, ACLRow } from '../lib/ledger/types';
 import type { AcceptedPermissionTypes } from '../lib/permissions';
 import type { UserClient, Client } from '.';
 import { Permissions } from '../lib/permissions';
@@ -87,10 +87,15 @@ export interface PendingOperations {
         certificate: Certificate;
         intermediateCertificates: CertificateBundle | null;
     }[];
-    permissionsChanges?: PerAccount<PerAccount<{
-        method: AdjustMethod;
-        permissions: Permissions;
-    }[]>>;
+    permissionsChanges?: {
+        [principalOrCertificate: string]: {
+            principal: ACLRow['principal'];
+            targets: PerAccount<{
+                method: AdjustMethod;
+                permissions: Permissions;
+            }[]>;
+        };
+    };
     info?: AccountInfoWithoutAccount;
     setRep?: Account;
 }
@@ -123,10 +128,18 @@ export interface PendingOperationsJSON {
         certificate: string;
         intermediateCertificates: string | null;
     }[];
-    permissionsChanges?: PerAccount<PerAccount<{
-        method: AdjustMethod;
-        permissions: [string, string];
-    }[]>>;
+    permissionsChanges?: {
+        [principalOrCertificate: string]: {
+            principal: string | {
+                certificate: string;
+                certificateAccount: string;
+            };
+            targets: PerAccount<{
+                method: AdjustMethod;
+                permissions: [string, string];
+            }[]>;
+        };
+    };
     info?: Pick<AccountInfo, 'name' | 'description' | 'metadata'> & {
         defaultPermission?: [string, string];
     };
@@ -183,7 +196,7 @@ export declare class UserClientBuilder {
     computeBlocks(renderOptions: RenderOptions): Promise<ComputeBlocksResponse>;
     send(recipient: AccountOrPending, amount: bigint, token: TokenOrPending, external?: string, options?: BuilderBlockOptions): void;
     receive(from: AccountOrPending, amount: bigint, token: TokenOrPending, exact?: boolean, forward?: GenericAccount, options?: BuilderBlockOptions): void;
-    updatePermissions(principal: GenericAccount, permissions: AcceptedPermissionTypes, target?: GenericAccount, method?: AdjustMethod, options?: BuilderBlockOptions): void;
+    updatePermissions(principal: ACLRow['principal'], permissions: AcceptedPermissionTypes, target?: GenericAccount, method?: AdjustMethod, options?: BuilderBlockOptions): void;
     modifyCertificate(method: ManageCertificateMethod, certificate: Certificate, intermediateCertificates?: CertificateBundle | null, options?: BuilderBlockOptions): void;
     modifyTokenSupply(amount: bigint, options?: BuilderBlockOptions): void;
     modifyTokenBalance(token: TokenOrPending, amount: bigint, isSet?: boolean, options?: BuilderBlockOptions): void;

package/client/index-browser.d.ts

@@ -1204,7 +1204,7 @@ export declare class UserClient {
      * @param options The options to use for the request
      * @return The vote staple that was generated and whether it was able to be published
      */
-    updatePermissions(principal: GenericAccount | string, permissions: AcceptedPermissionTypes, target?: GenericAccount | string, method?: AdjustMethod, options?: UserClientOptions): Promise<{
+    updatePermissions(principal: GenericAccount | string | ACLRow['principal'], permissions: AcceptedPermissionTypes, target?: GenericAccount | string, method?: AdjustMethod, options?: UserClientOptions): Promise<{
         voteStaple: VoteStaple;
         publish: boolean;
         from: "direct";

package/client/index-browser.js

@@ -117365,7 +117365,22 @@ class src_client_Certificate {
    * Verify against a given certificate store
    */
 
-  verifyChain(store, _ignore_seenCerts) {
+  /** @internal */
+
+  verifyChain(store) {
+    let seenHashes = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : new src_client_CertificateHash.Set();
+    /**
+     * Loop detection: reject any certificate already on the current
+     * verification path, per RFC 4158 Section 2.4.1 (no certificate may
+     * repeat in a path) and Section 5.2 (detection guidance).
