@interop/wallet-core 0.24.0 → 0.25.0

package/README.md

@@ -80,22 +80,24 @@ The subpaths:
   adversarial host (parse shape, SCID and entry-hash recomputation, entry
   proofs, the external-authorization rule against the independently verified
   did:webvh controller document, terminal handover entries), the chain-head pin
-  with its continuity rules, the entry builders, and the read/append/create path
-  (compare-and-swap with rebase-and-retry, read-back confirmation). Transport
-  lives in [`@interop/was-client`](https://npm.im/@interop/was-client)'s `/log`
-  subpath; the hashing and proof kernel in
+  with its continuity rules, the entry builders, the read/append/create path
+  (compare-and-swap with rebase-and-retry, read-back confirmation), and the
+  sealing sweep -- the idempotent backstop append that re-anchors a log's head
+  past the controller's latest membership change. Transport lives in
+  [`@interop/was-client`](https://npm.im/@interop/was-client)'s `/log` subpath;
+  the hashing and proof kernel in
   [`@interop/did-method-webvh`](https://npm.im/@interop/did-method-webvh).
 
 - **`@interop/wallet-core/keys`** -- the user key and its wrap-set roster,
   governed by the `key-map/user-key.jsonl` resource log: minting, the roster's
   init/read/rotate primitives with their client-side guards (the verified log
   itself, the latest-seen epoch pin, the document-backed recipient resolver),
-  the log-governed descriptor store those primitives drive, and the user key
-  rotation cascade's per-collection op (re-epoch a collection onto the roster's
-  current user key, staleness detected from durable state alone, history
-  escrowed -- also the completion sweep's building block), plus the detector
-  that converges a roster left wrapping the current key to a recipient the
-  account document no longer keys. Also `ensureWalletSpaceEpochs`, the
+  the log-governed (and sealable) descriptor store those primitives drive, and
+  the user key rotation cascade's per-collection op (re-epoch a collection onto
+  the roster's current user key, staleness detected from durable state alone,
+  history escrowed -- also the completion sweep's building block), plus the
+  detector that converges a roster left wrapping the current key to a recipient
+  the account document no longer keys. Also `ensureWalletSpaceEpochs`, the
   provision-time install of each encrypted wallet collection's key epoch[0] (a
   fresh random epoch key wrapped to the user key) -- the EDV-bearing second step
   of `provisionWalletSpace`. Also the enrolled-client display labels
@@ -107,12 +109,14 @@ The subpaths:
 - **`@interop/wallet-core/clients`** -- the enrolled-client management surface:
   the listing over the locally verified did:webvh log with display labels
   merged, the disconnect-eligibility policy as pure functions, the revocation
-  cascade orchestrator (document edit, roster rotation, collection fan-out,
-  optional recovery re-mints), and the login-time roster policy.
+  cascade orchestrator (document edit, roster rotation with its seal backstop,
+  collection fan-out, optional recovery re-mints), and the login-time roster
+  policy (which now also seals a converged roster's governing log).
 
 - **`@interop/wallet-core/descriptors`** -- collection encryption-descriptor
-  acquisition (fetch / cache / offline fallback) and the unknown-epoch refresh
-  policy, including a self-refreshing EDV document cipher.
+  acquisition (fetch / cache / offline fallback), the log-governed descriptor
+  source (every read re-verifies the governing resource log), and the
+  unknown-epoch refresh policy, including a self-refreshing EDV document cipher.
 
 - **`@interop/wallet-core/keyring`** -- the unlock layer: the unlock derivation,
   the `{ version, wrapped }` account-pointer record codec, and the unlock Space

