@interop/wallet-core 0.65.0 → 0.67.0

package/dist/clientAnnex/log.js

@@ -54,9 +54,9 @@ import { base64urlnopad } from '@scure/base';
 import { DID_LOG_RESOURCE } from '../space/collections.js';
 import { plaintextCollection } from '../space/plaintextCollection.js';
 import { resourceLogPinId } from '@interop/vh-resource-log';
-import { clientAnnexRung } from './ladder.js';
-import { assertCarryOverCommitments, assertPublishedLogDid, concludeWithPublishedLog, didWebvhControllerTemplate, MULTIKEY_VM_TYPE, pinOfLog, putLogResource, readPublishedLogOrThrow, updateKeySigner, WebvhLogConflictError, withLogConflictRetry } from '../webvh/didWebvh.js';
-import { signAccountEntry } from '../webvh/accountEntry.js';
+import { clientAnnexRung, ladderRung } from './ladder.js';
+import { advanceLogPin, assertCarryOverCommitments, assertPublishedLogDid, concludeWithPublishedLog, currentLogParameters, didWebvhControllerTemplate, MULTIKEY_VM_TYPE, putLogResource, readPublishedLogOrThrow, updateKeySigner, withLogConflictRetry, withThreadedHeadOnce } from '../webvh/didWebvh.js';
+import { accountEntryHead, signAccountEntry } from '../webvh/accountEntry.js';
 import { relationIds } from '../resourceLog/document.js';
 import { STANDING_ZCAP_TTL_MS, standingZcapStale } from '../webvh/standingZcap.js';
 import { wasWebvhLogStore } from '../webvh/wasIdStore.js';
@@ -315,11 +315,14 @@ export async function ensureClientAnnexSpace({ was, spaceId, controller }) {
  * @param options.nextKeyHashes {string[]}   every standing credential's
  *   rung-0 hash, the minting credential's included
  * @param options.signer {Signer}   the minting credential's rung-0 signer
- * @returns {Promise<{ did: string; generationId: string; log: DIDLog;
- *   doc: DIDDoc; spaceDescription?: SpaceDescription }>}   `spaceDescription`
- *   is the auxiliary Space's Description as the ensure read or wrote it, so a
- *   caller flipping the controller afterwards need not re-read it. Always
- *   present here, since this minter always runs the ensure.
+ * @returns {Promise<PublishedWebvhLog & { generationId: string;
+ *   spaceDescription?: SpaceDescription }>}   the published head of the
+ *   genesis log, which a stage building the generation's next entry can
+ *   stand on instead of re-reading it, carrying the PUT's own ETag when the
+ *   store handed one back. `spaceDescription` is the auxiliary Space's
+ *   Description as the ensure read or wrote it, so a caller flipping the
+ *   controller afterwards need not re-read it. Always present here, since
+ *   this minter always runs the ensure.
  */
 export async function mintClientAnnexGeneration({ was, wasServerUrl, spaceId, controller, updateKeyPublicKeyMultibase, nextKeyHashes, signer }) {
     const spaceDescription = await ensureClientAnnexSpace({
@@ -354,8 +357,15 @@ export async function mintClientAnnexGeneration({ was, wasServerUrl, spaceId, co
  * @param options.signer {Signer}
  * @param [options.capability] {IZcap}   an invocation capability the
  *   collection create and the genesis publish ride (a delegated minter)
- * @returns {Promise<{ did: string; generationId: string; log: DIDLog;
- *   doc: DIDDoc }>}
+ * @returns {Promise<PublishedWebvhLog & { generationId: string }>}   the
+ *   published head of the log this call just wrote -- the genesis log, its
+ *   DID and document, the effective update-key parameters, and the PUT's own
+ *   ETag when the store handed one back. It is what a stage building the
+ *   generation's next entry can stand on instead of re-reading the log
+ *   (see {@link ensureGenerationDelegationCurrent}'s `published`); the ETag
+ *   is absent against a backend that serves none, where a caller must read
+ *   for itself rather than degrade its compare-and-swap to an unconditional
+ *   write.
