@interop/wallet-core 0.52.1 → 0.54.0

package/dist/clientAnnex/recoveryLadderAnchored.js

@@ -11,7 +11,7 @@
  * `recovery/recoveryWebvh.ts`.
  */
 import { deriveNextKeyHash, updateDID } from '@interop/did-method-webvh';
-import { assertCarryOverCommitments, ladderVerificationMethod, MULTIKEY_VM_TYPE, relationIds, updateKeySigner, withLogConflictRetry } from '../webvh/didWebvh.js';
+import { assertCarryOverCommitments, ladderVerificationMethod, MULTIKEY_VM_TYPE, pinOfLog, relationIds, updateKeySigner, withLogConflictRetry } from '../webvh/didWebvh.js';
 import { ladderVmIds } from '../webvh/listClients.js';
 import { unlockKeyVerificationMethod, unlockKeyVmId } from '../unlock/standingWebvh.js';
 import { publishLogOnly, readLogOrThrow, RecoveryKeyNotCommittedError, recoveryVmId } from '../recovery/recoveryWebvh.js';
@@ -94,11 +94,28 @@ import { clientAnnexDidParts, servicesPointedAtClientAnnex } from './log.js';
  *   REQUIRED: the add entry points the `#DelegatedClients` service entry at
  *   it, and a caller that named no generation would republish the stranding
  *   this ordering exists to prevent
+ * @param [options.pinStore] {ResourceLogPinStore}   this caller's chain-head
+ *   pins; every read both entries are built on is checked against the pinned
+ *   head (a served prefix is refused before the reveal entry lands, not only
+ *   by a verify that follows both entries), and the pin advances to each
+ *   entry as it publishes
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @returns {Promise<object>}   the account DID, the post-continuation
  *   document and log (the rotation's recipient source and anchor), and, when
  *   the add entry ran here, the final `did.json` projection
  */
 export async function recoverWebvhLadderAnchored(options) {
+    // The seam is what makes the fresh credential's and replacement code's
+    // material durable before the add entry publishes the ladder VM; a call
+    // omitting it would republish the stranding this ordering exists to
+    // prevent. Refused before any read, so nothing is published.
+    if (typeof options.onCommitted !== 'function') {
+        throw new TypeError('recoverWebvhLadderAnchored requires onCommitted: the replacement ' +
+            'code and the fresh credential record must be persisted before the ' +
+            'add entry publishes the ladder VM.');
+    }
     return withLogConflictRetry(() => recoverWebvhLadderAnchoredOnce(options));
 }
 /**
@@ -108,10 +125,18 @@ export async function recoverWebvhLadderAnchored(options) {
  * @param options {object}   see {@link recoverWebvhLadderAnchored}
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog, webDoc?: object }>}
  */
-async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, credentialKeyAgreement, replacement, expectedDid, onCommitted }) {
+async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, credentialKeyAgreement, replacement, expectedDid, onCommitted, pinStore, logId }) {
+    // Each attempt's own read is what the CAS publish is built on, so the
+    // continuity check runs here -- and again on a conflict-retry re-run -- not
+    // only on the verify that follows both entries.
+    const pinned = {
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {})
+    };
     let published = await readLogOrThrow({
         store,
-        ...(expectedDid !== undefined ? { expectedDid } : {})
+        ...(expectedDid !== undefined ? { expectedDid } : {}),
+        ...pinned
     });
     const rung0 = await ladderRung({ ladderSeed, index: 0 });
     const rung1 = await ladderRung({ ladderSeed, index: 1 });
@@ -160,8 +185,18 @@ async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, cre
             log: updated.log,
             ifMatch: published.etag
         });
-        // The same account the reveal entry just extended.
-        published = await readLogOrThrow({ store, expectedDid: published.did });
+        // Advance the pin to what the reveal entry just published, so the re-read
+        // below (and any read after a tear here) refuses a host that rolls the
+        // log back behind it.
+        if (pinStore && logId !== undefined) {
+            await pinStore.write({ logId, pin: pinOfLog(updated.log) });
+        }
+        // The same account the reveal entry just extended, under the same pin.
+        published = await readLogOrThrow({
+            store,
+            expectedDid: published.did,
+            ...pinned
+        });
     }
     // The persist-before-publish seam: the replacement code's record and the
     // fresh credential's unlock record (the ladder seed inside) become durable
@@ -253,6 +288,11 @@ async function recoverWebvhLadderAnchoredOnce({ store, recovery, ladderSeed, cre
     // Conditional on the read this entry was built on: the re-read above when
     // the commit entry ran here, the first read when it was skipped.
     await publishLogOnly({ store, log: updated.log, ifMatch: published.etag });
+    // Advance the pin to what this entry just published, so a host rolling the
+    // log back straight afterwards is refused on the next read.
+    if (pinStore && logId !== undefined) {
+        await pinStore.write({ logId, pin: pinOfLog(updated.log) });
+    }
     return {
         did: updated.did,
         doc: updated.doc,