package/dist/clients/index.d.ts

@@ -15,19 +15,21 @@
  *   surfaces refuse the same rows for the same reasons and report a partial
  *   fan-out as the resumable success it is.
  * - `revokeAccountClient` -- the revocation cascade in dependency order
- *   (document edit, roster rotation, collection fan-out, optional recovery
- *   re-mints), with the app-specific stages injected.
+ *   (document edit, roster rotation with its seal backstop, collection
+ *   fan-out, optional recovery re-mints), with the app-specific stages
+ *   injected.
  * - `checkUserKeyRosterAtLogin` / `convergeUserKeyRosterToAccount` -- the
  *   login-time
  *   roster policy: which roster failures refuse a session, and the standing
- *   convergence of the roster onto the account document.
+ *   convergence of the roster onto the account document (recipients, then
+ *   the roster log's seal).
  */
 export { currentAccountSigningKeys, listAccountClients } from './listing.js';
 export type { AccountClientView, AccountLogPointer, VerifiedAccountLog } from './listing.js';
 export { cascadeCompletion, disconnectEligibility, revokedClientKeysFor } from './policy.js';
 export type { DisconnectRefusal } from './policy.js';
 export { revokeAccountClient } from './revocation.js';
-export type { CascadeCollections, ClientRevocationResult } from './revocation.js';
+export type { CascadeCollections, ClientRevocationResult, RosterSealReport } from './revocation.js';
 export { checkUserKeyRosterAtLogin, convergeUserKeyRosterToAccount } from './rosterPolicy.js';
 export type { AdoptedUserKey } from './rosterPolicy.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/clients/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAC5E,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAC5E,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/clients/index.js

@@ -15,12 +15,14 @@
  *   surfaces refuse the same rows for the same reasons and report a partial
  *   fan-out as the resumable success it is.
  * - `revokeAccountClient` -- the revocation cascade in dependency order
- *   (document edit, roster rotation, collection fan-out, optional recovery
- *   re-mints), with the app-specific stages injected.
+ *   (document edit, roster rotation with its seal backstop, collection
+ *   fan-out, optional recovery re-mints), with the app-specific stages
+ *   injected.
  * - `checkUserKeyRosterAtLogin` / `convergeUserKeyRosterToAccount` -- the
  *   login-time
  *   roster policy: which roster failures refuse a session, and the standing
- *   convergence of the roster onto the account document.
+ *   convergence of the roster onto the account document (recipients, then
+ *   the roster log's seal).
  */
 export { currentAccountSigningKeys, listAccountClients } from './listing.js';
 export { cascadeCompletion, disconnectEligibility, revokedClientKeysFor } from './policy.js';

package/dist/clients/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAO5E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAMrD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/clients/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAO5E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAOrD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC/B,MAAM,mBAAmB,CAAA"}

package/dist/clients/policy.d.ts

@@ -31,6 +31,7 @@
 import type { RevokedClientKeys } from '../webvh/index.js';
 import type { UserKeyCascadeResult } from '../keys/index.js';
 import type { AccountClientView } from './listing.js';
+import type { RosterSealReport } from './revocation.js';
 /**
  * Why a listed row cannot be disconnected. See the module doc.
  */
@@ -66,14 +67,21 @@ export declare function revokedClientKeysFor({ client }: {
 }): RevokedClientKeys;
 /**
  * How a completed cascade should be reported: `complete` when every encrypted
- * collection took the fresh key, `partial` when some did not -- a resumable
- * success, never an error (see the module doc).
+ * collection took the fresh key AND the roster's seal backstop did not fail,
+ * `partial` otherwise -- a resumable success, never an error (see the module
+ * doc). An unfinished seal is the same durable-staleness class as a stranded
+ * collection: "a governed log's head anchor predates the membership change"
+ * is detected from durable state alone, so a re-run (or the login sweep)
+ * finishes it.
  *
  * @param options {object}
  * @param options.collections {UserKeyCascadeResult}   the collection fan-out result
+ * @param [options.rosterSeal] {RosterSealReport}   the roster's seal-backstop
+ *   report, where the cascade ran one
  * @returns {'complete' | 'partial'}
  */
-export declare function cascadeCompletion({ collections }: {
+export declare function cascadeCompletion({ collections, rosterSeal }: {
     collections: UserKeyCascadeResult;
+    rosterSeal?: RosterSealReport;
 }): 'complete' | 'partial';
 //# sourceMappingURL=policy.d.ts.map