  */
 async function publishClientAnnexGenesis({ was, wasServerUrl, spaceId, generationId, updateKeyPublicKeyMultibase, nextKeyHashes, signer, capability }) {
     // The generation collection must exist before its first resource PUT; a
@@ -378,7 +388,7 @@ async function publishClientAnnexGenesis({ was, wasServerUrl, spaceId, generatio
         nextKeyHashes,
         signer
     });
-    await putLogResource({
+    const written = await putLogResource({
         store: clientAnnexLogStore({
             was,
             spaceId,
@@ -388,7 +398,12 @@ async function publishClientAnnexGenesis({ was, wasServerUrl, spaceId, generatio
         log: created.log,
         ifNoneMatch: true
     });
-    return { ...created, generationId };
+    return {
+        ...created,
+        generationId,
+        ...currentLogParameters(created),
+        ...(written.etag !== undefined ? { etag: written.etag } : {})
+    };
 }
 /**
  * Mints a fresh annex generation signed by a standing CREDENTIAL's
@@ -422,11 +437,14 @@ async function publishClientAnnexGenesis({ was, wasServerUrl, spaceId, generatio
  *   subtree). The typed-Space ensure is then skipped: the delegation's target
  *   covers the collections beneath the Space, never the Space Description,
  *   and a standing sibling delegation presupposes the auxiliary Space
- * @returns {Promise<{ did: string; generationId: string; log: DIDLog;
- *   doc: DIDDoc; spaceDescription?: SpaceDescription }>}   `spaceDescription`
- *   is the auxiliary Space's Description as the ensure read or wrote it, so a
- *   caller flipping the controller afterwards need not re-read it. Present
- *   exactly when the ensure ran, so absent under a supplied `capability`.
+ * @returns {Promise<PublishedWebvhLog & { generationId: string;
+ *   spaceDescription?: SpaceDescription }>}   the published head of the
+ *   genesis log, which a stage building the generation's next entry can
+ *   stand on instead of re-reading it, carrying the PUT's own ETag when the
+ *   store handed one back. `spaceDescription` is the auxiliary Space's
+ *   Description as the ensure read or wrote it, so a caller flipping the
+ *   controller afterwards need not re-read it. Present exactly when the
+ *   ensure ran, so absent under a supplied `capability`.
  */
 export async function mintCredentialClientAnnexGeneration({ was, wasServerUrl, spaceId, controller, ladderSeed, extraNextKeyHashes = [], capability }) {
     const spaceDescription = capability === undefined
@@ -606,8 +624,8 @@ export const DELEGATED_CLIENTS_DELEGATION_ACTIONS = ['GET', 'PUT'];
 /**
  * The sibling delegation's lifetime: the house standing-zcap value (one
  * year; see `standingZcap.ts`). It rots on exactly the account bridge's axis
- * -- same signer, same current-key-set rule, same renewal window -- so the
- * re-mint pass that refreshes the bridge refreshes it too.
+ * -- same signer, same current-key-set rule, same renewal window -- so
+ * whatever refreshes the bridge refreshes it too.
  */
 export const DELEGATED_CLIENTS_DELEGATION_TTL_MS = STANDING_ZCAP_TTL_MS;
 /**
@@ -658,15 +676,14 @@ export async function mintDelegatedClientsDelegation({ zcapClient, wasServerUrl,
     }));
 }
 /**
- * Builds the annex-side sibling-delegation minter the enrolled-client record
- * re-mint orchestrator (`recovery/remintRecoveryDelegations`) takes as an
- * injected closure -- the boundary keeping that base orchestrator free of
- * annex imports. The returned closure reads the auxiliary annex Space id off
- * the verified document's delegated-clients service entry (the annex DID
- * string embeds it) and mints a fresh {@link mintDelegatedClientsDelegation}
- * to the named controller; it resolves `undefined` while the document points
- * at no generation, which the orchestrator reads as "carry the old sealed
- * member verbatim".