+     *
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc4158#section-5.2 RFC 4158 Section 5.2}
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc4158#section-2.4.1 RFC 4158 Section 2.4.1}
+     */
+    if (seenHashes.has(client_certificate_assertClassBrand(client_Certificate_brand, this, client_computeHash).call(this))) {
+      return null;
+    }
+
     /*
      * Check to see if the certificate is signed by any of the Root CAs
      */
@@ -117397,6 +117412,8 @@ class src_client_Certificate {
      * Check to see if the certificate is signed by any of the specified intermediates
      */
     if (store.intermediate !== undefined) {
+      const nextSeen = new src_client_CertificateHash.Set(seenHashes);
+      nextSeen.add(client_certificate_assertClassBrand(client_Certificate_brand, this, client_computeHash).call(this));
       store.intermediate.forEach(intermediateCertificate => {
         if (retval !== null) {
           return;
@@ -117404,7 +117421,7 @@ class src_client_Certificate {
         const checkIssued = client_certificate_assertClassBrand(client_Certificate_brand, this, client_checkIssued).call(this, intermediateCertificate);
         if (checkIssued.issued) {
           if (intermediateCertificate.checkValid(this.moment)) {
-            const moreChain = intermediateCertificate.verifyChain(store, undefined /* seenCerts XXX:TODO */);
+            const moreChain = intermediateCertificate.verifyChain(store, nextSeen);
             if (moreChain !== null) {
               const checkRetval = [...moreChain, intermediateCertificate];
               const validChain = src_client_Certificate.verifyChainDepth([...checkRetval, this]);
@@ -117581,12 +117598,13 @@ class src_client_Certificate {
    */
   hash() {
     this.assertConstructed();
-    if (!client_certificate_classPrivateFieldGet(client_hash, this)) {
-      client_certificate_classPrivateFieldSet(client_hash, this, src_client_CertificateHash.fromData(client_certificate_Buffer.from(client_certificate_classPrivateFieldGet(client_raw2, this))));
-    }
-    return client_certificate_classPrivateFieldGet(client_hash, this);
+    return client_certificate_assertClassBrand(client_Certificate_brand, this, client_computeHash).call(this);
   }
 
+  /*
+   * Compute the hash without asserting full construction.
+   */
+
   /**
    * Get a JSON representation of the certificate
    */
@@ -117890,6 +117908,12 @@ function client_checkIssued(issuer) {
     issued: true
   };
 }
+function client_computeHash() {
+  if (!client_certificate_classPrivateFieldGet(client_hash, this)) {
+    client_certificate_classPrivateFieldSet(client_hash, this, src_client_CertificateHash.fromData(client_certificate_Buffer.from(client_certificate_classPrivateFieldGet(client_raw2, this))));
+  }
+  return client_certificate_classPrivateFieldGet(client_hash, this);
+}
 /**
  * The Certificate Builder
  */
@@ -130232,7 +130256,7 @@ client_lib_ledger_defineProperty(src_client_Ledger, "isInstance", client_checkab
 // EXTERNAL MODULE: ws (ignored)
 var client_ws_ignored_ = __webpack_require__(4708);
 ;// ./src/version.ts
-const client_version = '0.18.0+g5417d9af948be899fcebb75694edb492ff971891';
+const client_version = '0.18.1+gae2caf00c1e19c6d232ff1a37b9fd8e7ea8a1ddc';
 /* harmony default export */ const client_src_version = ((/* unused pure expression or super */ null && (client_version)));
 ;// ./src/lib/p2p.ts
 /* provided dependency */ var client_p2p_Buffer = __webpack_require__(8287)["Buffer"];
@@ -133131,20 +133155,33 @@ class src_client_UserClientBuilder {
         }
         if (operations.permissionsChanges !== undefined) {
           pendingOperations.permissionsChanges = {};
-          for (const accountPubKey in operations.permissionsChanges) {
-            pendingOperations.permissionsChanges[accountPubKey] = {};
-            for (const targetPubKey in operations.permissionsChanges[accountPubKey]) {
+          for (const [certificateOrAccountKey, changes] of Object.entries(operations.permissionsChanges)) {
+            pendingOperations.permissionsChanges[certificateOrAccountKey] = {
+              principal: (() => {
+                if (typeof changes.principal === 'string') {
+                  return src_client_Account.toAccount(changes.principal);
+                } else {
+                  return {
+                    usingCertificate: true,
+                    certificate: new src_client_Certificate.Hash(changes.principal.certificate),
+                    certificateAccount: src_client_Account.toAccount(changes.principal.certificateAccount)
+                  };
+                }
+              })(),
+              targets: {}
+            };
+            for (const targetPubKey in changes.targets) {
               const updateArray = [];
               for (const {
                 method,
                 permissions
-              } of operations.permissionsChanges[accountPubKey][targetPubKey]) {
+              } of changes.targets[targetPubKey]) {
                 updateArray.push({
                   method,
                   permissions: client_permissions_Permissions.FromAcceptedTypes(permissions)
                 });
               }
-              pendingOperations.permissionsChanges[accountPubKey][targetPubKey] = updateArray;
+              pendingOperations.permissionsChanges[certificateOrAccountKey].targets[targetPubKey] = updateArray;
             }
           }
         }
@@ -133594,9 +133631,13 @@ class src_client_UserClientBuilder {
           amount: amount
         });
       }
-      for (const principalPubKey in pending.permissionsChanges) {
-        for (const targetPubKey in pending.permissionsChanges[principalPubKey]) {
-          for (const change of pending.permissionsChanges[principalPubKey][targetPubKey]) {
+      for (const {
+        targets,
+        principal
+      } of Object.values((_pending$permissionsC = pending.permissionsChanges) !== null && _pending$permissionsC !== void 0 ? _pending$permissionsC : {})) {
+        var _pending$permissionsC;
+        for (const targetPubKey in targets) {
+          for (const change of targets[targetPubKey]) {
             const {
               method,
               permissions
@@ -133607,7 +133648,17 @@ class src_client_UserClientBuilder {
             }
             operations.push({
               type: src_client_Block.OperationType.MODIFY_PERMISSIONS,
-              principal: src_client_Account.fromPublicKeyString(principalPubKey),
+              principal: (() => {
+                if (src_client_Account.isInstance(principal)) {
+                  return principal;
+                } else {
+                  return {
