@kokuin/controller 0.1.0 → 0.2.0

package/lib/resolver.js

@@ -1,13 +1,23 @@
 import { DID_PREFIX } from './events.js';
-import { authoritativeStates } from './history.js';
-import { allStatesAsync } from './state.js';
-import { agreementKeysFrom, DID_METHOD, signingKeyFrom } from './state-resolver.js';
+import { authoritativeLogWithin } from './history.js';
+import { isControllerLog } from './log.js';
+import { resolverOver } from './state-resolver.js';
 const CONTEXT = 'Controller resolver';
 /**
  * A `did:kokuin:` resolver for `@kokuin/token`. Injected rather than imported by token: this package
  * depends on token for signing, so the reverse import would cycle. Token resolves `iss` through the
  * interface without knowing the fold exists.
+ *
+ * Every member answers from the head (the chain's last state merged with the current epoch) except
+ * `resolveHistoric`, which scans the chain's states for a rotated-away key. While the epoch is
+ * saturated, every member refuses (see `resolverOver`).
  */ export function createControllerResolver(options) {
+    return createControllerResolverWithin(options);
+}
+/**
+ * {@link createControllerResolver} under lowered epoch limits. Test-only: saturation is then
+ * reachable without thousands of signatures. Not exported from the package.
+ */ export function createControllerResolverWithin(options, limits) {
     // The fold currently under way for each DID, so overlapping resolutions of one DID share it (two
     // tokens from one issuer verified in parallel is ordinary — token caches only `did:peer:4`).
     //
@@ -18,43 +28,45 @@ const CONTEXT = 'Controller resolver';
     //
     // Not a cache: removed as soon as the fold settles, so a later resolution re-folds.
     const inFlight = new Map();
-    // Shared by every member: load, fold, throw `Unknown DID` when absent. The whole state array
-    // rather than the head, because `resolveHistoric` answers about rotated-away keys; head-only
-    // members take `states[states.length - 1]`. Always the async fold: it differs from `foldLog` only
-    // in awaiting a capability-authorised revoke's verifier, so a mode-selecting option would choose
-    // nothing — the verifier is the only thing a caller supplies.
-    async function computeStates(did) {
-        const events = await options.loadLog(did);
-        if (events == null || events.length === 0) {
+    // Shared by every member: load, fold, throw `Unknown DID` when absent. The chain's states as well
+    // as the head, because `resolveHistoric` answers about rotated-away keys.
+    async function computeView(did) {
+        const log = await options.loadLog(did);
+        if (log == null || isControllerLog(log) && log.chain.length === 0) {
             throw new Error(`Unknown DID: ${did}`);
         }
-        const foldOptions = {
-            verifyCapability: options.verifyCapability
-        };
+        // Without a store, the same fold against no memory: the request limit, the chain, then the
+        // epoch — one path, so the two configurations cannot disagree about what a log means.
         if (options.history == null) {
-            return await allStatesAsync({
+            return authoritativeLogWithin({
                 did,
-                events,
-                context: CONTEXT,
-                options: foldOptions
-            });
+                loaded: log,
+                seen: undefined,
+                context: CONTEXT
+            }, limits).result;
         }
         // Compared against what this party last accepted, so a truncated log — folding cleanly, missing
         // the revoke that matters — is refused. See `LogStore`.
-        const seen = await options.history.get(did);
-        const { log, states } = await authoritativeStates({
-            did,
-            loaded: events,
-            seen,
-            context: CONTEXT,
-            options: foldOptions
+        // Inside the store's merge, so two resolutions of one DID never lose each other's events. A log
+        // that lost throws out of the update, so nothing is written and the store never moves backwards.
+        // The answer is the merged fold — what was seen plus what was loaded — not the presentation.
+        let view;
+        await options.history.merge(did, async (seen)=>{
+            const settled = authoritativeLogWithin({
+                did,
+                loaded: log,
+                seen,
+                context: CONTEXT
+            }, limits);
+            view = settled.result;
+            return settled.log;
         });
-        // Only after it has folded, and only in the memory-keeping direction: a log that lost never
-        // reaches here, so the store never moves backwards.