package/dist/clientAnnex/recoveryLadderAnchored.js.map

@@ -1 +1 @@
-{"version":3,"file":"recoveryLadderAnchored.js","sourceRoot":"","sources":["../../src/clientAnnex/recoveryLadderAnchored.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EACL,2BAA2B,EAC3B,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,YAAY,EAGb,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAQhD;IACC,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,8BAA8B,CAAC,EAC5C,KAAK,EACL,QAAQ,EACR,UAAU,EACV,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,WAAW,EASZ;IACC,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAE9D,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CACrE,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CACvC,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,SAAS;oBACT,SAAS;oBACT,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;SACxB,CAAC,CAAA;QACF,mDAAmD;QACnD,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,WAAW,EAAE,CAAA;IACrC,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAA;IAEtD,kEAAkE;IAClE,6EAA6E;IAC7E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,GAAG;QACf,kBAAkB,EAAE,WAAW;KAChC,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC1C,MAAM,YAAY,GAAG,2BAA2B,CAAC;QAC/C,GAAG;QACH,YAAY,EAAE,sBAAsB;KACrC,CAAC,CAAA;IACF,MAAM,cAAc,GAAG,aAAa,CAAC;QACnC,GAAG;QACH,YAAY,EAAE,sBAAsB;KACrC,CAAC,CAAA;IACF,MAAM,YAAY,GAAyB;QACzC,QAAQ;QACR,YAAY;QACZ;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;KACF,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YACnD,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAC9D;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,cAAc,GAAG,CACrB,QAAqD,EACrD,KAAgB,EAChB,EAAE,CACF,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAC/D,YAAY,CAAC,EAAE,CACb,YAAY,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAClE,CAAA;IAEH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,kBAAkB,CAC3C;gBACD,KAAK,CAAC,YAAY;aACnB,CAAC;SACH;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAC9B;QACD,mBAAmB;QACnB,4DAA4D;QAC5D,yDAAyD;QACzD,qEAAqE;QACrE,kBAAkB;QAClB,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC;QAClD,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,CAAC;QAClE,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE;YAC7C,cAAc;YACd,eAAe;SAChB,CAAC;QACF,oBAAoB,EAAE,cAAc,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC9D,oBAAoB,EAAE,cAAc,CAAC,GAAG,CAAC,oBAAoB,EAAE;YAC7D,UAAU;SACX,CAAC;QACF,sEAAsE;QACtE,wEAAwE;QACxE,qDAAqD;QACrD,QAAQ,EAAE,4BAA4B,CAAC;YACrC,GAAG;YACH,UAAU,EAAE,GAAG;YACf,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CAAC;KACH,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAA;AACH,CAAC"}
+{"version":3,"file":"recoveryLadderAnchored.js","sourceRoot":"","sources":["../../src/clientAnnex/recoveryLadderAnchored.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAMxE,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,eAAe,EACf,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EACL,2BAA2B,EAC3B,aAAa,EAEd,MAAM,4BAA4B,CAAA;AACnC,OAAO,EACL,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,YAAY,EAGb,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAA;AAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAUhD;IACC,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,6DAA6D;IAC7D,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,mEAAmE;YACjE,oEAAoE;YACpE,oCAAoC,CACvC,CAAA;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,8BAA8B,CAAC,EAC5C,KAAK,EACL,QAAQ,EACR,UAAU,EACV,sBAAsB,EACtB,WAAW,EACX,WAAW,EACX,WAAW,EACX,QAAQ,EACR,KAAK,EAWN;IACC,sEAAsE;IACtE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IACD,IAAI,SAAS,GAAG,MAAM,cAAc,CAAC;QACnC,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