+                    usingCertificate: true,
+                    certificateHash: principal.certificate,
+                    certificateAccount: principal.certificateAccount
+                  };
+                }
+              })(),
               target: target,
               method: method,
               permissions: permissions
@@ -133673,18 +133724,26 @@ class src_client_UserClientBuilder {
     let options = arguments.length > 4 && arguments[4] !== undefined ? arguments[4] : {};
     client_builder_assertClassBrand(client_UserClientBuilder_brand, this, client_useOptions).call(this, options);
     method = method !== null && method !== void 0 ? method : src_client_Block.AdjustMethod.SET;
-    const principalPubKey = principal.publicKeyString.get();
-    const targetPubKey = (target !== null && target !== void 0 ? target : client_builder_classPrivateFieldGet(client_pendingOptions, this).account).publicKeyString.get();
+    let principalKey;
+    if (typeof principal === 'string' || src_client_Account.isInstance(principal)) {
+      principalKey = src_client_Account.toAccount(principal).publicKeyString.get();
+    } else {
+      principalKey = principal.certificate.toString();
+    }
     if (!client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges) {
       client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges = {};
     }
-    if (!client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalPubKey]) {
-      client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalPubKey] = {};
+    if (!client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalKey]) {
+      client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalKey] = {
+        principal,
+        targets: {}
+      };
     }
-    if (!client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalPubKey][targetPubKey]) {
-      client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalPubKey][targetPubKey] = [];
+    const targetPubKey = (target !== null && target !== void 0 ? target : client_builder_classPrivateFieldGet(client_pendingOptions, this).account).publicKeyString.get();
+    if (!client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalKey].targets[targetPubKey]) {
+      client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalKey].targets[targetPubKey] = [];
     }
-    client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalPubKey][targetPubKey].push({
+    client_builder_classPrivateFieldGet(client_pendingOperations, this).permissionsChanges[principalKey].targets[targetPubKey].push({
       method: method,
       permissions: client_permissions_Permissions.FromAcceptedTypes(permissions)
     });
@@ -136710,7 +136769,13 @@ class src_client_UserClient {
   async updatePermissions(principal, permissions, target, method) {
     let options = arguments.length > 4 && arguments[4] !== undefined ? arguments[4] : {};
     const builder = this.initBuilder(options);
-    builder.updatePermissions(client_lib_account.toAccount(principal), permissions, client_lib_account.toAccount(target), method, options);
+    let principalValue;
+    if (typeof principal === 'string' || client_lib_account.isInstance(principal)) {
+      principalValue = client_lib_account.toAccount(principal);
+    } else {
+      principalValue = principal;
+    }
+    builder.updatePermissions(principalValue, permissions, client_lib_account.toAccount(target), method, options);
     return await this.publishBuilder(builder);
   }
 

package/client/index.d.ts

@@ -1204,7 +1204,7 @@ export declare class UserClient {
      * @param options The options to use for the request
      * @return The vote staple that was generated and whether it was able to be published
      */
-    updatePermissions(principal: GenericAccount | string, permissions: AcceptedPermissionTypes, target?: GenericAccount | string, method?: AdjustMethod, options?: UserClientOptions): Promise<{
+    updatePermissions(principal: GenericAccount | string | ACLRow['principal'], permissions: AcceptedPermissionTypes, target?: GenericAccount | string, method?: AdjustMethod, options?: UserClientOptions): Promise<{
         voteStaple: VoteStaple;
         publish: boolean;
         from: "direct";

package/client/index.js

@@ -57418,14 +57418,28 @@ class UserClientBuilder {
                 }
                 if (operations.permissionsChanges !== undefined) {
                     pendingOperations.permissionsChanges = {};
-                    for (const accountPubKey in operations.permissionsChanges) {
-                        pendingOperations.permissionsChanges[accountPubKey] = {};
-                        for (const targetPubKey in operations.permissionsChanges[accountPubKey]) {
+                    for (const [certificateOrAccountKey, changes] of Object.entries(operations.permissionsChanges)) {
+                        pendingOperations.permissionsChanges[certificateOrAccountKey] = {
+                            principal: (() => {
+                                if (typeof changes.principal === 'string') {
+                                    return (account_1.Account.toAccount(changes.principal));
+                                }
+                                else {
+                                    return ({
+                                        usingCertificate: true,
+                                        certificate: new certificate_1.Certificate.Hash(changes.principal.certificate),
+                                        certificateAccount: account_1.Account.toAccount(changes.principal.certificateAccount)
+                                    });
+                                }
+                            })(),
+                            targets: {}
+                        };
+                        for (const targetPubKey in changes.targets) {
                             const updateArray = [];
-                            for (const { method, permissions } of operations.permissionsChanges[accountPubKey][targetPubKey]) {
+                            for (const { method, permissions } of changes.targets[targetPubKey]) {
                                 updateArray.push({ method, permissions: permissions_1.Permissions.FromAcceptedTypes(permissions) });
                             }
-                            pendingOperations.permissionsChanges[accountPubKey][targetPubKey] = updateArray;
+                            pendingOperations.permissionsChanges[certificateOrAccountKey].targets[targetPubKey] = updateArray;
                         }
                     }
                 }
@@ -57802,9 +57816,9 @@ class UserClientBuilder {
                     amount: amount
                 });
             }
