@interop/wallet-core 0.41.0 → 0.43.0

package/README.md

@@ -140,11 +140,24 @@ The subpaths:
   heals by re-running. The keyring bind is deliberately not a stage, so a wallet
   with no unlock method bound at creation drives the same ceremony.
 
+- **`@interop/wallet-core/unlock`** -- standing unlock credentials: every unlock
+  method (passphrase, passkey PRF, recovery code) as a standing credential in
+  the recovery-code posture, with self-enrolling login. The credential-derived
+  client identity and binding MAC key, the update-key ladder
+  (latent-and-consumed did:webvh update authority from a random seed carried in
+  the unlock record, the current rung recovered from the log itself), the unlock
+  record codec (shell / bridge delegation / ladder members under a
+  credential-authenticated binding, with the bridge-only re-mint), the merged
+  document-posture edit (a verbatim `keyAgreement` entry or a
+  `publicKeyCommitment` entry for a low-entropy-derived key), and the
+  self-enrolling continuation with its composed completion.
+
 - **`@interop/wallet-core/recovery`** -- recovery codes on the roster identity
-  model: a code as a minimal always-enrolled wallet client (format and
-  derivation, the recovery record, the document half of issuance / revocation /
-  recovery, the pre-minted `did.jsonl` delegation builder and the revocation
-  cascade's delegation re-mint core).
+  model, over the `unlock` machinery: a code as a minimal always-enrolled wallet
+  client (format and derivation, the document half of issuance / revocation /
+  recovery with its spend-on-use continuation, the pre-minted `did.jsonl`
+  delegation builder and the revocation cascade's bridge re-mint core; the
+  record codec is the `unlock` subpath's, re-exported here).
 
 ## Install
 

package/dist/clients/rosterPolicy.d.ts

@@ -15,13 +15,19 @@
  *   roster is authenticated and checked against the locally pinned latest-seen
  *   epoch either way.
  *
- *   **Failure semantics.** The three roster refusals -- a rolled-back or
- *   replayed roster, an epoch configuration that fails authentication, and a
- *   current epoch this client cannot unwrap -- rethrow and refuse the session:
- *   they are the same continuity class as a substituted account pointer, and
- *   proceeding would mean acting under a key nobody vouched for. Anything else
- *   (an unreachable server, a transport hiccup) is warned about and resolves
- *   `null`, so an offline start keeps working from the cached key.
+ *   **Failure semantics.** The roster refusals -- a fabricated or
+ *   discontinuous roster log, a rolled-back or replayed epoch configuration,
+ *   one that fails authentication, and a current epoch this client cannot
+ *   unwrap -- rethrow and refuse the session: they are the same continuity
+ *   class as a substituted account pointer, and proceeding would mean acting
+ *   under a key nobody vouched for. The one carve-out is the chain-head pin's
+ *   continuity reason `rollback` (see {@link isRosterRefusal}), which lands in
+ *   the transport class instead. Anything in that class (an unreachable
+ *   server, a transport hiccup, the rollback) is warned about and resolves
+ *   `null`, so the start keeps working from the cached key. A throw from the
+ *   app's adoption callback is a third class of its own: the read succeeded
+ *   but the adopted key and epoch pin did not persist, so it propagates
+ *   verbatim rather than degrading to the cached key.
  *
  * - {@link convergeUserKeyRosterToAccount} -- the roster stage of the
  *   cascade-completion sweep, which the collection fan-out then runs behind. A
@@ -70,10 +76,12 @@ export interface AdoptedUserKey {
  * Every read traces to the account document through the log-governed store
  * itself: the roster resolves only from the roster log's verified head, whose
  * entry proofs are checked against the locally verified account log. A log
- * that cannot be fetched lands in the transport-failure class -- the session
- * carries on under the cached key, WITHOUT adopting an unverifiable rotation
- * -- while a roster no enrolled client signed onto the log, and a log that
- * conflicts with the chain-head pin, are refusals like the other three.
+ * that cannot be fetched, and a served log the chain-head pin reports as a
+ * rollback, land in the transport-failure class -- the session carries on
+ * under the cached key, WITHOUT adopting an unverifiable (or rolled-back)
+ * rotation -- while a roster no enrolled client signed onto the log, and a
+ * log the pin reports as a fork or an SCID/method switch, are refusals like
+ * the other three.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
@@ -88,7 +96,9 @@ export interface AdoptedUserKey {
  * @param [options.onRosterRead] {Function}   called with the
  *   {@link AdoptedUserKey} of every successful read (whether or not it rotated),
  *   so the epoch pin advances to the epoch just authenticated; the key and the
- *   pin must persist atomically
+ *   pin must persist atomically. A throw from this callback propagates to the
+ *   caller verbatim -- it means the adopted key and pin did NOT persist, which
+ *   is neither a transport hiccup nor a roster refusal
  * @returns {Promise<UserKeyRosterReadResult | null>}   the read, or `null` when
  *   the account has no roster yet or the server could not be reached
  */
@@ -111,8 +121,9 @@ export declare function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgr
  * to a fresh key, that key is readable only from the roster, so a failed
  * adoption throws rather than reporting `rotated: false` with the retired key
  * and descriptor (which would skip `onUserKeyAdopted` and fan the collections
- * out onto the pre-rotation epoch). The three roster refusals rethrow
- * throughout, exactly as {@link checkUserKeyRosterAtLogin} rethrows them.
+ * out onto the pre-rotation epoch). The roster refusals rethrow throughout,
+ * exactly as {@link checkUserKeyRosterAtLogin} rethrows them, under the same
+ * rollback carve-out.
  *
  * @param options {object}
  * @param options.pointer {AccountLogPointer}   where the account log lives
@@ -125,8 +136,9 @@ export declare function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgr
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
  *   roster epoch
  * @param [options.accountLogPinStore] {ResourceLogPinStore}   this client's
- *   chain-head pin for the account log; a served log that conflicts with it
- *   is a refusal like the other five, not a transport failure
+ *   chain-head pin for the account log; a served log the pin reports as a
+ *   fork or an SCID/method switch is a refusal like the others, while a
+ *   rollback resolves to the unchanged input under the carve-out
  * @param [options.onUserKeyAdopted] {Function}   called with the
  *   {@link AdoptedUserKey} of a rotation, before the fan-out runs
  * @returns {Promise<object>}   whether the roster rotated on this call,