package/dist/clients/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAC3B,MAAM,GAAG,aAAa,GAAG,yBAAyB,CAAA;AAEpD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAC7B,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iBAAiB,CAYpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,WAAW,EACZ,EAAE;IACD,WAAW,EAAE,oBAAoB,CAAA;CAClC,GAAG,UAAU,GAAG,SAAS,CAEzB"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAC3B,MAAM,GAAG,aAAa,GAAG,yBAAyB,CAAA;AAEpD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;IACzB,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAC7B,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAWpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iBAAiB,CAYpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EACX,EAAE;IACD,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,CAAC,EAAE,gBAAgB,CAAA;CAC9B,GAAG,UAAU,GAAG,SAAS,CAIzB"}

package/dist/clients/policy.js

@@ -42,14 +42,22 @@ export function revokedClientKeysFor({ client }) {
 }
 /**
  * How a completed cascade should be reported: `complete` when every encrypted
- * collection took the fresh key, `partial` when some did not -- a resumable
- * success, never an error (see the module doc).
+ * collection took the fresh key AND the roster's seal backstop did not fail,
+ * `partial` otherwise -- a resumable success, never an error (see the module
+ * doc). An unfinished seal is the same durable-staleness class as a stranded
+ * collection: "a governed log's head anchor predates the membership change"
+ * is detected from durable state alone, so a re-run (or the login sweep)
+ * finishes it.
  *
  * @param options {object}
  * @param options.collections {UserKeyCascadeResult}   the collection fan-out result
+ * @param [options.rosterSeal] {RosterSealReport}   the roster's seal-backstop
+ *   report, where the cascade ran one
  * @returns {'complete' | 'partial'}
  */
-export function cascadeCompletion({ collections }) {
-    return collections.failed.length > 0 ? 'partial' : 'complete';
+export function cascadeCompletion({ collections, rosterSeal }) {
+    return collections.failed.length > 0 || rosterSeal?.outcome === 'failed'
+        ? 'partial'
+        : 'complete';
 }
 //# sourceMappingURL=policy.js.map

package/dist/clients/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAwCA;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,WAAW,EAGZ;IACC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/clients/policy.ts"],"names":[],"mappings":"AAyCA;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EAGP;IACC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IACD,OAAO;QACL,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;QACzD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;KAC9C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,WAAW,EACX,UAAU,EAIX;IACC,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,OAAO,KAAK,QAAQ;QACtE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}

package/dist/clients/revocation.d.ts

@@ -21,7 +21,11 @@
  *    log this call just extended). The roster delivers, never sources, so the
  *    revoked client's entry is dropped even before the retire filter. An
  *    account with no roster yet stops here: the client IS disconnected, with
- *    nothing to rotate.
+ *    nothing to rotate. On a sealable (log-governed) roster store, the seal
+ *    backstop follows: a rotation that no-op'd appended nothing, so the
+ *    roster log may still be anchored before the document edit -- `seal()`
+ *    re-anchors it with an idempotent no-op entry, best-effort and reported
+ *    rather than thrown.
  * 3. **The collection fan-out**: every encrypted collection is re-epoch'd onto
  *    the fresh key in parallel, so writes stop landing under epochs the
  *    revoked client can still decrypt. Failures are collected per collection
@@ -49,6 +53,18 @@ import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import { type ClientWebvhUpdateKeys, type RevokedClientKeys, type WebvhIdStore } from '../webvh/index.js';
 import { type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
+/**
+ * What the roster's seal backstop reported: `sealed` (the roster log's head
+ * still anchored before the document edit, and the backstop append landed),
+ * `noop` (already sealed -- the rotation itself was the sealing append, or a
+ * re-run found nothing to do), or `failed` (the seal could not run; carried
+ * in `error`, never thrown -- the cascade stays a resumable success and the
+ * login sweep re-seals).
+ */
+export interface RosterSealReport {
+    outcome: 'sealed' | 'noop' | 'failed';
+    error?: unknown;
+}
 /**
  * Where the cascade's collection fan-out gets its work: which encrypted
  * collections exist (only the app knows -- a mobile replica names the
@@ -64,11 +80,13 @@ export interface CascadeCollections {
 /**
  * What a completed cascade reports: whether the roster actually rotated on
  * this run (a re-run of an already-complete revocation reports `false`), the
- * per-collection fan-out result, the document as the edit left it, and the
- * recovery re-mint counts when that stage ran.
+ * roster's seal-backstop report (present when the roster store is sealable
+ * and the roster stage ran), the per-collection fan-out result, the document
+ * as the edit left it, and the recovery re-mint counts when that stage ran.
  */
 export interface ClientRevocationResult {
     rotated: boolean;
+    rosterSeal?: RosterSealReport;
     collections: UserKeyCascadeResult;
     document: object;
     userKey?: UserKey;

