@kokuin/controller 0.1.0 → 0.2.0

package/lib/state.js

@@ -1,34 +1,29 @@
-import { foldLog, foldLogAsync } from './fold.js';
-/**
- * Fold results to states, turning a fold failure into a throw. The identity and the resolver both
- * need the same fold-reject-take-last sequence, sync and async, so it lives here once. `context`
- * names the caller so its diagnostics survive the factoring.
- */ function foldedStates(did, context, result) {
+import { foldLog } from './fold.js';
+import { isControllerLog, MALFORMED_LOG } from './log.js';
+/** The fold's last state, turning a fold failure into a throw. `context` names the caller. */ function lastState(did, context, result) {
     if (!result.ok) {
         throw new Error(`${context}: invalid log for ${did}: ${result.reason} at event ${result.index}`);
     }
-    return result.states;
-}
-function lastState(did, context, result) {
-    const states = foldedStates(did, context, result);
-    return states[states.length - 1];
-}
-/**
- * Current state via the synchronous {@link foldLog}. A capability-authorised revoke fails closed
- * here — see {@link currentStateAsync}.
- */ export function currentState(did, events, context) {
-    return lastState(did, context, foldLog(did, events));
-}
-/**
- * Every per-position state, via {@link foldLogAsync}. What the resolver needs and the identity does
- * not: a verifier has to answer about keys the log has since rotated away, since a token outlives the
- * state that gave its `kid` meaning.
- */ export async function allStatesAsync({ did, events, context, options }) {
-    return foldedStates(did, context, await foldLogAsync(did, events, options));
+    const last = result.states[result.states.length - 1];
+    if (last === undefined) {
+        throw new Error(`${context}: no state produced for ${did}`);
+    }
+    return last;
 }
 /**
- * Current state via {@link foldLogAsync}, which can await `options.verifyCapability` for a
- * capability-authorised revoke instead of failing closed on it.
- */ export async function currentStateAsync({ did, events, context, options }) {
-    return lastState(did, context, await foldLogAsync(did, events, options));
+ * The root key state a log establishes: the chain's last state.
+ *
+ * The chain alone, deliberately. Epoch events never change a root key (`k`, `ka`, `n` and the
+ * derivation indices live on the chain only), so folding them would buy an identity nothing but up
+ * to `MAX_EPOCH_EVENTS` signature checks on a path that must stay synchronous and cheap. The returned
+ * state's `deny`, `members` and `saturated` are therefore the chain's, not the live ones; nothing
+ * that builds an identity reads them.
+ */ export function currentState(did, log, context) {
+    if (!isControllerLog(log)) {
+        throw new Error(`${context}: invalid log for ${did}: ${MALFORMED_LOG} at event 0`);
+    }
+    return lastState(did, context, foldLog(did, {
+        chain: log.chain,
+        events: []
+    }));
 }

package/lib/supersede.d.ts

@@ -1,5 +1,4 @@
-import { type SignedEvent } from './events.js';
-import { type FoldOptions, type FoldResult } from './fold.js';
+import type { SignedEvent } from './events.js';
 export type Duplicity = {
     /** Position of the divergence, from the folded state of the first conflicting event. */
     gen: number;
@@ -16,82 +15,42 @@ export type Duplicity = {
  * - `duplicity` — two events the controller cannot both have authored at one position. The only one
  *   that says anything is wrong with the log.
  * - `no-valid-branch` — nothing presented folded at all.
- * - `needs-capability-verification` — **every** branch carries a capability-authorised revoke this
- *   call was not equipped to check, so there is nothing left to compare. The log is fine; use
- *   {@link resolveBranchesAsync} with a `verifyCapability`. A call where only *some* branches are
- *   unverifiable answers with the rest and reports the count as {@link ResolveResult.unverified}.
  *
- * Added rather than swapped in: `duplicity` still carries the `gen: -1` sentinel for the two
- * non-duplicity arms, so a caller written against the previous shape still tells them apart.