-            for (const principalPubKey in pending.permissionsChanges) {
-                for (const targetPubKey in pending.permissionsChanges[principalPubKey]) {
-                    for (const change of pending.permissionsChanges[principalPubKey][targetPubKey]) {
+            for (const { targets, principal } of Object.values(pending.permissionsChanges ?? {})) {
+                for (const targetPubKey in targets) {
+                    for (const change of targets[targetPubKey]) {
                         const { method, permissions } = change;
                         let target;
                         if (!account.comparePublicKey(targetPubKey)) {
@@ -57812,7 +57826,18 @@ class UserClientBuilder {
                         }
                         operations.push({
                             type: block_1.Block.OperationType.MODIFY_PERMISSIONS,
-                            principal: account_1.Account.fromPublicKeyString(principalPubKey),
+                            principal: (() => {
+                                if (account_1.Account.isInstance(principal)) {
+                                    return (principal);
+                                }
+                                else {
+                                    return ({
+                                        usingCertificate: true,
+                                        certificateHash: principal.certificate,
+                                        certificateAccount: principal.certificateAccount
+                                    });
+                                }
+                            })(),
                             target: target,
                             method: method,
                             permissions: permissions
@@ -57860,18 +57885,24 @@ class UserClientBuilder {
     updatePermissions(principal, permissions, target, method, options = {}) {
         __classPrivateFieldGet(this, _UserClientBuilder_instances, "m", _UserClientBuilder_useOptions).call(this, options);
         method = method ?? block_1.Block.AdjustMethod.SET;
-        const principalPubKey = principal.publicKeyString.get();
-        const targetPubKey = (target ?? __classPrivateFieldGet(this, _UserClientBuilder_pendingOptions, "f").account).publicKeyString.get();
+        let principalKey;
+        if (typeof principal === 'string' || account_1.Account.isInstance(principal)) {
+            principalKey = account_1.Account.toAccount(principal).publicKeyString.get();
+        }
+        else {
+            principalKey = principal.certificate.toString();
+        }
         if (!__classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges) {
             __classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges = {};
         }
-        if (!__classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalPubKey]) {
-            __classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalPubKey] = {};
+        if (!__classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalKey]) {
+            __classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalKey] = { principal, targets: {} };
         }
-        if (!__classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalPubKey][targetPubKey]) {
-            __classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalPubKey][targetPubKey] = [];
+        const targetPubKey = (target ?? __classPrivateFieldGet(this, _UserClientBuilder_pendingOptions, "f").account).publicKeyString.get();
+        if (!__classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalKey].targets[targetPubKey]) {
+            __classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalKey].targets[targetPubKey] = [];
         }
-        __classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalPubKey][targetPubKey].push({
+        __classPrivateFieldGet(this, _UserClientBuilder_pendingOperations, "f").permissionsChanges[principalKey].targets[targetPubKey].push({
             method: method,
             permissions: permissions_1.Permissions.FromAcceptedTypes(permissions)
         });
@@ -60563,7 +60594,14 @@ class UserClient {
      */
     async updatePermissions(principal, permissions, target, method, options = {}) {
         const builder = this.initBuilder(options);
-        builder.updatePermissions(account_1.default.toAccount(principal), permissions, account_1.default.toAccount(target), method, options);
+        let principalValue;
+        if (typeof principal === 'string' || account_1.default.isInstance(principal)) {
+            principalValue = account_1.default.toAccount(principal);
+        }
+        else {
+            principalValue = principal;
+        }
+        builder.updatePermissions(principalValue, permissions, account_1.default.toAccount(target), method, options);
         return (await this.publishBuilder(builder));
     }
     /**
@@ -76618,7 +76656,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-var _CertificateBuilder_params, _CertificateBuilder_caPathLen, _CertificateBundle_raw, _CertificateBundle_contents, _Certificate_instances, _Certificate_raw, _Certificate_hash, _Certificate_extensionsRaw, _Certificate_extensionsProcessed, _Certificate_finalizeConstructionCalled, _Certificate_isSelfSigned, _Certificate_processExtensionsInternal, _Certificate_processBaseExtensions, _Certificate_parseKeyUsage, _Certificate_processBaseExtension, _Certificate_assertAllCriticalExtensionsProcessed, _Certificate_checkValid, _Certificate_checkIssued;
+var _CertificateBuilder_params, _CertificateBuilder_caPathLen, _CertificateBundle_raw, _CertificateBundle_contents, _Certificate_instances, _Certificate_raw, _Certificate_hash, _Certificate_extensionsRaw, _Certificate_extensionsProcessed, _Certificate_finalizeConstructionCalled, _Certificate_isSelfSigned, _Certificate_processExtensionsInternal, _Certificate_processBaseExtensions, _Certificate_parseKeyUsage, _Certificate_processBaseExtension, _Certificate_assertAllCriticalExtensionsProcessed, _Certificate_checkValid, _Certificate_checkIssued, _Certificate_computeHash;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.Certificate = exports.CertificateBundle = exports.CertificateHash = exports.CertificateBuilder = void 0;
 const ASN1 = __importStar(__webpack_require__(6045));
@@ -77598,7 +77636,18 @@ class Certificate {
             }
         }
     }
-    verifyChain(store, _ignore_seenCerts /* XXX:TODO */) {
+    verifyChain(store, seenHashes = new CertificateHash.Set()) {
+        /**
+         * Loop detection: reject any certificate already on the current
+         * verification path, per RFC 4158 Section 2.4.1 (no certificate may
+         * repeat in a path) and Section 5.2 (detection guidance).