package/dist/clients/revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAKL,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACnD,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqGlC"}
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;IACrC,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACnD,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IAC7D,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACzD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,UAAU,EAAE,qBAAqB,CAAA;IACjC,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAA;KACjB,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAsHlC"}

package/dist/clients/revocation.js

@@ -1,5 +1,5 @@
 import { revokeWebvhClient } from '../webvh/index.js';
-import { cascadeCollectionsToUserKey, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from '../keys/index.js';
+import { cascadeCollectionsToUserKey, isSealableDescriptorStore, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from '../keys/index.js';
 /**
  * Resolves the collection ids the fan-out covers, whether they are a fixed set
  * or a listing the app performs.
@@ -123,6 +123,22 @@ export async function revokeAccountClient({ idStore, updateKeys, revokedClient,
             descriptor: read.descriptor
         });
     }
+    // 2b. The seal backstop: an ordinary rotation is the sealing append by
+    // construction, but a rotation that no-op'd (the revoked client held no
+    // current-epoch wrap -- an orphan client, or any re-run) appended nothing,
+    // leaving the roster log's head anchored before the document edit. Sealing
+    // is best-effort and reported, never thrown: the wallet IS disconnected
+    // (stage 1 landed), and an unsealed log is durable state the login sweep
+    // re-detects and finishes.
+    let rosterSeal;
+    if (isSealableDescriptorStore(rosterStore)) {
+        try {
+            rosterSeal = { outcome: await rosterStore.seal() };
+        }
+        catch (err) {
+            rosterSeal = { outcome: 'failed', error: err };
+        }
+    }
     // 3. The collection fan-out, in parallel -- run even when this call found
     // the roster already rotated (a re-run after a crash), because the staleness
     // rule finds exactly the stranded collections.
@@ -144,6 +160,7 @@ export async function revokeAccountClient({ idStore, updateKeys, revokedClient,
     }
     return {
         rotated: read.rotated,
+        ...(rosterSeal ? { rosterSeal } : {}),
         collections: cascade,
         document: doc,
         userKey: read.userKey,

package/dist/clients/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAiDA,OAAO,EACL,iBAAiB,EAIlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAGpB,MAAM,kBAAkB,CAAA;AA8BzB;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,EAC7B,WAAW,EAGZ;IACC,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAA;IACrC,OAAO,OAAO,aAAa,KAAK,UAAU;QACxC,CAAC,CAAC,MAAM,aAAa,EAAE;QACvB,CAAC,CAAC,aAAa,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,iBAAiB,EAqBlB;IACC,IACE,sBAAsB;QACtB,sBAAsB,KAAK,aAAa,CAAC,mBAAmB,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,sCAAsC,CACzC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACtC,OAAO;QACP,UAAU;QACV,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF,uEAAuE;IACvE,4EAA4E;IAC5E,kFAAkF;IAClF,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACzC,QAAQ,EAAE,GAAG;SACd,CAAA;IACH,CAAC;IACD,MAAM,mBAAmB,CAAC;QACxB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,GAAG;QACb,iBAAiB,EAAE,kBAAkB,CAAC,aAAa,CAAC;KACrD,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK,EAAE,WAAW;QAClB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;KACd,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,iCAAiC;QACjC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,iEAAiE;YACjE,0DAA0D,CAC7D,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,gBAAgB,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,aAAa,EAAE,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;YACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;IAEF,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAqDA,OAAO,EACL,iBAAiB,EAIlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAGpB,MAAM,kBAAkB,CAAA;AA6CzB;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,EAC7B,WAAW,EAGZ;IACC,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAA;IACrC,OAAO,OAAO,aAAa,KAAK,UAAU;QACxC,CAAC,CAAC,MAAM,aAAa,EAAE;QACvB,CAAC,CAAC,aAAa,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,iBAAiB,EAqBlB;IACC,IACE,sBAAsB;QACtB,sBAAsB,KAAK,aAAa,CAAC,mBAAmB,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,sCAAsC,CACzC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACtC,OAAO;QACP,UAAU;QACV,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF,uEAAuE;IACvE,4EAA4E;IAC5E,kFAAkF;IAClF,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACzC,QAAQ,EAAE,GAAG;SACd,CAAA;IACH,CAAC;IACD,MAAM,mBAAmB,CAAC;QACxB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,GAAG;QACb,iBAAiB,EAAE,kBAAkB,CAAC,aAAa,CAAC;KACrD,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK,EAAE,WAAW;QAClB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;KACd,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,iCAAiC;QACjC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,iEAAiE;YACjE,0DAA0D,CAC7D,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,gBAAgB,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,2BAA2B;IAC3B,IAAI,UAAwC,CAAA;IAC5C,IAAI,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QAChD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,aAAa,EAAE,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;YACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,qBAAqB;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAA;IAEF,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,UAAU;QACjC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC"}

