@interop/wallet-core 0.66.0 → 0.67.0

package/dist/clients/revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACrD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD,UAAU,CAAC,EAAE,0BAA0B,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpD,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACzC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA+ElC"}
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAGzB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAA;AAEpD;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CACrD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,WAAW,EAAE,oBAAoB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,UAAU,CAAC,EAAE,0BAA0B,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAClB,EAAE;IACD,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,aAAa,EAAE,iBAAiB,CAAA;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,yBAAyB,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE;QACrC,QAAQ,EAAE,oBAAoB,CAAA;KAC/B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAA;IACzC,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA2DlC"}

package/dist/clients/revocation.js

@@ -1,12 +1,16 @@
 import { revokeWebvhClient } from '../webvh/index.js';
 import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
+import { assertUpdateKeyAttributed } from './policy.js';
 /**
  * Runs the whole revocation cascade for one enrolled wallet client. See the
  * module doc for the order and the convergence story. Throws before touching
- * anything on a call that must not proceed (revoking this client itself, a
- * client whose active update key was not attributed); once the document edit
- * lands, a thrown later stage leaves durable state a naive re-run -- or the
- * login-time sweep -- converges from.
+ * anything on a call that must not proceed: a client whose active update key
+ * was not attributed is refused here, and a client revoking itself is refused
+ * by the document edit's own client-arm check, from the seeds it holds, before
+ * its entry publishes -- the one wording every wallet sees, with the `self`
+ * eligibility refusal in `policy.ts` naming the rule for the surface. Once
+ * the document edit lands, a thrown later stage leaves durable state a naive
+ * re-run -- or the login-time sweep -- converges from.
  *
  * The document edit's `StagedCommitmentAmbiguousError` passes through
  * unwrapped, so a surface can re-word it ("disconnect this wallet from the
@@ -37,9 +41,6 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
  * @param [options.expectedDid] {string}   the account DID from the caller's
  *   stored account pointer; supplied, the document edit refuses a `did.jsonl`
  *   resolving to any other account
- * @param [options.ownSigningKeyMultibase] {string}   this client's own signing
- *   key; supplied, self-revocation is refused up front by the rule the surface
- *   should name, rather than by the update-key check inside the edit
  * @param options.rosterStore {EncryptionDescriptorStore}   the
  *   `key-map/user-key.jsonl` roster store
  * @param [options.userKey] {UserKey}   this client's cached user key
@@ -51,28 +52,17 @@ import { rotateRosterToDocumentAndCascade } from '../keys/index.js';
  *   with `{ userKey, latestEpochId, descriptor }` after the roster read and BEFORE
  *   the fan-out. The key and the epoch pin must persist atomically
  * @param options.collections {CascadeCollections}   the fan-out's work
- * @param [options.remintRecoveryDelegations] {Function}   `({ document }) =>
- *   Promise<{ reminted, skipped }>` -- the recovery-delegation re-mint stage,
- *   for a wallet that issues recovery codes
  * @param [options.remintGenerationDelegation] {Function}   `({ document }) =>
  *   Promise<GenerationDelegationRemint>` -- the generation-delegation
- *   re-mint stage, run against the post-edit document (stage 5 in the module
+ *   re-mint stage, run against the post-edit document (stage 4 in the module
  *   doc); expected to catch its own failures and report them
  * @param [options.onRotationAdopted] {Function}   `({ userKey }) => Promise<void>`
  *   -- the live-session adoption of a rotated key, run last so the session
  *   keeps operating without a re-login
  * @returns {Promise<ClientRevocationResult>}
  */
-export async function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, ownSigningKeyMultibase, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintRecoveryDelegations, remintGenerationDelegation, onRotationAdopted }) {
-    if (ownSigningKeyMultibase &&
-        ownSigningKeyMultibase === revokedClient.signingKeyMultibase) {
-        throw new Error('This wallet cannot disconnect itself; use another enrolled wallet ' +
-            'client (or a recovery code) instead.');
-    }
-    if (!revokedClient.updateKeyMultibase) {
-        throw new Error("This wallet's update key could not be attributed from the account " +
-            'log, so it cannot be disconnected from here.');
-    }
+export async function revokeAccountClient({ idStore, signer, projectionStore, revokedClient, knownLatentHashes, expectedDid, rosterStore, userKey, clientKeyAgreementKey, pinnedEpochId, onUserKeyAdopted, collections, remintGenerationDelegation, onRotationAdopted }) {
+    assertUpdateKeyAttributed(revokedClient);
     // 1. The document edit -- the pull axis everywhere, first. It resolves the
     // document as it now stands, which is what stage 2 resolves its remaining
     // recipients from.
@@ -111,11 +101,7 @@ export async function revokeAccountClient({ idStore, signer, projectionStore, re
             ...(generation ? { generation } : {})
         };
     }
-    // 4. The recovery re-mints, while the registry is still readable under the
-    // session's pre-adoption vault keys.
-    const recovery = await remintRecoveryDelegations?.({ document: doc });
-    // 5. The generation-delegation re-mint, against the same post-edit
-    // document.
+    // 4. The generation-delegation re-mint, against the post-edit document.
     const generation = await remintGenerationDelegation?.({ document: doc });
     if (tail.rotated) {
         await onRotationAdopted?.({ userKey: tail.userKey });
@@ -127,7 +113,6 @@ export async function revokeAccountClient({ idStore, signer, projectionStore, re
         document: doc,
         userKey: tail.userKey,
         rosterDescriptor: tail.rosterDescriptor,
-        ...(recovery ? { recovery } : {}),
         ...(generation ? { generation } : {})
     };
 }

