@interop/wallet-core 0.41.0 → 0.43.0

package/dist/resourceLog/append.js

@@ -33,21 +33,23 @@ import { verifyResourceLog } from './verify.js';
  *   (also confirming any `history` dispatch hint the caller followed)
  * @param options.pinStore {ResourceLogPinStore}   this client's pin for this
  *   log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
  * @returns {Promise<{ verified: VerifiedResourceLog; etag?: string } | null>}
  */
-export async function readResourceLog({ store, controller, expectedMethod, pinStore }) {
+export async function readResourceLog({ store, controller, expectedMethod, pinStore, logId }) {
     const current = await store.read();
     if (current === null) {
         return null;
     }
-    const pin = await pinStore.read();
+    const pin = await pinStore.read({ logId });
     const verified = await verifyResourceLog({
         entries: current.entries,
         controller,
         expectedMethod,
         pin
     });
-    await pinStore.write(verified.pin);
+    await pinStore.write({ logId, pin: verified.pin });
     return { verified, etag: current.etag };
 }
 /**
@@ -64,6 +66,8 @@ export async function readResourceLog({ store, controller, expectedMethod, pinSt
  * @param options.controller {ResourceLogController}
  * @param options.expectedMethod {string}
  * @param options.pinStore {ResourceLogPinStore}
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
  * @param options.signer {ResourceLogSigner}
  * @param options.buildState {function}   `(verified) => state | null` -- the
  *   full next state rebased on the verified head, or `null` when the head
@@ -74,14 +78,15 @@ export async function readResourceLog({ store, controller, expectedMethod, pinSt
  * @returns {Promise<VerifiedResourceLog>}   the read-back, re-verified log
  *   (whether or not this call appended)
  */
-export async function appendResourceLog({ store, controller, expectedMethod, pinStore, signer, buildState, versionTime, maxAttempts = 3 }) {
+export async function appendResourceLog({ store, controller, expectedMethod, pinStore, logId, signer, buildState, versionTime, maxAttempts = 3 }) {
     let lastConflict;
     for (let attempt = 0; attempt < maxAttempts; attempt++) {
         const current = await readResourceLog({
             store,
             controller,
             expectedMethod,
-            pinStore
+            pinStore,
+            logId
         });
         if (current === null) {
             throw new Error('Cannot append to the resource log: the log does not exist yet ' +
@@ -124,9 +129,9 @@ export async function appendResourceLog({ store, controller, expectedMethod, pin
             entries: readBack.entries,
             controller,
             expectedMethod,
-            pin: await pinStore.read()
+            pin: await pinStore.read({ logId })
         });
-        await pinStore.write(confirmed.pin);
+        await pinStore.write({ logId, pin: confirmed.pin });
         return confirmed;
     }
     throw new Error(`Appending to the resource log lost the compare-and-swap race ` +
@@ -145,6 +150,8 @@ export async function appendResourceLog({ store, controller, expectedMethod, pin
  * @param options.controller {ResourceLogController}
  * @param options.method {string}   the format identifier to declare
  * @param options.pinStore {ResourceLogPinStore}
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
  * @param options.signer {ResourceLogSigner}
  * @param options.state {ResourceLogEntry['state']}   the full initial state
  * @param [options.previousLog] {object}   handover successors only
@@ -152,7 +159,7 @@ export async function appendResourceLog({ store, controller, expectedMethod, pin
  * @returns {Promise<{ verified: VerifiedResourceLog; created: boolean }>}
  *   the verified log as it now stands, and whether this call created it
  */
-export async function createResourceLog({ store, controller, method, pinStore, signer, state, previousLog, versionTime }) {
+export async function createResourceLog({ store, controller, method, pinStore, logId, signer, state, previousLog, versionTime }) {
     const genesis = await buildResourceLogGenesis({
         state,
         method,
@@ -182,9 +189,9 @@ export async function createResourceLog({ store, controller, method, pinStore, s
         entries: current.entries,
         controller,
         expectedMethod: method,
-        pin: await pinStore.read()
+        pin: await pinStore.read({ logId })
     });
-    await pinStore.write(verified.pin);
+    await pinStore.write({ logId, pin: verified.pin });
     return { verified, created };
 }
 //# sourceMappingURL=append.js.map