package/dist/clients/rosterPolicy.d.ts

@@ -28,9 +28,14 @@
  *   revocation torn between its document edit and its roster rotation leaves
  *   the roster wrapping the CURRENT key to a client the document no longer
  *   keys -- durable and silent, since the revoked client's document edit will
- *   never be re-run -- so it is finished here. Strictly best-effort: a log
- *   that cannot be fetched or verified (offline, an unpromoted account) leaves
- *   the start's own roster read in place, and the next start tries again.
+ *   never be re-run -- so it is finished here. On a sealable (log-governed)
+ *   store the seal backstop follows: a revocation whose rotation no-op'd
+ *   leaves nothing for the recipient convergence to find, but the roster
+ *   log's head still anchors before the membership change, and that unsealed
+ *   state is detected and closed here, idempotently. Strictly best-effort: a
+ *   log that cannot be fetched or verified (offline, an unpromoted account)
+ *   leaves the start's own roster read in place, and the next start tries
+ *   again.
  *
  *   **Once per session.** A converged roster stays converged, and the engine
  *   restart (or storage-cipher rebuild) that adopts a rotation must not
@@ -120,8 +125,9 @@ export declare function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgr
  *   roster epoch
  * @param [options.onUserKeyAdopted] {Function}   called with the
  *   {@link AdoptedUserKey} of a rotation, before the fan-out runs
- * @returns {Promise<object>}   whether the roster rotated on this call, the
- *   stale recipient kids found, and the key + descriptor to fan out with
+ * @returns {Promise<object>}   whether the roster rotated on this call,
+ *   whether the seal backstop had to append (`sealed`), the stale recipient
+ *   kids found, and the key + descriptor to fan out with
  */
 export declare function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted }: {
     pointer: AccountLogPointer;
@@ -133,6 +139,7 @@ export declare function convergeUserKeyRosterToAccount({ pointer, store, userKey
     onUserKeyAdopted?: (adopted: AdoptedUserKey) => Promise<void>;
 }): Promise<{
     rotated: boolean;
+    sealed: boolean;
     staleRecipientIds: string[];
     userKey: UserKey;
     descriptor: CollectionEncryption;

package/dist/clients/rosterPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAMzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA8B1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CA6ED"}
+{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAOL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAMzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA8B1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CAqGD"}