package/dist/clients/rosterPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA8B1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CAwGD"}
+{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AA2CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAoC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CAwGD"}

package/dist/clients/rosterPolicy.js

@@ -2,11 +2,22 @@ import { convergeUserKeyRosterToDocument, isSealableDescriptorStore, readUserKey
 import { verifyAccountLog } from '../webvh/index.js';
 /**
  * Whether a thrown error is one of the roster refusals -- a fabricated or
- * discontinuous roster log, a rolled-back or replayed roster, an epoch
- * configuration that fails authentication, and a current epoch this client
- * cannot unwrap. They are the continuity class that refuses a session rather
- * than degrading it, so both entry points rethrow them instead of warning and
- * carrying on.
+ * discontinuous roster log, a rolled-back or replayed epoch configuration, an
+ * epoch configuration that fails authentication, and a current epoch this
+ * client cannot unwrap. They are the continuity class that refuses a session
+ * rather than degrading it, so both entry points rethrow them instead of
+ * warning and carrying on.
+ *
+ * The one carve-out is the chain-head pin's continuity reason `rollback` --
+ * reconcilable divergence (possibly replication lag, retryable per the
+ * profile's log-pin rules), the same carve-out `descriptors/acquire.ts` makes
+ * on the collection-descriptor path and the account-log pin makes for the
+ * account document: nothing rolled back is adopted and the pin never
+ * regresses, so a lagging replica degrades the start to the cached user key
+ * instead of hard-refusing a healthy account's login. The epoch pin's own
+ * `UserKeyRosterContinuityError` stays a refusal: with no chain to compare it
+ * cannot tell a rollback from a fork, and it is the guard that remains when
+ * the chain-head pin was lost with a reinstall.
  *
  * Matched on `err.name` rather than `instanceof`: the errors are raised inside
  * the app-injected descriptor store, which can resolve to a different copy of
@@ -19,8 +30,10 @@ import { verifyAccountLog } from '../webvh/index.js';
  */
 function isRosterRefusal(err) {
     const name = err?.name;
-    return (name === 'ResourceLogContinuityError' ||
-        name === 'ResourceLogIntegrityError' ||
+    if (name === 'ResourceLogContinuityError') {
+        return err.reason !== 'rollback';
+    }
+    return (name === 'ResourceLogIntegrityError' ||
         name === 'UserKeyRosterContinuityError' ||
         name === 'UserKeyRosterIntegrityError' ||
         name === 'UserKeyRosterUnwrapError');
@@ -31,10 +44,12 @@ function isRosterRefusal(err) {
  * Every read traces to the account document through the log-governed store
  * itself: the roster resolves only from the roster log's verified head, whose
  * entry proofs are checked against the locally verified account log. A log
- * that cannot be fetched lands in the transport-failure class -- the session
- * carries on under the cached key, WITHOUT adopting an unverifiable rotation
- * -- while a roster no enrolled client signed onto the log, and a log that
- * conflicts with the chain-head pin, are refusals like the other three.
+ * that cannot be fetched, and a served log the chain-head pin reports as a
+ * rollback, land in the transport-failure class -- the session carries on
+ * under the cached key, WITHOUT adopting an unverifiable (or rolled-back)
+ * rotation -- while a roster no enrolled client signed onto the log, and a
+ * log the pin reports as a fork or an SCID/method switch, are refusals like
+ * the other three.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