- */
-export type ResolveFailure = 'duplicity' | 'no-valid-branch' | 'needs-capability-verification';
-/**
- * How many presented branches this call could not check, and therefore did not compare.
- *
- * Non-zero means the answer is **provisional**: an unfoldable branch may have superseded the one
- * reported, so a caller acting on a winner must re-resolve through {@link resolveBranchesAsync} with
- * a `verifyCapability` or treat the result as unconfirmed. Zero for every correctly configured call.
- *
- * Reported rather than fatal because the alternative is an unauthenticated DoS on duplicity
- * detection. A cap-bearing revoke reaches the verifier path *before* any signature check (the
- * capability names the signer), so a keyless peer can copy the public inception, append a `rev` with
- * `sigs: []` and arbitrary `cap` bytes, and present it — and refusing the whole resolution on that
- * would turn a genuine duplicity report between two honest branches into a refusal, for every
- * profile. Dropping such a branch cannot hand an attacker a win (a branch that does not fold is not a
- * contender); the only exposure left is a *stale* answer, which this count marks.
+ * `duplicity` still carries the `gen: -1` sentinel for the non-duplicity arm, so a caller tells them
+ * apart.
  */
+export type ResolveFailure = 'duplicity' | 'no-valid-branch';
 export type ResolveResult = {
     ok: true;
     winner: Array<SignedEvent>;
     superseded: number;
-    unverified: number;
 } | {
     ok: false;
     failure: ResolveFailure;
     duplicity: Duplicity;
-    unverified: number;
 };
 /**
- * Whether a branch failed to fold only because this call could not check a capability. Filtering such
- * a branch out as invalid is what switched duplicity detection off for the management tier — a
- * `cap`-bearing revoke is the tier working as designed, not a forgery. Matched by prefix against the
- * fold's exported reasons, the contract those constants exist for.
- */
-export declare function needsCapabilityVerification(result: FoldResult): boolean;
-/**
- * Pick the authoritative branch. Two rules, in order:
+ * Pick the authoritative root chain among `chains` — chains only: epoch events never fork the log, so
+ * they are never a branch to choose between (see `mergeLogs` in `log.ts`). Two rules, in order:
  *
  * 1. The highest folded generation wins outright. Only a reset raises the generation, and only the
  *    committed recovery key can author a reset — the root's override, unreachable by a thief.
- * 2. Within that generation, branches are compared **at the point they diverge**, not at their heads:
- *    a rotate signed by the pre-committed next keys supersedes the current-key event it forked from
- *    and everything that branch accumulated. Two diverging events with no rotate to settle them are
- *    duplicity, surfaced rather than merged.
- *
- * Comparing heads instead would make branch *length* decisive below the top generation — the one
- * resource a thief has in abundance (a stolen current key cannot rotate but can sign unlimited
- * revokes). A longer branch still wins when it is the same history carried further, which the
- * divergence walk sees as a prefix.
- *
- * `superseded` counts the state-advancing events discarded from losing branches (what a cache must
+ * 2. Within that generation, chains are compared **at the point they diverge**, not at their heads. A
+ *    chain that ends at the divergence point is a prefix of the other and loses to it; two chains
+ *    that each carry an event there are duplicity, surfaced rather than merged.
+ *
+ * With root adds and root revokes moved into epochs, the chain holds only `icp` and `rot`, so the
+ * second case is always two rotates, or two resets at one generation — both signed by keys only the
+ * controller holds, neither outranking the other, and settled only by a reset at a higher generation.
+ * The current-key event a cold rotate outranks still exists, but in the epoch that rotate closes,
+ * where the fold gives it no effect; branch selection never sees it. That is also why chain length
+ * never decides anything here: the one resource a thief holding a current key has in abundance is
+ * current-key events, and none of them is on the chain. A longer chain still wins when it is the same
+ * history carried further, which the divergence walk sees as a prefix.
+ *
+ * `superseded` counts the state-advancing events discarded from losing chains (what a cache must
  * invalidate — folded state is not append-only under supersession); skipped events are not counted.