package/dist/clients/revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AA0EA,OAAO,EACL,iBAAiB,EAKlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AAoCzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EA0BlB;IACC,IACE,sBAAsB;QACtB,sBAAsB,KAAK,aAAa,CAAC,mBAAmB,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,sCAAsC,CACzC,CAAA;IACH,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,8CAA8C,CACjD,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAChD,OAAO;QACP,MAAM;QACN,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,sEAAsE;QACtE,gEAAgE;QAChE,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAErE,mEAAmE;IACnE,YAAY;IACZ,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAExE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC"}
+{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/clients/revocation.ts"],"names":[],"mappings":"AA4EA,OAAO,EACL,iBAAiB,EAKlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAKjC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAmCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,OAAO,EACP,MAAM,EACN,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,0BAA0B,EAC1B,iBAAiB,EAsBlB;IACC,yBAAyB,CAAC,aAAa,CAAC,CAAA;IAExC,2EAA2E;IAC3E,0EAA0E;IAC1E,mBAAmB;IACnB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAChD,OAAO;QACP,MAAM;QACN,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,aAAa;QACb,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IAEF,wEAAwE;IACxE,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,IAAI,GAAG,MAAM,gCAAgC,CAAC;QAClD,WAAW;QACX,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,qBAAqB;QACrB,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,sEAAsE;QACtE,gEAAgE;QAChE,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,GAAG;YACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;IAExE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,iBAAiB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAA;AACH,CAAC"}

package/dist/clients/rosterPolicy.d.ts

@@ -137,6 +137,10 @@ export declare function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgr
  *   store
  * @param options.userKey {UserKey}   the start's current user key
  * @param options.descriptor {CollectionEncryption}   the start's roster read
+ * @param [options.etag] {string}   the validator that read was served under
+ *   (`UserKeyRosterReadResult.etag`), when it was a read on this same
+ *   `store` instance; with it, a convergence write is seeded from the
+ *   start's read rather than acquiring the roster a second time
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
@@ -152,11 +156,12 @@ export declare function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgr
  *   kids found, the kids escrowed by the mirror direction, and the key +
  *   descriptor to fan out with
  */
-export declare function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, clientKeyAgreementKey, pinnedEpochId, accountLogPinStore, onUserKeyAdopted }: {
+export declare function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, etag, clientKeyAgreementKey, pinnedEpochId, accountLogPinStore, onUserKeyAdopted }: {
     pointer: AccountLogPointer;
     store: EncryptionDescriptorStore;
     userKey: UserKey;
     descriptor: CollectionEncryption;
+    etag?: string;
     clientKeyAgreementKey: IKeyAgreementKey;
     pinnedEpochId?: string | null;
     accountLogPinStore?: ResourceLogPinStore;