package/dist/clients/rosterPolicy.js

@@ -1,4 +1,4 @@
-import { convergeUserKeyRosterToDocument, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, readUserKeyRoster } from '../keys/index.js';
+import { convergeUserKeyRosterToDocument, isSealableDescriptorStore, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, readUserKeyRoster } from '../keys/index.js';
 import { ResourceLogContinuityError, ResourceLogIntegrityError } from '../resourceLog/index.js';
 import { verifyAccountLog } from '../webvh/index.js';
 /**
@@ -103,12 +103,14 @@ export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgree
  *   roster epoch
  * @param [options.onUserKeyAdopted] {Function}   called with the
  *   {@link AdoptedUserKey} of a rotation, before the fan-out runs
- * @returns {Promise<object>}   whether the roster rotated on this call, the
- *   stale recipient kids found, and the key + descriptor to fan out with
+ * @returns {Promise<object>}   whether the roster rotated on this call,
+ *   whether the seal backstop had to append (`sealed`), the stale recipient
+ *   kids found, and the key + descriptor to fan out with
  */
 export async function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted }) {
     const unchanged = {
         rotated: false,
+        sealed: false,
         staleRecipientIds: [],
         userKey,
         descriptor
@@ -132,8 +134,29 @@ export async function convergeUserKeyRosterToAccount({ pointer, store, userKey,
         console.warn('Could not converge the wrap-set roster onto the account document:', err);
         return unchanged;
     }
+    // The seal backstop, on a sealable (log-governed) store: a converged
+    // recipient set can still leave the roster log's head anchored before the
+    // membership change -- the torn revocation whose rotation no-op'd (the
+    // revoked client held no current-epoch wrap), which the recipient
+    // convergence above finds nothing to rotate for. "A governed log's head
+    // anchor predates the membership change" is the durable signal; sealing it
+    // is idempotent, so every start may try. Refusal classes rethrow exactly
+    // like the convergence's; anything else (transport) warns and leaves the
+    // seal to the next start.
+    let sealed = false;
+    if (isSealableDescriptorStore(store)) {
+        try {
+            sealed = (await store.seal()) === 'sealed';
+        }
+        catch (err) {
+            if (isRosterRefusal(err)) {
+                throw err;
+            }
+            console.warn('Could not seal the wrap-set roster log:', err);
+        }
+    }
     if (!rotated) {
-        return unchanged;
+        return { ...unchanged, sealed };
     }
     console.warn('The wrap-set roster still wrapped the current key to ' +
         `${staleRecipientIds.length} recipient(s) the account document no ` +
@@ -170,6 +193,7 @@ export async function convergeUserKeyRosterToAccount({ pointer, store, userKey,
     });
     return {
         rotated: true,
+        sealed,
         staleRecipientIds,
         userKey: read.userKey,
         descriptor: read.descriptor

package/dist/clients/rosterPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAiDA,OAAO,EACL,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,CACL,GAAG,YAAY,0BAA0B;QACzC,GAAG,YAAY,yBAAyB;QACxC,GAAG,YAAY,4BAA4B;QAC3C,GAAG,YAAY,2BAA2B;QAC1C,GAAG,YAAY,wBAAwB,CACxC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;YACnC,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,YAAY,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,+DAA+D;YAC7D,WAAW,EACb,GAAG,CACJ,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EASjB;IAMC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,iBAAiB,EAAE,EAAc;QACjC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACtD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;SACX,CAAC,CAAA;QACF,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;QAC3B,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CACV,mEAAmE,EACnE,GAAG,CACJ,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CACV,uDAAuD;QACrD,GAAG,iBAAiB,CAAC,MAAM,wCAAwC;QACnE,+CAA+C,CAClD,CAAA;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,mEAAmE;YACnE,kBAAkB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,oEAAoE;YACpE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,iBAAiB;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}
+{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAsDA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,CACL,GAAG,YAAY,0BAA0B;QACzC,GAAG,YAAY,yBAAyB;QACxC,GAAG,YAAY,4BAA4B;QAC3C,GAAG,YAAY,2BAA2B;QAC1C,GAAG,YAAY,wBAAwB,CACxC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;YACnC,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,YAAY,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,+DAA+D;YAC7D,WAAW,EACb,GAAG,CACJ,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EASjB;IAOC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,EAAc;QACjC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACtD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;SACX,CAAC,CAAA;QACF,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;QAC3B,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CACV,mEAAmE,EACnE,GAAG,CACJ,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0BAA0B;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,CAAA;IACjC,CAAC;IACD,OAAO,CAAC,IAAI,CACV,uDAAuD;QACrD,GAAG,iBAAiB,CAAC,MAAM,wCAAwC;QACnE,+CAA+C,CAClD,CAAA;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,mEAAmE;YACnE,kBAAkB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,oEAAoE;YACpE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,iBAAiB;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}