- * Branches that do not fold are filtered out before comparison, so a thief who cannot produce a valid
+ * Chains that do not fold are filtered out before comparison, so a thief who cannot produce a valid
  * event cannot create a duplicity report.
- *
- * This form folds synchronously and cannot check a capability-authorised revoke: such a branch is
- * counted in {@link ResolveResult.unverified} and left out, and only a call where *every* branch is
- * one answers `failure: 'needs-capability-verification'`. See {@link ResolveResult.unverified} for
- * why the count is reported rather than fatal; the remedy is {@link resolveBranchesAsync} with a
- * verifier.
- */
-export declare function resolveBranches(did: string, branches: Array<Array<SignedEvent>>): ResolveResult;
-/**
- * Async counterpart of {@link resolveBranches}, and the form the management tier needs — the sync
- * fold fails closed on a capability-authorised revoke, so resolving through it would filter every
- * branch of such a log away as invalid and report "no valid history" for a healthy profile.
- *
- * Branches are folded one at a time: `verifyCapability` is caller-supplied code that may do I/O, and
- * branch counts in a duplicity report are small, so there is nothing to win against calling a
- * caller's verifier concurrently.
  */
-export declare function resolveBranchesAsync(did: string, branches: Array<Array<SignedEvent>>, options?: FoldOptions): Promise<ResolveResult>;
+export declare function resolveBranches(did: string, chains: Array<Array<SignedEvent>>): ResolveResult;

package/lib/supersede.js

@@ -1,6 +1,12 @@
 import { digestOf } from './canonical.js';
-import { verifyRotate } from './events.js';
-import { CAPABILITY_REVOKE_NEEDS_ASYNC_FOLD, CAPABILITY_REVOKE_NEEDS_VERIFIER, foldLog, foldLogAsync } from './fold.js';
+import { foldLog } from './fold.js';
+/** Index into an array whose element is a branch-resolution invariant, throwing rather than reading undefined. */ function required(items, index, what) {
+    const item = items[index];
+    if (item === undefined) {
+        throw new Error(`supersede: ${what}`);
+    }
+    return item;
+}
 /**
  * The position reported for a failure that is not a fork. Real comparisons never reach `gen < 0` and
  * a real digest is never the empty string — how a caller told these from duplicity before
@@ -14,26 +20,11 @@ import { CAPABILITY_REVOKE_NEEDS_ASYNC_FOLD, CAPABILITY_REVOKE_NEEDS_VERIFIER, f
     ]
 };
 function headState({ states }) {
-    return states[states.length - 1];
+    return required(states, states.length - 1, 'folded branch has no state');
 }
 /** The digest of the `j`th event on the spine — the whole history up to it, chained. */ function spineDigest(folded, j) {
-    return folded.states[folded.spine[j]].digest;
-}
-/**
- * Whether a branch failed to fold only because this call could not check a capability. Filtering such
- * a branch out as invalid is what switched duplicity detection off for the management tier — a
- * `cap`-bearing revoke is the tier working as designed, not a forgery. Matched by prefix against the
- * fold's exported reasons, the contract those constants exist for.
- */ export function needsCapabilityVerification(result) {
-    return !result.ok && (result.reason.startsWith(CAPABILITY_REVOKE_NEEDS_ASYNC_FOLD) || result.reason.startsWith(CAPABILITY_REVOKE_NEEDS_VERIFIER));
-}
-function allUnverified(unverified) {
-    return {
-        ok: false,
-        failure: 'needs-capability-verification',
-        duplicity: NO_POSITION,
-        unverified
-    };
+    const index = required(folded.spine, j, 'spine index out of range');
+    return required(folded.states, index, 'spine points past folded state').digest;
 }
 function branchFrom(branch, result) {
     if (!result.ok) {
@@ -46,7 +37,7 @@ function branchFrom(branch, result) {
     for(let i = 1; i < states.length; i++){
         // A skipped event is the only one that leaves the digest where it was; every other chains its
         // predecessor's digest into its body, so no two can agree.
