fix: Closes some divergences between Rust <> TypeScript

.github/dependabot.yml

@@ -5,6 +5,7 @@ updates:
     schedule:
       interval: "weekly"
     labels: [ "dependencies" ]
+    reviewers: ["leonardocustodio"]
     groups:
       node:
         patterns:
@@ -13,6 +14,7 @@ updates:
   - package-ecosystem: github-actions
     directory: '/'
     labels: [ "gh-actions" ]
+    reviewers: ["leonardocustodio"]
     schedule:
       interval: weekly
     groups:

.github/workflows/ci.yml

@@ -16,15 +16,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '24'
 
@@ -64,15 +64,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '24'
 
@@ -120,6 +120,6 @@ jobs:
           test "$mismatch_status" -eq 1
           printf '%s\n' "$mismatch" | grep -q ' 1 MISMATCH$'
           test "$classes_status" -eq 0
-          printf '%s\n' "$classes" | grep -q '^4 vectors - 1 match, 1 panic-mapped, 2 js-only (J3 1, J4 1), 0 unparsable, 0 MISMATCH$'
+          printf '%s\n' "$classes" | grep -q '^3 vectors - 1 match, 2 js-only (J3 1, J4 1), 0 unparsable, 0 MISMATCH$'
           test "$malformed_status" -eq 1
           printf '%s\n' "$malformed" | grep -q ', 1 unparsable, 0 MISMATCH$'

.github/workflows/docs.yml

@@ -19,15 +19,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '24'
 
@@ -41,10 +41,10 @@ jobs:
         run: test -s docs/index.html
 
       - name: Setup Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: docs
 
@@ -62,4 +62,4 @@ jobs:
     steps:
       - name: Deploy
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5

.github/workflows/release.yml

@@ -16,15 +16,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: latest
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/upstream.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install yq
         run: |

.gitignore

@@ -38,5 +38,13 @@ bench/charts/*.html
 # Rust cross-validation harness build artifacts
 tests/rust-validation/target
 
-# The baseline closure is installed, not committed
-tests/baseline/node_modules/
+# Lockfile: intentionally absent until @blockchaincommons/provenance-mark
+# 1.0.0-beta.3 is on npm (the registry has beta.2, and this package needs the
+# newer one; every other dependency is published). Until then nothing can be
+# resolved from the registry at all, and a local install resolves that
+# dependency through the workspace link, which would bake an unpublishable
+# path into the lockfile. The lockfile that used to be committed here listed
+# only devDependencies and no runtime ones, so `--frozen-lockfile` failed on
+# it. Once provenance-mark publishes, commit a real lockfile and switch the
+# workflows to `bun install --frozen-lockfile`.
+bun.lock

.prettierignore

@@ -1,4 +1,3 @@
 tests/baseline/*.mjs
 tests/baseline/*.d.mts
-tests/baseline/node_modules
 tests/vectors/vectors.json