package/dist/descriptors/acquire.d.ts

@@ -80,7 +80,10 @@ export declare function wasDescriptorSource({ was, spaceId }: {
  * @param options.collectionId {string}
  * @param [options.onFetchError] {function}   observes a swallowed fetch
  *   failure (the thrown-fetch branch only; an empty description is not an
- *   error). Errors from the cache itself throw through
+ *   error). Errors from the cache itself throw through, as do a log-governed
+ *   source's refusal classes (a fabricated or discontinuous log is a security
+ *   signal, not an outage the cache should paper over) -- except a continuity
+ *   `rollback`, which falls back to the cache like any transport hiccup
  * @returns {Promise<CollectionEncryption | undefined>}
  */
 export declare function acquireDescriptor({ source, cache, collectionId, onFetchError }: {

package/dist/descriptors/acquire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acquire.d.ts","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,oBAAoB,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,cAAc,CAAC,OAAO,EAAE;QACtB,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC7C,eAAe,CAAC,OAAO,EAAE;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,oBAAoB,CAAA;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAU7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAiB5C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAiBhD"}
+{"version":3,"file":"acquire.d.ts","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AA2B1E;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,oBAAoB,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,cAAc,CAAC,OAAO,EAAE;QACtB,YAAY,EAAE,MAAM,CAAA;KACrB,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC7C,eAAe,CAAC,OAAO,EAAE;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,oBAAoB,CAAA;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAoB5C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EACb,EAAE;IACD,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,KAAK,EAAE,yBAAyB,CAAA;IAChC,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACtE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAiBhD"}

package/dist/descriptors/acquire.js

@@ -1,3 +1,25 @@
+/**
+ * Whether a thrown fetch failure is a resource-log refusal the cache must NOT
+ * paper over: a fabricated log (`ResourceLogIntegrityError`), or a log that
+ * is not the continuation of the pinned history
+ * (`ResourceLogContinuityError`) -- EXCEPT continuity reason `rollback`,
+ * which is reconcilable divergence (possibly replication lag): the pin is
+ * never regressed and nothing rolled-back is adopted, so serving the cached
+ * copy in the meantime is exactly the offline posture. Matched on `err.name`
+ * rather than `instanceof`, which keeps this file dependency-light and
+ * survives a linked or duplicated copy of the package.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+function isLogRefusal(err) {
+    const name = err?.name;
+    if (name === 'ResourceLogIntegrityError') {
+        return true;
+    }
+    return (name === 'ResourceLogContinuityError' &&
+        err.reason !== 'rollback');
+}
 /**
  * The {@link EncryptionDescriptorSource} over a was-client handle: reads the
  * collection's Description in the given Space and returns its `encryption`
@@ -35,7 +57,10 @@ export function wasDescriptorSource({ was, spaceId }) {
  * @param options.collectionId {string}
  * @param [options.onFetchError] {function}   observes a swallowed fetch
  *   failure (the thrown-fetch branch only; an empty description is not an
- *   error). Errors from the cache itself throw through
+ *   error). Errors from the cache itself throw through, as do a log-governed
+ *   source's refusal classes (a fabricated or discontinuous log is a security
+ *   signal, not an outage the cache should paper over) -- except a continuity
+ *   `rollback`, which falls back to the cache like any transport hiccup
  * @returns {Promise<CollectionEncryption | undefined>}
  */
 export async function acquireDescriptor({ source, cache, collectionId, onFetchError }) {
@@ -53,6 +78,9 @@ export async function acquireDescriptor({ source, cache, collectionId, onFetchEr
         return cache.readDescriptor({ collectionId });
     }
     catch (err) {
+        if (isLogRefusal(err)) {
+            throw err;
+        }
         onFetchError?.(err, { collectionId });
         return cache.readDescriptor({ collectionId });
     }