-        if (states[i].digest !== states[i - 1].digest) {
+        if (required(states, i, 'state gap').digest !== required(states, i - 1, 'state gap').digest) {
             spine.push(i);
         }
     }
@@ -63,11 +54,11 @@ function branchFrom(branch, result) {
     if (candidate.branch.length !== incumbent.branch.length) {
         return candidate.branch.length < incumbent.branch.length;
     }
-    return digestOf(candidate.branch[candidate.branch.length - 1].event) < digestOf(incumbent.branch[incumbent.branch.length - 1].event);
+    return digestOf(required(candidate.branch, candidate.branch.length - 1, 'empty branch').event) < digestOf(required(incumbent.branch, incumbent.branch.length - 1, 'empty branch').event);
 }
 /**
- * How far two branches agree, in spine entries. Zero is unreachable for branches of one log (they
- * share an inception), so a common prefix of 1 means they forked immediately after it.
+ * How far two branches agree, in spine entries. Zero means they disagree on their first entry: on
+ * spines trimmed to the top generation, two different resets opening it.
  */ function commonSpine(a, b) {
     const shortest = Math.min(a.spine.length, b.spine.length);
     let j = 0;
@@ -77,36 +68,23 @@ function branchFrom(branch, result) {
     return j;
 }
 /**
- * Does `candidate` supersede `incumbent` at the point their branches diverge? Per KERI, a rotate
- * signed by the pre-committed next keys outranks any current-key operation — at the diverging
- * position *and* over everything after it on the losing branch. That is what makes the owner win the
- * race against a thief holding a current key regardless of who published first or how far ahead: a
- * stolen current key cannot rotate but can sign revokes all day, so length must not decide this.
- */ function supersedes({ candidate, incumbent, priorDigest, priorNext }) {
-    if (candidate.event.t !== 'rot') {
-        return false;
-    }
-    if (incumbent.event.t === 'rot') {
-        return false;
-    }
-    return verifyRotate(candidate, {
-        digest: priorDigest,
-        n: priorNext
-    });
-}
-/**
- * Walk the contenders down to one, deciding at each divergence point rather than at the heads. Every
- * step resolves the *whole* surviving group at once: with three or more contenders, a sequential
- * pairwise reduction could compare two losing branches before reaching the one that supersedes both,
- * reporting duplicity between the losers and making the outcome depend on presentation order. The
- * group shrinks strictly each iteration, so this terminates.
+ * Walk the contenders down to one, deciding at each divergence point rather than at the heads. A
+ * contender ending at the divergence point is a prefix of the others and drops out; once every
+ * remaining contender carries an event there, they disagree on it, and nothing on the root chain can
+ * settle that within a generation — the chain holds only `icp` and `rot`, and two rotates at one
+ * position (or two resets at one generation) are both signed by keys only the controller holds,
+ * neither outranking the other. That is duplicity, for a reset at a higher generation to resolve.
+ *
+ * The whole surviving group is judged at once rather than pairwise, so the report is the same in every
+ * presentation order. The group shrinks strictly each iteration, so this terminates.
  */ function resolveContenders(contenders) {
     let group = contenders;
     while(group.length > 1){
+        const pivot = required(group, 0, 'empty contender group');
         // Where they first disagree, against the group as a whole — the point every contender agrees to.
-        let divergence = group[0].spine.length;
+        let divergence = pivot.spine.length;
         for (const folded of group.slice(1)){
-            divergence = Math.min(divergence, commonSpine(group[0], folded));
+            divergence = Math.min(divergence, commonSpine(pivot, folded));
         }
         // A branch ending at the divergence point is a prefix of the others: extended, not contradicted,
         // so it loses without any event discarded. The ordinary "one peer is behind" case, and the only
@@ -119,155 +97,76 @@ function branchFrom(branch, result) {
             group = extended;
             continue;
         }
-        // Group the contenders by the event they diverge on. Branches sharing one are decided further
-        // down.