+ * Builds the annex-side sibling-delegation minter a record re-bind takes as
+ * an injected closure -- the boundary keeping a caller outside this subpath
+ * free of annex imports. The returned closure reads the auxiliary annex Space
+ * id off the verified document's delegated-clients service entry (the annex
+ * DID string embeds it) and mints a fresh
+ * {@link mintDelegatedClientsDelegation} to the named controller; it resolves
+ * `undefined` while the document points at no generation, which a caller
+ * reads as "carry the old sealed member verbatim".
  * @param options {object}
  * @param options.doc {object}   the locally verified account document
  * @param options.zcapClient {ZcapClient}   the acting client's promoted
@@ -945,7 +962,7 @@ export async function revokeTreatingAlreadyRevokedAsSuccess({ revoke, delegation
         await revoke(delegation);
     }
     catch (err) {
-        if (err.name === 'ValidationError') {
+        if (err?.name === 'ValidationError') {
             return;
         }
         throw err;
@@ -1160,23 +1177,10 @@ async function readClientAnnexLogOrThrow({ store, expectedDid, pinStore, logId }
  * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}
  */
 export async function enrollClientAnnexTransientClient({ published: threadedHead, ...rest }) {
-    if (threadedHead !== undefined) {
-        try {
-            return await enrollClientAnnexTransientClientOnce({
-                ...rest,
-                published: threadedHead
-            });
-        }
-        catch (err) {
-            // A lost compare-and-swap on the threaded head says only that the head
-            // is stale; the retry below re-reads under the pin with its whole
-            // budget. Every other failure is the caller's.
-            if (!(err instanceof WebvhLogConflictError)) {
-                throw err;
-            }
-        }
-    }
-    return withLogConflictRetry(() => enrollClientAnnexTransientClientOnce(rest));
+    return withThreadedHeadOnce({
+        published: threadedHead,
+        attempt: published => enrollClientAnnexTransientClientOnce({ ...rest, published })
+    });
 }
 /**
  * One attempt of {@link enrollClientAnnexTransientClient}, re-invoked by the
@@ -1276,18 +1280,25 @@ async function enrollClientAnnexTransientClientOnce({ store, ladderSeed, generat
     // pre-entry log straight afterwards is refused as a rollback on the next
     // read (equal-to-pin would otherwise be accepted, and a later stage built on
     // the stale head would miss this entry).
-    if (pinStore && logId !== undefined) {
-        await pinStore.write({ logId, pin: pinOfLog(updated.log) });
-    }
+    await advanceLogPin({ pinStore, logId, log: updated.log });
     return { did: updated.did, doc: updated.doc, log: updated.log };
 }
 /**
  * Points the account document's delegated-clients service entry at a
  * annex DID -- the first install after a generation's genesis, and the GC
- * swap's re-point alike. One ordinary document-update entry, signed by an
- * enrolled client's active update key; the annex log always
- * publishes FIRST (see {@link mintClientAnnexGeneration}), so a tear leaves an
- * unpointed, authorization-inert generation, never a dangling pointer.
+ * swap's re-point alike. One ordinary document-update entry on either signer
+ * arm; the annex log always publishes FIRST (see
+ * {@link mintClientAnnexGeneration}), so a tear leaves an unpointed,
+ * authorization-inert generation, never a dangling pointer.
+ *
+ * On the ladder arm the entry is the pointer move a credential-only caller
+ * makes (the transient readiness pass, the establishment's stage 3): the
+ * seam attributes the ladder's current rung per attempt, the rung reveals
+ * itself in the entry it signs, and when it stood only committed the entry
+ * also commits the next rung's hash, so one entry does what a reveal entry
+ * followed by a client-signed pointer entry used to. A lost race re-runs the
+ * attribution from the winner's head, which is what climbs to the winner's
+ * committed rung (retry-up-the-ladder).