@@ -49,27 +64,21 @@ function isRosterRefusal(err) {
  * @param [options.onRosterRead] {Function}   called with the
  *   {@link AdoptedUserKey} of every successful read (whether or not it rotated),
  *   so the epoch pin advances to the epoch just authenticated; the key and the
- *   pin must persist atomically
+ *   pin must persist atomically. A throw from this callback propagates to the
+ *   caller verbatim -- it means the adopted key and pin did NOT persist, which
+ *   is neither a transport hiccup nor a roster refusal
  * @returns {Promise<UserKeyRosterReadResult | null>}   the read, or `null` when
  *   the account has no roster yet or the server could not be reached
  */
 export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgreementKey, pinnedEpochId, onRosterRead }) {
+    let read;
     try {
-        const read = await readUserKeyRoster({
+        read = await readUserKeyRoster({
             store,
             ...(userKey ? { userKey } : {}),
             clientKeyAgreementKey,
             pinnedEpochId
         });
-        if (!read) {
-            return null;
-        }
-        await onRosterRead?.({
-            userKey: read.userKey,
-            latestEpochId: read.latestEpochId,
-            descriptor: read.descriptor
-        });
-        return read;
     }
     catch (err) {
         if (isRosterRefusal(err)) {
@@ -81,6 +90,20 @@ export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgree
             'user key:', err);
         return null;
     }
+    if (!read) {
+        return null;
+    }
+    // The adoption callback runs OUTSIDE the transport catch: the roster read
+    // itself succeeded, so a throw here is the app failing to persist the
+    // adopted key and epoch pin, and swallowing it into the warn-and-null path
+    // would report a broken persist as an offline start (the session would
+    // proceed on the retired cached key with the pin never advanced).
+    await onRosterRead?.({
+        userKey: read.userKey,
+        latestEpochId: read.latestEpochId,
+        descriptor: read.descriptor
+    });
+    return read;
 }
 /**
  * Converges the roster onto the account's locally verified did:webvh document,
@@ -94,8 +117,9 @@ export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgree
  * to a fresh key, that key is readable only from the roster, so a failed
  * adoption throws rather than reporting `rotated: false` with the retired key
  * and descriptor (which would skip `onUserKeyAdopted` and fan the collections
- * out onto the pre-rotation epoch). The three roster refusals rethrow
- * throughout, exactly as {@link checkUserKeyRosterAtLogin} rethrows them.
+ * out onto the pre-rotation epoch). The roster refusals rethrow throughout,
+ * exactly as {@link checkUserKeyRosterAtLogin} rethrows them, under the same
+ * rollback carve-out.
  *
  * @param options {object}
  * @param options.pointer {AccountLogPointer}   where the account log lives
@@ -108,8 +132,9 @@ export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgree
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
  *   roster epoch
  * @param [options.accountLogPinStore] {ResourceLogPinStore}   this client's
- *   chain-head pin for the account log; a served log that conflicts with it
- *   is a refusal like the other five, not a transport failure
+ *   chain-head pin for the account log; a served log the pin reports as a
+ *   fork or an SCID/method switch is a refusal like the others, while a
+ *   rollback resolves to the unchanged input under the carve-out
  * @param [options.onUserKeyAdopted] {Function}   called with the
  *   {@link AdoptedUserKey} of a rotation, before the fan-out runs
  * @returns {Promise<object>}   whether the roster rotated on this call,