package/dist/clients/rosterPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAInE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AAuCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAqC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CA0HD"}
+{"version":3,"file":"rosterPolicy.d.ts","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAInE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAErD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AAuCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EACb,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAqC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,IAAI,EACJ,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,KAAK,EAAE,yBAAyB,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D,GAAG,OAAO,CAAC;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,oBAAoB,CAAA;CACjC,CAAC,CA+GD"}

package/dist/clients/rosterPolicy.js

@@ -132,6 +132,10 @@ export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgree
  *   store
  * @param options.userKey {UserKey}   the start's current user key
  * @param options.descriptor {CollectionEncryption}   the start's roster read
+ * @param [options.etag] {string}   the validator that read was served under
+ *   (`UserKeyRosterReadResult.etag`), when it was a read on this same
+ *   `store` instance; with it, a convergence write is seeded from the
+ *   start's read rather than acquiring the roster a second time
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   this client's own
  *   (identity) key-agreement key
  * @param [options.pinnedEpochId] {string}   the locally pinned latest-seen
@@ -147,7 +151,7 @@ export async function checkUserKeyRosterAtLogin({ store, userKey, clientKeyAgree
  *   kids found, the kids escrowed by the mirror direction, and the key +
  *   descriptor to fan out with
  */
-export async function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, clientKeyAgreementKey, pinnedEpochId, accountLogPinStore, onUserKeyAdopted }) {
+export async function convergeUserKeyRosterToAccount({ pointer, store, userKey, descriptor, etag, clientKeyAgreementKey, pinnedEpochId, accountLogPinStore, onUserKeyAdopted }) {
     const unchanged = {
         rotated: false,
         sealed: false,
@@ -159,24 +163,27 @@ export async function convergeUserKeyRosterToAccount({ pointer, store, userKey,
     let rotated;
     let staleRecipientIds;
     let escrowedRecipientIds;
+    let converged;
     try {
         const { doc } = await verifyAccountLog({
             ...pointer,
             ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
         });
-        const converged = await convergeUserKeyRosterToDocument({
+        const result = await convergeUserKeyRosterToDocument({
             store,
             document: doc,
             descriptor,
+            ...(etag !== undefined ? { etag } : {}),
             // The escrow direction needs a key that unwraps every epoch, and the
             // login sweep is the standing mender for a ceremony torn between the
             // entry that published a client and the append that was to wrap the
             // user key to it. Without it only the retire direction would run here.
             ownerKeyAgreementKey: clientKeyAgreementKey
         });
-        rotated = converged.rotated;
-        staleRecipientIds = converged.staleRecipientIds;
-        escrowedRecipientIds = converged.escrowedRecipientIds;
+        rotated = result.rotated;
+        staleRecipientIds = result.staleRecipientIds;
+        escrowedRecipientIds = result.escrowedRecipientIds;
+        converged = result.descriptor;
     }
     catch (err) {
         if (isRosterRefusal(err)) {
@@ -217,31 +224,21 @@ export async function convergeUserKeyRosterToAccount({ pointer, store, userKey,
     }
     log.warn('The wrap-set roster still wrapped the current key to recipient(s) ' +
         'the account document no longer keys; the rotation has been completed', { staleRecipientCount: staleRecipientIds.length });
-    // Rotated: the fresh key is only readable from the roster, so re-read it
-    // and adopt it before the collection fan-out runs against it. A failure
-    // here cannot resolve to the unchanged input -- the roster HAS moved.
-    let read;
-    try {
-        read = await readUserKeyRoster({
-            store,
-            userKey,
-            clientKeyAgreementKey,
-            pinnedEpochId
-        });
-    }
-    catch (err) {
-        if (isRosterRefusal(err)) {
-            throw err;
-        }
-        throw new Error('The wrap-set roster was rotated onto a fresh user key, but the ' +
-            'read that adopts it failed; this session must not continue under ' +
-            'the retired key.', { cause: err });
-    }
-    if (!read) {
-        throw new Error('The wrap-set roster was rotated onto a fresh user key and then ' +
-            'reported absent; this session must not continue under the retired ' +
-            'key.');
-    }
+    // Rotated: the fresh key is only readable from the roster, so adopt it
+    // before the collection fan-out runs against it -- off the rotation's own
+    // verified result, so the roster is not acquired again (the continuity and
+    // possession checks still run). A rotation leaves the roster present, so
+    // the read cannot resolve absent; its refusals -- this client's own wrap
+    // missing from the fresh epoch, a rollback behind the pin -- propagate,
+    // since the roster HAS moved and this session must not continue under the
+    // retired key.
+    const read = await readUserKeyRoster({
+        store,
+        descriptor: converged,
+        userKey,
+        clientKeyAgreementKey,
+        pinnedEpochId
+    });
     await onUserKeyAdopted?.({
         userKey: read.userKey,
         latestEpochId: read.latestEpochId,