  *
  * An existing delegated-clients entry is re-pointed in place, its fragment id
  * preserved verbatim (the id is non-semantic and stable); absent one, a fresh
@@ -1295,18 +1306,19 @@ async function enrollClientAnnexTransientClientOnce({ store, ladderSeed, generat
  * service entry, the verification methods, and the relationship arrays are
  * preserved untouched. Idempotent: a document already pointing at the DID is
  * a no-op on the log (and, unless `logOnly`, it republishes `did.json` from
- * the resolved log, which the enrolled-client caller has the authority to
+ * the resolved log, which a controller-invoking caller has the authority to
  * do).
  *
  * @param options {object}
  * @param options.idStore {WebvhIdStore}   the ACCOUNT log's store; with
  *   `logOnly`, only its log read and `did.jsonl` PUT are used, so the narrow
  *   delegated seam satisfies it
- * @param options.signer {AccountLogSigner}   who signs the pointer entry:
- *   this enrolled client's update-key seeds -- or the ladder-rung idiom on a
- *   ladder-anchored account (`{ updateSeed: rung0.seed, stagedSeed:
- *   rung1.seed }`), as the credential-anchored genesis and the
- *   transient-recovery continuation pass
+ * @param options.signer {AccountLogSigner}   who signs the pointer entry: an
+ *   enrolled client's own update-key seeds (`{ kind: 'client', updateKeys }`,
+ *   the GC swap's re-point and an enrolled client's stage-3 fold), or a
+ *   standing credential's ladder seed (`{ kind: 'ladder', ladderSeed }`),
+ *   under which the acting rung is attributed from the head each attempt
+ *   builds on
  * @param options.clientAnnexDid {string}   the generation to point at
  * @param [options.expectedDid] {string}   the account DID the log must
  *   resolve to, from the account pointer
@@ -1316,13 +1328,16 @@ async function enrollClientAnnexTransientClientOnce({ store, ladderSeed, generat
  *   `accountLogPinId({ spaceId })`; required whenever a `pinStore` is
  *   supplied
  * @param [options.logOnly] {boolean}   publish `did.jsonl` only, never the
- *   `did.json` projection -- the transient-recovery continuation writing
- *   through the record's bridge delegation, whose narrow scope covers nothing
- *   but the log. The projection then lags until some caller holding an
- *   `id`-collection writer runs `ensureDidWebProjection` over the resolved
- *   log; on a client-less account that is a transient visit under its
- *   generation delegation. The log stays the source of truth meanwhile, and
- *   the server reads it rather than the projection, so the lag is a `did:web`
+ *   `did.json` projection. Defaults per arm, as {@link signAccountEntry}
+ *   does: `true` on the ladder arm, since a transient visit writes through
+ *   the record's bridge delegation, whose narrow scope covers nothing but the
+ *   log, and `false` on the client arm. The establishment's stage 3, a ladder
+ *   signer over a root-invoking store, passes `false` explicitly. A lagging
+ *   projection is republished when some caller holding an `id`-collection
+ *   writer runs `ensureDidWebProjection` over the resolved log; on a
+ *   client-less account that is a transient visit under its generation
+ *   delegation. The log stays the source of truth meanwhile, and the server
+ *   reads it rather than the projection, so the lag is a `did:web`
  *   verifier's concern alone
  * @param [options.published] {PublishedWebvhLog}   a head the caller already
  *   read and verified under this same pin slot, so the pointer entry builds
@@ -1333,55 +1348,36 @@ async function enrollClientAnnexTransientClientOnce({ store, ladderSeed, generat
  *   threaded attempt is EXTRA rather than one of the retry's three: a caller
  *   who saved a read is left with the same conflict budget as one who did not
  * @returns {Promise<{ did: string, doc: DIDDoc,
- *   published: PublishedWebvhLog }>}   `published` is the head this call
- *   leaves standing: the post-entry one, paired with its publish's own ETag,
- *   when the entry was appended; the head it stood on verbatim when the
- *   document already pointed at the DID
+ *   published: PublishedWebvhLog, rung?: LadderRung }>}   `published` is the
+ *   head this call leaves standing: the post-entry one, paired with its
+ *   publish's own ETag, when the entry was appended; the head it stood on
+ *   verbatim when the document already pointed at the DID. `rung` stands on
+ *   the ladder arm alone: the rung the entry was signed with, or, when the
+ *   document already pointed, the ladder's currently attributed rung
  */
 export async function setDelegatedClientsPointer({ published: threadedHead, ...rest }) {
-    if (threadedHead !== undefined) {
-        try {
-            return await setDelegatedClientsPointerOnce({
-                ...rest,
-                published: threadedHead
-            });
-        }
-        catch (err) {
-            // A lost compare-and-swap on the threaded head says only that the head
-            // is stale; the retry below re-reads under the pin with its whole
-            // budget. Every other failure is the caller's.