,MAAM;KACV,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAE9D,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACzE,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAC7C,WAAW,CAAC,kBAAkB,CAC/B,CAAA;IAED,uEAAuE;IACvE,kEAAkE;IAClE,cAAc;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IAC3E,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CACrE,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CACvC,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAA4B,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,MAAM;YACN,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE;gBACV,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;aACnE;YACD,qEAAqE;YACrE,iEAAiE;YACjE,aAAa,EAAE;gBACb,GAAG,IAAI,GAAG,CAAC;oBACT,GAAG,SAAS,CAAC,aAAa;oBAC1B,YAAY;oBACZ,SAAS;oBACT,SAAS;oBACT,eAAe;iBAChB,CAAC;aACH;SACF,CAAC,CAAA;QACF,MAAM,cAAc,CAAC;YACnB,KAAK;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,OAAO,EAAE,SAAS,CAAC,IAAI;SACxB,CAAC,CAAA;QACF,0EAA0E;QAC1E,uEAAuE;QACvE,sBAAsB;QACtB,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7D,CAAC;QACD,uEAAuE;QACvE,SAAS,GAAG,MAAM,cAAc,CAAC;YAC/B,KAAK;YACL,WAAW,EAAE,SAAS,CAAC,GAAG;YAC1B,GAAG,MAAM;SACV,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,WAAW,EAAE,CAAA;IACrC,gEAAgE;IAChE,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAA;IAEtD,kEAAkE;IAClE,6EAA6E;IAC7E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,SAAS,CAAA;IAC9B,MAAM,SAAS,GAAG,YAAY,CAAC;QAC7B,GAAG;QACH,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;KAC5D,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,YAAY,CAAC;QACnC,GAAG;QACH,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;KAC/D,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,GAAG;QACf,kBAAkB,EAAE,WAAW;KAChC,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,WAAW,EAAE,CAAA;IAC1C,MAAM,YAAY,GAAG,2BAA2B,CAAC;QAC/C,GAAG;QACH,YAAY,EAAE,sBAAsB;KACrC,CAAC,CAAA;IACF,MAAM,cAAc,GAAG,aAAa,CAAC;QACnC,GAAG;QACH,YAAY,EAAE,sBAAsB;KACrC,CAAC,CAAA;IACF,MAAM,YAAY,GAAyB;QACzC,QAAQ;QACR,YAAY;QACZ;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,WAAW,CAAC,wBAAwB;SACzD;KACF,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAyB,CAAA;IAC9E,MAAM,mBAAmB,GAAG;QAC1B,GAAG,eAAe,CAAC,MAAM,CACvB,MAAM,CAAC,EAAE,CACP,MAAM,CAAC,EAAE,KAAK,SAAS;YACvB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YACnD,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAC9D;QACD,GAAG,YAAY;KAChB,CAAA;IACD,MAAM,cAAc,GAAG,CACrB,QAAqD,EACrD,KAAgB,EAChB,EAAE,CACF,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAC/D,YAAY,CAAC,EAAE,CACb,YAAY,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAClE,CAAA;IAEH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,MAAM;QACN,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE;YACV,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,SAAS,CAAC,UAAU,CAAC,MAAM,CAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,kBAAkB,CAC3C;gBACD,KAAK,CAAC,YAAY;aACnB,CAAC;SACH;QACD,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,CAC9B;QACD,mBAAmB;QACnB,4DAA4D;QAC5D,yDAAyD;QACzD,qEAAqE;QACrE,kBAAkB;QAClB,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC;QAClD,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,CAAC;QAClE,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE;YAC7C,cAAc;YACd,eAAe;SAChB,CAAC;QACF,oBAAoB,EAAE,cAAc,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC9D,oBAAoB,EAAE,cAAc,CAAC,GAAG,CAAC,oBAAoB,EAAE;YAC7D,UAAU;SACX,CAAC;QACF,sEAAsE;QACtE,wEAAwE;QACxE,qDAAqD;QACrD,QAAQ,EAAE,4BAA4B,CAAC;YACrC,GAAG;YACH,UAAU,EAAE,GAAG;YACf,cAAc,EAAE,SAAS,CAAC,cAAc;SACzC,CAAC;KACH,CAAC,CAAA;IACF,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAA;AACH,CAAC"}

