DID minting has been completely broken since the didwebvh-ts 2.8 upgrade

[brianorwhatever]

The re-mint still didn't fire after #217. The cause turned out to be much bigger than the re-mint.

No did:webvh can be created at all — and hasn't been since the didwebvh-ts 2.8 upgrade in this branch series. Every mint throws:

Key did:key:z6Mk… is not authorized to update.

Root cause

2.8's isKeyAuthorized parses the proof's verificationMethod down to its bare keyMultibase, then compares by exact equality:

var isKeyAuthorized = (verificationMethod, updateKeys) => {
  const parsed = parseDidKeyVerificationMethod(verificationMethod);  // → "z6Mk…"
  return updateKeys.some((updateKey) => updateKey === parsed.keyMultibase);
};

Every call site passed signer.getVerificationMethodId() — the full did:key:z6Mk… URI. "did:key:z6Mk…" === "z6Mk…" is never true. didwebvh-ts verifies the log it has just created, so creation fails closed.

How I found it, and a theory I had to discard

I reproduced it locally with a brand-new key and empty localStorage, and it failed identically. That killed my earlier explanation — I'd concluded this was about a controller key lost with the old origin, and built #216's key-intersection authorization on that premise. It was wrong: the failure has nothing to do with which key you hold.

It also explains why prod logs showed no remintDid invocation: the hook died in the browser at the mint step, before any request was ever made. #216 and #217 were both fixing the wrong layer.

Scope

Fixed at all four call sites:

Site	Impact
src/lib/webvh.ts	user DIDs — signup and re-mint
convex/didCreation.ts	server-side DID creation
convex/siteActions.ts ×2	createDID and updateDID — site publishing had the same defect

Test

scripts/webvh-mint.test.mjs performs a real mint. didwebvh-ts verifies its own output, so a malformed updateKeys fails the test exactly as it failed in the browser — this specific regression cannot return silently.

The harness installs browser globals via defineProperty (bun exposes a readonly localStorage) and restores them afterwards, since bun shares globals across test files.

Also

Removes convex/remintDid.ts. It was meant to go in #217 — the rm was inside a command the sandbox blocked, so it merged as dead code. The client now uses the JWT-authorized /api/user/remintDid endpoint.

116 pass / 0 fail; both typechecks clean; lint on touched files clean (the 9 pre-existing convex/ problems are unchanged from main).

After merge

Wait for Railway to finish, not just Deploy Convex — the last two attempts tested a stale bundle. Then sign in and expect a [remint] line plus a reload. Verify with:

npx convex run --prod migrations/remintUserDidDb:listUsersOnDomain '{"domain":"trypoo.app"}'

🤖 Generated with Claude Code

Note

Fix DID minting broken by didwebvh-ts 2.8 by using raw publicKeyMultibase in updateKeys

didwebvh-ts 2.8 changed key authorization to compare exact keyMultibase values, but the code was still passing verificationMethodId strings to updateKeys, breaking all DID minting.

• Updates createUserWebVHDid, createDIDRecord, and both siteActions handlers to pass the bare publicKeyMultibase instead of verificationMethodId
• Deletes the now-unused remintDid.ts module and removes it from generated API types
• Adds a Node integration test in scripts/webvh-mint.test.mjs that verifies end-to-end DID minting produces a valid, non-stale did:webvh

^{Macroscope summarized 23434b6.}