package/dist/clients/rosterPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAsDA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,OAAO,CACL,IAAI,KAAK,4BAA4B;QACrC,IAAI,KAAK,2BAA2B;QACpC,IAAI,KAAK,8BAA8B;QACvC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,0BAA0B,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;YACnC,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,YAAY,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,+DAA+D;YAC7D,WAAW,EACb,GAAG,CACJ,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAUjB;IAOC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,EAAc;QACjC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACrC,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACtD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;SACX,CAAC,CAAA;QACF,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;QAC3B,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CACV,mEAAmE,EACnE,GAAG,CACJ,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0BAA0B;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,CAAA;IACjC,CAAC;IACD,OAAO,CAAC,IAAI,CACV,uDAAuD;QACrD,GAAG,iBAAiB,CAAC,MAAM,wCAAwC;QACnE,+CAA+C,CAClD,CAAA;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,mEAAmE;YACnE,kBAAkB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,oEAAoE;YACpE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,iBAAiB;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}
+{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AA4DA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAC1C,OAAQ,GAA4B,CAAC,MAAM,KAAK,UAAU,CAAA;IAC5D,CAAC;IACD,OAAO,CACL,IAAI,KAAK,2BAA2B;QACpC,IAAI,KAAK,8BAA8B;QACvC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,0BAA0B,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,+DAA+D;YAC7D,WAAW,EACb,GAAG,CACJ,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAUjB;IAOC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,EAAc;QACjC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACrC,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACtD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;SACX,CAAC,CAAA;QACF,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;QAC3B,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CACV,mEAAmE,EACnE,GAAG,CACJ,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0BAA0B;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,CAAA;IACjC,CAAC;IACD,OAAO,CAAC,IAAI,CACV,uDAAuD;QACrD,GAAG,iBAAiB,CAAC,MAAM,wCAAwC;QACnE,+CAA+C,CAClD,CAAA;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,mEAAmE;YACnE,kBAAkB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,oEAAoE;YACpE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,iBAAiB;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}

package/dist/descriptors/index.d.ts

@@ -38,7 +38,7 @@
  */
 export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
 export type { EncryptionDescriptorCache, EncryptionDescriptorSource } from './acquire.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource } from './logSource.js';
+export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
 export { DescriptorRefreshPolicy } from './refresh.js';
 export { createRefreshingEdvDocCipher } from './cipher.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/descriptors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}

package/dist/descriptors/index.js

@@ -37,7 +37,7 @@
  *   instance.
  */
 export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource } from './logSource.js';
+export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
 export { DescriptorRefreshPolicy } from './refresh.js';
 export { createRefreshingEdvDocCipher } from './cipher.js';
 //# sourceMappingURL=index.js.map

