@interop/wallet-core 0.67.0 → 0.69.0

package/dist/clientAnnex/rosterDeliveredEpochs.d.ts

@@ -40,9 +40,8 @@
  * Per-collection fan-out failures surface on the result's `epochs.failed`
  * list (the establishment's assert contract); nothing is discarded.
  */
-import type { IZcap } from '@interop/data-integrity-core';
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
-import type { CollectionEncryption, WasClient } from '@interop/was-client';
+import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import { type UserKey, type WalletSpaceEpochsResult } from '../keys/index.js';
 /**
@@ -76,10 +75,11 @@ export type RosterDeliveredEpochsResult = {
 /**
  * Ensures the user-key roster exists and every encrypted collection carries
  * epoch[0] under the key the roster delivers (see the module doc for the
- * policy and the refusal shapes). The two authority pairs ride the caller's
- * handles: the SIGNER is the store's (`store`, ladder-signed appends on a
- * ladder-anchored account), the INVOCATION is `was`'s -- bootstrap root
- * pre-promotion, or a delegated capability post-promotion (`capability`).
+ * policy and the refusal shapes). Both authority pairs ride the caller's
+ * stores: the SIGNER and the INVOCATION are wired into `store` for the
+ * roster and into each `storeFor` store for the collections -- ladder-signed
+ * appends on a ladder-anchored account, invoked with the bootstrap root
+ * pre-promotion or with a delegated capability post-promotion.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
@@ -90,11 +90,11 @@ export type RosterDeliveredEpochsResult = {
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   the credential's
  *   own key-agreement key -- the roster recipient the ensure wraps to, and
  *   the unwrap key of the re-read
- * @param options.was {WasClient}   the collection fan-out's storage client
- * @param options.spaceId {string}   the account Space's id
- * @param [options.capability] {IZcap}   the delegated invocation capability
- *   every fan-out request rides (a post-promotion caller: the generation
- *   delegation); absent, requests invoke the root capability
+ * @param options.storeFor {function}   `(collectionId) =>
+ *   EncryptionDescriptorStore` -- the collection fan-out's per-collection
+ *   descriptor stores
+ * @param options.spaceId {string}   the account Space's id, named in the
+ *   fan-out's per-collection failure messages
  * @param [options.collectionIds] {string[]}   the fan-out's collection set
  *   override, threaded through to `ensureWalletSpaceEpochs`
  * @param options.beforeMint {Function}   `() => Promise<void>` -- the mint
@@ -109,13 +109,12 @@ export type RosterDeliveredEpochsResult = {
  *   is refused with a `TypeError` before any read
  * @returns {Promise<RosterDeliveredEpochsResult>}
  */
-export declare function ensureRosterDeliveredEpochs({ store, candidateUserKey, clientKeyAgreementKey, was, spaceId, capability, collectionIds, beforeMint }: {
+export declare function ensureRosterDeliveredEpochs({ store, candidateUserKey, clientKeyAgreementKey, storeFor, spaceId, collectionIds, beforeMint }: {
     store: EncryptionDescriptorStore;
     candidateUserKey: UserKey;
     clientKeyAgreementKey: IKeyAgreementKey;
-    was: WasClient;
+    storeFor: (collectionId: string) => EncryptionDescriptorStore;
     spaceId: string;
-    capability?: IZcap;
     collectionIds?: string[];
     beforeMint: () => Promise<void>;
 }): Promise<RosterDeliveredEpochsResult>;