package/dist/clients/rosterPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AA4DA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,OAAO,CACL,IAAI,KAAK,8BAA8B;QACvC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,0BAA0B,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,GAAG,CAAC,IAAI,CACN,uEAAuE,EACvE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAUjB;IAQC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,EAAc;QACjC,oBAAoB,EAAE,EAAc;QACpC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,oBAA8B,CAAA;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACrC,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,+BAA+B,CAAC;YACtD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;YACV,qEAAqE;YACrE,qEAAqE;YACrE,oEAAoE;YACpE,uEAAuE;YACvE,oBAAoB,EAAE,qBAAqB;SAC5C,CAAC,CAAA;QACF,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;QAC3B,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAA;QAC/C,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,CAAA;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CACN,kEAAkE,EAClE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0BAA0B;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CACN,sEAAsE;YACpE,qCAAqC,EACvC,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,GAAG,CAAC,IAAI,CACN,oEAAoE;QAClE,sEAAsE,EACxE,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAClD,CAAA;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,mEAAmE;YACnE,kBAAkB,EACpB,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,oEAAoE;YACpE,MAAM,CACT,CAAA;IACH,CAAC;IACD,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,iBAAiB;QACjB,oBAAoB;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}
+{"version":3,"file":"rosterPolicy.js","sourceRoot":"","sources":["../../src/clients/rosterPolicy.ts"],"names":[],"mappings":"AA4DA,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAA;IACrD,OAAO,CACL,IAAI,KAAK,8BAA8B;QACvC,IAAI,KAAK,6BAA6B;QACtC,IAAI,KAAK,0BAA0B,CACpC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,KAAK,EACL,OAAO,EACP,qBAAqB,EACrB,aAAa,EACb,YAAY,EAOb;IACC,IAAI,IAAoC,CAAA;IACxC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC;YAC7B,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB;YACrB,aAAa;SACd,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,yEAAyE;QACzE,+DAA+D;QAC/D,GAAG,CAAC,IAAI,CACN,uEAAuE,EACvE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IACD,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,YAAY,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,OAAO,EACP,KAAK,EACL,OAAO,EACP,UAAU,EACV,IAAI,EACJ,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAWjB;IAQC,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,EAAc;QACjC,oBAAoB,EAAE,EAAc;QACpC,OAAO;QACP,UAAU;KACX,CAAA;IACD,IAAI,OAAgB,CAAA;IACpB,IAAI,iBAA2B,CAAA;IAC/B,IAAI,oBAA8B,CAAA;IAClC,IAAI,SAAsC,CAAA;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACrC,GAAG,OAAO;YACV,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;YACnD,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,UAAU;YACV,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,qEAAqE;YACrE,qEAAqE;YACrE,oEAAoE;YACpE,uEAAuE;YACvE,oBAAoB,EAAE,qBAAqB;SAC5C,CAAC,CAAA;QACF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QACxB,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAA;QAC5C,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAA;QAClD,SAAS,GAAG,MAAM,CAAC,UAAU,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CACN,kEAAkE,EAClE;YACE,GAAG;SACJ,CACF,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,kEAAkE;IAClE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,0BAA0B;IAC1B,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,QAAQ,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,GAAG,CAAA;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CACN,sEAAsE;YACpE,qCAAqC,EACvC,EAAE,sBAAsB,EAAE,oBAAoB,CAAC,MAAM,EAAE,CACxD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACvD,CAAC;IACD,GAAG,CAAC,IAAI,CACN,oEAAoE;QAClE,sEAAsE,EACxE,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAClD,CAAA;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,eAAe;IACf,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,UAAU,EAAE,SAAU;QACtB,OAAO;QACP,qBAAqB;QACrB,aAAa;KACd,CAAC,CAAA;IACF,MAAM,gBAAgB,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM;QACN,iBAAiB;QACjB,oBAAoB;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAA;AACH,CAAC"}