package/dist/descriptors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA"}

package/dist/descriptors/logSource.d.ts

@@ -1,11 +1,60 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The log-governed {@link EncryptionDescriptorSource}: descriptor acquisition
+ * for a collection whose encryption descriptor is governed by a resource log
+ * (the Resource Log Profile) rather than by its Collection Description. Every
+ * read -- including the unknown-epoch refresh's re-read -- resolves to the
+ * log's VERIFIED head state: chain, proofs, external authorization against
+ * the independently verified controller document, and the chain-head pin all
+ * checked before any descriptor is handed out, so a refresh re-verifies the
+ * log rather than adopting whatever the host serves. A verified head whose
+ * state is not an epoch configuration is refused fail-closed rather than
+ * handed out as a descriptor.
+ */
+import type { CollectionEncryption } from '@interop/was-client';
 import { type ResourceLogStore } from '@interop/was-client/log';
-import { type ResourceLogController, type ResourceLogPinStore } from '../resourceLog/index.js';
+import { type ResourceLogController, type ResourceLogPinStore, type VerifiedResourceLog } from '../resourceLog/index.js';
 import type { EncryptionDescriptorSource } from './acquire.js';
 /**
  * The state-document schema identifier an encryption descriptor carries in a
  * governed log entry, per WAS-EC.
  */
 export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
+/**
+ * The one governed epoch-configuration read: the fail-closed boundary that
+ * decides whether a served log state may be treated as an encryption
+ * descriptor. Resolves the controller view, reads and fully verifies the log
+ * (chain, proofs, external authorization, and the chain-head pin, via
+ * `readResourceLog`), and refuses a verified head whose state is not a
+ * `WasEpochConfiguration` rather than handing it out as a descriptor.
+ * Resolves `null` for an absent log (the pre-genesis state). Both governed
+ * descriptor consumers -- the log-governed descriptor source below and the
+ * roster's log-governed descriptor store -- read through this helper, so a
+ * hardening applied here reaches every trusted descriptor read.
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}   the log's transport seam
+ * @param options.resolveController {function}
+ *   `() => Promise<ResourceLogController>` -- the caller's currently verified
+ *   controller view, resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pin for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
+ * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; etag?: string } | null>}
+ */
+export declare function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }: {
+    store: ResourceLogStore;
+    resolveController: () => Promise<ResourceLogController>;
+    pinStore: ResourceLogPinStore;
+    logId: string;
+}): Promise<{
+    verified: VerifiedResourceLog;
+    descriptor: CollectionEncryption;
+    etag?: string;
+} | null>;
 /**
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
  * logs. An absent log resolves `undefined` exactly like an absent
@@ -20,14 +69,17 @@ export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
  * @param options.resolveController {function}
  *   `() => Promise<ResourceLogController>` -- the caller's currently verified
  *   controller view, resolved per operation
- * @param options.pinStoreFor {function}   `(collectionId) =>
- *   ResourceLogPinStore` -- this client's chain-head pin for the collection's
- *   log
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pins, keyed per log
+ * @param options.logIdFor {function}   `(collectionId) => string` -- the
+ *   collection's descriptor log's pin-slot key, typically built with
+ *   `resourceLogPinId`
  * @returns {EncryptionDescriptorSource}
  */
-export declare function logGovernedDescriptorSource({ logFor, resolveController, pinStoreFor }: {
+export declare function logGovernedDescriptorSource({ logFor, resolveController, pinStore, logIdFor }: {
     logFor: (collectionId: string) => ResourceLogStore;
     resolveController: () => Promise<ResourceLogController>;
-    pinStoreFor: (collectionId: string) => ResourceLogPinStore;
+    pinStore: ResourceLogPinStore;
+    logIdFor: (collectionId: string) => string;
 }): EncryptionDescriptorSource;
 //# sourceMappingURL=logSource.d.ts.map

package/dist/descriptors/logSource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,WAAW,EACZ,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,mBAAmB,CAAA;CAC3D,GAAG,0BAA0B,CAuB7B"}
+{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAwBR;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;CAC3C,GAAG,0BAA0B,CAe7B"}