package/dist/clientAnnex/rosterDeliveredEpochs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterDeliveredEpochs.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/rosterDeliveredEpochs.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAczB;;;;;;;GAOG;AACH,MAAM,MAAM,2BAA2B,GACnC;IACE,OAAO,EAAE,WAAW,GAAG,qBAAqB,CAAA;IAC5C;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,gBAAgB,EAAE,oBAAoB,CAAA;IACtC;;OAEG;IACH,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,uBAAuB,CAAA;CAChC,GACD;IACE,OAAO,EAAE,SAAS,CAAA;IAClB,gBAAgB,EAAE,oBAAoB,CAAA;IACtC;;OAEG;IACH,KAAK,EAAE,OAAO,CAAA;CACf,CAAA;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,GAAG,EACH,OAAO,EACP,UAAU,EACV,aAAa,EACb,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,gBAAgB,EAAE,OAAO,CAAA;IACzB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAoFvC"}
+{"version":3,"file":"rosterDeliveredEpochs.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/rosterDeliveredEpochs.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAczB;;;;;;;GAOG;AACH,MAAM,MAAM,2BAA2B,GACnC;IACE,OAAO,EAAE,WAAW,GAAG,qBAAqB,CAAA;IAC5C;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,gBAAgB,EAAE,oBAAoB,CAAA;IACtC;;OAEG;IACH,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,uBAAuB,CAAA;CAChC,GACD;IACE,OAAO,EAAE,SAAS,CAAA;IAClB,gBAAgB,EAAE,oBAAoB,CAAA;IACtC;;OAEG;IACH,KAAK,EAAE,OAAO,CAAA;CACf,CAAA;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,2BAA2B,CAAC,EAChD,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,QAAQ,EACR,OAAO,EACP,aAAa,EACb,UAAU,EACX,EAAE;IACD,KAAK,EAAE,yBAAyB,CAAA;IAChC,gBAAgB,EAAE,OAAO,CAAA;IACzB,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IAC7D,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAmFvC"}

package/dist/clientAnnex/rosterDeliveredEpochs.js

@@ -13,10 +13,11 @@ const CREATE_RACE_ERROR_NAMES = new Set([
 /**
  * Ensures the user-key roster exists and every encrypted collection carries
  * epoch[0] under the key the roster delivers (see the module doc for the
- * policy and the refusal shapes). The two authority pairs ride the caller's
- * handles: the SIGNER is the store's (`store`, ladder-signed appends on a
- * ladder-anchored account), the INVOCATION is `was`'s -- bootstrap root
- * pre-promotion, or a delegated capability post-promotion (`capability`).
+ * policy and the refusal shapes). Both authority pairs ride the caller's
+ * stores: the SIGNER and the INVOCATION are wired into `store` for the
+ * roster and into each `storeFor` store for the collections -- ladder-signed
+ * appends on a ladder-anchored account, invoked with the bootstrap root
+ * pre-promotion or with a delegated capability post-promotion.
  *
  * @param options {object}
  * @param options.store {EncryptionDescriptorStore}   the roster's descriptor
@@ -27,11 +28,11 @@ const CREATE_RACE_ERROR_NAMES = new Set([
  * @param options.clientKeyAgreementKey {IKeyAgreementKey}   the credential's
  *   own key-agreement key -- the roster recipient the ensure wraps to, and
  *   the unwrap key of the re-read
- * @param options.was {WasClient}   the collection fan-out's storage client
- * @param options.spaceId {string}   the account Space's id
- * @param [options.capability] {IZcap}   the delegated invocation capability
- *   every fan-out request rides (a post-promotion caller: the generation
- *   delegation); absent, requests invoke the root capability
+ * @param options.storeFor {function}   `(collectionId) =>
+ *   EncryptionDescriptorStore` -- the collection fan-out's per-collection
+ *   descriptor stores
+ * @param options.spaceId {string}   the account Space's id, named in the
+ *   fan-out's per-collection failure messages
  * @param [options.collectionIds] {string[]}   the fan-out's collection set
  *   override, threaded through to `ensureWalletSpaceEpochs`
  * @param options.beforeMint {Function}   `() => Promise<void>` -- the mint
@@ -46,7 +47,7 @@ const CREATE_RACE_ERROR_NAMES = new Set([
  *   is refused with a `TypeError` before any read
  * @returns {Promise<RosterDeliveredEpochsResult>}
  */
-export async function ensureRosterDeliveredEpochs({ store, candidateUserKey, clientKeyAgreementKey, was, spaceId, capability, collectionIds, beforeMint }) {
+export async function ensureRosterDeliveredEpochs({ store, candidateUserKey, clientKeyAgreementKey, storeFor, spaceId, collectionIds, beforeMint }) {
     if (typeof beforeMint !== 'function') {
         throw new TypeError('ensureRosterDeliveredEpochs requires a beforeMint seam: the mint ' +
             'preconditions that license installing the candidate as epoch[0].');
@@ -109,11 +110,10 @@ export async function ensureRosterDeliveredEpochs({ store, candidateUserKey, cli
     // the install. Per-collection failures ride the result's `failed` list to
     // the caller.
     const epochs = await ensureWalletSpaceEpochs({
-        was,
+        storeFor,
         spaceId,
         userKey,
         rosterDescriptor: descriptor,
-        ...(capability !== undefined ? { capability } : {}),
         ...(collectionIds !== undefined ? { collectionIds } : {})
     });
     return {

