fixup! diigo-cache: bookmark cache in Durable Objects (goal 1c)

Docs per the docs-files-api skill: a 1–2 line @file; what a declaration is or does in JSDoc on it, not in // comments or the file header.

Generated-by: Claude Opus 5.5

diigo-cache/src/webkeys.ts

@@ -1,30 +1,4 @@
-/**
- * @file webkeys: URL-borne bearer permissions, per Tyler Close's
- * ["web-key: Mashing with permission"](https://waterken.sourceforge.net/web-key/)
- * (IEEE W2SP 2008); the design abstract lives in
- * [docs/webkeys.md](../../docs/webkeys.md), with the Waterken precursor
- * code in `kpreid/e-on-java` as provenance (YURL32 = `org.waterken.uri.
- * Base32` / `BigIntegerSugar.toYURL32`; bearer invariant = `EARL.java`;
- * identity-without-authority = `SwissTable`'s swissHash).
- *
- * A webkey separates secret from address:
- * - the **secret bits**: supplied directly by the caller as a Worker
- *   unique ID (e.g. `DurableObjectId` from `ns.newUniqueId()`), or raw
- *   bytes (`Uint8Array`). Per [OCap discipline]
- *   (.opencode/skills/ocap-discipline/SKILL.md), functions here are pure:
- *   no ambient RNG calls, no callback indirection. The caller holds the
- *   minting authority at the application boundary and supplies the result.
- * - the **encoding**: YURL32 — lowercase `a–z` + `2–7`, 5 bits/char,
- *   URL-safe by construction (no `-`, no `_`, no case to misread).
- *
- * Cloudflare Worker `DurableObjectId`s are 256 bits (32 bytes), rendered
- * as 64 hex characters by `id.toString()`. {@link toWebkey} encodes that
- * ID into 52 YURL32 glyphs; {@link idFromWebkey} decodes it back to the
- * 64-hex string expected by `ns.idFromString()`.
- *
- * {@link shashKey} gives the identity-without-authority twin (the
- * swissHash discipline) for log-correlation: one-way, on SHA-256.
- */
+/** @file webkeys: URL-borne bearer keys, YURL32-encoded; see {@link toWebkey}. */
 
 /** the YURL32 alphabet: `a–z` then `2–7` (32 glyphs, 5 bits each) */
 const YURL32_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567" as const;
@@ -125,6 +99,20 @@ export type WorkerUniqueId = DurableObjectIdLike | Uint8Array;
 /**
  * Convert a Worker unique ID (or raw bytes) to a YURL32 webkey string.
  *
+ * A webkey separates secret from address. The secret bits are supplied by
+ * the caller (a `DurableObjectId` from `ns.newUniqueId()`, or raw bytes):
+ * these functions are pure, with no ambient RNG; the caller holds the
+ * minting authority. The encoding is YURL32: lowercase `a–z` + `2–7`,
+ * 5 bits per glyph, URL-safe by construction. A 256-bit `DurableObjectId`
+ * (64 hex characters) becomes 52 glyphs; {@link idFromWebkey} decodes it
+ * back for `ns.idFromString()`.
+ *
+ * Provenance: Tyler Close's web-key (IEEE W2SP 2008) and the Waterken code
+ * in `kpreid/e-on-java` (YURL32 = `org.waterken.uri.Base32`); the design
+ * abstract is docs/webkeys.md.
+ *
+ * @see https://waterken.sourceforge.net/web-key/
+ *
  * @param id A `DurableObjectId` (from `ns.newUniqueId()`), a 64-char hex ID,
  * or raw bytes (`Uint8Array`).
  * @returns A YURL32 webkey string (52 glyphs for 256-bit `DurableObjectId`,