-        await options.history.set(did, log);
-        return states;
+        if (view === undefined) {
+            throw new Error(`${CONTEXT}: the log store did not run the merge for ${did}`);
+        }
+        return view;
     }
-    async function loadStates(did) {
+    async function loadView(did) {
         if (!did.startsWith(DID_PREFIX)) {
             throw new Error(`Unknown DID: ${did}`);
         }
@@ -67,7 +79,7 @@ const CONTEXT = 'Controller resolver';
         // Deferred by a microtask so the entry is registered *before* `loadLog` runs — otherwise a
         // `loadLog` that re-enters `resolve` before its own first `await` recurses to a stack overflow
         // while the map is still empty.
-        const fold = Promise.resolve().then(()=>computeStates(did));
+        const fold = Promise.resolve().then(()=>computeView(did));
         inFlight.set(did, fold);
         try {
             return await fold;
@@ -79,43 +91,27 @@ const CONTEXT = 'Controller resolver';
         }
     }
     return {
-        method: DID_METHOD,
-        // The head's key set only: a profile that rotated away from a key answers "no" for it here, which
-        // is what makes `rotate` retire a leaked authority key rather than add one beside it.
-        async resolve (did, header = {}) {
-            return signingKeyFrom({
-                did,
-                states: await loadStates(did),
-                header
-            });
-        },
-        // Every key set within the current generation, for a caller verifying past-issued material. A
-        // `rotate` must not invalidate those; a `reset` still does, and the scan stops at the generation
-        // boundary. See `signingKeyFrom` in `state-resolver.ts`.
-        async resolveHistoric (did, header = {}) {
-            return signingKeyFrom({
-                did,
-                states: await loadStates(did),
-                header,
-                historic: true
+        ...resolverOver(loadView),
+        frozen () {
+            // The promise, not the settled view: concurrent first calls for one DID join one load and
+            // fold, rather than each starting its own and answering from whichever settled.
+            const views = new Map();
+            return resolverOver((did)=>{
+                const known = views.get(did);
+                if (known !== undefined) {
+                    return known;
+                }
+                const view = loadView(did);
+                views.set(did, view);
+                // A failed load is no answer to freeze: dropped, so a later call loads afresh. Every answer
+                // this view gave for the DID came from that failure, so the next fold is still its first.
+                view.catch(()=>{
+                    if (views.get(did) === view) {
+                        views.delete(did);
+                    }
+                });
+                return view;
             });
-        },
-        async resolveDenySet (did) {
-            // The head's set, deliberately, not the state at any position a capability names: `iat` is
-            // author-supplied and backdatable, so anchoring to it would let a revoked holder pick a
-            // position at which it was not yet denied. The set is position-dependent *within the fold*; the
-            // question a verifier asks is "is this grant valid now". Both spellings ride in it (see
-            // `KeyState.deny`); the key half is enforced by `signingKeyFrom`, and the two forms cannot
-            // collide. `loadStates` throws `Unknown DID` rather than answering an empty (= "nobody
-            // revoked") set.
-            const states = await loadStates(did);
-            return states[states.length - 1].deny;
-        },
-        async resolveAgreementKey (did) {
-            // The head's set only, unlike `resolve`. A retired agreement key is a downgrade, not a grant
-            // the profile already made: the recipient decrypts old ciphertexts by re-deriving from the
-            // seed, never by resolution.