package/dist/clientAnnex/rosterDeliveredEpochs.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterDeliveredEpochs.js","sourceRoot":"","sources":["../../src/clientAnnex/rosterDeliveredEpochs.ts"],"names":[],"mappings":"AA8CA,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,yBAAyB;IACzB,uBAAuB;CACxB,CAAC,CAAA;AAiCF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,GAAG,EACH,OAAO,EACP,UAAU,EACV,aAAa,EACb,UAAU,EAUX;IACC,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CACjB,mEAAmE;YACjE,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,gCAAgC;IAChC,IAAI,UAAgC,CAAA;IACpC,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,EAAE,CAAA;YAClB,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK;gBACL,OAAO,EAAE,gBAAgB;gBACzB,qBAAqB;aACtB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,CAAC,uBAAuB,CAAC,GAAG,CACzB,GAAgC,EAAE,IAAI,IAAI,EAAE,CAC9C,EACD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;QAC9B,kBAAkB,GAAG,IAAI,CAAA;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,KAAK,gBAAgB,CAAC,EAAE,CAAA;IAE9D,+DAA+D;IAC/D,sEAAsE;IACtE,kCAAkC;IAClC,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;YACnC,KAAK;YACL,UAAU;YACV,OAAO,EAAE,gBAAgB;YACzB,qBAAqB;SACtB,CAAC,CAAA;QACF,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACG,GAAgC,EAAE,IAAI,KAAK,0BAA0B,EACtE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QACzE,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,cAAc;IACd,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,GAAG;QACH,OAAO;QACP,OAAO;QACP,gBAAgB,EAAE,UAAU;QAC5B,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW;QACjE,OAAO;QACP,gBAAgB,EAAE,UAAU;QAC5B,MAAM;QACN,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"rosterDeliveredEpochs.js","sourceRoot":"","sources":["../../src/clientAnnex/rosterDeliveredEpochs.ts"],"names":[],"mappings":"AA6CA,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EAGlB,MAAM,kBAAkB,CAAA;AAEzB;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,yBAAyB;IACzB,uBAAuB;CACxB,CAAC,CAAA;AAiCF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAChD,KAAK,EACL,gBAAgB,EAChB,qBAAqB,EACrB,QAAQ,EACR,OAAO,EACP,aAAa,EACb,UAAU,EASX;IACC,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CACjB,mEAAmE;YACjE,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,gCAAgC;IAChC,IAAI,UAAgC,CAAA;IACpC,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,EAAE,CAAA;YAClB,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK;gBACL,OAAO,EAAE,gBAAgB;gBACzB,qBAAqB;aACtB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,CAAC,uBAAuB,CAAC,GAAG,CACzB,GAAgC,EAAE,IAAI,IAAI,EAAE,CAC9C,EACD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;QAC9B,kBAAkB,GAAG,IAAI,CAAA;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,KAAK,gBAAgB,CAAC,EAAE,CAAA;IAE9D,+DAA+D;IAC/D,sEAAsE;IACtE,kCAAkC;IAClC,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;YACnC,KAAK;YACL,UAAU;YACV,OAAO,EAAE,gBAAgB;YACzB,qBAAqB;SACtB,CAAC,CAAA;QACF,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACG,GAAgC,EAAE,IAAI,KAAK,0BAA0B,EACtE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QACzE,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,cAAc;IACd,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC3C,QAAQ;QACR,OAAO;QACP,OAAO;QACP,gBAAgB,EAAE,UAAU;QAC5B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAA;IACF,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW;QACjE,OAAO;QACP,gBAAgB,EAAE,UAAU;QAC5B,MAAM;QACN,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/clientAnnex/selfEnroll.d.ts