package/dist/descriptors/errors.d.ts

@@ -23,11 +23,12 @@
  * Both classes assign their `name` explicitly, which is what makes the string
  * a contract.
  *
- * The unknown-epoch half of the pair ships from `@interop/wallet-core/sync`
- * as `isUnknownEpochError`: the create-loss re-mint dispatches on it, and
- * `sync` deliberately imports nothing else in this library. This file is the
- * home of the other half, beside the cipher that raises it, and stays
- * import-free for the same reason `resourceLog/errors.ts` does.
+ * The unknown-epoch half of the pair ships from `@interop/was-client/sync`
+ * as `isUnknownEpochError`, beside the class that assigns the name. This half
+ * stays here on policy rather than on class adjacency: it classifies a
+ * roster-membership failure the wallet layer owns, and no sync driver
+ * dispatches on it. The file sits beside the cipher that raises the error and
+ * stays import-free for the same reason `resourceLog/errors.ts` does.
  */
 /**
  * Whether an error is the cipher's not-a-recipient signal (`KeyUnwrapError`):

package/dist/descriptors/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/descriptors/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEtD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/descriptors/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEtD"}

package/dist/descriptors/errors.js

@@ -23,11 +23,12 @@
  * Both classes assign their `name` explicitly, which is what makes the string
  * a contract.
  *
- * The unknown-epoch half of the pair ships from `@interop/wallet-core/sync`
- * as `isUnknownEpochError`: the create-loss re-mint dispatches on it, and
- * `sync` deliberately imports nothing else in this library. This file is the
- * home of the other half, beside the cipher that raises it, and stays
- * import-free for the same reason `resourceLog/errors.ts` does.
+ * The unknown-epoch half of the pair ships from `@interop/was-client/sync`
+ * as `isUnknownEpochError`, beside the class that assigns the name. This half
+ * stays here on policy rather than on class adjacency: it classifies a
+ * roster-membership failure the wallet layer owns, and no sync driver
+ * dispatches on it. The file sits beside the cipher that raises the error and
+ * stays import-free for the same reason `resourceLog/errors.ts` does.
  */
 /**
  * Whether an error is the cipher's not-a-recipient signal (`KeyUnwrapError`):

package/dist/descriptors/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/descriptors/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAQ,GAAiC,EAAE,IAAI,KAAK,gBAAgB,CAAA;AACtE,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/descriptors/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAQ,GAAiC,EAAE,IAAI,KAAK,gBAAgB,CAAA;AACtE,CAAC"}