-        const rivals = new Map();
-        for (const folded of group){
-            const digest = spineDigest(folded, divergence);
-            const bucket = rivals.get(digest);
-            if (bucket == null) {
-                rivals.set(digest, [
-                    folded
-                ]);
-            } else {
-                bucket.push(folded);
-            }
-        }
-        const groups = [
-            ...rivals.values()
-        ];
-        // The state the diverging events all chain to. Identical across contenders, so any can answer.
-        const first = groups[0][0];
-        const prior = first.states[first.spine[divergence] - 1];
-        let dominant = -1;
-        for(let i = 0; i < groups.length; i++){
-            const candidate = groups[i][0].branch[groups[i][0].spine[divergence]];
-            const dominatesAll = groups.every((other, j)=>{
-                if (j === i) {
-                    return true;
-                }
-                return supersedes({
-                    candidate,
-                    incumbent: other[0].branch[other[0].spine[divergence]],
-                    priorDigest: prior.digest,
-                    priorNext: prior.next
-                });
-            });
-            if (dominatesAll) {
-                if (dominant !== -1) {
-                    // More than one branch dominates every other — impossible for a legitimate rotate (two
-                    // distinct rotates never both supersede one another), but fall through to duplicity
-                    // defensively rather than pick arbitrarily.
-                    dominant = -2;
-                    break;
-                }
-                dominant = i;
+        // Every contender carries an event at the divergence point and at least two differ: two events the
+        // controller cannot both have authored. Deterministic regardless of arrival order: sort the
+        // conflicting digests, report from the branch sorted first.
+        const digests = [
+            ...new Set(group.map((folded)=>spineDigest(folded, divergence)))
+        ].sort();
+        const firstDigest = required(digests, 0, 'no diverging digests');
+        const secondDigest = required(digests, 1, 'duplicity needs two digests');
+        const reporter = group.find((folded)=>spineDigest(folded, divergence) === firstDigest);
+        const at = required(reporter.states, required(reporter.spine, divergence, 'spine index out of range'), 'divergence points past folded state');
+        return {
+            ok: false,
+            failure: 'duplicity',
+            duplicity: {
+                gen: at.gen,
+                seq: at.seq,
+                digests: [
+                    firstDigest,
+                    secondDigest
+                ]
             }
-        }
-        if (dominant < 0) {
-            // Two events the controller cannot both have authored, no rotate to settle it. Deterministic
-            // regardless of arrival order: sort the conflicting digests, report from the branch sorted
-            // first.
-            const digests = groups.map((members)=>spineDigest(members[0], divergence)).sort();
-            const reporter = groups.find((members)=>spineDigest(members[0], divergence) === digests[0]);
-            const at = reporter[0].states[reporter[0].spine[divergence]];
-            return {
-                ok: false,
-                failure: 'duplicity',
-                duplicity: {
-                    gen: at.gen,
-                    seq: at.seq,
-                    digests: [
-                        digests[0],
-                        digests[1]
-                    ]
-                }
-            };
-        }
-        group = groups[dominant];
+        };
     }
     return {
         ok: true,
-        winner: group[0]
+        winner: required(group, 0, 'empty contender group')
     };
 }
 /**
- * Pick the authoritative branch. Two rules, in order:
+ * Pick the authoritative root chain among `chains` — chains only: epoch events never fork the log, so
+ * they are never a branch to choose between (see `mergeLogs` in `log.ts`). Two rules, in order:
  *
  * 1. The highest folded generation wins outright. Only a reset raises the generation, and only the
  *    committed recovery key can author a reset — the root's override, unreachable by a thief.
- * 2. Within that generation, branches are compared **at the point they diverge**, not at their heads:
- *    a rotate signed by the pre-committed next keys supersedes the current-key event it forked from
- *    and everything that branch accumulated. Two diverging events with no rotate to settle them are
- *    duplicity, surfaced rather than merged.
+ * 2. Within that generation, chains are compared **at the point they diverge**, not at their heads. A
+ *    chain that ends at the divergence point is a prefix of the other and loses to it; two chains
+ *    that each carry an event there are duplicity, surfaced rather than merged.