-            return agreementKeysFrom(did, await loadStates(did));
         }
     };
 }

package/lib/state-resolver.d.ts

@@ -1,26 +1,42 @@
-import { type DIDMethodResolver, type ResolvedAgreementKey, type ResolvedSigningKey, type ResolveIssuerHeader } from '@kokuin/token';
+import { type DIDMethodResolver, type MemberQuery, type ResolvedAgreementKey, type ResolvedMember, type ResolvedSigningKey, type ResolveIssuerHeader } from '@kokuin/token';
 import type { KeyState } from './fold.js';
 /** The method segment of {@link DID_PREFIX}, so the two cannot drift. */
 export declare const DID_METHOD: string;
+/**
+ * A folded log as every resolver member reads it: `states`, one per chain event, for the historic
+ * key scan; `head`, the last of them merged with the current epoch, for every live answer (keys,
+ * denials, members, saturation).
+ */
+export type FoldedView = {
+    states: Array<KeyState>;
+    head: KeyState;
+};
+/**
+ * What every resolver member throws while the controller's current epoch is saturated, followed by
+ * `: ` and the DID. A plain error, not `IssuerKeyNotFoundError`: nothing about the key failed, the
+ * controller as a whole cannot be answered for, and `@kokuin/capability` denies on exactly that.
+ */
+export declare const EPOCH_SATURATED = "controller epoch is saturated";
+/** What `resolveMember` rejects a member with that is not live in the head's generation. */
+export declare const MEMBER_NOT_EFFECTIVE = "not an effective management member";
 /**
  * What a token signed by a revoked key is rejected with. The `#`-prefixed key follows after `: `, so
  * match with `startsWith`.
  */
 export declare const KEY_REVOKED = "kid names a key the controller has revoked";
 /**
- * The signing key `header` names, out of an already-folded log. `historic` picks which question above
+ * The signing key `header` names, out of an already-folded view. `historic` picks which question above
  * is asked, and defaults to the safe one.
  *
- * **A revoked key answers neither question.** A `rev` naming `#<key>` retires a key for material it
- * has *already* signed, and this is where that bites — every `did:kokuin:` signature check reaches a
+ * **A revoked key answers neither question.** A deny entry naming `#<key>` retires a key for material
+ * it has *already* signed, and this is where that bites — every `did:kokuin:` signature check reaches a
  * resolved key through here, so the denial covers `verifyToken` on both `historic` settings, every
- * capability and revocation record `@kokuin/capability` verifies, and the fold's own cap-authorised
- * revoke. The historic arm is the live one: a revoked key is never in the head's `k` (the
- * `KeyState.deny` invariant), so only the backwards scan can select one, and without this
- * `resolveHistoric` would accept a leaked key forever.
+ * capability and revocation record `@kokuin/capability` verifies. The historic arm is the live one:
+ * a revoked key is never in the head's `k` (the `KeyState.deny` invariant), so only the backwards
+ * scan can select one, and without this `resolveHistoric` would accept a leaked key forever.
  *
- * The head arm cannot be reached from a log this package folded, but is not decoration: `states`
- * arrives from the caller, and the invariant is the fold's property, not the array's — a
+ * The head arm cannot be reached from a log this package folded, but is not decoration: `view`
+ * arrives from the caller, and the invariant is the fold's property, not the view's — a
  * caller-built state whose head publishes a key it also denies resolves to nothing here.
  *
  * **Evaluated against the head's deny set, never the position the key was selected at.** A denial is
@@ -28,33 +44,53 @@ export declare const KEY_REVOKED = "kid names a key the controller has revoked";
  * thief presents a token resolving at a position before the revoke. Deliberately *not* how a DID
  * denial behaves inside the fold, where `states[i]` is consulted at position `i` because "was this
  * author allowed to act *here*" is the whole question; the two rules answer different questions.
- * Inside the fold they coincide anyway: `createStateResolver` gets the prefix `states[0..i-1]`, so
- * its head *is* the position being verified.
+ * The head here is the chain's last state merged with the current epoch, so a key retired by an
+ * epoch revoke is refused as surely as one a settlement checkpointed.