package/dist/descriptors/logSource.js

@@ -5,6 +5,52 @@ import { readResourceLog, ResourceLogIntegrityError } from '../resourceLog/index
  * governed log entry, per WAS-EC.
  */
 export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
+/**
+ * The one governed epoch-configuration read: the fail-closed boundary that
+ * decides whether a served log state may be treated as an encryption
+ * descriptor. Resolves the controller view, reads and fully verifies the log
+ * (chain, proofs, external authorization, and the chain-head pin, via
+ * `readResourceLog`), and refuses a verified head whose state is not a
+ * `WasEpochConfiguration` rather than handing it out as a descriptor.
+ * Resolves `null` for an absent log (the pre-genesis state). Both governed
+ * descriptor consumers -- the log-governed descriptor source below and the
+ * roster's log-governed descriptor store -- read through this helper, so a
+ * hardening applied here reaches every trusted descriptor read.
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}   the log's transport seam
+ * @param options.resolveController {function}
+ *   `() => Promise<ResourceLogController>` -- the caller's currently verified
+ *   controller view, resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pin for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
+ * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; etag?: string } | null>}
+ */
+export async function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }) {
+    const controller = await resolveController();
+    const current = await readResourceLog({
+        store,
+        controller,
+        expectedMethod: RESOURCE_LOG_METHOD,
+        pinStore,
+        logId
+    });
+    if (current === null) {
+        return null;
+    }
+    const state = current.verified.state;
+    if (state.type !== EPOCH_CONFIGURATION_STATE_TYPE) {
+        throw new ResourceLogIntegrityError(`The governed descriptor log carries state of type ` +
+            `"${state.type}", not "${EPOCH_CONFIGURATION_STATE_TYPE}".`);
+    }
+    return {
+        verified: current.verified,
+        descriptor: state,
+        etag: current.etag
+    };
+}
 /**
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
  * logs. An absent log resolves `undefined` exactly like an absent
@@ -19,30 +65,26 @@ export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
  * @param options.resolveController {function}
  *   `() => Promise<ResourceLogController>` -- the caller's currently verified
  *   controller view, resolved per operation
- * @param options.pinStoreFor {function}   `(collectionId) =>
- *   ResourceLogPinStore` -- this client's chain-head pin for the collection's
- *   log
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pins, keyed per log
+ * @param options.logIdFor {function}   `(collectionId) => string` -- the
+ *   collection's descriptor log's pin-slot key, typically built with
+ *   `resourceLogPinId`
  * @returns {EncryptionDescriptorSource}
  */
-export function logGovernedDescriptorSource({ logFor, resolveController, pinStoreFor }) {
+export function logGovernedDescriptorSource({ logFor, resolveController, pinStore, logIdFor }) {
     return {
         async collectionEncryption({ collectionId }) {
-            const controller = await resolveController();
-            const current = await readResourceLog({
+            const current = await readGovernedEpochConfiguration({
                 store: logFor(collectionId),
-                controller,
-                expectedMethod: RESOURCE_LOG_METHOD,
-                pinStore: pinStoreFor(collectionId)
+                resolveController,
+                pinStore,
+                logId: logIdFor(collectionId)
             });
             if (current === null) {
                 return undefined;
             }
-            const state = current.verified.state;
-            if (state.type !== EPOCH_CONFIGURATION_STATE_TYPE) {
-                throw new ResourceLogIntegrityError(`The governed descriptor log carries state of type ` +
-                    `"${state.type}", not "${EPOCH_CONFIGURATION_STATE_TYPE}".`);
-            }
-            return state;
+            return current.descriptor;
         }
     };
 }

package/dist/descriptors/logSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,mBAAmB,EAEpB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,eAAe,EACf,yBAAyB,EAG1B,MAAM,yBAAyB,CAAA;AAGhC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,WAAW,EAKZ;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;gBACpC,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,UAAU;gBACV,cAAc,EAAE,mBAAmB;gBACnC,QAAQ,EAAE,WAAW,CAAC,YAAY,CAAC;aACpC,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;YACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;gBAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;oBAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;YACH,CAAC;YACD,OAAO,KAA6B,CAAA;QACtC,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,mBAAmB,EAEpB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,eAAe,EACf,yBAAyB,EAI1B,MAAM,yBAAyB,CAAA;AAGhC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAKC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EAMT;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB;gBACjB,QAAQ;gBACR,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;aAC9B,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/enrollment/enrollment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAaxE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAc7B,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AA+DD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,IAAI,CAYP;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,kBAAkB,EAAE,yBAAyB,CAAA;IAC7C,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B3E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EACnB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAyEvD"}
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAaxE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAc7B,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AAiDD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,IAAI,CAYP;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,kBAAkB,EAAE,yBAAyB,CAAA;IAC7C,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B3E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EACnB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAyEvD"}