@@ -44,7 +44,6 @@
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { UserKey } from '../keys/userKey.js';
 import type { AccountPointer } from '../keyring/record.js';
-import { type ResourceLogPinStore } from '@interop/vh-resource-log';
 import type { ClientWebvhUpdateKeys } from '../webvh/didWebvh.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
 /**
@@ -65,13 +64,11 @@ import type { UnlockLogStore } from '../unlock/standingWebvh.js';
  *   with
  * @param options.logStore {UnlockLogStore}   the public log read plus the
  *   delegated `did.jsonl` PUT, built by the app around the record's bridge
- *   delegation
- * @param [options.accountLogPinStore] {ResourceLogPinStore}   this client's
- *   chain-head pin for the account log, checked on every read the two log
- *   entries are built on and advanced as each publishes, then checked again
- *   by the verify that follows. A fresh browser normally has none (this is
- *   its first contact), which is exactly the pin's trust-on-first-use
- *   establishment
+ *   delegation. It carries this client's chain-head pin for the account log,
+ *   checked on every read the two log entries are built on and advanced as
+ *   each publishes, then checked again by the verify that follows. A fresh
+ *   browser normally holds no pin yet (this is its first contact), which is
+ *   exactly the pin's trust-on-first-use establishment
  * @param options.onCommitted {function}
  *   `(committed: { builtOnHead, clientSeed, webvhUpdateKeys }) =>
  *   Promise<void>` -- the REQUIRED persist-before-publish seam. The caller
@@ -111,12 +108,11 @@ import type { UnlockLogStore } from '../unlock/standingWebvh.js';
  *   cleared. The member exists so a build skew that dropped it surfaces
  *   instead of reading as `false`
  */
-export declare function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, accountLogPinStore, onCommitted, resume }: {
+export declare function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, onCommitted, resume }: {
     pointer: AccountPointer;
     ladderSeed: Uint8Array;
     credentialKeyAgreementKey: IKeyAgreementKey;
     logStore: UnlockLogStore;
-    accountLogPinStore?: ResourceLogPinStore;
     onCommitted: (committed: {
         builtOnHead: {
             scid: string;

package/dist/clientAnnex/selfEnroll.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"selfEnroll.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/selfEnroll.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AASpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAMjC,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,sBAAsB,CAAA;AAW7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,kBAAkB,EAClB,WAAW,EACX,MAAM,EACP,EAAE;IACD,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,EAAE,cAAc,CAAA;IACxB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;QAChD,UAAU,EAAE,UAAU,CAAA;QACtB,eAAe,EAAE,qBAAqB,CAAA;KACvC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,UAAU,CAAA;QACtB,eAAe,EAAE,qBAAqB,CAAA;QACtC,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,CAAA;CACF,GAAG,OAAO,CAAC;IACV,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,OAAO,CAAA;CACnB,CAAC,CA8ID"}
+{"version":3,"file":"selfEnroll.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/selfEnroll.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AASpE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAO1D,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,sBAAsB,CAAA;AAW7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,WAAW,EACX,MAAM,EACP,EAAE;IACD,OAAO,EAAE,cAAc,CAAA;IACvB,UAAU,EAAE,UAAU,CAAA;IACtB,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,EAAE,cAAc,CAAA;IACxB,WAAW,EAAE,CAAC,SAAS,EAAE;QACvB,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;QAChD,UAAU,EAAE,UAAU,CAAA;QACtB,eAAe,EAAE,qBAAqB,CAAA;KACvC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,UAAU,CAAA;QACtB,eAAe,EAAE,qBAAqB,CAAA;QACtC,WAAW,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACjD,CAAA;CACF,GAAG,OAAO,CAAC;IACV,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,qBAAqB,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,OAAO,CAAA;CACnB,CAAC,CA2ID"}