+         *
+         * @see {@link https://datatracker.ietf.org/doc/html/rfc4158#section-5.2 RFC 4158 Section 5.2}
+         * @see {@link https://datatracker.ietf.org/doc/html/rfc4158#section-2.4.1 RFC 4158 Section 2.4.1}
+         */
+        if (seenHashes.has(__classPrivateFieldGet(this, _Certificate_instances, "m", _Certificate_computeHash).call(this))) {
+            return (null);
+        }
         /*
          * Check to see if the certificate is signed by any of the Root CAs
          */
@@ -77629,6 +77678,8 @@ class Certificate {
          * Check to see if the certificate is signed by any of the specified intermediates
          */
         if (store.intermediate !== undefined) {
+            const nextSeen = new CertificateHash.Set(seenHashes);
+            nextSeen.add(__classPrivateFieldGet(this, _Certificate_instances, "m", _Certificate_computeHash).call(this));
             store.intermediate.forEach((intermediateCertificate) => {
                 if (retval !== null) {
                     return;
@@ -77636,7 +77687,7 @@ class Certificate {
                 const checkIssued = __classPrivateFieldGet(this, _Certificate_instances, "m", _Certificate_checkIssued).call(this, intermediateCertificate);
                 if (checkIssued.issued) {
                     if (intermediateCertificate.checkValid(this.moment)) {
-                        const moreChain = intermediateCertificate.verifyChain(store, undefined /* seenCerts XXX:TODO */);
+                        const moreChain = intermediateCertificate.verifyChain(store, nextSeen);
                         if (moreChain !== null) {
                             const checkRetval = [...moreChain, intermediateCertificate];
                             const validChain = Certificate.verifyChainDepth([...checkRetval, this]);
@@ -77792,10 +77843,7 @@ class Certificate {
      */
     hash() {
         this.assertConstructed();
-        if (!__classPrivateFieldGet(this, _Certificate_hash, "f")) {
-            __classPrivateFieldSet(this, _Certificate_hash, CertificateHash.fromData(Buffer.from(__classPrivateFieldGet(this, _Certificate_raw, "f"))), "f");
-        }
-        return (__classPrivateFieldGet(this, _Certificate_hash, "f"));
+        return (__classPrivateFieldGet(this, _Certificate_instances, "m", _Certificate_computeHash).call(this));
     }
     /**
      * Get a JSON representation of the certificate
@@ -78033,6 +78081,11 @@ _Certificate_raw = new WeakMap(), _Certificate_hash = new WeakMap(), _Certificat