  */
-export declare function signingKeyFrom({ did, states, header, historic, }: {
+export declare function signingKeyFrom({ did, view, header, historic, }: {
     did: string;
-    states: Array<KeyState>;
+    view: FoldedView;
     header: ResolveIssuerHeader;
     historic?: boolean;
 }): ResolvedSigningKey;
 /**
- * The head's key agreement set, minus anything it has revoked. A `rev` may name an agreement key as
- * readily as a signing one (the target spelling is the key, not its purpose), and these are the keys
+ * The head's key agreement set, minus anything it has revoked. A deny entry may name an agreement key
+ * as readily as a signing one (the target spelling is the key, not its purpose), and these are the keys
  * a *sender* encrypts to — encrypting to a revoked key is the one outcome a denial must prevent.
  *
  * Like the signing side, unreachable from a log this package folded (the `KeyState.deny` invariant)
- * but `states` arrives from the caller. Filtering to empty is the honest answer for a state that
+ * but `head` arrives from the caller. Filtering to empty is the honest answer for a state that
  * denies everything it publishes: `@kokuin/jwe` then encrypts nothing, the fail-closed direction.
  */
-export declare function agreementKeysFrom(did: string, states: Array<KeyState>): Array<ResolvedAgreementKey>;
+export declare function agreementKeysFrom(did: string, head: KeyState): Array<ResolvedAgreementKey>;
 /**
- * A `DIDMethodResolver` answering for exactly one profile, out of already-folded state. The fold
- * hands one to a capability-authorised revoke's verifier, built from the states *before* the event
- * being verified — the prefix contract made unforgettable: the verifier no longer needs a
- * position-aware registry, because the fold supplies the answer. See `FoldOptions.verifyCapability`.
- *
- * Answers only for `did`; any other identifier is `Unknown DID`, so a caller merging this into a
- * wider registry falls back to its own resolver for another `did:kokuin:` delegate and never serves
- * one profile's state for another's. Not a cache: the states are the caller's, fixed at construction.
+ * The key and lease the head pins for one management member, or `IssuerKeyNotFoundError` carrying
+ * {@link MEMBER_NOT_EFFECTIVE}.
+ *
+ * Every condition is asked of the head alone, the "answer for now" the interface demands: the member
+ * must be present in it under the queried `add` digest, not removed and not targeted by a denial
+ * (`effective`, which the fold computes with the one denial predicate it uses everywhere), and the
+ * query's DID must be the member's under canonical DID equivalence — the long and short spellings of
+ * one `did:peer:4` are one member; any other DID is another, even one carrying the same key.
+ *
+ * **The generation is part of the identity.** A reset carrying a snapshot keeps each member's `add`
+ * reference, so incarnation alone cannot tell a grant minted before the reset from one minted after;
+ * only `gen` can. A query naming any generation but the head's is refused, which is what makes a
+ * reset kill every grant of the generation it replaces, carried members' included. The lease is
+ * reported, never judged: the log has no clock, and bounding a grant by it is the verifier's step.
+ *
+ * `IssuerKeyNotFoundError` throughout, for the reason `keyFromKid` gives: the controller resolved and
+ * what failed is a claim a token made about it, which must not read as the controller being
+ * unresolvable.
+ */
+export declare function memberFrom(did: string, head: KeyState, query: MemberQuery): ResolvedMember;
+/**
+ * A `DIDMethodResolver` answering every member out of the view `load` yields for the asked DID —
+ * the one shape the live resolver and its frozen views share, so the
+ * saturation refusal and the choice of which half of the view answers what are written once.
+ *
+ * **A saturated head answers nothing**, `resolveHistoric` included: the epoch's denials can no
+ * longer be read, so any answer could be one a denial withdrew. The chain still folds, so root can
+ * settle into a fresh epoch, and the refusal ends there.