package/dist/clientAnnex/selfEnroll.d.ts

@@ -25,6 +25,13 @@
  *    key-agreement key), so later logins on this browser read the roster the
  *    ordinary enrolled way.
  *
+ * Between the two entries of step 2 sits the required `onCommitted` seam: the
+ * caller writes the pending client-key record there, so the add entry -- the
+ * ceremony's pivot -- never publishes a client whose seed only a live tab
+ * holds (the post-pivot derivability rule, `decisions/0010`). What that record
+ * carries is what `resume` replays: the same seeds, and the head the pivot
+ * entry was built on.
+ *
  * Persisting the key set under the app's own unlock layer is the caller's
  * job, exactly as with the enrollment ceremony's completion: this module
  * hands back the key set, the user key, and the roster epoch to pin, and
@@ -64,16 +71,67 @@ import type { UnlockLogStore } from '../unlock/standingWebvh.js';
  *   by the verify that follows. A fresh browser normally has none (this is
  *   its first contact), which is exactly the pin's trust-on-first-use
  *   establishment
+ * @param options.onCommitted {function}
+ *   `(committed: { builtOnHead, clientSeed, webvhUpdateKeys }) =>
+ *   Promise<void>` -- the REQUIRED persist-before-publish seam. The caller
+ *   writes the pending client-key record there -- the `pending` codec group
+ *   of `keys/clientKeyRecord.ts`, ceremony `'self-enrollment'` -- so the add
+ *   entry never publishes a client this browser cannot re-derive, per the
+ *   post-pivot derivability rule (`decisions/0010`). The argument carries
+ *   everything that record needs beyond what the caller already holds: the
+ *   key set is minted INSIDE this call, so the seeds are handed over here,
+ *   while the record's `controller` and pointer DID are the caller's own
+ *   `pointer`. On a resume the seeds handed back are the resumed record's own,
+ *   verbatim, so re-persisting is idempotent. The ceremony's own seam
+ *   ({@link selfEnrollWebvhClient}'s) takes `{ builtOnHead }` alone -- its
+ *   callers hold the key set already -- and this call passes it a wrapper.
+ *   The rest of the contract is the ceremony's: it runs after the
+ *   reveal-and-commit entry stands and before the add entry is built, once
+ *   per attempt, a throw withholds the pivot, and the idempotent completed
+ *   branch never enters it. A call omitting the seam is refused with a
+ *   `TypeError` before any read
+ * @param [options.resume] {object}   the pending record's contents, replayed:
+ *   `{ clientSeed, webvhUpdateKeys, builtOnHead }`. Supplied, the local key
+ *   mint is SKIPPED and the whole enrollment key set is re-derived from the
+ *   recorded seeds, so the resumed run publishes the same client the torn run
+ *   was publishing, and `builtOnHead` is passed through as the ceremony's
+ *   resume marker (refusing a served log that never reached that head with
+ *   `BuiltOnHeadNotReachedError`). Everything downstream is unchanged: the
+ *   ceremony's own revealed / committed / completed detection publishes only
+ *   what is missing
  * @returns {Promise<object>}   the new client's key set (for the caller to
  *   persist under its unlock layer), its did:key, the account DID, the user
- *   key, and the roster epoch to pin
+ *   key, the roster epoch to pin, and `committed` -- whether THIS call
+ *   published the ceremony's pivot entry, propagated verbatim from
+ *   {@link selfEnrollWebvhClient}. A resume that met an already-complete
+ *   continuation returns `committed: false` and is a full success: the clear
+ *   condition for the pending record is that the call RETURNED, never
+ *   `committed === true`, or a resumed-onto-completed record would never be
+ *   cleared. The member exists so a build skew that dropped it surfaces
+ *   instead of reading as `false`
  */
-export declare function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, accountLogPinStore }: {
+export declare function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, accountLogPinStore, onCommitted, resume }: {
     pointer: AccountPointer;
     ladderSeed: Uint8Array;
     credentialKeyAgreementKey: IKeyAgreementKey;
     logStore: UnlockLogStore;
     accountLogPinStore?: ResourceLogPinStore;
+    onCommitted: (committed: {
+        builtOnHead: {
+            scid: string;
+            versionId: string;
+        };
+        clientSeed: Uint8Array;
+        webvhUpdateKeys: ClientWebvhUpdateKeys;
+    }) => Promise<void>;
+    resume?: {
+        clientSeed: Uint8Array;
+        webvhUpdateKeys: ClientWebvhUpdateKeys;
+        builtOnHead: {
+            scid: string;
+            versionId: string;
+        };
+    };
 }): Promise<{
     clientSeed: Uint8Array;
     webvhUpdateKeys: ClientWebvhUpdateKeys;
@@ -81,5 +139,6 @@ export declare function selfEnrollClientCore({ pointer, ladderSeed, credentialKe
     did: string;
     userKey: UserKey;
     latestEpochId: string;
+    committed: boolean;
 }>;
 //# sourceMappingURL=selfEnroll.d.ts.map

package/dist/clientAnnex/selfEnroll.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"selfEnroll.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/selfEnroll.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AASpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAMjC,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,kBAAkB,EACnB,EAAE;IACD,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,EAAE,cAAc,CAAA;IACxB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC;IACV,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB,CAAC,CA8GD"}
+{"version":3,"file":"selfEnroll.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/selfEnroll.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AASpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAMjC,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,sBAAsB,CAAA;AAW7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,kBAAkB,EAClB,WAAW,EACX,MAAM,EACP,EAAE;IACD,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,EAAE,cAAc,CAAA;IACxB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;QAChD,UAAU,EAAE,UAAU,CAAA;QACtB,eAAe,EAAE,qBAAqB,CAAA;KACvC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,UAAU,CAAA;QACtB,eAAe,EAAE,qBAAqB,CAAA;QACtC,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,CAAA;CACF,GAAG,OAAO,CAAC;IACV,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,OAAO,CAAA;CACnB,CAAC,CA8ID"}