  *
- * Comparing heads instead would make branch *length* decisive below the top generation — the one
- * resource a thief has in abundance (a stolen current key cannot rotate but can sign unlimited
- * revokes). A longer branch still wins when it is the same history carried further, which the
- * divergence walk sees as a prefix.
+ * With root adds and root revokes moved into epochs, the chain holds only `icp` and `rot`, so the
+ * second case is always two rotates, or two resets at one generation — both signed by keys only the
+ * controller holds, neither outranking the other, and settled only by a reset at a higher generation.
+ * The current-key event a cold rotate outranks still exists, but in the epoch that rotate closes,
+ * where the fold gives it no effect; branch selection never sees it. That is also why chain length
+ * never decides anything here: the one resource a thief holding a current key has in abundance is
+ * current-key events, and none of them is on the chain. A longer chain still wins when it is the same
+ * history carried further, which the divergence walk sees as a prefix.
  *
- * `superseded` counts the state-advancing events discarded from losing branches (what a cache must
+ * `superseded` counts the state-advancing events discarded from losing chains (what a cache must
  * invalidate — folded state is not append-only under supersession); skipped events are not counted.
- * Branches that do not fold are filtered out before comparison, so a thief who cannot produce a valid
+ * Chains that do not fold are filtered out before comparison, so a thief who cannot produce a valid
  * event cannot create a duplicity report.
- *
- * This form folds synchronously and cannot check a capability-authorised revoke: such a branch is
- * counted in {@link ResolveResult.unverified} and left out, and only a call where *every* branch is
- * one answers `failure: 'needs-capability-verification'`. See {@link ResolveResult.unverified} for
- * why the count is reported rather than fatal; the remedy is {@link resolveBranchesAsync} with a
- * verifier.
- */ export function resolveBranches(did, branches) {
+ */ export function resolveBranches(did, chains) {
     const valid = [];
-    let unverified = 0;
-    for (const branch of branches){
-        const result = foldLog(did, branch);
-        if (needsCapabilityVerification(result)) {
-            unverified++;
-            continue;
-        }
-        const folded = branchFrom(branch, result);
+    for (const branch of chains){
+        const folded = branchFrom(branch, foldLog(did, {
+            chain: branch,
+            events: []
+        }));
         if (folded != null) {
             valid.push(folded);
         }
     }
-    return selectWinner(valid, unverified);
+    return selectWinner(valid);
 }
-/**
- * Async counterpart of {@link resolveBranches}, and the form the management tier needs — the sync
- * fold fails closed on a capability-authorised revoke, so resolving through it would filter every
- * branch of such a log away as invalid and report "no valid history" for a healthy profile.
- *
- * Branches are folded one at a time: `verifyCapability` is caller-supplied code that may do I/O, and
- * branch counts in a duplicity report are small, so there is nothing to win against calling a
- * caller's verifier concurrently.
- */ export async function resolveBranchesAsync(did, branches, options = {}) {
-    const valid = [];
-    let unverified = 0;
-    for (const branch of branches){
-        const result = await foldLogAsync(did, branch, options);
-        // Reachable only with no `verifyCapability` configured — with one, the verifier's answer decides
-        // and a rejection is an invalid branch. So a correctly configured call always reports
-        // `unverified: 0`.
-        if (needsCapabilityVerification(result)) {
-            unverified++;
-            continue;
-        }
-        const folded = branchFrom(branch, result);
-        if (folded != null) {
-            valid.push(folded);
-        }
-    }
-    return selectWinner(valid, unverified);
-}
-function selectWinner(valid, unverified) {
+function selectWinner(valid) {
     if (valid.length === 0) {
-        // Nothing left to compare, and which answer that is depends on *why*: an unchecked branch is not
-        // evidence the log has no history.
-        return unverified > 0 ? allUnverified(unverified) : {
+        return {
             ok: false,
             failure: 'no-valid-branch',
-            duplicity: NO_POSITION,
-            unverified
+            duplicity: NO_POSITION
         };
     }
     // Re-derivation is idempotent: branches folding to the same head are one history presented twice.
