@openvtc/trust-tasks 0.12.17 → 0.13.1

package/dist/_runtime/index.d.ts

@@ -12,5 +12,8 @@
 export { TRUST_TASK_ERROR_TYPE_URI, enforceAudienceBinding, enforceSpecPolicy, rejectWith, rejectWithRecipient, respondWith, toErrorPayload, validateBasic, type ErrorPayload, type ErrorResponse, type InResponseTo, type Proof, type RejectReason, type SpecPolicy, type TrustTaskDocument, } from "./document.js";
 export { STANDARD_CODES, extendedCode, familyCode, isStandardCode, normalizeCode, slugFromTypeUri, type StandardCode, } from "./codes.js";
 export { StaticTransport, UnauthenticatedTransport, identityMismatchReason, reject, resolveParties, type ConsistencyError, type ResolvedParties, type TransportContext, type TransportHandler, } from "./transport.js";
-export { PROOF_NOT_ACCEPTED_BY_POLICY, consumeInbound, refuse, type ConsumeOptions, type ConsumeOutcome, type PayloadPolicy, type PayloadValidator, type ProofPolicy, type ProofVerifier, } from "./consume.js";
+export { ID_CONFLICT_WIRE_MESSAGE, PROOF_INVALID_WIRE_MESSAGE, PROOF_NOT_ACCEPTED_BY_POLICY, REPLAY_RECORD_UNAVAILABLE, consequentialChecks, consumeInbound, notConsequentialChecks, refuse, type ConsumeChecks, type ConsumeOptions, type ConsumeOutcome, type PayloadPolicy, type PayloadValidator, type ProofPolicy, type ProofVerifier, } from "./consume.js";
+export { canonicalJson, sha256Hex } from "./canonical.js";
+export { CONSEQUENTIAL_FRESHNESS, DEFAULT_FRESHNESS, DEFAULT_MAX_AGE_MS, DEFAULT_SKEW_MS, EXPIRY_NOT_AFTER_ISSUANCE, FUTURE_ISSUED_AT, ISSUED_AT_REQUIRED, STALE_WIRE_MESSAGE, recordExpiry, validateFreshness, type FreshnessPolicy, } from "./freshness.js";
+export { InMemoryReplayGuard, documentDigest, type ReplayGuard, type ReplayPolicy, type ReplayVerdict, } from "./replay.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/_runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,MAAM,EACN,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,MAAM,EACN,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC"}

package/dist/_runtime/index.js

@@ -12,5 +12,8 @@
 export { TRUST_TASK_ERROR_TYPE_URI, enforceAudienceBinding, enforceSpecPolicy, rejectWith, rejectWithRecipient, respondWith, toErrorPayload, validateBasic, } from "./document.js";
 export { STANDARD_CODES, extendedCode, familyCode, isStandardCode, normalizeCode, slugFromTypeUri, } from "./codes.js";
 export { StaticTransport, UnauthenticatedTransport, identityMismatchReason, reject, resolveParties, } from "./transport.js";
-export { PROOF_NOT_ACCEPTED_BY_POLICY, consumeInbound, refuse, } from "./consume.js";
+export { ID_CONFLICT_WIRE_MESSAGE, PROOF_INVALID_WIRE_MESSAGE, PROOF_NOT_ACCEPTED_BY_POLICY, REPLAY_RECORD_UNAVAILABLE, consequentialChecks, consumeInbound, notConsequentialChecks, refuse, } from "./consume.js";
+export { canonicalJson, sha256Hex } from "./canonical.js";
+export { CONSEQUENTIAL_FRESHNESS, DEFAULT_FRESHNESS, DEFAULT_MAX_AGE_MS, DEFAULT_SKEW_MS, EXPIRY_NOT_AFTER_ISSUANCE, FUTURE_ISSUED_AT, ISSUED_AT_REQUIRED, STALE_WIRE_MESSAGE, recordExpiry, validateFreshness, } from "./freshness.js";
+export { InMemoryReplayGuard, documentDigest, } from "./replay.js";
 //# sourceMappingURL=index.js.map

package/dist/_runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,GAQd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,GAEhB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,GAKf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,MAAM,GAOP,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/_runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,aAAa,GAQd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,UAAU,EACV,cAAc,EACd,aAAa,EACb,eAAe,GAEhB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,EACN,cAAc,GAKf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,MAAM,GAQP,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,GAElB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,cAAc,GAIf,MAAM,aAAa,CAAC"}