package/dist/clientAnnex/selfEnroll.js

@@ -6,7 +6,7 @@ import { webvhResourceLogController } from '../resourceLog/index.js';
 import { mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
 import { accountLogPinId, verifyAccountLog } from '../webvh/verifyLog.js';
 import { clientSigningKeyMultibase, isWebvhDid, webvhZcapClient } from '../webvh/zcap.js';
-import { selfEnrollWebvhClient } from './ladderAnchored.js';
+import { assertBuiltOnHeadShape, selfEnrollWebvhClient } from './ladderAnchored.js';
 /**
  * Runs the whole self-enrollment described in the module doc. The caller has
  * already unwrapped the credential's unlock record (so it holds the
@@ -32,19 +32,70 @@ import { selfEnrollWebvhClient } from './ladderAnchored.js';
  *   by the verify that follows. A fresh browser normally has none (this is
  *   its first contact), which is exactly the pin's trust-on-first-use
  *   establishment
+ * @param options.onCommitted {function}
+ *   `(committed: { builtOnHead, clientSeed, webvhUpdateKeys }) =>
+ *   Promise<void>` -- the REQUIRED persist-before-publish seam. The caller
+ *   writes the pending client-key record there -- the `pending` codec group
+ *   of `keys/clientKeyRecord.ts`, ceremony `'self-enrollment'` -- so the add
+ *   entry never publishes a client this browser cannot re-derive, per the
+ *   post-pivot derivability rule (`decisions/0010`). The argument carries
+ *   everything that record needs beyond what the caller already holds: the
+ *   key set is minted INSIDE this call, so the seeds are handed over here,
+ *   while the record's `controller` and pointer DID are the caller's own
+ *   `pointer`. On a resume the seeds handed back are the resumed record's own,
+ *   verbatim, so re-persisting is idempotent. The ceremony's own seam
+ *   ({@link selfEnrollWebvhClient}'s) takes `{ builtOnHead }` alone -- its
+ *   callers hold the key set already -- and this call passes it a wrapper.
+ *   The rest of the contract is the ceremony's: it runs after the
+ *   reveal-and-commit entry stands and before the add entry is built, once
+ *   per attempt, a throw withholds the pivot, and the idempotent completed
+ *   branch never enters it. A call omitting the seam is refused with a
+ *   `TypeError` before any read
+ * @param [options.resume] {object}   the pending record's contents, replayed:
+ *   `{ clientSeed, webvhUpdateKeys, builtOnHead }`. Supplied, the local key
+ *   mint is SKIPPED and the whole enrollment key set is re-derived from the
+ *   recorded seeds, so the resumed run publishes the same client the torn run
+ *   was publishing, and `builtOnHead` is passed through as the ceremony's
+ *   resume marker (refusing a served log that never reached that head with
+ *   `BuiltOnHeadNotReachedError`). Everything downstream is unchanged: the
+ *   ceremony's own revealed / committed / completed detection publishes only
+ *   what is missing
  * @returns {Promise<object>}   the new client's key set (for the caller to
  *   persist under its unlock layer), its did:key, the account DID, the user
- *   key, and the roster epoch to pin
+ *   key, the roster epoch to pin, and `committed` -- whether THIS call
+ *   published the ceremony's pivot entry, propagated verbatim from
+ *   {@link selfEnrollWebvhClient}. A resume that met an already-complete
+ *   continuation returns `committed: false` and is a full success: the clear
+ *   condition for the pending record is that the call RETURNED, never
+ *   `committed === true`, or a resumed-onto-completed record would never be
+ *   cleared. The member exists so a build skew that dropped it surfaces
+ *   instead of reading as `false`
  */
-export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, accountLogPinStore }) {
+export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, accountLogPinStore, onCommitted, resume }) {
+    // Refused before any read, on the ceremony's own rule: without the seam the
+    // pivot entry can publish a client whose seed nothing persisted.
+    if (typeof onCommitted !== 'function') {
+        throw new TypeError('selfEnrollClientCore requires onCommitted: the pending client-key ' +
+            'record must be persisted before the add entry publishes the client.');
+    }
+    // A resume skips the mint on the strength of the recorded seeds, so its
+    // marker must be usable as the fork guard: refused here, before any read,
+    // rather than silently resuming unguarded.
+    if (resume) {
+        assertBuiltOnHeadShape({ builtOnHead: resume.builtOnHead });
+    }
     const expectedDid = pointer.did;
     if (!expectedDid || !isWebvhDid(expectedDid)) {
         throw new Error('The account pointer names no did:webvh; only a promoted account can ' +
             'self-enroll a client.');
     }
     // The new client's whole key set, minted locally; nothing travels but the
-    // public halves the log entries publish.
-    const clientSeed = crypto.getRandomValues(new Uint8Array(32));
+    // public halves the log entries publish. A resume mints nothing: every
+    // member below is a pure derivation of the recorded seeds, so the replayed
+    // key set is the torn run's, byte for byte.
+    const clientSeed = resume
+        ? resume.clientSeed
+        : crypto.getRandomValues(new Uint8Array(32));
     const { keyAgent, keyAgreementKey } = await agentsFromSeed({
         seed: clientSeed
     });
@@ -53,7 +104,9 @@ export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyA
         throw new Error('The minted key-agreement key has no public multibase.');
     }
     const signingKeyMultibase = clientSigningKeyMultibase({ keyAgent });
-    const webvhUpdateKeys = await mintClientWebvhUpdateKeys();
+    const webvhUpdateKeys = resume
+        ? resume.webvhUpdateKeys
+        : await mintClientWebvhUpdateKeys();
     const newClientKeys = {
         signingKeyMultibase,
         keyAgreementKeyMultibase,
@@ -68,11 +121,18 @@ export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyA
     // on a pinned read -- a served prefix of the log is refused before the
     // reveal-and-commit entry lands, rather than being rebased under the new
     // client's entries and only then caught by the verify below.
-    await selfEnrollWebvhClient({
+    const enrolled = await selfEnrollWebvhClient({
         store: logStore,
         ladderSeed,
         newClientKeys,
         newClientUpdateSeeds: webvhUpdateKeys,
+        // The ceremony's seam hands over the head alone; the key set it publishes
+        // was minted here, so the wrapper adds it -- everything the caller's
+        // pending record needs that the caller does not already hold. On a resume
+        // these are the resumed record's own seeds, so the re-persist is a
+        // rewrite of what already stands.
+        onCommitted: async ({ builtOnHead }) => onCommitted({ builtOnHead, clientSeed, webvhUpdateKeys }),
+        ...(resume ? { builtOnHead: resume.builtOnHead } : {}),
         expectedDid,
         ...(accountLogPinStore
             ? {
@@ -132,7 +192,11 @@ export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyA
         clientDid: keyAgent.id,
         did: expectedDid,
         userKey: read.userKey,
-        latestEpochId: read.latestEpochId
+        latestEpochId: read.latestEpochId,
+        // Propagated verbatim: whether THIS call published the pivot entry. The
+        // pending record is cleared because the call returned, not because this
+        // reads `true`.
+        committed: enrolled.committed
     };
 }
 //# sourceMappingURL=selfEnroll.js.map