package/dist/clientAnnex/selfEnroll.js

@@ -4,7 +4,7 @@ import { userKeyRosterDescriptorStore } from '../keys/rosterStore.js';
 import { memoryResourceLogPinStore } from '@interop/vh-resource-log';
 import { webvhResourceLogController } from '../resourceLog/index.js';
 import { mintClientWebvhUpdateKeys, updateKeyMultibase } from '../webvh/didWebvh.js';
-import { accountLogPinId, verifyAccountLog } from '../webvh/verifyLog.js';
+import { verifyAccountLog } from '../webvh/verifyLog.js';
 import { clientSigningKeyMultibase, isWebvhDid, webvhZcapClient } from '../webvh/zcap.js';
 import { assertBuiltOnHeadShape, selfEnrollWebvhClient } from './ladderAnchored.js';
 /**
@@ -25,13 +25,11 @@ import { assertBuiltOnHeadShape, selfEnrollWebvhClient } from './ladderAnchored.
  *   with
  * @param options.logStore {UnlockLogStore}   the public log read plus the
  *   delegated `did.jsonl` PUT, built by the app around the record's bridge
- *   delegation
- * @param [options.accountLogPinStore] {ResourceLogPinStore}   this client's
- *   chain-head pin for the account log, checked on every read the two log
- *   entries are built on and advanced as each publishes, then checked again
- *   by the verify that follows. A fresh browser normally has none (this is
- *   its first contact), which is exactly the pin's trust-on-first-use
- *   establishment
+ *   delegation. It carries this client's chain-head pin for the account log,
+ *   checked on every read the two log entries are built on and advanced as
+ *   each publishes, then checked again by the verify that follows. A fresh
+ *   browser normally holds no pin yet (this is its first contact), which is
+ *   exactly the pin's trust-on-first-use establishment
  * @param options.onCommitted {function}
  *   `(committed: { builtOnHead, clientSeed, webvhUpdateKeys }) =>
  *   Promise<void>` -- the REQUIRED persist-before-publish seam. The caller
@@ -71,7 +69,7 @@ import { assertBuiltOnHeadShape, selfEnrollWebvhClient } from './ladderAnchored.
  *   cleared. The member exists so a build skew that dropped it surfaces
  *   instead of reading as `false`
  */
-export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, accountLogPinStore, onCommitted, resume }) {
+export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyAgreementKey, logStore, onCommitted, resume }) {
     // Refused before any read, on the ceremony's own rule: without the seam the
     // pivot entry can publish a client whose seed nothing persisted.
     if (typeof onCommitted !== 'function') {
@@ -133,13 +131,7 @@ export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyA
         // rewrite of what already stands.
         onCommitted: async ({ builtOnHead }) => onCommitted({ builtOnHead, clientSeed, webvhUpdateKeys }),
         ...(resume ? { builtOnHead: resume.builtOnHead } : {}),
-        expectedDid,
-        ...(accountLogPinStore
-            ? {
-                pinStore: accountLogPinStore,
-                logId: accountLogPinId({ spaceId: pointer.spaceId })
-            }
-            : {})
+        expectedDid
     });
     // Verify the continuation from the world-readable log -- the same
     // first-contact read an enrollee's completion runs, and the controller the
@@ -148,7 +140,10 @@ export async function selfEnrollClientCore({ pointer, ladderSeed, credentialKeyA
         did: expectedDid,
         spaceId: pointer.spaceId,
         host: pointer.host,
-        ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
+        // The same chain-head pin the two entries above published under: the
+        // verifier fetches the log by host URL and holds no store, so the store's
+        // own pin is handed to it explicitly.
+        pinStore: logStore.pin.store
     });
     // The first roster read: signed with the `<did:webvh>#<multibase>` keyId
     // the add entry just published, unwrapping the user key from the