package/dist/_runtime/replay.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Duplicate-execution protection — SPEC §7.2 item 11, §8.4, §10.1.
+ *
+ * Mirrors `replay.rs` in trust-tasks-rs, check for check.
+ *
+ * # The rule
+ *
+ * §7.2 item 11 is normative and unconditional for a *consequential Trust
+ * Task*: once a consumer has accepted a document with a given `id` for
+ * execution, receiving that same document again **MUST NOT** cause the
+ * consequential effect a second time, and receiving a *different* document
+ * under the same `id` **MUST** be rejected with `idConflict`.
+ *
+ * §8.4 is the same mechanism from the producer's end: a retry is a bit-for-bit
+ * identical resend, and it is safe *precisely because* item 11 obliges the
+ * consumer to absorb it. Every transport binding in this repo delegates replay
+ * defence to the consumer — `bindings/https/0.2` §5 says "Freshness / replay:
+ * None", and the DIDComm and TSP bindings say the same — so if the consumer
+ * does not do it, nobody does, and an ordinary mediator redelivery grants an
+ * ACL entry twice by accident. §10.1: "The rule deliberately does not
+ * distinguish a hostile replay from a legitimate transport retry, because at
+ * the document layer the two are indistinguishable."
+ *
+ * # The key
+ *
+ * The `id` **alone** — "Transport request identifiers, transport message
+ * identifiers, and execution handles **MUST NOT** substitute" — plus a digest
+ * of the canonical serialization, because "an `id` alone cannot distinguish
+ * the retry it must absorb from the conflict it must reject".
+ *
+ * {@link documentDigest} hashes {@link canonicalJson} of the whole document
+ * rather than the octets as received: a re-indented body or a member order
+ * chosen by an intermediary would otherwise make a legitimate §8.4 retry look
+ * like a *different* document.
+ *
+ * The digest covers the **entire** document, `proof` included. That differs
+ * deliberately from the §4.9.3 *task digest*, computed over
+ * `JCS(document ∖ proof)`, and the spec spells the distinction out: "Item 11
+ * and §8.4 ask *which serialization arrived*, so a re-signed `proof` over
+ * identical content makes a different document — that is the `idConflict`
+ * case, and the distinction is the whole point of the rule."
+ */
+import type { TrustTaskDocument } from "./document.js";
+/**
+ * The content identity of a document, per SPEC §7.2's keying paragraph:
+ * SHA-256 over the canonical serialization of the whole document, as hex.
+ *
+ * Consumer-local. Never on the wire, and **not** the §4.9.3 task digest.
+ */
+export declare function documentDigest<P>(doc: TrustTaskDocument<P>): string;
+/** What a {@link ReplayGuard} says about a document offered for execution. */
+export type ReplayVerdict = 
+/** Not seen before. The caller may execute. */
+{
+    kind: "fresh";
+}
+/**
+ * Already accepted under the *same* digest — a §8.4 retry, or a replay. The
+ * caller **MUST NOT** execute again.
+ */
+ | {
+    kind: "duplicate";
+    /** The response the first execution produced, where one was retained. */
+    priorResponse?: unknown;
+    /** Whether that first execution is still running. */
+    inFlight: boolean;
+}
+/**
+ * Already accepted under a *different* digest. §7.2 item 11 requires
+ * `idConflict`, and requires that this not be treated as a retry.
+ */
+ | {
+    kind: "conflict";
+};
+/**
+ * The consumer-side record that makes SPEC §7.2 item 11 true.
+ *
+ * An interface, so a deployment can back it with Redis, Postgres, or anything
+ * that survives a process restart. {@link InMemoryReplayGuard} is the default
+ * and is correct for a single-process consumer; it is **not** correct behind a
+ * load balancer, where two replicas would each accept the same document once.
+ */
+export interface ReplayGuard {
+    /**
+     * Claim `id` for execution on behalf of a document with identity `digest`.
+     *
+     * `retainUntil` is the instant past which the record may be dropped —
+     * {@link recordExpiry}, which SPEC §7.2 makes the same instant as the end of
+     * the consumer's willingness to execute the document. An implementation
+     * SHOULD treat a record whose `retainUntil` has passed as absent, so the key
+     * is released rather than conflicting forever with a document nobody would
+     * execute.
+     *
+     * Implementations **MUST** make claim-and-record atomic with respect to
+     * concurrent calls: two simultaneous deliveries of the same document must
+     * not both receive `fresh`. That is the whole guarantee.
+     *
+     * Throwing means the record could not be consulted. {@link consumeInbound}
+     * fails closed on that, mapping it to `unavailable` with `retryable: true` —
+     * a consumer that cannot establish whether a document is a duplicate has not
+     * satisfied item 11, and executing anyway is the double execution the rule
+     * forbids.
+     */
+    claim(id: string, digest: string, retainUntil: number | undefined, now: number): Promise<ReplayVerdict> | ReplayVerdict;
+    /**
+     * Attach the response a completed execution produced, so a later duplicate
+     * can be answered with it per §7.2 (*Disposition of a duplicate*) rather
+     * than merely absorbed in silence.
+     *
+     * Optional: a guard that records nothing still satisfies item 11 — the
+     * effect does not happen twice — and is the right shape for a
+     * fire-and-forget specification, which has no response to return.
+     */
+    recordResponse?(id: string, response: unknown): Promise<void> | void;
+    /**
+     * Release a claim whose execution is not to stand — for example a refusal
+     * the consumer marked `retryable`, where §8.4 has just invited the producer
+     * to re-send the same bytes. Without this, that invited retry would come
+     * back as an absorbed duplicate carrying the same failure forever.
+     */
+    release?(id: string, digest: string): Promise<void> | void;
+}
+/** How a consumer applies SPEC §7.2 item 11 in {@link consumeInbound}. */
+export type ReplayPolicy = 
+/** Apply item 11 using this guard. Correct for any consequential spec. */
+{
+    kind: "guard";
+    guard: ReplayGuard;
+}
+/**
+ * Keep no duplicate-execution record. Conformant **only** where the task is
+ * not consequential (§2), or where the specification "explicitly declares
+ * repeated execution safe and intended" — a property of the operation, not
+ * of the consumer's convenience.
+ */
+ | {
+    kind: "notConsequential";
+};
+/**
+ * A bounded, in-process {@link ReplayGuard}: an LRU map from `id` to the
+ * digest accepted under it, its retention deadline, and the response it
+ * produced.
+ *
+ * **Suitable when** one process is the sole consumer for the `recipient` VID
+ * it serves and losing the record on restart is acceptable.
+ *
+ * **Not suitable when** the consumer is replicated: two replicas hold separate
+ * maps, so a document accepted by replica A is `fresh` at replica B and the
+ * effect happens twice — the exact failure item 11 exists to prevent.
+ * Replicated deployments MUST back the guard with a shared store.
+ *
+ * Eviction is by capacity as well as by `retainUntil`: a burst of distinct
+ * documents can push an older record out before its deadline, and a replay
+ * arriving after that would be accepted. Size the capacity above the number of
+ * distinct documents the widest acceptance window can hold.
+ *
+ * `Map` preserves insertion order, which is what makes the LRU a delete-then-
+ * reinsert rather than a second index.
+ */
+export declare class InMemoryReplayGuard implements ReplayGuard {
+    #private;
+    /**
+     * @param capacity Maximum records retained. Must be positive: a guard that
+     * retains nothing answers `fresh` to everything, which is a silent total
+     * defeat of item 11 rather than a visible misconfiguration.
+     */
+    constructor(capacity?: number);
+    /** Number of records currently retained. For tests and metrics. */
+    get size(): number;
+    /** Drop every record whose `retainUntil` has passed. */
+    purgeExpired(now: number): void;
+    claim(id: string, digest: string, retainUntil: number | undefined, now: number): ReplayVerdict;
+    recordResponse(id: string, response: unknown): void;
+    release(id: string, digest: string): void;
+}
+//# sourceMappingURL=replay.d.ts.map