package/dist/clientAnnex/selfEnroll.js.map

@@ -1 +1 @@
-{"version":3,"file":"selfEnroll.js","sourceRoot":"","sources":["../../src/clientAnnex/selfEnroll.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAGrE,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAG3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,kBAAkB,EAOnB;IAQC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAA;IAC/B,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,yCAAyC;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnE,MAAM,eAAe,GAAG,MAAM,yBAAyB,EAAE,CAAA;IACzD,MAAM,aAAa,GAAwB;QACzC,mBAAmB;QACnB,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,qBAAqB,CAAC;QAC1B,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,aAAa;QACb,oBAAoB,EAAE,eAAe;QACrC,WAAW;QACX,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC;gBACE,QAAQ,EAAE,kBAAkB;gBAC5B,KAAK,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;aACrD;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,kEAAkE;IAClE,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;QACtC,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IAEF,yEAAyE;IACzE,iEAAiE;IACjE,0EAA0E;IAC1E,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrE,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,yBAAyB;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,kCAAkC,CACrC,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,yBAAyB,CAAC;QAC9B,KAAK;QACL,SAAS,EAAE;YACT,EAAE,EAAE,kBAAkB,CAAC;gBACrB,mBAAmB;gBACnB,wBAAwB;aACzB,CAAC;YACF,kBAAkB,EAAE,wBAAwB;SAC7C;QACD,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAA;IAEF,OAAO;QACL,UAAU;QACV,eAAe;QACf,SAAS,EAAE,QAAQ,CAAC,EAAE;QACtB,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAA;AACH,CAAC"}
+{"version":3,"file":"selfEnroll.js","sourceRoot":"","sources":["../../src/clientAnnex/selfEnroll.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAGrE,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,qBAAqB,CAAA;AAG5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,kBAAkB,EAClB,WAAW,EACX,MAAM,EAiBP;IASC,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CACjB,oEAAoE;YAClE,qEAAqE,CACxE,CAAA;IACH,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,sBAAsB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAA;IAC/B,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,UAAU,GAAG,MAAM;QACvB,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9C,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnE,MAAM,eAAe,GAAG,MAAM;QAC5B,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,MAAM,yBAAyB,EAAE,CAAA;IACrC,MAAM,aAAa,GAAwB;QACzC,mBAAmB;QACnB,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,aAAa;QACb,oBAAoB,EAAE,eAAe;QACrC,0EAA0E;QAC1E,qEAAqE;QACrE,0EAA0E;QAC1E,mEAAmE;QACnE,kCAAkC;QAClC,WAAW,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CACrC,WAAW,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,WAAW;QACX,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC;gBACE,QAAQ,EAAE,kBAAkB;gBAC5B,KAAK,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;aACrD;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,kEAAkE;IAClE,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;QACtC,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IAEF,yEAAyE;IACzE,iEAAiE;IACjE,0EAA0E;IAC1E,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrE,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,yBAAyB;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,kCAAkC,CACrC,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,yBAAyB,CAAC;QAC9B,KAAK;QACL,SAAS,EAAE;YACT,EAAE,EAAE,kBAAkB,CAAC;gBACrB,mBAAmB;gBACnB,wBAAwB;aACzB,CAAC;YACF,kBAAkB,EAAE,wBAAwB;SAC7C;QACD,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAA;IAEF,OAAO;QACL,UAAU;QACV,eAAe;QACf,SAAS,EAAE,QAAQ,CAAC,EAAE;QACtB,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,wEAAwE;QACxE,wEAAwE;QACxE,gBAAgB;QAChB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAA;AACH,CAAC"}