package/dist/resourceLog/append.js.map

@@ -1 +1 @@
-{"version":3,"file":"append.js","sourceRoot":"","sources":["../../src/resourceLog/append.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EACL,aAAa,EAGd,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,iBAAiB,EAA4B,MAAM,aAAa,CAAA;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EAMT;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IACjC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU;QACV,cAAc;QACd,GAAG;KACJ,CAAC,CAAA;IACF,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,UAAU,EACV,WAAW,EACX,WAAW,GAAG,CAAC,EAahB;IACC,IAAI,YAAqB,CAAA;IACzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,KAAK;YACL,UAAU;YACV,cAAc;YACd,QAAQ;SACT,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAC9D,2CAA2C,CAC9C,CAAA;QACH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QAClC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,6DAA6D;gBAC3D,4DAA4D,CAC/D,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,uEAAuE;YACvE,yCAAyC;YACzC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;YACxC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK;YACL,UAAU;YACV,MAAM;YACN,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,sEAAsE;gBACtE,YAAY,GAAG,GAAG,CAAA;gBAClB,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACtD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc;YACd,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE;SAC3B,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACnC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,+DAA+D;QAC7D,GAAG,WAAW,kBAAkB,EAClC,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EACV,MAAM,EACN,QAAQ,EACR,MAAM,EACN,KAAK,EACL,WAAW,EACX,WAAW,EAUZ;IACC,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;QAC5C,KAAK;QACL,MAAM;QACN,UAAU;QACV,MAAM;QACN,WAAW;QACX,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,uBAAuB,CAAC,EAAE,CAAC;YAC9C,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IACtB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,wBAAwB,CAC3B,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU;QACV,cAAc,EAAE,MAAM;QACtB,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE;KAC3B,CAAC,CAAA;IACF,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../../src/resourceLog/append.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EACL,aAAa,EAGd,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,iBAAiB,EAA4B,MAAM,aAAa,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,KAAK,EAON;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU;QACV,cAAc;QACd,GAAG;KACJ,CAAC,CAAA;IACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,KAAK,EACL,MAAM,EACN,UAAU,EACV,WAAW,EACX,WAAW,GAAG,CAAC,EAchB;IACC,IAAI,YAAqB,CAAA;IACzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,KAAK;YACL,UAAU;YACV,cAAc;YACd,QAAQ;YACR,KAAK;SACN,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAC9D,2CAA2C,CAC9C,CAAA;QACH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QAClC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,6DAA6D;gBAC3D,4DAA4D,CAC/D,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,uEAAuE;YACvE,yCAAyC;YACzC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;YACxC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK;YACL,UAAU;YACV,MAAM;YACN,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,sEAAsE;gBACtE,YAAY,GAAG,GAAG,CAAA;gBAClB,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACtD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc;YACd,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;SACpC,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,+DAA+D;QAC7D,GAAG,WAAW,kBAAkB,EAClC,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EACV,MAAM,EACN,QAAQ,EACR,KAAK,EACL,MAAM,EACN,KAAK,EACL,WAAW,EACX,WAAW,EAWZ;IACC,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;QAC5C,KAAK;QACL,MAAM;QACN,UAAU;QACV,MAAM;QACN,WAAW;QACX,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,uBAAuB,CAAC,EAAE,CAAC;YAC9C,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IACtB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,wBAAwB,CAC3B,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU;QACV,cAAc,EAAE,MAAM;QACtB,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC"}

package/dist/resourceLog/index.d.ts

@@ -19,7 +19,7 @@
 export { webvhResourceLogController, type ResourceLogController } from './controller.js';
 export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
 export { buildResourceLogEntry, buildResourceLogGenesis, type ResourceLogSigner } from './entry.js';
-export { memoryResourceLogPinStore, type ResourceLogHeadPin, type ResourceLogPinStore } from './pin.js';
+export { memoryResourceLogPinStore, resourceLogPinId, type ResourceLogHeadPin, type ResourceLogPinStore } from './pin.js';
 export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover, type VerifiedResourceLog } from './verify.js';
 export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
 export { latestAssertionRemovalIndex, sealResourceLog } from './seal.js';

package/dist/resourceLog/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/resourceLog/index.js