  */
-export declare function createStateResolver(did: string, states: Array<KeyState>): DIDMethodResolver;
+export declare function resolverOver(load: (did: string) => Promise<FoldedView>): DIDMethodResolver;

package/lib/state-resolver.js

@@ -1,7 +1,13 @@
-import { IssuerKeyNotFoundError } from '@kokuin/token';
+import { IssuerKeyNotFoundError, normalizeDID } from '@kokuin/token';
 import { DID_PREFIX, keyTarget } from './events.js';
 import { decodeKey } from './keys.js';
 /** The method segment of {@link DID_PREFIX}, so the two cannot drift. */ export const DID_METHOD = DID_PREFIX.slice('did:'.length, -1);
+/**
+ * What every resolver member throws while the controller's current epoch is saturated, followed by
+ * `: ` and the DID. A plain error, not `IssuerKeyNotFoundError`: nothing about the key failed, the
+ * controller as a whole cannot be answered for, and `@kokuin/capability` denies on exactly that.
+ */ export const EPOCH_SATURATED = 'controller epoch is saturated';
+/** What `resolveMember` rejects a member with that is not live in the head's generation. */ export const MEMBER_NOT_EFFECTIVE = 'not an effective management member';
 /**
  * The `kid` fragment's body, or `null` when the header names no key. Format is `#<the multibase key
  * exactly as it appears in `k`>`, matched against the folded key sets by membership — an index-based
@@ -32,11 +38,14 @@ import { decodeKey } from './keys.js';
  * a fall back to `keys[0]`**, which would check the signature against a key the token never claimed.
  * An absent `kid` resolves to the head's first key: volunteering one is not the same as accepting one
  * the token names. Past-issued material is {@link historicSigningKey}, via explicit `resolveHistoric`.
- */ function headSigningKey(did, states, kid) {
-    const head = states[states.length - 1];
+ */ function headSigningKey(did, head, kid) {
     const key = keyFromKid(did, kid);
     if (key == null) {
-        return head.keys[0];
+        const first = head.keys[0];
+        if (first === undefined) {
+            throw new IssuerKeyNotFoundError(`Controller ${did} has no signing key`);
+        }
+        return first;
     }
     if (!head.keys.includes(key)) {
         throw new IssuerKeyNotFoundError(`Controller ${did} kid names a key that is not current: ${kid}`);
@@ -55,14 +64,21 @@ import { decodeKey } from './keys.js';
  * decreases, so the backwards scan stops dead at the first earlier-generation state. Runs backwards
  * because the head's own key set is the common answer. A `kid` naming a never-published key, or one
  * from a superseded generation, is an error — never a fall back to `keys[0]`.
- */ function historicSigningKey(did, states, kid) {
-    const head = states[states.length - 1];
+ */ function historicSigningKey(did, { states, head }, kid) {
     const key = keyFromKid(did, kid);
     if (key == null) {
-        return head.keys[0];
+        const first = head.keys[0];
+        if (first === undefined) {
+            throw new IssuerKeyNotFoundError(`Controller ${did} has no signing key`);
+        }
+        return first;
     }
-    for(let i = states.length - 1; i >= 0 && states[i].gen === head.gen; i--){
-        if (states[i].keys.includes(key)) {
+    for(let i = states.length - 1; i >= 0; i--){
+        const state = states[i];
+        if (state === undefined || state.gen !== head.gen) {
+            break;
+        }
+        if (state.keys.includes(key)) {
             return key;
         }
     }
@@ -73,19 +89,18 @@ import { decodeKey } from './keys.js';
  * match with `startsWith`.
  */ export const KEY_REVOKED = 'kid names a key the controller has revoked';
 /**
- * The signing key `header` names, out of an already-folded log. `historic` picks which question above
+ * The signing key `header` names, out of an already-folded view. `historic` picks which question above
  * is asked, and defaults to the safe one.
  *
- * **A revoked key answers neither question.** A `rev` naming `#<key>` retires a key for material it
- * has *already* signed, and this is where that bites — every `did:kokuin:` signature check reaches a
+ * **A revoked key answers neither question.** A deny entry naming `#<key>` retires a key for material
+ * it has *already* signed, and this is where that bites — every `did:kokuin:` signature check reaches a
  * resolved key through here, so the denial covers `verifyToken` on both `historic` settings, every
- * capability and revocation record `@kokuin/capability` verifies, and the fold's own cap-authorised
- * revoke. The historic arm is the live one: a revoked key is never in the head's `k` (the
- * `KeyState.deny` invariant), so only the backwards scan can select one, and without this
- * `resolveHistoric` would accept a leaked key forever.