package/dist/clients/rosterPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AA2CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAoC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CAwGD"}
+{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAGnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AA2CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAqC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CA0GD"}

package/dist/clients/rosterPolicy.js

@@ -1,4 +1,5 @@
 import { convergeUserKeyRosterToDocument, isSealableDescriptorStore, readUserKeyRoster } from '../keys/index.js';
+import { log } from '../log.js';
 import { verifyAccountLog } from '../webvh/index.js';
 /**
  * Whether a thrown error is one of the roster refusals -- a fabricated or
@@ -86,8 +87,9 @@ export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgree
         }
         // An unreachable server (or any transport hiccup) must not lock the user
         // out of an offline start: the cached key stays authoritative.
-        console.warn('The wrap-set roster check failed; continuing with the cached ' +
-            'user key:', err);
+        log.warn('The wrap-set roster check failed; continuing with the cached user key', {
+            err
+        });
         return null;
     }
     if (!read) {
@@ -168,7 +170,9 @@ export async function convergeUserKeyRosterToAccount({ pointer, store, userKey,
         if (isRosterRefusal(err)) {
             throw err;
         }
-        console.warn('Could not converge the wrap-set roster onto the account document:', err);
+        log.warn('Could not converge the wrap-set roster onto the account document', {
+            err
+        });
         return unchanged;
     }
     // The seal backstop, on a sealable (log-governed) store: a converged
@@ -189,15 +193,14 @@ export async function convergeUserKeyRosterToAccount({ pointer, store, userKey,
             if (isRosterRefusal(err)) {
                 throw err;
             }
-            console.warn('Could not seal the wrap-set roster log:', err);
+            log.warn('Could not seal the wrap-set roster log', { err });
         }
     }
     if (!rotated) {
         return { ...unchanged, sealed };
     }
-    console.warn('The wrap-set roster still wrapped the current key to ' +
-        `${staleRecipientIds.length} recipient(s) the account document no ` +
-        'longer keys; the rotation has been completed.');
+    log.warn('The wrap-set roster still wrapped the current key to recipient(s) ' +
+        'the account document no longer keys; the rotation has been completed', { staleRecipientCount: staleRecipientIds.length });
     // Rotated: the fresh key is only readable from the roster, so re-read it
     // and adopt it before the collection fan-out runs against it. A failure
     // here cannot resolve to the unchanged input -- the roster HAS moved.

package/dist/clients/rosterPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AA4DA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAC1C,OAAQ,GAA4B,CAAC,MAAM,KAAK,UAAU,CAAA;IAC5D,CAAC;IACD,OAAO,CACL,IAAI,KAAK,2BAA2B;QACpC,IAAI,KAAK,8BAA8B;QACvC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,0BAA0B,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,OAAO,CAAC,IAAI,CACV,+DAA+D;YAC7D,WAAW,EACb,GAAG,CACJ,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAUjB;IAOC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,EAAc;QACjC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACrC,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACtD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;SACX,CAAC,CAAA;QACF,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;QAC3B,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CACV,mEAAmE,EACnE,GAAG,CACJ,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0BAA0B;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,CAAA;IACjC,CAAC;IACD,OAAO,CAAC,IAAI,CACV,uDAAuD;QACrD,GAAG,iBAAiB,CAAC,MAAM,wCAAwC;QACnE,+CAA+C,CAClD,CAAA;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,mEAAmE;YACnE,kBAAkB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,oEAAoE;YACpE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,iBAAiB;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}
+{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AA4DA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAC1C,OAAQ,GAA4B,CAAC,MAAM,KAAK,UAAU,CAAA;IAC5D,CAAC;IACD,OAAO,CACL,IAAI,KAAK,2BAA2B;QACpC,IAAI,KAAK,8BAA8B;QACvC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,0BAA0B,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,GAAG,CAAC,IAAI,CACN,uEAAuE,EACvE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAUjB;IAOC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,EAAc;QACjC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACrC,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACtD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;SACX,CAAC,CAAA;QACF,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;QAC3B,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CACN,kEAAkE,EAClE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0BAA0B;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,CAAA;IACjC,CAAC;IACD,GAAG,CAAC,IAAI,CACN,oEAAoE;QAClE,sEAAsE,EACxE,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAClD,CAAA;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,mEAAmE;YACnE,kBAAkB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,oEAAoE;YACpE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,iBAAiB;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}