@@ -19,7 +19,7 @@
 export { webvhResourceLogController } from './controller.js';
 export { ResourceLogClosedError, ResourceLogContinuityError, ResourceLogIntegrityError } from './errors.js';
 export { buildResourceLogEntry, buildResourceLogGenesis } from './entry.js';
-export { memoryResourceLogPinStore } from './pin.js';
+export { memoryResourceLogPinStore, resourceLogPinId } from './pin.js';
 export { isTerminalResourceLogEntry, verifyResourceLog, verifyResourceLogHandover } from './verify.js';
 export { appendResourceLog, createResourceLog, readResourceLog } from './append.js';
 export { latestAssertionRemovalIndex, sealResourceLog } from './seal.js';

package/dist/resourceLog/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAE3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EAG1B,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,0BAA0B,EAE3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EAC1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAGjB,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,yBAAyB,EAE1B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/resourceLog/pin.d.ts

@@ -11,6 +11,12 @@
  * adopted. Storage is the app's concern (freewallet: beside its other pins in
  * localStorage; DCW: a table row), so only the seam lives here, plus an
  * in-memory implementation for tests and single-session use.
+ *
+ * The seam is keyed: every read and write names the log it concerns with a
+ * `logId`, so one store instance serves every log a wallet holds. Wallet-core
+ * supplies the key at every call, built by {@link resourceLogPinId} (or one of
+ * the named builders over it), so an app implements one keyed store and never
+ * chooses keys itself.
  */
 /**
  * One log's pin: the format identifier from the genesis `parameters.method`,
@@ -25,18 +31,50 @@ export interface ResourceLogHeadPin {
     head: string;
 }
 /**
- * Where a client keeps its chain-head pins, one record per log. `read`
- * resolves `null` before first contact. Writes happen only on the two legal
- * transitions (advance after full verification, replace across a verified
- * handover) -- the verifier never regresses a pin.
+ * Where a client keeps its chain-head pins, one record per log, keyed by
+ * `logId`. `read` resolves `null` before first contact with that log. Writes
+ * happen only on the two legal transitions (advance after full verification,
+ * replace across a verified handover) -- the verifier never regresses a pin.
+ *
+ * The `logId` uniquely names one log among all the logs this store instance
+ * serves: one store may serve every log a wallet holds, keyed per log, and two
+ * different logs must never share a `logId`. Wallet-core supplies the key at
+ * every read and write, built by {@link resourceLogPinId} (or one of the named
+ * builders over it), so an implementation never chooses keys of its own.
  */
 export interface ResourceLogPinStore {
-    read(): Promise<ResourceLogHeadPin | null>;
-    write(pin: ResourceLogHeadPin): Promise<void>;
+    read(options: {
+        logId: string;
+    }): Promise<ResourceLogHeadPin | null>;
+    write(options: {
+        logId: string;
+        pin: ResourceLogHeadPin;
+    }): Promise<void>;
 }
 /**
- * An in-memory pin store: continuity within one session only. Tests use it
- * as the seam's reference implementation; apps persist for real.
+ * The pin-slot key for one log: an opaque per-log identity key for pin
+ * storage, not a fetchable path or URL.
+ *
+ * It is deliberately host-free. The `spaceId` is the account's stable random
+ * id, so a log served from a claimed new host lands in the SAME pin slot and
+ * is checked against the pin already held, rather than opening a fresh
+ * trust-on-first-use slate (the mirror-fork concern).
+ *
+ * @param options {object}
+ * @param options.spaceId {string}   the Space the log lives in
+ * @param options.collectionId {string}   the collection holding the log
+ * @param options.resourceId {string}   the log resource's id
+ * @returns {string}
+ */
+export declare function resourceLogPinId({ spaceId, collectionId, resourceId }: {
+    spaceId: string;
+    collectionId: string;
+    resourceId: string;
+}): string;
+/**
+ * An in-memory pin store: continuity within one session only, keyed by
+ * `logId` like any other implementation, so one instance serves several logs.
+ * Tests use it as the seam's reference implementation; apps persist for real.
  *
  * @returns {ResourceLogPinStore}
  */

package/dist/resourceLog/pin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pin.d.ts","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IAC1C,KAAK,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAU/D"}
+{"version":3,"file":"pin.d.ts","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IACpE,KAAK,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,kBAAkB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,OAAO,EACP,YAAY,EACZ,UAAU,EACX,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB,GAAG,MAAM,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAU/D"}