         return ({ issued: false, reason: 'Signature verification failed' });
     }
     return ({ issued: true });
+}, _Certificate_computeHash = function _Certificate_computeHash() {
+    if (!__classPrivateFieldGet(this, _Certificate_hash, "f")) {
+        __classPrivateFieldSet(this, _Certificate_hash, CertificateHash.fromData(Buffer.from(__classPrivateFieldGet(this, _Certificate_raw, "f"))), "f");
+    }
+    return (__classPrivateFieldGet(this, _Certificate_hash, "f"));
 };
 /**
  * The Certificate Builder
@@ -81230,7 +81283,7 @@ exports.Testing = { findRDN, blockHashesFromVote, feeFromVote, hashDataSchema, f
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.version = void 0;
-exports.version = '0.18.0+g5417d9af948be899fcebb75694edb492ff971891';
+exports.version = '0.18.1+gae2caf00c1e19c6d232ff1a37b9fd8e7ea8a1ddc';
 exports["default"] = exports.version;
 
 

package/docs/assets/hierarchy.js

@@ -1 +1 @@
-window.hierarchyData = "eJy1m2tz2zYWhv+LPqNeArz7mywzrda2rCWV7HQ6Hg0twTI3NKkloTaeTv77zoEomeBFBgHuF7WTBO95cAfOC/49KfKclZPrPzBxiYmwaRkEYdP0bYRNxzEQJp6LEcau68P/e/C3tmshbGLTQY5NPPhjYsM/8Q2ETWKAjG2BgG1YCBPLgKKW78O/4QIeD+LY8C+x6yKPuARh4rg+srHtIcdzPOT6hvOEJgV9SemGJXlWTq7/nhDfJ/DfLH6jk+vJt5zRiMX7lE7Q5HuSbSfXmHhocijSyfVkk8ZlSct/3FHK4gVl0e3dVUhfaEGzDd1efRS+emVv6QQdC0yuJ6zc/gJqvxz/4CeamLblN+L+65Az1bC8rERU17QbURUDSsTyCa7FuknzzXeFYLzc59Es2zea0X6Ly1fViFBWIqpj1dtzeXhOk/L1cX8cXqfQxHZOoZOM0eIl3vRHFzV6Ec5CgGEbdr3yM1qw5CXZxIwqNkFD4fOGsA3fbQwsnS4QyktEx7ZXi/61pMUsTWjGtHqiJSPRGWiyeU3SbUGzyfUfMDqQjR33iTM6bifjLM9ekp0u4lFFcrgQbNVQFpT9lRffp5tNfsjYPHvJ1WDaOpI4Nq4vhQ+HlCVRsptvaQaDkBazgsaMTovd4Y1mTLE3P5WVhRW68RQsKIq8UBjoQnmJge5a9YF+n+8UYt7n/ePkHMkx7PrqHbG41vDysXg5iWjYcmrRptECP85v1Tq6LDbrNHleH1iSluu4zPBVpSfXww4WdmYoG1E2KktEmSyLbTVYbhIWsSLJFFeMHqKzqjSX1+C6jWtniTGQQFCWxiHNHhu/iYa1j9MczxErDpuRhxGXlCSySb3Hbg4vL7SIWF7EO5UjoEj0zNWuBNFPJr24Udq+geAQg+AcgVzXMZGHHQ9hTHwXYbhAwFUAbg4m8eG2YJrwa9km7K1wvu86fdwcsq3ySb6mMKQucKEAJhd7wtEwL8vkOX0PfuyTgm4VT94dKkPY4PjP2VzH7Lz0aBzXPgQ+X+7hKtaIf598pzdxqdpZp+KDWsO2fATdBE3iGT7uuo/dHJJ0S1W29qbE580CQ77BoNEhcl3hEaM1dbSqLF9b4pKOCfI1K5NdRreq98VOnUHDwicYYYNYfBp7vm8375WPe1rEcCOIgsWt6gVTEPm8tXxDOJU0JVbrMFiOgMJ1ZGg85yLNfPHlcRQcEJLgEc+PoszD4+38y+/rZRA+zKNo/riItMnakhKMBJNexlkYTFfBen4bLFbzL/Mg1EZsKcoQeq2MzVlv9XgXLNbT24f5Yh19XS7vf9dGbEtKMJrElWKsuuhmej9dzIJRWUVpGWa3f+6GwSyYf9MHrHQkaKwLK8nDdDH9NVjPghAGzWy60gdrS37OyJfferZEc1MYshnw8D6uH5DgZFG/Aw5oimNJqZDClSr4wWiRxala2FppqdBC8u5U+I6+L+NE5RzQUJBAwIZVX3qC2W00jYLZktjOHdYA6dKRwcFGffgFtwSSVBocgoAUgDBJP5JW6gwtDSkM3+nplnCkbgmHdAsRB6rQuzxxvrmj79rj5Kwkg2Safm8LjYUUDkQStvFq7GmxNCRkICxi9ndVkfwZMzpKX52lpKCcPqhwPKhwIJRtmB3dpUXT1