@@ -287,26 +186,41 @@ function selectWinner(valid, unverified) {
         ...byHead.values()
     ];
     const topGen = Math.max(...distinct.map((folded)=>headState(folded).gen));
-    const resolved = resolveContenders(distinct.filter((f)=>headState(f).gen === topGen));
-    if (!resolved.ok) {
-        // A duplicity report is provisional the same way a winner is: an unchecked branch might have
-        // superseded both conflicting events.
-        return {
-            ...resolved,
-            unverified
+    // Compared from the top generation's first event on, not from the inception. A reset chains to the
+    // inception rather than to what preceded it, and its state is a function of the event alone, so one
+    // reset can sit on different prefixes — appended to a generation-0 chain by one party, straight
+    // after the inception in another's pruned copy. Once both contain it, what came before cannot change
+    // the winner; compared from the inception, the two would diverge at position 1 and read as a fork.
+    // At generation 0 the generation starts at the inception, so nothing is dropped.
+    const original = new Map();
+    const contenders = distinct.filter((folded)=>headState(folded).gen === topGen).map((folded)=>{
+        const start = folded.spine.findIndex((index)=>required(folded.states, index, 'spine points past folded state').gen === topGen);
+        const trimmed = {
+            ...folded,
+            spine: folded.spine.slice(start)
         };
+        original.set(trimmed, folded);
+        return trimmed;
+    });
+    const resolved = resolveContenders(contenders);
+    if (!resolved.ok) {
+        return resolved;
     }
-    const { winner } = resolved;
+    const winner = original.get(resolved.winner) ?? resolved.winner;
+    // Discarded: what a loser's spine holds that the winner's does not. Counted by digest rather than
+    // from the common prefix, so a reset both carry on different prefixes is not counted as lost.
+    const kept = new Set(winner.spine.map((_, j)=>spineDigest(winner, j)));
     let superseded = 0;
     for (const loser of distinct){
         if (loser !== winner) {
-            superseded += loser.spine.length - commonSpine(winner, loser);
+            for(let j = 0; j < loser.spine.length; j++){
+                if (!kept.has(spineDigest(loser, j))) superseded++;
+            }
         }
     }
     return {
         ok: true,
         winner: winner.branch,
-        superseded,
-        unverified
+        superseded
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kokuin/controller",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "did:kokuin controller key event log",
   "keywords": [
     "did",
@@ -25,26 +25,26 @@
     "lib/*"
   ],
   "dependencies": {
-    "@noble/curves": "^2.3.0",
-    "@noble/hashes": "^2.3.0",
-    "@scure/base": "^2.3.0",
-    "@sozai/json": "^0.1.1",
-    "micro-key-producer": "^0.10.0",
-    "@kokuin/token": "^0.5.0"
+    "@kokuin/token": "^0.6.0",
+    "@noble/curves": "^2.4.0",
+    "@noble/hashes": "^2.4.0",
+    "@scure/base": "^2.4.0",
+    "@sozai/json": "^0.3.0",
+    "micro-key-producer": "^0.10.2"
   },
   "devDependencies": {
     "@kokuin/controller-conformance": "^0.0.0",
-    "@kokuin/deterministic": "^0.2.2",
-    "@kokuin/jwe": "^0.1.0"
+    "@kokuin/deterministic": "^0.2.3",
+    "@kokuin/jwe": "^0.1.1"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
     "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
-    "build:clean": "del lib",
-    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
-    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "build:clean": "del-cli lib",
+    "build:js": "del-cli 'lib/**/*.js' && swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
+    "build:types": "del-cli 'lib/**/*.d.ts' 'lib/**/*.d.ts.map' && tsc --emitDeclarationOnly --skipLibCheck",
     "test": "pnpm run test:types && pnpm run test:unit",
     "test:types": "tsc --noEmit --skipLibCheck -p tsconfig.test.json",
     "test:unit": "vitest run"