+ * capability and revocation record `@kokuin/capability` verifies. The historic arm is the live one:
+ * a revoked key is never in the head's `k` (the `KeyState.deny` invariant), so only the backwards
+ * scan can select one, and without this `resolveHistoric` would accept a leaked key forever.
  *
- * The head arm cannot be reached from a log this package folded, but is not decoration: `states`
- * arrives from the caller, and the invariant is the fold's property, not the array's — a
+ * The head arm cannot be reached from a log this package folded, but is not decoration: `view`
+ * arrives from the caller, and the invariant is the fold's property, not the view's — a
  * caller-built state whose head publishes a key it also denies resolves to nothing here.
  *
  * **Evaluated against the head's deny set, never the position the key was selected at.** A denial is
@@ -93,14 +108,14 @@ import { decodeKey } from './keys.js';
  * thief presents a token resolving at a position before the revoke. Deliberately *not* how a DID
  * denial behaves inside the fold, where `states[i]` is consulted at position `i` because "was this
  * author allowed to act *here*" is the whole question; the two rules answer different questions.
- * Inside the fold they coincide anyway: `createStateResolver` gets the prefix `states[0..i-1]`, so
- * its head *is* the position being verified.
- */ export function signingKeyFrom({ did, states, header, historic = false }) {
-    const head = states[states.length - 1];
+ * The head here is the chain's last state merged with the current epoch, so a key retired by an
+ * epoch revoke is refused as surely as one a settlement checkpointed.
+ */ export function signingKeyFrom({ did, view, header, historic = false }) {
+    const { head } = view;
     if (head.keys.length === 0) {
         throw new Error(`Controller ${did} has no signing key`);
     }
-    const selected = historic ? historicSigningKey(did, states, header.kid) : headSigningKey(did, states, header.kid);
+    const selected = historic ? historicSigningKey(did, view, header.kid) : headSigningKey(did, head, header.kid);
     // `IssuerKeyNotFoundError` like every rejection here: the DID resolved and the log folded, and what
     // failed is the key. Retyping it unresolvable would let a `kid` (unauthenticated) make this
     // controller read as unresolvable to every fail-closed caller. See {@link keyFromKid}.
@@ -117,15 +132,14 @@ import { decodeKey } from './keys.js';
     };
 }
 /**
- * The head's key agreement set, minus anything it has revoked. A `rev` may name an agreement key as
- * readily as a signing one (the target spelling is the key, not its purpose), and these are the keys
+ * The head's key agreement set, minus anything it has revoked. A deny entry may name an agreement key
+ * as readily as a signing one (the target spelling is the key, not its purpose), and these are the keys
  * a *sender* encrypts to — encrypting to a revoked key is the one outcome a denial must prevent.
  *
  * Like the signing side, unreachable from a log this package folded (the `KeyState.deny` invariant)
- * but `states` arrives from the caller. Filtering to empty is the honest answer for a state that
+ * but `head` arrives from the caller. Filtering to empty is the honest answer for a state that
  * denies everything it publishes: `@kokuin/jwe` then encrypts nothing, the fail-closed direction.
- */ export function agreementKeysFrom(did, states) {
-    const head = states[states.length - 1];
+ */ export function agreementKeysFrom(did, head) {
     return head.agreement.flatMap((value)=>{
         if (head.deny.has(keyTarget(value))) {
             return [];
@@ -141,46 +155,109 @@ import { decodeKey } from './keys.js';
     });
 }
 /**
- * A `DIDMethodResolver` answering for exactly one profile, out of already-folded state. The fold
- * hands one to a capability-authorised revoke's verifier, built from the states *before* the event
- * being verified — the prefix contract made unforgettable: the verifier no longer needs a
- * position-aware registry, because the fold supplies the answer. See `FoldOptions.verifyCapability`.