package/dist/resourceLog/pin.js

@@ -11,21 +11,46 @@
  * adopted. Storage is the app's concern (freewallet: beside its other pins in
  * localStorage; DCW: a table row), so only the seam lives here, plus an
  * in-memory implementation for tests and single-session use.
+ *
+ * The seam is keyed: every read and write names the log it concerns with a
+ * `logId`, so one store instance serves every log a wallet holds. Wallet-core
+ * supplies the key at every call, built by {@link resourceLogPinId} (or one of
+ * the named builders over it), so an app implements one keyed store and never
+ * chooses keys itself.
+ */
+/**
+ * The pin-slot key for one log: an opaque per-log identity key for pin
+ * storage, not a fetchable path or URL.
+ *
+ * It is deliberately host-free. The `spaceId` is the account's stable random
+ * id, so a log served from a claimed new host lands in the SAME pin slot and
+ * is checked against the pin already held, rather than opening a fresh
+ * trust-on-first-use slate (the mirror-fork concern).
+ *
+ * @param options {object}
+ * @param options.spaceId {string}   the Space the log lives in
+ * @param options.collectionId {string}   the collection holding the log
+ * @param options.resourceId {string}   the log resource's id
+ * @returns {string}
  */
+export function resourceLogPinId({ spaceId, collectionId, resourceId }) {
+    return `space/${spaceId}/${collectionId}/${resourceId}`;
+}
 /**
- * An in-memory pin store: continuity within one session only. Tests use it
- * as the seam's reference implementation; apps persist for real.
+ * An in-memory pin store: continuity within one session only, keyed by
+ * `logId` like any other implementation, so one instance serves several logs.
+ * Tests use it as the seam's reference implementation; apps persist for real.
  *
  * @returns {ResourceLogPinStore}
  */
 export function memoryResourceLogPinStore() {
-    let pin = null;
+    const pins = new Map();
     return {
-        async read() {
-            return pin;
+        async read({ logId }) {
+            return pins.get(logId) ?? null;
         },
-        async write(next) {
-            pin = next;
+        async write({ logId, pin }) {
+            pins.set(logId, pin);
         }
     };
 }

package/dist/resourceLog/pin.js.map

@@ -1 +1 @@
-{"version":3,"file":"pin.js","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AA0BH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,GAAG,GAA8B,IAAI,CAAA;IACzC,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAwB;YAClC,GAAG,GAAG,IAAI,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"pin.js","sourceRoot":"","sources":["../../src/resourceLog/pin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AAgCH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,OAAO,EACP,YAAY,EACZ,UAAU,EAKX;IACC,OAAO,SAAS,OAAO,IAAI,YAAY,IAAI,UAAU,EAAE,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAA;IAClD,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE;YAClB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;QAChC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACtB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/resourceLog/seal.d.ts

@@ -67,6 +67,8 @@ export declare function latestAssertionRemovalIndex({ controller }: {
  * @param options.expectedMethod {string}   the format identifier expected
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pin for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key
  * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
@@ -79,11 +81,12 @@ export declare function latestAssertionRemovalIndex({ controller }: {
  *   anything is written
  * @returns {Promise<{ sealed: boolean, verified: VerifiedResourceLog | null }>}
  */
-export declare function sealResourceLog({ store, controller, expectedMethod, pinStore, signer, versionTime, verified: knownVerified }: {
+export declare function sealResourceLog({ store, controller, expectedMethod, pinStore, logId, signer, versionTime, verified: knownVerified }: {
     store: ResourceLogStore;
     controller: ResourceLogController;
     expectedMethod: string;
     pinStore: ResourceLogPinStore;
+    logId: string;
     signer: ResourceLogSigner;
     versionTime?: string;
     verified?: VerifiedResourceLog;

package/dist/resourceLog/seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,WAAW,EACX,QAAQ,EAAE,aAAa,EACxB,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;CAAE,CAAC,CA2CrE"}
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,UAAU,EACX,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,KAAK,EACL,MAAM,EACN,WAAW,EACX,QAAQ,EAAE,aAAa,EACxB,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,iBAAiB,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC/B,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;CAAE,CAAC,CA6CrE"}