package/dist/_runtime/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../src/_runtime/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,MAAM,CAEnE;AAED,8EAA8E;AAC9E,MAAM,MAAM,aAAa;AACvB,+CAA+C;AAC7C;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE;AACnB;;;GAGG;GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAC;CACnB;AACH;;;GAGG;GACD;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzB;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CACH,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAAC;IAE1C;;;;;;;;OAQG;IACH,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAErE;;;;;OAKG;IACH,OAAO,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,0EAA0E;AAC1E,MAAM,MAAM,YAAY;AACtB,0EAA0E;AACxE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE;AACvC;;;;;GAKG;GACD;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,CAAC;AASjC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IAIrD;;;;OAIG;gBACS,QAAQ,SAAS;IAO7B,mEAAmE;IACnE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,wDAAwD;IACxD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM/B,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa;IAgC9F,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IAOnD,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;CAS1C"}

package/dist/_runtime/replay.js

@@ -0,0 +1,147 @@
+/**
+ * Duplicate-execution protection — SPEC §7.2 item 11, §8.4, §10.1.
+ *
+ * Mirrors `replay.rs` in trust-tasks-rs, check for check.
+ *
+ * # The rule
+ *
+ * §7.2 item 11 is normative and unconditional for a *consequential Trust
+ * Task*: once a consumer has accepted a document with a given `id` for
+ * execution, receiving that same document again **MUST NOT** cause the
+ * consequential effect a second time, and receiving a *different* document
+ * under the same `id` **MUST** be rejected with `idConflict`.
+ *
+ * §8.4 is the same mechanism from the producer's end: a retry is a bit-for-bit
+ * identical resend, and it is safe *precisely because* item 11 obliges the
+ * consumer to absorb it. Every transport binding in this repo delegates replay
+ * defence to the consumer — `bindings/https/0.2` §5 says "Freshness / replay:
+ * None", and the DIDComm and TSP bindings say the same — so if the consumer
+ * does not do it, nobody does, and an ordinary mediator redelivery grants an
+ * ACL entry twice by accident. §10.1: "The rule deliberately does not
+ * distinguish a hostile replay from a legitimate transport retry, because at
+ * the document layer the two are indistinguishable."
+ *
+ * # The key
+ *
+ * The `id` **alone** — "Transport request identifiers, transport message
+ * identifiers, and execution handles **MUST NOT** substitute" — plus a digest
+ * of the canonical serialization, because "an `id` alone cannot distinguish
+ * the retry it must absorb from the conflict it must reject".
+ *
+ * {@link documentDigest} hashes {@link canonicalJson} of the whole document
+ * rather than the octets as received: a re-indented body or a member order
+ * chosen by an intermediary would otherwise make a legitimate §8.4 retry look
+ * like a *different* document.
+ *
+ * The digest covers the **entire** document, `proof` included. That differs
+ * deliberately from the §4.9.3 *task digest*, computed over
+ * `JCS(document ∖ proof)`, and the spec spells the distinction out: "Item 11
+ * and §8.4 ask *which serialization arrived*, so a re-signed `proof` over
+ * identical content makes a different document — that is the `idConflict`
+ * case, and the distinction is the whole point of the rule."
+ */
+import { canonicalJson, sha256Hex } from "./canonical.js";
+/**
+ * The content identity of a document, per SPEC §7.2's keying paragraph:
+ * SHA-256 over the canonical serialization of the whole document, as hex.
+ *
+ * Consumer-local. Never on the wire, and **not** the §4.9.3 task digest.
+ */
+export function documentDigest(doc) {
+    return sha256Hex(canonicalJson(doc));
+}
+/**
+ * A bounded, in-process {@link ReplayGuard}: an LRU map from `id` to the
+ * digest accepted under it, its retention deadline, and the response it
+ * produced.
+ *
+ * **Suitable when** one process is the sole consumer for the `recipient` VID
+ * it serves and losing the record on restart is acceptable.
+ *
+ * **Not suitable when** the consumer is replicated: two replicas hold separate
+ * maps, so a document accepted by replica A is `fresh` at replica B and the
+ * effect happens twice — the exact failure item 11 exists to prevent.
+ * Replicated deployments MUST back the guard with a shared store.
+ *
+ * Eviction is by capacity as well as by `retainUntil`: a burst of distinct
+ * documents can push an older record out before its deadline, and a replay
+ * arriving after that would be accepted. Size the capacity above the number of
+ * distinct documents the widest acceptance window can hold.
+ *
+ * `Map` preserves insertion order, which is what makes the LRU a delete-then-