package/dist/descriptors/index.d.ts

@@ -27,7 +27,9 @@
  *   collections whose descriptor is governed by a resource log: every read
  *   (including the unknown-epoch refresh) re-verifies the log and resolves to
  *   its verified head state, refusing a head that is not a
- *   `WasEpochConfiguration`.
+ *   `WasEpochConfiguration`. It keys each collection's chain-head pin by
+ *   `collectionDescriptorLogPinId` over the Space id, the library-named slot
+ *   (`space/<spaceId>/key-map/<collectionId>.jsonl`), so no app builds one.
  * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
  *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
  *   for hosts whose reads scan rows and count unknown-epoch skips.
@@ -38,11 +40,13 @@
  * - `isKeyUnwrapError` -- how a host scanning rows tells "not a recipient of
  *   this epoch" from corruption, matched by `err.name` because the cipher is
  *   an injected seam. Its sibling `isUnknownEpochError` ships from
- *   `@interop/wallet-core/sync`.
+ *   `@interop/was-client/sync`, beside the class it matches. This one stays
+ *   here on policy: it classifies a roster-membership failure the wallet
+ *   layer owns, and no sync driver dispatches on it.
  */
 export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
 export type { EncryptionDescriptorCache, EncryptionDescriptorSource } from './acquire.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
+export { collectionDescriptorLogPinId, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
 export { DescriptorRefreshPolicy } from './refresh.js';
 export { createRefreshingEdvDocCipher } from './cipher.js';
 export { isKeyUnwrapError } from './errors.js';

package/dist/descriptors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}

package/dist/descriptors/index.js

@@ -27,7 +27,9 @@
  *   collections whose descriptor is governed by a resource log: every read
  *   (including the unknown-epoch refresh) re-verifies the log and resolves to
  *   its verified head state, refusing a head that is not a
- *   `WasEpochConfiguration`.
+ *   `WasEpochConfiguration`. It keys each collection's chain-head pin by
+ *   `collectionDescriptorLogPinId` over the Space id, the library-named slot
+ *   (`space/<spaceId>/key-map/<collectionId>.jsonl`), so no app builds one.
  * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
  *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
  *   for hosts whose reads scan rows and count unknown-epoch skips.
@@ -38,10 +40,12 @@
  * - `isKeyUnwrapError` -- how a host scanning rows tells "not a recipient of
  *   this epoch" from corruption, matched by `err.name` because the cipher is
  *   an injected seam. Its sibling `isUnknownEpochError` ships from
- *   `@interop/wallet-core/sync`.
+ *   `@interop/was-client/sync`, beside the class it matches. This one stays
+ *   here on policy: it classifies a roster-membership failure the wallet
+ *   layer owns, and no sync driver dispatches on it.
  */
 export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
+export { collectionDescriptorLogPinId, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
 export { DescriptorRefreshPolicy } from './refresh.js';
 export { createRefreshingEdvDocCipher } from './cipher.js';
 export { isKeyUnwrapError } from './errors.js';

package/dist/descriptors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}

package/dist/descriptors/logSource.d.ts

@@ -21,6 +21,29 @@ import type { EncryptionDescriptorSource } from './acquire.js';
  * governed log entry, per WAS-EC.
  */
 export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
+/**
+ * The pin-slot key for a collection's governing descriptor log: the slot a
+ * keyed `ResourceLogPinStore` holds that log's chain-head pin under,
+ * `space/<spaceId>/key-map/<collectionId>.jsonl`. The library names it, as it
+ * names the account log's (`accountLogPinId`) and the roster's
+ * (`userKeyRosterPinId`) slots, so no app builds one of its own: the shape is
+ * host-free on purpose -- the Space id is what stays stable across a claimed
+ * host move, so a log served from a new host still lands in the same slot and
+ * is checked against the held pin rather than opening a fresh
+ * trust-on-first-use slate. The resource half mirrors the roster log's home
+ * (`key-map/user-key.jsonl`): a governing log lives in the plaintext,
+ * capability-gated key-map collection, beside the roster, since a log stored
+ * inside the encrypted collection it governs would itself be sealed.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}   the data Space id
+ * @param options.collectionId {string}   the governed collection
+ * @returns {string}
+ */
+export declare function collectionDescriptorLogPinId({ spaceId, collectionId }: {
+    spaceId: string;
+    collectionId: string;
+}): string;
 /**
  * The one governed epoch-configuration read: the fail-closed boundary that
  * decides whether a served log state may be treated as an encryption
@@ -72,16 +95,15 @@ export declare function readGovernedEpochConfiguration({ store, resolveControlle
  *   `() => Promise<ResourceLogController>` -- the caller's currently verified
  *   controller view, resolved per operation
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
- *   pins, keyed per log
- * @param options.logIdFor {function}   `(collectionId) => string` -- the
- *   collection's descriptor log's pin-slot key, typically built with
- *   `resourceLogPinId`
+ *   pins, keyed per log; each collection's slot is
+ *   {@link collectionDescriptorLogPinId} over `spaceId`
+ * @param options.spaceId {string}   the data Space the collections belong to
  * @returns {EncryptionDescriptorSource}
  */
-export declare function logGovernedDescriptorSource({ logFor, resolveController, pinStore, logIdFor }: {
+export declare function logGovernedDescriptorSource({ logFor, resolveController, pinStore, spaceId }: {
     logFor: (collectionId: string) => ResourceLogStore;
     resolveController: () => Promise<ResourceLogController>;
     pinStore: ResourceLogPinStore;
-    logIdFor: (collectionId: string) => string;
+    spaceId: string;
 }): EncryptionDescriptorSource;
 //# sourceMappingURL=logSource.d.ts.map