JDCsMy+FUd3tZEKL/h3YidHyS6L2aFQyQ70KMkgOWYfUjgaUjgQyTXaY0WLpSEhA+GaQrr16PdMZ/dh/pdaflOQkMtnAkX9vFRzLHVIWjLSNI7VODB+zABtZ61XbqgjCc4fJE9deE1h8rcTpuc/HWsgXlKEkKM4cBclB9fExidurz4auc1XJjsdV1XU0CATljTB6lNMdbY0hiS2wLpEGHsY3t94pgO/Dj6iehh3oN7T7Y4Wut5mTUVmdfFMpxcFEozj4JyVpJCc/taZb+nbPmc0Y3f0fRy2tqQEJLGM+mg7KlVezKqIszLmj54UB94lOTm4+uJyn+92tQTzoMl5LDt4UrqW93QkcRokq7jYUXg/UeZKXlFTQqo5/E4I5RY5Fh/aKLwxjq3iCIs/d+2XNNvWPdSBpn9VfMgCBW8OjjiucHng9v3zf6iqffpRfmgLwbsEBA8CEDjx8OMhcJvhx0HAacOvaZyw7QZ28GOfJpsExgajP9gqVtySurUkDycA2OCav43H1daS5fKE9oL5wx3tXHFpqAkMnwreqRM9obH+nbDXeTnPShZnG8UHDqKGdOMIb/rmWcKSOD0eSaLDfp++q8F0CEkTubhxQvyVZie7QeO81aWk0IH2qQOFAyGI67maDYUhKxq4yggsVk5mim+qeDL6n9HjottPHNaEnVpDGxHMzhNpy2VpqIuOozbsZeOxhxdM0YrXab3+bQUQPMkRgC9ak73EnnMibjmWQoQLrqUm+wDzsq8W2DrVwm15mkKsfl9TsxLy9mZfHQgmVR3arqcQ6oLzqVmJAQZoby08fKpF651Cb6web3TE2khapH21Molb1ar9ql+I2XRPNavwmYnay+ue1iH/8rp5wV/VndXyNmtfLazTaorN/tcU2n7woP3T920EqzyChRPBuoNg4iIY9wiGCYK2RzV0t94BS1q8JWUJCzZlv+WKB4AOlSGV4G4y4gbvkZEICf87+j6vdcjw1MFH8YFU/Gklhm+nwG6Ep5XmiVDIrfJ8tabbJ2fyiYRgCiPuQVZUwvnz7EY1X7EO/9ympjL43Fl/oQrOG+JOSgXsW2JHqz+4lSDsbMIjkQXf4oH7hbjdVGc0zTrj2QdQJ21KDOOFl8DceUHc7KgY3fretsq/00w7p95UkbwEQda8I92sjdMhJE8k5m54q2sDtXWkecQXk3Gp5ch8lB8+NV0T1jb3tKpZRvNiOIozo+HHcN8IPl3FBv/lX8mSatRbdsOQ/UgKqxmyH+UlcpTwsa1kPlnrKzsJYYW8plG1oS1sZEuyXFJa3Cclg3SD4o4hisjOClt44HT3LaKnzwpX73vFzaupIs9iCyw8+ZJsRuBpKw3uPGipqvNc6+Jheqyj83BEw4YvUQzbRTz1wH8dxK/DiF8o+S/MZoN/xG741X3GEUyaxju5L4fs+GE6pOXygpVBtine9+pVldeXHTmO8OFGn/4i/3+R15WlmXHrGcf6/CBEewfo15Pns/v4wpH5QiU+0vHmRJ+rpSPNI35zf1yOQ7oXrE2VJb3SkOYQ9udKQxtCkqC5Zpoe4i1TLTNiOjQuad+EUj/29CkOh3cMfvoxqmueJxzTFoc32FG+xemBBhkrFG2PlsxwTM+sFnGP1BfBh3ybvLzz68RNnILDo4HZIyY7JD3hZVZI/3ugJeNqId3Q5E8dtD41eTa3eYmrOkUDqiWj0K0Edm7PJE8/f/78H8/MMg8="
+window.hierarchyData = "eJy1nGtzozgWhv+LP2t6ESAQ+eY49Iw3ieM16d6amupyEVtx2HbAC/JMp6b6v28dgR3ExRES+4VOpVvveXRBl/OK/nuSZxkvJld/YNt3MMKOiwPxtBF2PN9H2KZ+gDD2Aww/BxbCDoGfHUwc5BHHhV87DsKYWlDItsU/8eBnYkMhF4MMsXwh4yLsUBHE8+Ff4sBF1KYg41EfEUwo8qjvIj/A9Bua5Ox5zzY8ydJicvX3xA4CG/5M41c2uZp8zTiLeHzYswmafE/S7eQK2xRNjvl+cjXZ7OOiYMU/bhnj8YLx6Ob204o9s5ylG7b99F740wt/3U9QWWByNeHF9hdQ+6X8xU80cYgbNOL+65hx3bCirEJU3yGNqJoBFWIFNq7Fut5nm+8awUS5j6O5JLCa0X6LixfdiFBWIarn1ttzeXzaJ8XLw6EcXqfQNvFOoZOUs/w53vRHlzV6Ec5CgEEsUq/8jOU8eU42MWeaTdBQ+LghiBX4jYFl0gVSeYXomNBa9C8Fy2f7hKXcqCdaMgqdgSabl2S/zVk6ufoDRgci2PO/CUbP72ScZelzsjNFLFUUh4uN3RrKgvG/svz7dLPJjimfp8+ZHkxbRxGHSBPF/XHPkyjZzbcshUHI8lnOYs6m+e74ylKu2ZsfyqrC+k4N9hQszPMs1xjoUnmFge6Tes/dZTuNmHdZ/zg5R/IsUh+uEY9rDa8eS5RTiIZJfRWeRgv8ML/R6+gi36z3ydP6yJN9sY6LFH+q9NR62MOENFgixkdliRhXZfGsBst1wiOeJ6nmjNFDdFZV5nIbXDdxbS8xBhIIKtPQZo+N30TD2sdvjueI58fNyMNISCoSEafeY9fH52eWRzzL453OFlAmehJqnyTRD156eaEkgYVgE4NgH4F83wsQxdRCGDsWnBYcAicEm1KEHQfDz+VvXN+CtRX29127j+tjutXeydcUhtQFDhTA5OOgvqots6JInvZv4Y9DkrOt5s67Q2UIG2z/BZvvNQ8f5bnFYLv2LvDxdA9HsUb8u+Q7u44L3c46FR/UGsQNEHQTNAnFltN1Hrs+Jvst01namxIfNwsM+QaDQYeodQW17WZMsyqr19ambscL8iUtkl3KtrrnxU6dQcMigCyDZRMXxkVgWX7zXPlwYHkMJ4IoXNzoHjAlkY9bK7C81mm6JvG4XoXLEVCEjgpNQC/SzBefH0bBASEFHvkAKMvcP9zMP/++Xoar+3kUzR8WkTFZW1KB0bbdXsbZKpw+huv5Tbh4nH+ehytjxJaiCmHg9BI+PtyGi/X05n6+WEdflsu7340R25IKjI4TKDFWXXQ9vZsuZuGorLK0CnPQ/+6uwlk4/2oOWOko0LgXZpL76WL6a7iehSsYNLPpozlYW/JjRjH91rMlhovCkMVAhA/s+hkQdhb1M+CApihLKoX06wtx+IOzPI33emFrpRVCY8sKOkLfsrdlnOjsAxoKSgikPvWEs5toGoWzpU28W2wA0qWjgoOlDFl4YxOCAwMOSUAJQHpJ35NW+gwtDRUM26I93bIaqVtWQ7rFkQeq1Lsicb65ZW/G4+SspIREcG8LjYW0GogkLePV2DNiaUioQLiS09Ro4Dz5M+ZslL46SylB+X1Qq/GgVgOhCCYd3WVE09RQwpDSntJsYTrbqIT3LLt3vETJLo35MdfJDvQoKSG5fUir0ZBWA5Go3R4rRiwNCRUI35WSv6XfM53drbK/9PKbkoRaPhNjv8/zNCFpySjT+F5jw/j+Bhg7a71yQx1JcP4geRrY4imuZljet7IG8iFFCjmKA3dRcnBNiI1P3PXRKGy+ItmZuKqyhj4ZlaY0yerTTHW2NIYktsC6hGs1tni6FJ6+U6HaXa7mHdvuWG7qbdZUVGYX6tJeFEgwjoNzVlJC6vR8S6H5lr0eMs5SfsvexmFrSypA2q60VS+VKi/mMY/TIhaXnjQH3iU5JThcz6LeZbtdLcE86OUsyw5+Kf0ynYtt12+QPMb5jsH9iSLT8oqaEirNQaxOCO0WKYsPbRTRGGWreLTl9i9Zuq17qANN/6r4kAkK7hyUOL5TX4uEff/0H6Zrn76XH9pCcC8BwYUABE48PFx4UAQGLwJORzzpCdtpYIc/Dvtkk8DY4OwHf4w1l6RuLcXNCQA2uOav43G1tVS5qNRe8P4IRzvTnBpqAsNfBXrqRCo11r8T/jIv5mnB43SjecFB1lBuHMnSmKcJT+J9uSWJjofD/k0PpkNImcgPGjvEX1l6shsM9ltdShodSE4dKN8EjQtm5mo2FIbMaOAqI7BYBZljeS2X6p/Rw6LbTxzWhJ1aQxsRzM6K1G95VQ112XE0hr1sPPbyevjE23JpWwEkT3IE4IvWZC9xQCti2vLapAgXXEtD9gHmZV8tMDnXouXGSbH6fU3DSqjbm311sG23qkPby5ZCXXA+DSsxwADtrUVQnuAcLB02L8fq8UZHrI2iRdpXK8cJTrW6/F433VPDKnxkovbyBtU8JPtGHe9ev79q+lar26x9tXBPsykm/fcAjP3gIesnLEgIZnkEEyeCeQfBi4tg3CMYJgjaHtXQpWzQkuWvSVHAhM34b5nmBqBDZUglhJuMhMFbMspXrm7Z27zWIcNTB+/FB1GB64uE04mE3QgXLAmpCEnLJzF0+9RMviYhgVSVbVWLjU3rE/XZjWreYh3+uU1NZfC+s35DFZw3JJyUEtjBWO5o/Qu3CoSdTVgSuQ5Bwv1Cwm6SGCX/8uwD6JM2JYbxevDRHzgvSJgdFaP0jd5j9p2lxjn1poriIQiy5h3pZmOcDiFVItfypNyNaHVjoLaOMg+2G+cvE0fmvfzwV9N3YW7zSTXvurh5fh3FmTHwY4RvBJ+u2j48HfGVrFOdwVzpQpCUFNYzZN/LK+QoHfmrrEsJYKOv7BSENfKapyVDNrWX9nLJWH6XFBzSDZorhiyi+lYQKZ1z+zVip88KH98OmotXU0WZxZOMqa8i+ZJsRuBpKw3uPGipqvPa1yalLe9YW+fhiJYHX6JYviue8O5a1BFPsFRhqyoOZOIJf4txddb0JB+kcU/u8zEtP0yHtFyW8yJMN/nbQb+q6vqqI8eTfMI+/UX2/yKvK6sz+83N7Pp8IcR4BejXU+ZzWtdM1ufbIePyrfT4pPYrL4yYc7V0lHmk2auajlfsIFmbOlN6paHMIa3PlYYxhCJBa84kSLRMNc3I6dC4YH0vlP62p09xOLyHxe7HrjJZVNqmLY6vsKJ8jfdHFqY817Q9WjLDMWllITvUrU+C99k2eX4Tx4nreA8OjwFmj5jqkKTSfyqyYv89soILtRXbsORPE7Q+NWU26Ua/kKk6xQCqJaPRrS6s3NQNvv38+fN/Qvwx7A=="