package/dist/descriptors/acquire.js.map

@@ -1 +1 @@
-{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AAuDA;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EAIR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,WAAW,GAAG,MAAM,GAAG;iBAC1B,KAAK,CAAC,OAAO,CAAC;iBACd,UAAU,CAAC,YAAY,CAAC;iBACxB,QAAQ,EAAE,CAAA;YACb,OAAO,WAAW,EAAE,UAAU,IAAI,SAAS,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EAMb;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;YAClE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QACrC,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EAMb;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,aAAa,CAAC,GAAG,CACf,KAAK,EAAC,YAAY,EAAC,EAAE,CACnB;QACE,YAAY;QACZ,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;KAC9D,CACb,CACF,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}
+{"version":3,"file":"acquire.js","sourceRoot":"","sources":["../../src/descriptors/acquire.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,IAAI,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CACL,IAAI,KAAK,4BAA4B;QACpC,GAA4B,CAAC,MAAM,KAAK,UAAU,CACpD,CAAA;AACH,CAAC;AA+BD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,GAAG,EACH,OAAO,EAIR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,WAAW,GAAG,MAAM,GAAG;iBAC1B,KAAK,CAAC,OAAO,CAAC;iBACd,UAAU,CAAC,YAAY,CAAC;iBACxB,QAAQ,EAAE,CAAA;YACb,OAAO,WAAW,EAAE,UAAU,IAAI,SAAS,CAAA;QAC7C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,MAAM,EACN,KAAK,EACL,YAAY,EACZ,YAAY,EAMb;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;YAClE,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,CAAA;QACrC,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,MAAM,EACN,KAAK,EACL,aAAa,EACb,YAAY,EAMb;IACC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,aAAa,CAAC,GAAG,CACf,KAAK,EAAC,YAAY,EAAC,EAAE,CACnB;QACE,YAAY;QACZ,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;KAC9D,CACb,CACF,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/descriptors/index.d.ts

@@ -20,7 +20,14 @@
  *   description is ambiguous, since WAS masks an unauthorized read as an
  *   absent one). No descriptor anywhere means a plaintext collection, or an
  *   encrypted one whose epoch[0] install has not landed -- which a caller that
- *   has declared the collection encrypted must refuse fail-closed.
+ *   has declared the collection encrypted must refuse fail-closed. A
+ *   log-governed source's refusal classes rethrow instead of falling back
+ *   (except a continuity rollback, which is reconcilable divergence).
+ * - `logGovernedDescriptorSource` -- the `EncryptionDescriptorSource` for
+ *   collections whose descriptor is governed by a resource log: every read
+ *   (including the unknown-epoch refresh) re-verifies the log and resolves to
+ *   its verified head state, refusing a head that is not a
+ *   `WasEpochConfiguration`.
  * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
  *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
  *   for hosts whose reads scan rows and count unknown-epoch skips.
@@ -31,6 +38,7 @@
  */
 export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
 export type { EncryptionDescriptorCache, EncryptionDescriptorSource } from './acquire.js';
+export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource } from './logSource.js';
 export { DescriptorRefreshPolicy } from './refresh.js';
 export { createRefreshingEdvDocCipher } from './cipher.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/descriptors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}

package/dist/descriptors/index.js

@@ -20,7 +20,14 @@
  *   description is ambiguous, since WAS masks an unauthorized read as an
  *   absent one). No descriptor anywhere means a plaintext collection, or an
  *   encrypted one whose epoch[0] install has not landed -- which a caller that
- *   has declared the collection encrypted must refuse fail-closed.
+ *   has declared the collection encrypted must refuse fail-closed. A
+ *   log-governed source's refusal classes rethrow instead of falling back
+ *   (except a continuity rollback, which is reconcilable divergence).
+ * - `logGovernedDescriptorSource` -- the `EncryptionDescriptorSource` for
+ *   collections whose descriptor is governed by a resource log: every read
+ *   (including the unknown-epoch refresh) re-verifies the log and resolves to
+ *   its verified head state, refusing a head that is not a
+ *   `WasEpochConfiguration`.
  * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
  *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
  *   for hosts whose reads scan rows and count unknown-epoch skips.
@@ -30,6 +37,7 @@
  *   instance.
  */
 export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
+export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource } from './logSource.js';
 export { DescriptorRefreshPolicy } from './refresh.js';
 export { createRefreshingEdvDocCipher } from './cipher.js';
 //# sourceMappingURL=index.js.map

package/dist/descriptors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}