+ * The key and lease the head pins for one management member, or `IssuerKeyNotFoundError` carrying
+ * {@link MEMBER_NOT_EFFECTIVE}.
+ *
+ * Every condition is asked of the head alone, the "answer for now" the interface demands: the member
+ * must be present in it under the queried `add` digest, not removed and not targeted by a denial
+ * (`effective`, which the fold computes with the one denial predicate it uses everywhere), and the
+ * query's DID must be the member's under canonical DID equivalence — the long and short spellings of
+ * one `did:peer:4` are one member; any other DID is another, even one carrying the same key.
+ *
+ * **The generation is part of the identity.** A reset carrying a snapshot keeps each member's `add`
+ * reference, so incarnation alone cannot tell a grant minted before the reset from one minted after;
+ * only `gen` can. A query naming any generation but the head's is refused, which is what makes a
+ * reset kill every grant of the generation it replaces, carried members' included. The lease is
+ * reported, never judged: the log has no clock, and bounding a grant by it is the verifier's step.
+ *
+ * `IssuerKeyNotFoundError` throughout, for the reason `keyFromKid` gives: the controller resolved and
+ * what failed is a claim a token made about it, which must not read as the controller being
+ * unresolvable.
+ */ export function memberFrom(did, head, query) {
+    const refuse = (why)=>new IssuerKeyNotFoundError(`Controller ${did} ${query.did} is ${MEMBER_NOT_EFFECTIVE}: ${why}`);
+    if (query.gen !== head.gen) {
+        throw refuse(`generation ${String(query.gen)} is not the current ${head.gen}`);
+    }
+    const member = head.members.get(query.add);
+    if (member === undefined) {
+        throw refuse(`no member was added by ${query.add}`);
+    }
+    if (!member.effective) {
+        throw refuse(member.removed ? 'removed' : 'denied');
+    }
+    if (normalizeDID(member.did) !== normalizeDID(query.did)) {
+        throw refuse(`incarnation ${query.add} is another DID`);
+    }
+    const key = decodeKey(member.key);
+    // Unreachable from a log this package folded (a member pin is Ed25519, adds and snapshots alike),
+    // but `head` may be caller-built, and an agreement key must never come back as a signing one.
+    if (key.alg !== 'EdDSA') {
+        throw refuse(`pinned key is not Ed25519: ${key.alg}`);
+    }
+    return {
+        key: {
+            alg: key.alg,
+            publicKey: key.publicKey
+        },
+        lease: member.lease
+    };
+}
+/**
+ * A `DIDMethodResolver` answering every member out of the view `load` yields for the asked DID —
+ * the one shape the live resolver and its frozen views share, so the
+ * saturation refusal and the choice of which half of the view answers what are written once.
  *
- * Answers only for `did`; any other identifier is `Unknown DID`, so a caller merging this into a
- * wider registry falls back to its own resolver for another `did:kokuin:` delegate and never serves
- * one profile's state for another's. Not a cache: the states are the caller's, fixed at construction.
- */ export function createStateResolver(did, states) {
-    function statesFor(asked) {
-        if (asked !== did) {
-            throw new Error(`Unknown DID: ${asked}`);
+ * **A saturated head answers nothing**, `resolveHistoric` included: the epoch's denials can no
+ * longer be read, so any answer could be one a denial withdrew. The chain still folds, so root can
+ * settle into a fresh epoch, and the refusal ends there.
+ */ export function resolverOver(load) {
+    async function live(did) {
+        const view = await load(did);
+        if (view.head.saturated) {
+            throw new Error(`${EPOCH_SATURATED}: ${did}`);
         }
-        return states;
+        return view;
     }
     return {
         method: DID_METHOD,
-        async resolve (asked, header = {}) {
+        // The head's key set only: a profile that rotated away from a key answers "no" for it here, which
+        // is what makes `rotate` retire a leaked authority key rather than add one beside it.