-            if (!(err instanceof WebvhLogConflictError)) {
-                throw err;
-            }
-        }
-    }
-    return withLogConflictRetry(() => setDelegatedClientsPointerOnce(rest));
+    return withThreadedHeadOnce({
+        published: threadedHead,
+        attempt: published => setDelegatedClientsPointerOnce({ ...rest, published })
+    });
 }
 /**
  * ONE attempt of {@link setDelegatedClientsPointer}, re-invoked by that
- * function's conflict retry and exported for a caller that runs its own.
- * A caller whose retry loop also attributes the signing rung must use this
- * form: the wrapper's inner retry would re-invoke the attempt with the SAME
- * signer, and a rung a racing ceremony consumed meanwhile can never
- * become authorized by re-reading, so the attempt would fail on the plain
- * not-authorized refusal instead of surfacing the conflict the caller's loop
- * knows how to re-attribute from.
- *
- * A caller that already read the head its signer was attributed
- * against passes it as `published`, and the entry is built on exactly that
- * head. A racing entry landing in between then loses the CAS on the PUT and
- * surfaces as a {@link WebvhLogConflictError}, which is what a re-attributing
- * loop retries -- rather than as the not-authorized refusal a fresh read of
- * the winner's head would produce.
+ * function's conflict retry and exported for a caller that runs its own
+ * retry around it.
+ *
+ * A caller that already read the head passes it as `published`, and the
+ * entry is built on exactly that head. A racing entry landing in between
+ * then loses the CAS on the PUT and surfaces as a
+ * {@link WebvhLogConflictError} for the retry to re-run.
  *
  * @param options {object}   see {@link setDelegatedClientsPointer}, plus:
  * @param [options.published] {PublishedWebvhLog}   the verified head to build
  *   this entry on, when the caller has already read it under the same pin;
  *   absent, the attempt reads the head itself
- * @returns {Promise<{ did: string, doc: DIDDoc,
- *   published: PublishedWebvhLog }>}
+ * @returns {Promise<PointerEntryOutcome>}
  */
-export async function setDelegatedClientsPointerOnce({ idStore, signer, clientAnnexDid, expectedDid, pinStore, logId, logOnly = false, published: alreadyRead }) {
+export async function setDelegatedClientsPointerOnce({ idStore, signer, clientAnnexDid, expectedDid, pinStore, logId, logOnly = signer.kind === 'ladder', published: alreadyRead }) {
     // Refuses a malformed target before anything is read or written.
     clientAnnexDidParts({ did: clientAnnexDid });
     let settled;
@@ -1395,10 +1391,10 @@ export async function setDelegatedClientsPointerOnce({ idStore, signer, clientAn
         missingMessage: 'did:webvh: did.jsonl is missing; nothing to point at a client annex.',
         verb: 're-pointing the delegated-clients entry',
         logOnly,
-        build: async ({ published }) => {
+        build: async ({ published, rung, state }) => {
             const { did, doc } = published;
             if (delegatedClientsPointer({ doc }) === clientAnnexDid) {
-                if (!logOnly && signer.kind === 'client') {
+                if (!logOnly) {
                     await concludeWithPublishedLog({ idStore, published });
                 }
                 // The head verbatim: the projection PUT touches no log, so this
@@ -1406,7 +1402,20 @@ export async function setDelegatedClientsPointerOnce({ idStore, signer, clientAn
                 settled = { did, doc, published };
                 return undefined;
             }
+            // A ladder rung standing only as a committed hash reveals itself
+            // through the seam's reveal union; this entry commits the next rung
+            // beside it, so the ladder stays prerotated past the move. An already
+            // revealed rung re-states the parameters verbatim.