package/dist/resourceLog/seal.js

@@ -53,6 +53,8 @@ export async function latestAssertionRemovalIndex({ controller }) {
  * @param options.expectedMethod {string}   the format identifier expected
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pin for this log
+ * @param options.logId {string}   the pin-slot key for this log, from
+ *   `resourceLogPinId`
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key
  * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
@@ -65,7 +67,7 @@ export async function latestAssertionRemovalIndex({ controller }) {
  *   anything is written
  * @returns {Promise<{ sealed: boolean, verified: VerifiedResourceLog | null }>}
  */
-export async function sealResourceLog({ store, controller, expectedMethod, pinStore, signer, versionTime, verified: knownVerified }) {
+export async function sealResourceLog({ store, controller, expectedMethod, pinStore, logId, signer, versionTime, verified: knownVerified }) {
     if (controller.versionIds.length === 0) {
         return { sealed: false, verified: null };
     }
@@ -79,7 +81,8 @@ export async function sealResourceLog({ store, controller, expectedMethod, pinSt
             store,
             controller,
             expectedMethod,
-            pinStore
+            pinStore,
+            logId
         });
         if (current === null) {
             return { sealed: false, verified: null };
@@ -95,6 +98,7 @@ export async function sealResourceLog({ store, controller, expectedMethod, pinSt
         controller,
         expectedMethod,
         pinStore,
+        logId,
         signer,
         // The rebase hook doubles as the convergence check: a concurrent writer
         // whose entry already anchors past the removal sealed the log for us.

package/dist/resourceLog/seal.js.map

@@ -1 +1 @@
-{"version":3,"file":"seal.js","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAMhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,UAAU,EAGX;IACC,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,QAAQ,GAAuB,IAAI,CAAA;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;QACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnB,YAAY,GAAG,KAAK,CAAA;oBACpB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,WAAW,EACX,QAAQ,EAAE,aAAa,EASxB;IACC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,QAAQ,GAAG,aAAa,IAAI,IAAI,CAAA;IACpC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,KAAK;YACL,UAAU;YACV,cAAc;YACd,QAAQ;SACT,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC1C,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAC7B,CAAC;IACD,IACE,QAAQ,CAAC,eAAe,KAAK,IAAI;QACjC,QAAQ,CAAC,eAAe,IAAI,YAAY,EACxC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACxC,KAAK;QACL,UAAU;QACV,cAAc;QACd,QAAQ;QACR,MAAM;QACN,wEAAwE;QACxE,sEAAsE;QACtE,UAAU,EAAE,OAAO,CAAC,EAAE,CACpB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,OAAO,CAAC,eAAe,IAAI,YAAY;YACrC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK;QACxB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../../src/resourceLog/seal.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAMhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,UAAU,EAGX;IACC,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,QAAQ,GAAuB,IAAI,CAAA;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;QACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnB,YAAY,GAAG,KAAK,CAAA;oBACpB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,KAAK,EACL,MAAM,EACN,WAAW,EACX,QAAQ,EAAE,aAAa,EAUxB;IACC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IACtE,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,IAAI,IAAI,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,QAAQ,GAAG,aAAa,IAAI,IAAI,CAAA;IACpC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,KAAK;YACL,UAAU;YACV,cAAc;YACd,QAAQ;YACR,KAAK;SACN,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC1C,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAC7B,CAAC;IACD,IACE,QAAQ,CAAC,eAAe,KAAK,IAAI;QACjC,QAAQ,CAAC,eAAe,IAAI,YAAY,EACxC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACxC,KAAK;QACL,UAAU;QACV,cAAc;QACd,QAAQ;QACR,KAAK;QACL,MAAM;QACN,wEAAwE;QACxE,sEAAsE;QACtE,UAAU,EAAE,OAAO,CAAC,EAAE,CACpB,OAAO,CAAC,eAAe,KAAK,IAAI;YAChC,OAAO,CAAC,eAAe,IAAI,YAAY;YACrC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK;QACxB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AAC9C,CAAC"}