+        async resolve (did, header = {}) {
             return signingKeyFrom({
-                did: asked,
-                states: statesFor(asked),
+                did,
+                view: await live(did),
                 header
             });
         },
-        // The head of *this prefix*, not the log: these states end at the position the fold is verifying.
-        // A capability issued before that position is the archived material `resolveHistoric` exists for.
-        async resolveHistoric (asked, header = {}) {
+        // Every key set within the current generation, for a caller verifying past-issued material. A
+        // `rotate` must not invalidate those; a `reset` still does, and the scan stops at the generation
+        // boundary. See {@link signingKeyFrom}.
+        async resolveHistoric (did, header = {}) {
             return signingKeyFrom({
-                did: asked,
-                states: statesFor(asked),
+                did,
+                view: await live(did),
                 header,
                 historic: true
             });
         },
-        async resolveDenySet (asked) {
-            const known = statesFor(asked);
-            return known[known.length - 1].deny;
+        async resolveDenySet (did) {
+            // The head's set, deliberately, not the state at any position a capability names: `iat` is
+            // author-supplied and backdatable, so anchoring to it would let a revoked holder pick a
+            // position at which it was not yet denied. The head merges the current epoch, so a denial
+            // made there without root counts as soon as this party has seen it. Both spellings ride in it
+            // (see `KeyState.deny`); the key half is enforced by `signingKeyFrom`, and the two forms
+            // cannot collide. `load` throws `Unknown DID` rather than answering an empty (= "nobody
+            // revoked") set.
+            return (await live(did)).head.deny;
+        },
+        async resolveAgreementKey (did) {
+            // The head's set only, unlike `resolve`. A retired agreement key is a downgrade, not a grant
+            // the profile already made: the recipient decrypts old ciphertexts by re-deriving from the
+            // seed, never by resolution.
+            return agreementKeysFrom(did, (await live(did)).head);
         },
-        async resolveAgreementKey (asked) {
-            return agreementKeysFrom(asked, statesFor(asked));
+        async resolveMember (subject, member) {
+            return memberFrom(subject, (await live(subject)).head, member);
         }
     };
 }

package/lib/state.d.ts

@@ -1,28 +1,12 @@
-import type { SignedEvent } from './events.js';
-import { type FoldOptions, type KeyState } from './fold.js';
+import { type KeyState } from './fold.js';
+import { type ControllerLog } from './log.js';
 /**
- * Current state via the synchronous {@link foldLog}. A capability-authorised revoke fails closed
- * here — see {@link currentStateAsync}.
+ * The root key state a log establishes: the chain's last state.
+ *
+ * The chain alone, deliberately. Epoch events never change a root key (`k`, `ka`, `n` and the
+ * derivation indices live on the chain only), so folding them would buy an identity nothing but up
+ * to `MAX_EPOCH_EVENTS` signature checks on a path that must stay synchronous and cheap. The returned
+ * state's `deny`, `members` and `saturated` are therefore the chain's, not the live ones; nothing
+ * that builds an identity reads them.
  */
-export declare function currentState(did: string, events: Array<SignedEvent>, context: string): KeyState;
-/**
- * Every per-position state, via {@link foldLogAsync}. What the resolver needs and the identity does
- * not: a verifier has to answer about keys the log has since rotated away, since a token outlives the
- * state that gave its `kid` meaning.
- */
-export declare function allStatesAsync({ did, events, context, options, }: {
-    did: string;
-    events: Array<SignedEvent>;
-    context: string;
-    options?: FoldOptions;
-}): Promise<Array<KeyState>>;
-/**
- * Current state via {@link foldLogAsync}, which can await `options.verifyCapability` for a
- * capability-authorised revoke instead of failing closed on it.
- */
-export declare function currentStateAsync({ did, events, context, options, }: {
-    did: string;
-    events: Array<SignedEvent>;
-    context: string;
-    options?: FoldOptions;
-}): Promise<KeyState>;
+export declare function currentState(did: string, log: ControllerLog, context: string): KeyState;