+ * reinsert rather than a second index.
+ */
+export class InMemoryReplayGuard {
+    #entries = new Map();
+    #capacity;
+    /**
+     * @param capacity Maximum records retained. Must be positive: a guard that
+     * retains nothing answers `fresh` to everything, which is a silent total
+     * defeat of item 11 rather than a visible misconfiguration.
+     */
+    constructor(capacity = 10_000) {
+        if (!Number.isInteger(capacity) || capacity < 1) {
+            throw new RangeError("InMemoryReplayGuard capacity must be a positive integer");
+        }
+        this.#capacity = capacity;
+    }
+    /** Number of records currently retained. For tests and metrics. */
+    get size() {
+        return this.#entries.size;
+    }
+    /** Drop every record whose `retainUntil` has passed. */
+    purgeExpired(now) {
+        for (const [id, entry] of this.#entries) {
+            if (entry.retainUntil !== undefined && entry.retainUntil <= now)
+                this.#entries.delete(id);
+        }
+    }
+    claim(id, digest, retainUntil, now) {
+        const existing = this.#entries.get(id);
+        // An expired record is treated as absent: the consumer would refuse the
+        // document under §7.2 item 4 or the acceptance window anyway, so holding
+        // the key would only manufacture a permanent `idConflict` for an `id`
+        // nobody can use.
+        if (existing !== undefined && existing.retainUntil !== undefined && existing.retainUntil <= now) {
+            this.#entries.delete(id);
+        }
+        else if (existing !== undefined) {
+            if (existing.digest !== digest) {
+                // A conflicting document is not a *use* of the record, so it does not
+                // refresh recency — otherwise a flood of conflicts could pin an entry
+                // and evict live ones.
+                return { kind: "conflict" };
+            }
+            this.#entries.delete(id);
+            this.#entries.set(id, existing);
+            return existing.response === undefined
+                ? { kind: "duplicate", inFlight: !existing.completed }
+                : { kind: "duplicate", priorResponse: existing.response, inFlight: !existing.completed };
+        }
+        this.#entries.set(id, { digest, retainUntil, response: undefined, completed: false });
+        while (this.#entries.size > this.#capacity) {
+            const oldest = this.#entries.keys().next();
+            if (oldest.done === true)
+                break;
+            this.#entries.delete(oldest.value);
+        }
+        return { kind: "fresh" };
+    }
+    recordResponse(id, response) {
+        const entry = this.#entries.get(id);
+        if (entry === undefined)
+            return;
+        entry.response = response;
+        entry.completed = true;
+    }
+    release(id, digest) {
+        const entry = this.#entries.get(id);
+        // Only release the claim this digest made, and only while it is
+        // unfinished: a concurrent arrival that legitimately holds the key must
+        // not have it taken away by another document's cleanup.
+        if (entry !== undefined && entry.digest === digest && !entry.completed) {
+            this.#entries.delete(id);
+        }
+    }
+}
+//# sourceMappingURL=replay.js.map

package/dist/_runtime/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../../src/_runtime/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG1D;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAI,GAAyB;IACzD,OAAO,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAkGD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,mBAAmB;IACrB,QAAQ,GAAG,IAAI,GAAG,EAAiB,CAAC;IACpC,SAAS,CAAS;IAE3B;;;;OAIG;IACH,YAAY,QAAQ,GAAG,MAAM;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,UAAU,CAAC,yDAAyD,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,mEAAmE;IACnE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,wDAAwD;IACxD,YAAY,CAAC,GAAW;QACtB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,MAAc,EAAE,WAA+B,EAAE,GAAW;QAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEvC,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,kBAAkB;QAClB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;YAChG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,sEAAsE;gBACtE,sEAAsE;gBACtE,uBAAuB;gBACvB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAChC,OAAO,QAAQ,CAAC,QAAQ,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE;gBACtD,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC7F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM;YAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,cAAc,CAAC,EAAU,EAAE,QAAiB;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,OAAO,CAAC,EAAU,EAAE,MAAc;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,gEAAgE;QAChE,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACvE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF"}