package/dist/descriptors/logSource.d.ts

@@ -28,7 +28,9 @@ export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
  * (chain, proofs, external authorization, and the chain-head pin, via
  * `readResourceLog`), and refuses a verified head whose state is not a
  * `WasEpochConfiguration` rather than handing it out as a descriptor.
- * Resolves `null` for an absent log (the pre-genesis state). Both governed
+ * Resolves `null` for an absent log (the pre-genesis state) only while no pin
+ * is held for it; under a held pin an absent log is refused as a `rollback`,
+ * the library's rule. Both governed
  * descriptor consumers -- the log-governed descriptor source below and the
  * roster's log-governed descriptor store -- read through this helper, so a
  * hardening applied here reaches every trusted descriptor read.
@@ -58,7 +60,8 @@ export declare function readGovernedEpochConfiguration({ store, resolveControlle
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
  * logs. An absent log resolves `undefined` exactly like an absent
  * Collection Description `encryption` member (a plaintext collection, or one
- * whose provisioning has not landed); verification failures throw through --
+ * whose provisioning has not landed), unless a pin is held for it, in which
+ * case the read refuses as a `rollback`; verification failures throw through --
  * {@link acquireDescriptor} rethrows the refusal classes rather than falling
  * back to the cache.
  *

package/dist/descriptors/logSource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAwBR;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;CAC3C,GAAG,0BAA0B,CAe7B"}
+{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAwBR;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;CAC3C,GAAG,0BAA0B,CAe7B"}

package/dist/descriptors/logSource.js

@@ -12,7 +12,9 @@ export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
  * (chain, proofs, external authorization, and the chain-head pin, via
  * `readResourceLog`), and refuses a verified head whose state is not a
  * `WasEpochConfiguration` rather than handing it out as a descriptor.
- * Resolves `null` for an absent log (the pre-genesis state). Both governed
+ * Resolves `null` for an absent log (the pre-genesis state) only while no pin
+ * is held for it; under a held pin an absent log is refused as a `rollback`,
+ * the library's rule. Both governed
  * descriptor consumers -- the log-governed descriptor source below and the
  * roster's log-governed descriptor store -- read through this helper, so a
  * hardening applied here reaches every trusted descriptor read.
@@ -55,7 +57,8 @@ export async function readGovernedEpochConfiguration({ store, resolveController,
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
  * logs. An absent log resolves `undefined` exactly like an absent
  * Collection Description `encryption` member (a plaintext collection, or one
- * whose provisioning has not landed); verification failures throw through --
+ * whose provisioning has not landed), unless a pin is held for it, in which
+ * case the read refuses as a `rollback`; verification failures throw through --
  * {@link acquireDescriptor} rethrows the refusal classes rather than falling
  * back to the cache.
  *

package/dist/descriptors/logSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,eAAe,EACf,yBAAyB,EAK1B,MAAM,0BAA0B,CAAA;AAGjC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAKC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EAMT;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB;gBACjB,QAAQ;gBACR,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;aAC9B,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,eAAe,EACf,yBAAyB,EAK1B,MAAM,0BAA0B,CAAA;AAGjC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAKC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EAMT;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB;gBACjB,QAAQ;gBACR,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;aAC9B,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -29,6 +29,11 @@
  * - `@interop/wallet-core/recovery` -- recovery codes on the roster identity
  *   model: a code as a minimal always-enrolled wallet client.
  *
+ * The root also exports the logging port: `setLogger` and the `Logger`
+ * type (`src/log.ts`), the seam an app wires once at bootstrap so this
+ * package's internal `console` fallback is replaced with a real logger
+ * (the sibling logging package's `createLogger`, for one).
+ *
  * This root re-exports `sync` and `space` for convenience. `identity`,
  * `request`, `webvh`, `keys`, `descriptors`, `keyring`,
  * `enrollment`, and `recovery` are deliberately NOT re-exported here, so
@@ -37,4 +42,6 @@
  */
 export * from './sync/index.js';
 export * from './space/index.js';
+export { setLogger } from './log.js';
+export type { Logger } from './log.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -29,6 +29,11 @@
  * - `@interop/wallet-core/recovery` -- recovery codes on the roster identity
  *   model: a code as a minimal always-enrolled wallet client.
  *
+ * The root also exports the logging port: `setLogger` and the `Logger`
+ * type (`src/log.ts`), the seam an app wires once at bootstrap so this
+ * package's internal `console` fallback is replaced with a real logger
+ * (the sibling logging package's `createLogger`, for one).
+ *
  * This root re-exports `sync` and `space` for convenience. `identity`,
  * `request`, `webvh`, `keys`, `descriptors`, `keyring`,
  * `enrollment`, and `recovery` are deliberately NOT re-exported here, so
@@ -37,4 +42,5 @@
  */
 export * from './sync/index.js';
 export * from './space/index.js';
+export { setLogger } from './log.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA"}