package/dist/descriptors/logSource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAwBR;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;CAC3C,GAAG,0BAA0B,CAe7B"}
+{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAwBR;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACR,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAe7B"}

package/dist/descriptors/logSource.js

@@ -1,10 +1,37 @@
 import { RESOURCE_LOG_METHOD } from '@interop/storage-core';
-import { readResourceLog, ResourceLogIntegrityError } from '@interop/vh-resource-log';
+import { readResourceLog, ResourceLogIntegrityError, resourceLogPinId } from '@interop/vh-resource-log';
+import { KEY_MAP_COLLECTION } from '../space/collections.js';
 /**
  * The state-document schema identifier an encryption descriptor carries in a
  * governed log entry, per WAS-EC.
  */
 export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
+/**
+ * The pin-slot key for a collection's governing descriptor log: the slot a
+ * keyed `ResourceLogPinStore` holds that log's chain-head pin under,
+ * `space/<spaceId>/key-map/<collectionId>.jsonl`. The library names it, as it
+ * names the account log's (`accountLogPinId`) and the roster's
+ * (`userKeyRosterPinId`) slots, so no app builds one of its own: the shape is
+ * host-free on purpose -- the Space id is what stays stable across a claimed
+ * host move, so a log served from a new host still lands in the same slot and
+ * is checked against the held pin rather than opening a fresh
+ * trust-on-first-use slate. The resource half mirrors the roster log's home
+ * (`key-map/user-key.jsonl`): a governing log lives in the plaintext,
+ * capability-gated key-map collection, beside the roster, since a log stored
+ * inside the encrypted collection it governs would itself be sealed.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}   the data Space id
+ * @param options.collectionId {string}   the governed collection
+ * @returns {string}
+ */
+export function collectionDescriptorLogPinId({ spaceId, collectionId }) {
+    return resourceLogPinId({
+        spaceId,
+        collectionId: KEY_MAP_COLLECTION.id,
+        resourceId: `${collectionId}.jsonl`
+    });
+}
 /**
  * The one governed epoch-configuration read: the fail-closed boundary that
  * decides whether a served log state may be treated as an encryption
@@ -69,20 +96,19 @@ export async function readGovernedEpochConfiguration({ store, resolveController,
  *   `() => Promise<ResourceLogController>` -- the caller's currently verified
  *   controller view, resolved per operation
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
- *   pins, keyed per log
- * @param options.logIdFor {function}   `(collectionId) => string` -- the
- *   collection's descriptor log's pin-slot key, typically built with
- *   `resourceLogPinId`
+ *   pins, keyed per log; each collection's slot is
+ *   {@link collectionDescriptorLogPinId} over `spaceId`
+ * @param options.spaceId {string}   the data Space the collections belong to
  * @returns {EncryptionDescriptorSource}
  */
-export function logGovernedDescriptorSource({ logFor, resolveController, pinStore, logIdFor }) {
+export function logGovernedDescriptorSource({ logFor, resolveController, pinStore, spaceId }) {
     return {
         async collectionEncryption({ collectionId }) {
             const current = await readGovernedEpochConfiguration({
                 store: logFor(collectionId),
                 resolveController,
                 pinStore,
-                logId: logIdFor(collectionId)
+                logId: collectionDescriptorLogPinId({ spaceId, collectionId })
             });
             if (current === null) {
                 return undefined;