+            const commitHashes = signer.kind === 'ladder' && state === 'committed'
+                ? [
+                    await deriveNextKeyHash((await ladderRung({
+                        ladderSeed: signer.ladderSeed,
+                        index: rung.index + 1
+                    })).keyMultibase)
+                ]
+                : undefined;
             return {
+                ...(commitHashes !== undefined ? { commitHashes } : {}),
                 services: servicesPointedAtClientAnnex({
                     doc,
                     accountDid: did,
@@ -1415,8 +1424,9 @@ export async function setDelegatedClientsPointerOnce({ idStore, signer, clientAn
             };
         }
     });
+    const ladderRungPart = outcome.rung !== undefined ? { rung: outcome.rung } : {};
     if (settled) {
-        return settled;
+        return { ...settled, ...ladderRungPart };
     }
     const updated = outcome.updated;
     return {
@@ -1425,16 +1435,8 @@ export async function setDelegatedClientsPointerOnce({ idStore, signer, clientAn
         // The post-entry head, from what `updateDID` already resolved plus this
         // publish's own validator: the update-key parameters are the ones the
         // entry re-stated unchanged above, so nothing is re-resolved or re-read.
-        published: {
-            log: updated.log,
-            did: updated.did,
-            // Detached from the entry's own `state`, as every other producer of
-            // this type is, so a consumer editing the document cannot edit the log.
-            doc: structuredClone(updated.doc),
-            updateKeys: updated.meta.updateKeys,
-            nextKeyHashes: updated.meta.nextKeyHashes,
-            ...(outcome.etag !== undefined ? { etag: outcome.etag } : {})
-        }
+        published: accountEntryHead({ outcome }),
+        ...ladderRungPart
     };
 }
 /**
@@ -1522,6 +1524,93 @@ export async function enrollTransientClient({ readAccountDocument, storeForGener
     throw new Error('client annex: the delegated-clients pointer kept moving across ' +
         `${String(maxRounds)} enrollment rounds; giving up.`);
 }
+/**
+ * The fresh-generation block every separate-pointer-entry caller runs: mint
+ * a generation in the annex Space, install its generation delegation, then
+ * append the account document's pointer entry naming it. The pointer write is
+ * the injected step (`point`): an enrolled client signs it under its own
+ * update keys, and a credential-only caller (the establishment, the
+ * transient visit) moves it as the ladder, one rung-signed entry per attempt. A
+ * caller with a step that must land
+ * between the install and the pointer entry (the establishment's bootstrap
+ * arm, whose Space still answers to its creation controller until it flips
+ * it to the account DID) supplies `beforePointerEntry`.
+ *
+ * The install stands on the head the mint just published rather than
+ * re-reading the log this run wrote a moment ago -- but only when that head
+ * carries the PUT's own ETag, since the install's entry publishes under a
+ * compare-and-swap and a head with no validator would degrade that to an
+ * unconditional write. With no ETag the install reads for itself. Either way
+ * its own publish advances the pin, so this generation's pin slot is
+ * established by this run.