package/dist/unlock/index.d.ts

@@ -0,0 +1,40 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/unlock` subpath: standing unlock credentials --
+ * every unlock method (passphrase, passkey PRF, recovery code) as a standing
+ * credential in the recovery-code posture, with self-enrolling login. The
+ * recovery subpath's spend-on-use flows sit on top of the machinery here.
+ *
+ * - `standingClientFromUnlockSeed` / `unlockClientIdentityFromSeed` -- the
+ *   deterministic client identity a credential derives (roster wrap target,
+ *   binding MAC key), shared with the recovery-code derivation.
+ * - `generateLadderSeed` / `ladderRung` / `attributeLadderRung` -- the
+ *   update-key ladder: latent-and-consumed did:webvh update authority from a
+ *   random seed carried in the unlock record, current rung recovered from the
+ *   log itself, ambiguity failing closed.
+ * - `wrapUnlockRecord` / `unwrapUnlockRecord` / `remintUnlockRecordBridge` --
+ *   the unlock record codec: the credential-authenticated shell-and-core
+ *   layout (controller, email, pointer under the binding MAC; the bridge
+ *   delegation re-mintable; the ladder seed sealed and carried verbatim).
+ * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
+ *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
+ *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
+ * - `selfEnrollWebvhClient` / `selfEnrollClientCore` -- the self-enrolling
+ *   continuation (reveal a rung, add an ordinary client, retire the rung) and
+ *   the composed completion a fresh browser runs end to end.
+ *
+ * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * was-client dependency graph (the same isolation pattern as `./keyring`).
+ */
+export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
+export type { StandingUnlockClient, UnlockClientIdentity } from './standingClient.js';
+export { attributeLadderRung, generateLadderSeed, LADDER_MAX_SCAN, LADDER_SEED_BYTES, LadderAttributionError, ladderRung, ladderRungSeed } from './ladder.js';
+export type { LadderRung, LadderRungState } from './ladder.js';
+export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
+export type { SealedRecordMember, SignedUnlockRecord, UnlockRecordContents, UnlockRecordProofState } from './unlockRecord.js';
+export { publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export type { StandingUnlockKeys, UnlockKeyAgreementPublication, UnlockLogStore } from './standingWebvh.js';
+export { selfEnrollClientCore } from './selfEnroll.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/unlock/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE9D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACf,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/unlock/index.js

@@ -0,0 +1,36 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/unlock` subpath: standing unlock credentials --
+ * every unlock method (passphrase, passkey PRF, recovery code) as a standing
+ * credential in the recovery-code posture, with self-enrolling login. The
+ * recovery subpath's spend-on-use flows sit on top of the machinery here.
+ *
+ * - `standingClientFromUnlockSeed` / `unlockClientIdentityFromSeed` -- the
+ *   deterministic client identity a credential derives (roster wrap target,
+ *   binding MAC key), shared with the recovery-code derivation.
+ * - `generateLadderSeed` / `ladderRung` / `attributeLadderRung` -- the
+ *   update-key ladder: latent-and-consumed did:webvh update authority from a
+ *   random seed carried in the unlock record, current rung recovered from the
+ *   log itself, ambiguity failing closed.
+ * - `wrapUnlockRecord` / `unwrapUnlockRecord` / `remintUnlockRecordBridge` --
+ *   the unlock record codec: the credential-authenticated shell-and-core
+ *   layout (controller, email, pointer under the binding MAC; the bridge
+ *   delegation re-mintable; the ladder seed sealed and carried verbatim).
+ * - `publishUnlockKey` / `removeUnlockKey` -- the merged document posture
+ *   edit, parameterized by credential class: a verbatim `keyAgreement` entry,
+ *   or a `MultikeyCommitment` entry for a low-entropy-derived key.
+ * - `selfEnrollWebvhClient` / `selfEnrollClientCore` -- the self-enrolling
+ *   continuation (reveal a rung, add an ordinary client, retire the rung) and
+ *   the composed completion a fresh browser runs end to end.
+ *
+ * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * was-client dependency graph (the same isolation pattern as `./keyring`).
+ */
+export { standingClientFromUnlockSeed, STANDING_CLIENT_SALT, unlockClientIdentityFromSeed } from './standingClient.js';
+export { attributeLadderRung, generateLadderSeed, LADDER_MAX_SCAN, LADDER_SEED_BYTES, LadderAttributionError, ladderRung, ladderRungSeed } from './ladder.js';
+export { computeUnlockBinding, remintUnlockRecordBridge, UnlockBindingError, unlockRecordBinding, unwrapUnlockRecord, wrapUnlockRecord } from './unlockRecord.js';
+export { publishUnlockKey, removeUnlockKey, selfEnrollWebvhClient, unlockKeyVerificationMethod, unlockKeyVmId } from './standingWebvh.js';
+export { selfEnrollClientCore } from './selfEnroll.js';
+//# sourceMappingURL=index.js.map