package/dist/descriptors/logSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,eAAe,EACf,yBAAyB,EAK1B,MAAM,0BAA0B,CAAA;AAGjC;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAKC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EAMT;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB;gBACjB,QAAQ;gBACR,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC;aAC9B,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAKjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EAIb;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,GAAG,YAAY,QAAQ;KACpC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAKC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EAMR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB;gBACjB,QAAQ;gBACR,KAAK,EAAE,4BAA4B,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC/D,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/enrollment/enrollment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAaxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAe7B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AAiDD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,IAAI,CAYP;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,gBAAgB,CAAA;IACxB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,kBAAkB,EAAE,yBAAyB,CAAA;IAC7C,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CAuC3E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EACnB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAyEvD"}
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/enrollment/enrollment.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAaxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAe7B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAQ1D;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBAE7C,OAAO,SAC+C;CAKzD;AAiDD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,iBAAiB,CAwDpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAAC,EAC5C,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,IAAI,CAYP;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;CAC3B,GAAG,MAAM,CAKT;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAC,CA2BD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,MAAM,EACN,qBAAqB,EACrB,kBAAkB,EAClB,OAAO,EACR,EAAE;IACD,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,gBAAgB,CAAA;IACxB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,kBAAkB,EAAE,yBAAyB,CAAA;IAC7C,OAAO,EAAE,YAAY,CAAA;CACtB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CAmC3E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,UAAU,EACV,eAAe,EACf,OAAO,EACP,kBAAkB,EACnB,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,OAAO,EAAE,cAAc,CAAA;IACvB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;CACzC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAyEvD"}

package/dist/enrollment/enrollment.js

@@ -8,7 +8,7 @@ import { AccountLogMissingError, verifyAccountLog } from '../webvh/verifyLog.js'
 import { addUserKeyRosterRecipient } from '../keys/userKeyRoster.js';
 import { readUserKeyRoster, rosterRecipientKid, userKeyRosterLogSigner } from '../keys/userKeyRoster.js';
 import { userKeyRosterDescriptorStore } from '../keys/rosterStore.js';
-import { isSealableDescriptorStore } from '../keys/rosterLogStore.js';
+import { anchorRosterStoreAt } from '../keys/userKeyRosterCascade.js';
 import { memoryResourceLogPinStore } from '@interop/vh-resource-log';
 import { webvhResourceLogController } from '../resourceLog/index.js';
 import { CONNECT_CODE_PREFIX } from './connectCode.js';
@@ -214,7 +214,7 @@ export async function mintEnrollmentRequest() {
     if (!keyAgreementKeyMultibase) {
         throw new Error('The minted key-agreement key has no public multibase.');
     }
-    const webvhUpdateKeys = await mintClientWebvhUpdateKeys();
+    const webvhUpdateKeys = mintClientWebvhUpdateKeys();
     const request = {
         signingKeyMultibase: clientSigningKeyMultibase({ keyAgent }),
         keyAgreementKeyMultibase,
@@ -304,11 +304,7 @@ export async function approveEnrollment({ request, signer, clientKeyAgreementKey
         newClient: request
     });
     if (signer.kind === 'ladder') {
-        if (isSealableDescriptorStore(userKeyRosterStore)) {
-            userKeyRosterStore.setMinimumControllerVersion({
-                controller: webvhResourceLogController({ did, log })
-            });
-        }
+        anchorRosterStoreAt({ rosterStore: userKeyRosterStore, did, log });
         await escrow();
     }
     return {