package/dist/keys/create/0.1/payload.d.ts

@@ -24,6 +24,10 @@ export interface KeysCreatePayload {
      * Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it.
      */
     derivationPath?: string;
+    /**
+     * Durable identifier to give the new key. Where the maintainer derives from a seed it MAY default this to `derivationPath`, which is what makes the member optional for an ordinary create. It is **not** optional in practice for `internal: true`: such a key has no derivation path to be named after, so a maintainer that offers internal keys and receives no `keyId` has nothing to call the key and SHOULD reject the request. A maintainer MUST reject a `keyId` that collides with an existing key rather than overwrite it.
+     */
+    keyId?: string;
     /**
      * Absent is the same as `false`, and this member deliberately declares no JSON Schema `default`: a declared default is materialised by generated bindings, so an absent `internal` would reappear as an explicit `false` on re-serialisation and break round-trip idempotence for every existing request document. Request a key generated from the maintainer's CSPRNG rather than derived from a seed. Such a key is reproducible from nothing: it is not recoverable from a recovery phrase, and a maintainer offering it SHOULD exclude it from backup and export. A consumer asks for this when the key's value lies in being unexportable — the maintainer can sign with it and nothing can take it away — and accepts that losing the maintainer's storage destroys it permanently.
      *
@@ -137,6 +141,11 @@ export declare const PAYLOAD_SCHEMA: {
             readonly type: "string";
             readonly description: "Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it.";
         };
+        readonly keyId: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly description: "Durable identifier to give the new key. Where the maintainer derives from a seed it MAY default this to `derivationPath`, which is what makes the member optional for an ordinary create. It is **not** optional in practice for `internal: true`: such a key has no derivation path to be named after, so a maintainer that offers internal keys and receives no `keyId` has nothing to call the key and SHOULD reject the request. A maintainer MUST reject a `keyId` that collides with an existing key rather than overwrite it.";
+        };
         readonly internal: {
             readonly type: "boolean";
             readonly description: "Absent is the same as `false`, and this member deliberately declares no JSON Schema `default`: a declared default is materialised by generated bindings, so an absent `internal` would reappear as an explicit `false` on re-serialisation and break round-trip idempotence for every existing request document. Request a key generated from the maintainer's CSPRNG rather than derived from a seed. Such a key is reproducible from nothing: it is not recoverable from a recovery phrase, and a maintainer offering it SHOULD exclude it from backup and export. A consumer asks for this when the key's value lies in being unexportable — the maintainer can sign with it and nothing can take it away — and accepts that losing the maintainer's storage destroys it permanently.\n\nA maintainer that cannot mint such a key MUST reject the request rather than silently return a derived one, because the consumer's whole reason for asking is a property the derived key does not have. Consumers MUST confirm the outcome by reading `origin` on the returned record, which is `internal` iff the request was honoured; a maintainer that ignored an unrecognised member returns `derived`, and that difference is the consumer's only reliable signal.";
@@ -401,6 +410,11 @@ export declare const SPEC: {
                 readonly type: "string";
                 readonly description: "Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it.";
             };
+            readonly keyId: {
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly description: "Durable identifier to give the new key. Where the maintainer derives from a seed it MAY default this to `derivationPath`, which is what makes the member optional for an ordinary create. It is **not** optional in practice for `internal: true`: such a key has no derivation path to be named after, so a maintainer that offers internal keys and receives no `keyId` has nothing to call the key and SHOULD reject the request. A maintainer MUST reject a `keyId` that collides with an existing key rather than overwrite it.";
+            };
             readonly internal: {
                 readonly type: "boolean";
                 readonly description: "Absent is the same as `false`, and this member deliberately declares no JSON Schema `default`: a declared default is materialised by generated bindings, so an absent `internal` would reappear as an explicit `false` on re-serialisation and break round-trip idempotence for every existing request document. Request a key generated from the maintainer's CSPRNG rather than derived from a seed. Such a key is reproducible from nothing: it is not recoverable from a recovery phrase, and a maintainer offering it SHOULD exclude it from backup and export. A consumer asks for this when the key's value lies in being unexportable — the maintainer can sign with it and nothing can take it away — and accepts that losing the maintainer's storage destroys it permanently.\n\nA maintainer that cannot mint such a key MUST reject the request rather than silently return a derived one, because the consumer's whole reason for asking is a property the derived key does not have. Consumers MUST confirm the outcome by reading `origin` on the returned record, which is `internal` iff the request was honoured; a maintainer that ignored an unrecognised member returns `derived`, and that difference is the consumer's only reliable signal.";

package/dist/keys/create/0.1/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACrD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC7C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6CAAsD,CAAC;AAE/E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAExC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,sDAA+D,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmKjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+H1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMhB,CAAC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../../../src/keys/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AACrD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAC7C;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,GAAG,CAAC;CACX;AACD;;GAEG;AACH,MAAM,WAAW,GAAG;IAClB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AACD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;IAClB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AACD;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAClC;AAED,2BAA2B;AAC3B,eAAO,MAAM,QAAQ,EAAG,6CAAsD,CAAC;AAE/E,mEAAmE;AACnE,MAAM,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAExC,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,EAAG,sDAA+D,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwKjB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+H1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMP,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMhB,CAAC"}