+ *
+ * @param options {object}
+ * @param options.was {WasClient}   the storage client the mint and the
+ *   install write through
+ * @param options.wasServerUrl {string}
+ * @param options.spaceId {string}   the auxiliary annex Space's id
+ * @param options.controller {string}   the Space's creation controller (see
+ *   {@link mintCredentialClientAnnexGeneration})
+ * @param options.ladderSeed {Uint8Array}   the minting credential's ladder
+ *   seed
+ * @param options.mintGenerationDelegation {Function}
+ *   `({ clientAnnexDid }) => Promise<IZcap>`
+ * @param options.point {Function}   `(clientAnnexDid) => Promise<T>` -- the
+ *   pointer entry, whose result rides the return verbatim
+ * @param [options.capability] {IZcap}   the sibling delegation the annex
+ *   writes ride, for a caller holding a standing invocation authority
+ * @param [options.beforePointerEntry] {Function}
+ *   `({ minted }) => Promise<void>` -- runs after the install and before the
+ *   pointer entry, with the mint's published head (its `spaceDescription`
+ *   included)
+ * @param [options.pinStore] {ResourceLogPinStore}   chain-head pins; the
+ *   generation's slot is derived here
+ * @param [options.now] {number}   epoch milliseconds, for tests
+ * @returns {Promise<{ clientAnnexDid: string, generationDelegation: IZcap,
+ *   pointed: T }>}
+ */
+export async function mintPointedClientAnnexGeneration({ was, wasServerUrl, spaceId, controller, ladderSeed, mintGenerationDelegation, point, capability, beforePointerEntry, pinStore, now }) {
+    const minted = await mintCredentialClientAnnexGeneration({
+        was,
+        wasServerUrl,
+        spaceId,
+        controller,
+        ladderSeed,
+        ...(capability !== undefined ? { capability } : {})
+    });
+    const ensured = await ensureGenerationDelegationCurrent({
+        store: clientAnnexLogStore({
+            was,
+            spaceId,
+            generationId: minted.generationId,
+            ...(capability !== undefined ? { capability } : {})
+        }),
+        ladderSeed,
+        generationId: minted.generationId,
+        mintGenerationDelegation,
+        expectedDid: minted.did,
+        ...(minted.etag !== undefined ? { published: minted } : {}),
+        ...(pinStore !== undefined
+            ? {
+                pinStore,
+                logId: clientAnnexLogPinId({
+                    spaceId,
+                    generationId: minted.generationId
+                })
+            }
+            : {}),
+        ...(now !== undefined ? { now } : {})
+    });
+    if (beforePointerEntry !== undefined) {
+        await beforePointerEntry({ minted });
+    }
+    const pointed = await point(minted.did);
+    return {
+        clientAnnexDid: minted.did,
+        generationDelegation: ensured.delegation,
+        pointed
+    };
+}
 /**
  * RENEW PRECEDES MINT: the blocking pre-mint stage a transient App Connect
  * approval runs before delegating any grant. Reads the annex document
@@ -1603,23 +1692,10 @@ export async function enrollTransientClient({ readAccountDocument, storeForGener
  *   wanting one reads for itself
  */
 export async function ensureGenerationDelegationCurrent({ published: threadedHead, ...rest }) {
-    if (threadedHead !== undefined) {
-        try {
-            return await ensureGenerationDelegationCurrentOnce({
-                ...rest,
-                published: threadedHead
-            });
-        }
-        catch (err) {
-            // A lost compare-and-swap on the threaded head says only that the head
-            // is stale; the retry below re-reads under the pin with its whole
-            // budget. Every other failure is the caller's.
-            if (!(err instanceof WebvhLogConflictError)) {
-                throw err;
-            }
-        }
-    }
-    return withLogConflictRetry(() => ensureGenerationDelegationCurrentOnce(rest));
+    return withThreadedHeadOnce({
+        published: threadedHead,
+        attempt: published => ensureGenerationDelegationCurrentOnce({ ...rest, published })
+    });
 }
 /**
  * One attempt of {@link ensureGenerationDelegationCurrent}, re-invoked by the
@@ -1689,9 +1765,7 @@ async function ensureGenerationDelegationCurrentOnce({ store, ladderSeed, genera
     // pre-entry log straight afterwards is refused as a rollback on the next
     // read (equal-to-pin would otherwise be accepted, and a later stage built on
     // the stale head would miss this entry).
-    if (pinStore && logId !== undefined) {
-        await pinStore.write({ logId, pin: pinOfLog(updated.log) });
-    }
+    await advanceLogPin({ pinStore, logId, log: updated.log });
     return { delegation: fresh, renewed: true };
 }
 /**