package/dist/enrollment/enrollment.js

@@ -1,5 +1,5 @@
+import { decodeMultikey, MultikeyCodec } from '@interop/data-integrity-core/multihash';
 import { base64urlnopad } from '@scure/base';
-import { multibaseDecode, MULTICODEC_X25519_PUB_HEADER } from '@interop/x25519-key-agreement-key';
 import { agentsFromSeed } from '../identity/agents.js';
 import { enrollWebvhClient, keyAgreementTwinMultibase, mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
 import { clientSigningKeyMultibase, isWebvhDid, webvhZcapClient } from '../webvh/zcap.js';
@@ -31,46 +31,34 @@ export class EnrollmentPendingError extends Error {
  */
 const ED25519_MULTIBASE_PREFIX = 'z6Mk';
 const X25519_MULTIBASE_PREFIX = 'z6LS';
-/**
- * The multicodec varint header of an `ed25519-pub` value, the registry
- * constant the `z6Mk` prefix renders. The X25519 counterpart is imported from
- * the key suite that owns it; there is no exported Ed25519 equivalent.
- */
-const MULTICODEC_ED25519_PUB_HEADER = new Uint8Array([0xed, 0x01]);
-/**
- * The byte length of both public key types a connect code carries.
- */
-const PUBLIC_KEY_BYTES = 32;
 /**
  * Validates one connect-code key all the way down to its bytes: the multibase
- * prefix, a real base58btc decode, the multicodec header, and the key length.
- * The prefix alone is worth nothing here -- these keys are signed into an
- * append-only did:webvh log, where a key that only LOOKS like a multibase is
- * published forever.
+ * prefix, then a real base58btc decode with the multicodec header and key
+ * length enforced by `decodeMultikey`. The prefix alone is worth nothing here
+ * -- these keys are signed into an append-only did:webvh log, where a key
+ * that only LOOKS like a multibase is published forever. The prefix check
+ * stays alongside the decode: it is a stricter, deliberate spelling
+ * constraint (`z6Mk` / `z6LS` exactly) the codec-level decode does not cover.
  *
  * @param options {object}
  * @param options.value {unknown}   the payload member
  * @param options.prefix {string}   the expected multibase prefix
- * @param options.header {Uint8Array}   the expected multicodec header bytes
+ * @param options.expectedCodec {MultikeyCodec}   the expected multicodec
  * @param options.name {string}   the key's name, for the error message
  * @returns {string}   the key, verbatim
  */
-function requireConnectCodeKey({ value, prefix, header, name }) {
+function requireConnectCodeKey({ value, prefix, expectedCodec, name }) {
     if (typeof value !== 'string' || !value.startsWith(prefix)) {
         throw new Error(`The connect code carries a malformed ${name}.`);
     }
-    let bytes;
     try {
-        bytes = multibaseDecode(header, value);
+        decodeMultikey({ multikey: value, expectedCodec });
     }
     catch (err) {
         throw new Error(`The connect code carries a malformed ${name}.`, {
             cause: err
         });
     }
-    if (bytes.length !== PUBLIC_KEY_BYTES) {
-        throw new Error(`The connect code carries a malformed ${name}.`);
-    }
     return value;
 }
 /**
@@ -122,25 +110,25 @@ export function parseEnrollmentRequest({ code }) {
         signingKeyMultibase: requireConnectCodeKey({
             value: signingKeyMultibase,
             prefix: ED25519_MULTIBASE_PREFIX,
-            header: MULTICODEC_ED25519_PUB_HEADER,
+            expectedCodec: MultikeyCodec.ED25519_PUB,
             name: 'signing key'
         }),
         keyAgreementKeyMultibase: requireConnectCodeKey({
             value: keyAgreementKeyMultibase,
             prefix: X25519_MULTIBASE_PREFIX,
-            header: MULTICODEC_X25519_PUB_HEADER,
+            expectedCodec: MultikeyCodec.X25519_PUB,
             name: 'key-agreement key'
         }),
         updateKeyMultibase: requireConnectCodeKey({
             value: updateKey,
             prefix: ED25519_MULTIBASE_PREFIX,
-            header: MULTICODEC_ED25519_PUB_HEADER,
+            expectedCodec: MultikeyCodec.ED25519_PUB,
             name: 'update key'
         }),
         stagedUpdateKeyMultibase: requireConnectCodeKey({
             value: stagedUpdateKeyMultibase,
             prefix: ED25519_MULTIBASE_PREFIX,
-            header: MULTICODEC_ED25519_PUB_HEADER,
+            expectedCodec: MultikeyCodec.ED25519_PUB,
             name: 'staged update key'
         })
     };