package/dist/keys/create/0.1/payload.js

@@ -33,6 +33,11 @@ export const PAYLOAD_SCHEMA = {
             "type": "string",
             "description": "Hierarchical-deterministic path to derive at. Where the custodian derives from a seed, supplying the path makes the key reproducible from that seed; omitting it leaves the choice to the custodian. MUST NOT be combined with `internal: true`, which derives from no seed and records no path — a request carrying both is contradictory and the maintainer SHOULD reject it."
         },
+        "keyId": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Durable identifier to give the new key. Where the maintainer derives from a seed it MAY default this to `derivationPath`, which is what makes the member optional for an ordinary create. It is **not** optional in practice for `internal: true`: such a key has no derivation path to be named after, so a maintainer that offers internal keys and receives no `keyId` has nothing to call the key and SHOULD reject the request. A maintainer MUST reject a `keyId` that collides with an existing key rather than overwrite it."
+        },
         "internal": {
             "type": "boolean",
             "description": "Absent is the same as `false`, and this member deliberately declares no JSON Schema `default`: a declared default is materialised by generated bindings, so an absent `internal` would reappear as an explicit `false` on re-serialisation and break round-trip idempotence for every existing request document. Request a key generated from the maintainer's CSPRNG rather than derived from a seed. Such a key is reproducible from nothing: it is not recoverable from a recovery phrase, and a maintainer offering it SHOULD exclude it from backup and export. A consumer asks for this when the key's value lies in being unexportable — the maintainer can sign with it and nothing can take it away — and accepts that losing the maintainer's storage destroys it permanently.\n\nA maintainer that cannot mint such a key MUST reject the request rather than silently return a derived one, because the consumer's whole reason for asking is a property the derived key does not have. Consumers MUST confirm the outcome by reading `origin` on the returned record, which is `internal` iff the request was honoured; a maintainer that ignored an unrecognised member returns `derived`, and that difference is the consumer's only reliable signal."