package/dist/unlock/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/unlock/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAM5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,cAAc,EACf,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAA;AAQ1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,2BAA2B,EAC3B,aAAa,EACd,MAAM,oBAAoB,CAAA;AAO3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/unlock/ladder.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The byte length of a ladder seed: 32 random bytes, minted at bind time and
+ * carried only inside the unlock record's sealed ladder member.
+ */
+export declare const LADDER_SEED_BYTES = 32;
+/**
+ * How many rungs {@link attributeLadderRung} derives before concluding the
+ * log commits none of them. Generous: one rung is consumed per
+ * self-enrollment, so a real ladder's standing commitment sits at the number
+ * of self-enrollments the credential has ever performed.
+ */
+export declare const LADDER_MAX_SCAN = 128;
+/**
+ * Thrown when the published log's standing parameters match no derivable rung
+ * -- the credential's posture was revoked (or never published), the ladder
+ * seed does not belong to this account, or the scan bound was exceeded -- or
+ * when they match more than one rung in the same role, which no legitimate
+ * history produces. Self-enrollment refuses loudly rather than guessing.
+ */
+export declare class LadderAttributionError extends Error {
+    constructor(message: string);
+}
+/**
+ * Generates a fresh random ladder seed.
+ *
+ * @returns {Uint8Array}
+ */
+export declare function generateLadderSeed(): Uint8Array;
+/**
+ * One rung of the ladder: its index, the 32-byte Ed25519 seed behind it, and
+ * the update key's public multibase as the log carries it.
+ */
+export interface LadderRung {
+    index: number;
+    seed: Uint8Array;
+    keyMultibase: string;
+}
+/**
+ * Derives the 32-byte update-key seed of rung `index`.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.index {number}   the rung index, from 0
+ * @returns {Uint8Array}
+ */
+export declare function ladderRungSeed({ ladderSeed, index }: {
+    ladderSeed: Uint8Array;
+    index: number;
+}): Uint8Array;
+/**
+ * Derives rung `index` in full: seed and public multibase.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.index {number}   the rung index, from 0
+ * @returns {Promise<LadderRung>}
+ */
+export declare function ladderRung({ ladderSeed, index }: {
+    ladderSeed: Uint8Array;
+    index: number;
+}): Promise<LadderRung>;
+/**
+ * Where an attributed rung stands in the published log: `'committed'` (the
+ * steady state -- only its hash stands in `nextKeyHashes`) or `'revealed'` (a
+ * torn self-enrollment published the reveal entry but not the add entry, so
+ * the rung sits in `updateKeys` awaiting the resumed add).
+ */
+export type LadderRungState = 'committed' | 'revealed';
+/**
+ * Recovers the ladder's current rung from the published log's standing
+ * parameters -- the counter recovery that replaces any stored counter. Scans
+ * rungs `0..maxScan - 1`; a rung whose key stands in `updateKeys` is a torn
+ * self-enrollment to resume (`'revealed'`), else a rung whose hash stands in
+ * `nextKeyHashes` is the standing commitment (`'committed'`). Exactly one
+ * revealed rung, or exactly one committed rung beside it, is legitimate --
+ * the reveal entry keeps the spent rung's hash committed so a resumed run can
+ * re-state it, which is why a revealed rung wins over a committed one.
+ * Anything else fails closed with {@link LadderAttributionError}.
+ *
+ * @param options {object}
+ * @param options.ladderSeed {Uint8Array}
+ * @param options.published {object}   the resolved log's standing parameters
+ * @param options.published.updateKeys {string[]}
+ * @param options.published.nextKeyHashes {string[]}
+ * @param [options.maxScan] {number}   how many rungs to derive before giving
+ *   up; defaults to {@link LADDER_MAX_SCAN}
+ * @returns {Promise<{ rung: LadderRung, state: LadderRungState }>}
+ */
+export declare function attributeLadderRung({ ladderSeed, published, maxScan }: {
+    ladderSeed: Uint8Array;
+    published: {
+        updateKeys: string[];
+        nextKeyHashes: string[];
+    };
+    maxScan?: number;
+}): Promise<{
+    rung: LadderRung;
+    state: LadderRungState;
+}>;
+//# sourceMappingURL=ladder.d.ts.map

package/dist/unlock/ladder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ladder.d.ts","sourceRoot":"","sources":["../../src/unlock/ladder.ts"],"names":[],"mappings":"AAiCA;;;GAGG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAA;AAUnC;;;;;GAKG;AACH,eAAO,MAAM,eAAe,MAAM,CAAA;AAElC;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,UAAU,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,UAAU,CAWb;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,EAC/B,UAAU,EACV,KAAK,EACN,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,UAAU,CAAC,CAGtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,UAAU,CAAA;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,SAAS,EACT,OAAyB,EAC1B,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,SAAS,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BxD"}