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 1.0.0-beta.3 - 2026-09-16
+
+### Changed (breaking)
+
+- **Dates are `DateInput`.** `XIDGenesis.date` and the next-mark options' `date` take a `Date` or a `CborDate` (provenance-mark's `DateInput`, re-exported), as every date input in envelope, gstp and provenance-mark does. A value of another kind is a `TypeError`; a `Date` without a time is now `ProvenanceMark` with cause `InvalidDate`, the generator's own check, where it was a `TypeError`.
+- **Object arguments are checked for their class.** An argument that is not the class the API names is a `TypeError` naming the argument: the inception key (`PublicKeys`, a `PrivateKeyBase`, or a pair whose `publicKeys` and `privateKeys` are checked), `addKey`, `addService`, `addDelegate`, `setProvenance`, both arguments of `setProvenanceWithGenerator`, the generator of `nextProvenanceMarkWithProvidedGenerator`, `Provenance.from`, `setMark`, `setGenerator`, and `XIDDocument.equals`/`Provenance.equals`. A plain object used to crash inside a sibling package (`undefined is not an object`) or, for the marks, to be stored and fail at the next `toEnvelope`. `Provenance.equals` names its own argument (`other must be a Provenance`).
+- `Provenance.equals` compares generators through `ProvenanceMarkGenerator.equals` instead of their JSON.
+- **`Delegate.from` copies the controller.** The delegate holds its own copy of the document it was built from, taken at construction, as the reference's `Delegate::new` clones it; a later change to the caller's document is not seen. `delegate.controller` is the live handle to that copy. (`Delegate.clone()` and `XIDDocument.clone()` still copy; the reference's clones share the controller through its `Shared` handle, a mechanism a JavaScript `Map` does not need.)
+- **`HasPermissions` carries the reference's names.** On `Key`, `Service`, `Delegate` and `Permissions`: `allow` and `deny` are the read-only sets, `addAllow`, `addDeny`, `removeAllow`, `removeDeny` and `clearAllPermissions` edit them; `Key.addPermission` is the reference's alias of `addAllow`. The carriers' `allow(p)`/`deny(p)` adders and `Permissions.clear` are gone, as are `Permissions.isAllowed`/`isDenied`, a precedence rule the reference does not define.
+- **Lookups, checks and extraction under the reference's names.** `findKeyByPublicKeys`, `findKeyByReference`, `findDelegateByXid`, `findDelegateByReference`, `findServiceByUri`; `checkContainsKey`, `checkContainsDelegate`, `checkServicesConsistency`, `checkServiceConsistency` (all `void`); `extractInceptionPrivateKeysFromEnvelope`; `getAttachment`. `key`, `keyByReference`, `delegate`, `delegateByReference`, `service`, `expectKey`, `expectDelegate`, `expectServicesConsistent`, `expectServiceConsistent`, `inceptionPrivateKeysFromEnvelope`, `attachment` and `edge` are gone (`getEdge` stays).
+- **Two next-mark methods.** `nextProvenanceMarkWithEmbeddedGenerator({ password?, date?, info? })` and `nextProvenanceMarkWithProvidedGenerator(generator, { date?, info? })` replace `nextProvenanceMark`, each with the reference's preconditions (`NoGenerator`/`InvalidPassword`, `GeneratorConflict`); `NextProvenanceMarkOptions` lost `generator`, `ProvidedGeneratorOptions` is new.
+- **Returns that carry the item.** `removeResolutionMethod` returns the `URI` removed (or `undefined`); `Provenance.takeGenerator` returns `TakenGenerator` — the generator as held (`GeneratorData`, in the clear or the locked envelope) with its salt — or `undefined`.
+- **Removals the reference has.** `Key.removeEndpoint`, `Service.removeKeyReference`, `Service.removeDelegateReference` (the reference's `endpoints_mut`, `key_referenecs_mut`, `delegate_references_mut`), each returning whether the item was there.
+- **Gone.** `Service.addKeyReferenceHex`/`addDelegateReferenceHex` (write `addKeyReference(Reference.fromHex(hex))`); `Delegate.fromEnvelope`'s `parseDocument` option with `DelegateParseOptions` and `ParseXIDDocument` (the controller is always parsed with `XIDDocument.fromEnvelope`).
+- `EmptyValue`'s detail is `field`, the reference's name; `ItemDetails` covers the three `item` codes and `EmptyValueDetails` the fourth.
+- Requires `@blockchaincommons/provenance-mark` 1.0.0-beta.3.
+
+### Added
+
+- `examples/document.ts`: builds a document with a genesis mark, keys, a service and a delegate, signs it into an envelope, parses it back verified and advances the chain.
+- `tests/guards.test.ts`: every guard against eight plain values and a property over arbitrary non-instance values; `CborDate` at both date inputs; generator equality through an envelope round trip.
+- The frozen baseline for the differential is this package's 1.0.0-beta.2 with the `@blockchaincommons` siblings inlined, built by `scripts/build-baseline.ts`; the `@bcts/xid` closure is gone from the package.
+- Vectors for the removers, both next-mark forms (the caller's generator advanced in place, a stale one, another chain, no mark, the document's own generator in the way), `takeGenerator` on absent, clear, unlocked and locked generators, and a delegate whose source document keeps changing after the delegate was built; the harness replays them all against the reference. The panic-mapped class is gone with the hex adders: a reference panic is a MISMATCH.
+- `GeneratorData`, `TakenGenerator`, `ProvidedGeneratorOptions`, `EmptyValueDetails`.
+
+### Verification
+
+- Rust harness: 389 vectors - 362 match, 27 js-only (J3 23, J4 4), 0 unparsable, 0 MISMATCH.
+
 ## 1.0.0-beta.2 - 2026-09-16
 
 ### Changed (breaking)
@@ -23,4 +52,4 @@
 
 ## 1.0.0-beta.1
 
-- Initial beta implementation
+- Initial beta implementation

CLA.md

@@ -8,7 +8,7 @@ E-Mail: `$email`
 
 Legal Jurisdiction: Wyoming, United States of America
 
-Project: https://github.com/BlockchainCommons/bc-lethe-kit
+Project: https://github.com/BlockchainCommons/bc-xid-ts
 
 Date: `$date`