package/dist/keys/create/0.1/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA0GH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6CAAsD,CAAC;AAK/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sDAA+D,CAAC;AAKjG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,6CAA6C;IACpD,OAAO,EAAE,uBAAuB;IAChC,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,SAAS;KACV;IACD,YAAY,EAAE;QACZ,SAAS,EAAE;YACT,MAAM,EAAE,iBAAiB;YACzB,aAAa,EAAE,wBAAwB;SACxC;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,iXAAiX;SACjY;QACD,UAAU,EAAE;YACV,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,ssCAAssC;SACttC;QACD,UAAU,EAAE;YACV,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,scAAsc;SACtd;QACD,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,yDAAyD;SACzE;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,iHAAiH;SACjI;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,gCAAgC;YACzC,aAAa,EAAE,yLAAyL;YACxM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,oFAAoF;iBACpG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,mHAAmH;iBACnI;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,+FAA+F;iBAC/G;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mIAAmI;iBACnJ;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qHAAqH;iBACrI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,wFAAwF;iBACxG;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kRAAkR;iBAClS;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8DAA8D;iBAC9E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2EAA2E;iBAC3F;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,UAAU;gBACV,UAAU;aACX;YACD,aAAa,EAAE,8wBAA8wB;YAC7xB,SAAS,EAAE,SAAS;SACrB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,SAAS;aACV;YACD,aAAa,EAAE,+KAA+K;SAC/L;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP;YACD,aAAa,EAAE,sJAAsJ;SACtK;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,gCAAgC;YACzC,aAAa,EAAE,yLAAyL;YACxM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,oFAAoF;iBACpG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,mHAAmH;iBACnI;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,+FAA+F;iBAC/G;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mIAAmI;iBACnJ;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qHAAqH;iBACrI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,wFAAwF;iBACxG;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kRAAkR;iBAClS;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8DAA8D;iBAC9E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2EAA2E;iBAC3F;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,UAAU;gBACV,UAAU;aACX;YACD,aAAa,EAAE,8wBAA8wB;YAC7xB,SAAS,EAAE,SAAS;SACrB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,SAAS;aACV;YACD,aAAa,EAAE,+KAA+K;SAC/L;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP;YACD,aAAa,EAAE,sJAAsJ;SACtK;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../../src/keys/create/0.1/payload.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8GH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,QAAQ,GAAG,6CAAsD,CAAC;AAK/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sDAA+D,CAAC;AAKjG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,SAAS,EAAE,8CAA8C;IACzD,KAAK,EAAE,6CAA6C;IACpD,OAAO,EAAE,uBAAuB;IAChC,MAAM,EAAE,QAAQ;IAChB,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE;QACV,SAAS;KACV;IACD,YAAY,EAAE;QACZ,SAAS,EAAE;YACT,MAAM,EAAE,iBAAiB;YACzB,aAAa,EAAE,wBAAwB;SACxC;QACD,gBAAgB,EAAE;YAChB,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,iXAAiX;SACjY;QACD,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,sgBAAsgB;SACthB;QACD,UAAU,EAAE;YACV,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,ssCAAssC;SACttC;QACD,UAAU,EAAE;YACV,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,scAAsc;SACtd;QACD,OAAO,EAAE;YACP,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,yDAAyD;SACzE;QACD,WAAW,EAAE;YACX,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,iHAAiH;SACjI;QACD,KAAK,EAAE;YACL,MAAM,EAAE,aAAa;YACrB,aAAa,EAAE,yDAAyD;SACzE;KACF;IACD,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,gCAAgC;YACzC,aAAa,EAAE,yLAAyL;YACxM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,oFAAoF;iBACpG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,mHAAmH;iBACnI;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,+FAA+F;iBAC/G;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mIAAmI;iBACnJ;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qHAAqH;iBACrI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,wFAAwF;iBACxG;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kRAAkR;iBAClS;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8DAA8D;iBAC9E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2EAA2E;iBAC3F;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,UAAU;gBACV,UAAU;aACX;YACD,aAAa,EAAE,8wBAA8wB;YAC7xB,SAAS,EAAE,SAAS;SACrB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,SAAS;aACV;YACD,aAAa,EAAE,+KAA+K;SAC/L;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP;YACD,aAAa,EAAE,sJAAsJ;SACtK;KACF;CACO,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS,EAAE,8CAA8C;IACzD,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE;QACP,UAAU,EAAE;YACV,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,gCAAgC;YACzC,aAAa,EAAE,yLAAyL;YACxM,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,KAAK;aACN;YACD,YAAY,EAAE;gBACZ,KAAK,EAAE;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,aAAa,EAAE,oFAAoF;iBACpG;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,KAAK,EAAE;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,uKAAuK;YACtL,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,CAAC;YAClB,sBAAsB,EAAE,IAAI;YAC5B,eAAe,EAAE;gBACf,SAAS,EAAE,mCAAmC;aAC/C;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,sBAAsB,EAAE,KAAK;YAC7B,UAAU,EAAE;gBACV,OAAO;gBACP,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,WAAW;aACZ;YACD,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,mHAAmH;iBACnI;gBACD,SAAS,EAAE;oBACT,MAAM,EAAE,iBAAiB;iBAC1B;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,CAAC;oBACd,aAAa,EAAE,+FAA+F;iBAC/G;gBACD,gBAAgB,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,mIAAmI;iBACnJ;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,CAAC;oBACZ,aAAa,EAAE,qHAAqH;iBACrI;gBACD,QAAQ,EAAE;oBACR,MAAM,EAAE,mBAAmB;iBAC5B;gBACD,OAAO,EAAE;oBACP,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,wFAAwF;iBACxG;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,aAAa,EAAE,kRAAkR;iBAClS;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,8DAA8D;iBAC9E;gBACD,WAAW,EAAE;oBACX,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,WAAW;oBACrB,aAAa,EAAE,2EAA2E;iBAC3F;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,aAAa;iBACtB;aACF;SACF;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,UAAU;gBACV,UAAU;aACX;YACD,aAAa,EAAE,8wBAA8wB;YAC7xB,SAAS,EAAE,SAAS;SACrB;QACD,WAAW,EAAE;YACX,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,QAAQ;gBACR,SAAS;aACV;YACD,aAAa,EAAE,+KAA+K;SAC/L;QACD,SAAS,EAAE;YACT,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE;gBACN,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP;YACD,aAAa,EAAE,sJAAsJ;SACtK;KACF;CACO,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,cAAc;CACrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,KAAK;IACf,eAAe,EAAE,IAAI;IACrB,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE,uBAAuB;CAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openvtc/trust-tasks",
-  "version": "0.12.17",
+  "version": "0.13.1",
   "description": "Generated TypeScript bindings for the Trust Tasks framework registry.",
   "type": "module",
   "main": "./dist/index.js",

package/src/_runtime/canonical.ts

@@ -0,0 +1,159 @@
+/**
+ * Deterministic document serialization and the SHA-256 digest over it.
+ *
+ * Mirrors `canonical.rs` in trust-tasks-rs. SPEC §7.2 (*Keying and comparison
+ * for item 11*) defines two documents sharing an `id` as **the same document**
+ * when their serializations are identical under RFC 8785 canonicalization —
+ * the same identity §8.4 gives a retry. A consumer implementing item 11 has to
+ * retain a digest of what it accepted, not merely the `id`.
+ *
+ * `canonicalJson` here is closer to literal RFC 8785 than the Rust side is,
+ * because JavaScript's own primitives are what JCS was specified against:
+ * `Array.prototype.sort()` orders by UTF-16 code unit, and `JSON.stringify`
+ * formats numbers with `Number::toString` and escapes strings with exactly the
+ * §3.2.2.2 escape set. The only thing this adds is recursive member ordering.
+ *
+ * The item-11 digest is **consumer-local**: it goes into this consumer's own
+ * replay record and never onto the wire, into a citation, or into a proof. It
+ * is *not* the §4.9.3 task digest, which is computed over `document ∖ proof`
+ * and is a published, multibase-encoded multihash. See `replay.ts`.
+ *
+ * Hand-written, and dependency-free on purpose: this package ships no runtime
+ * dependencies, and `node:crypto` would not resolve in a browser or a worker.
+ */
+
+/**
+ * Serialize `value` with object members recursively ordered and no
+ * insignificant whitespace.
+ *
+ * `undefined` members are omitted, as `JSON.stringify` omits them — which is
+ * what makes this agree with the document as it would be sent.
+ */
+export function canonicalJson(value: unknown): string {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  if (Array.isArray(value)) return `[${value.map((v) => canonicalJson(v)).join(",")}]`;
+
+  const entries = Object.entries(value as Record<string, unknown>)
+    .filter(([, v]) => v !== undefined)
+    // RFC 8785 §3.2.3: sort by UTF-16 code unit, which is what the default
+    // comparator does after String() — and these are already strings.
+    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+
+  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+}
+
+const K = new Uint32Array([
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+
+const rotr = (x: number, n: number): number => (x >>> n) | (x << (32 - n));
+
+/**
+ * UTF-8 encode `s`, without `TextEncoder`.
+ *
+ * `TextEncoder` is a host global, not an ES2022 one: this package's `lib` is
+ * `["ES2022"]` and adding `DOM` to reach one name would pull the whole browser
+ * surface into a package that must also typecheck for Node and for workers.
+ * Fifteen lines is the cheaper price.
+ *
+ * Unpaired surrogates — which `JSON.parse` will produce from a `\uD800` escape
+ * — encode as U+FFFD, matching `TextEncoder`. Two documents differing only in
+ * an unpaired surrogate would therefore collide; they are not valid JSON text
+ * to begin with, and the collision absorbs a duplicate rather than executing
+ * one, so it fails safe.
+ */
+function utf8(s: string): Uint8Array {
+  const out: number[] = [];
+  for (let i = 0; i < s.length; i++) {
+    let cp = s.charCodeAt(i);
+    if (cp >= 0xd800 && cp <= 0xdbff && i + 1 < s.length) {
+      const low = s.charCodeAt(i + 1);
+      if (low >= 0xdc00 && low <= 0xdfff) {
+        cp = 0x10000 + ((cp - 0xd800) << 10) + (low - 0xdc00);
+        i++;
+      }
+    }
+    if (cp >= 0xd800 && cp <= 0xdfff) cp = 0xfffd; // unpaired surrogate
+
+    if (cp < 0x80) out.push(cp);
+    else if (cp < 0x800) out.push(0xc0 | (cp >> 6), 0x80 | (cp & 0x3f));
+    else if (cp < 0x10000)
+      out.push(0xe0 | (cp >> 12), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f));
+    else
+      out.push(
+        0xf0 | (cp >> 18),
+        0x80 | ((cp >> 12) & 0x3f),
+        0x80 | ((cp >> 6) & 0x3f),
+        0x80 | (cp & 0x3f),
+      );
+  }
+  return Uint8Array.from(out);
+}
+
+/**
+ * FIPS 180-4 SHA-256 over the UTF-8 encoding of `input`, as lowercase hex.
+ *
+ * Synchronous by necessity: `crypto.subtle.digest` is a Promise, and the
+ * consume pipeline needs the digest before it decides whether to await
+ * anything. Pinned to the standard's published vectors in `test/`.
+ */
+export function sha256Hex(input: string): string {
+  const bytes = utf8(input);
+  const bitLen = bytes.length * 8;
+
+  // Pad to a multiple of 64 bytes: 0x80, zeroes, then the 64-bit big-endian
+  // bit length.
+  const padded = new Uint8Array(Math.ceil((bytes.length + 9) / 64) * 64);
+  padded.set(bytes);
+  padded[bytes.length] = 0x80;
+  const view = new DataView(padded.buffer);
+  // Lengths above 2^53 bits are unreachable from a JS string; the high word is
+  // written anyway so the padding is well-formed.
+  view.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000), false);
+  view.setUint32(padded.length - 4, bitLen >>> 0, false);
+
+  const h = new Uint32Array([
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+  ]);
+  const w = new Uint32Array(64);
+
+  for (let offset = 0; offset < padded.length; offset += 64) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(offset + i * 4, false);
+    for (let i = 16; i < 64; i++) {
+      const s0 = rotr(w[i - 15]!, 7) ^ rotr(w[i - 15]!, 18) ^ (w[i - 15]! >>> 3);
+      const s1 = rotr(w[i - 2]!, 17) ^ rotr(w[i - 2]!, 19) ^ (w[i - 2]! >>> 10);
+      w[i] = (w[i - 16]! + s0 + w[i - 7]! + s1) >>> 0;
+    }
+
+    let [a, b, c, d, e, f, g, hh] = [h[0]!, h[1]!, h[2]!, h[3]!, h[4]!, h[5]!, h[6]!, h[7]!];
+    for (let i = 0; i < 64; i++) {
+      const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = (e & f) ^ (~e & g);
+      const temp1 = (hh + s1 + ch + K[i]! + w[i]!) >>> 0;
+      const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = (a & b) ^ (a & c) ^ (b & c);
+      const temp2 = (s0 + maj) >>> 0;
+
+      hh = g;
+      g = f;
+      f = e;
+      e = (d + temp1) >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = (temp1 + temp2) >>> 0;
+    }
+
+    const next = [a, b, c, d, e, f, g, hh];
+    for (let i = 0; i < 8; i++) h[i] = (h[i]! + next[i]!) >>> 0;
+  }
+
+  return Array.from(h, (word) => word.toString(16).padStart(8, "0")).join("");
+}