package/dist/clientAnnex/selfEnroll.js.map

@@ -1 +1 @@
-{"version":3,"file":"selfEnroll.js","sourceRoot":"","sources":["../../src/clientAnnex/selfEnroll.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAGrE,OAAO,EACL,yBAAyB,EAE1B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,qBAAqB,CAAA;AAG5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,kBAAkB,EAClB,WAAW,EACX,MAAM,EAiBP;IASC,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CACjB,oEAAoE;YAClE,qEAAqE,CACxE,CAAA;IACH,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,sBAAsB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAA;IAC/B,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,UAAU,GAAG,MAAM;QACvB,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9C,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnE,MAAM,eAAe,GAAG,MAAM;QAC5B,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,yBAAyB,EAAE,CAAA;IAC/B,MAAM,aAAa,GAAwB;QACzC,mBAAmB;QACnB,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,aAAa;QACb,oBAAoB,EAAE,eAAe;QACrC,0EAA0E;QAC1E,qEAAqE;QACrE,0EAA0E;QAC1E,mEAAmE;QACnE,kCAAkC;QAClC,WAAW,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CACrC,WAAW,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,WAAW;QACX,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC;gBACE,QAAQ,EAAE,kBAAkB;gBAC5B,KAAK,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;aACrD;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IAEF,kEAAkE;IAClE,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;QACtC,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IAEF,yEAAyE;IACzE,iEAAiE;IACjE,0EAA0E;IAC1E,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrE,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,yBAAyB;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,kCAAkC,CACrC,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,yBAAyB,CAAC;QAC9B,KAAK;QACL,SAAS,EAAE;YACT,EAAE,EAAE,kBAAkB,CAAC;gBACrB,mBAAmB;gBACnB,wBAAwB;aACzB,CAAC;YACF,kBAAkB,EAAE,wBAAwB;SAC7C;QACD,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAA;IAEF,OAAO;QACL,UAAU;QACV,eAAe;QACf,SAAS,EAAE,QAAQ,CAAC,EAAE;QACtB,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,wEAAwE;QACxE,wEAAwE;QACxE,gBAAgB;QAChB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAA;AACH,CAAC"}
+{"version":3,"file":"selfEnroll.js","sourceRoot":"","sources":["../../src/clientAnnex/selfEnroll.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAGrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACL,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAA;AAK7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,qBAAqB,CAAA;AAG5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,OAAO,EACP,UAAU,EACV,yBAAyB,EACzB,QAAQ,EACR,WAAW,EACX,MAAM,EAgBP;IASC,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CACjB,oEAAoE;YAClE,qEAAqE,CACxE,CAAA;IACH,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,sBAAsB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAA;IAC/B,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,UAAU,GAAG,MAAM;QACvB,CAAC,CAAC,MAAM,CAAC,UAAU;QACnB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9C,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CAAC;QACzD,IAAI,EAAE,UAAU;KACjB,CAAC,CAAA;IACF,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,eAA6D,CAAA;IAC/D,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnE,MAAM,eAAe,GAAG,MAAM;QAC5B,CAAC,CAAC,MAAM,CAAC,eAAe;QACxB,CAAC,CAAC,yBAAyB,EAAE,CAAA;IAC/B,MAAM,aAAa,GAAwB;QACzC,mBAAmB;QACnB,wBAAwB;QACxB,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;YAC3C,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;QACF,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;YACjD,IAAI,EAAE,eAAe,CAAC,UAAU;SACjC,CAAC;KACH,CAAA;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,aAAa;QACb,oBAAoB,EAAE,eAAe;QACrC,0EAA0E;QAC1E,qEAAqE;QACrE,0EAA0E;QAC1E,mEAAmE;QACnE,kCAAkC;QAClC,WAAW,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CACrC,WAAW,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,WAAW;KACZ,CAAC,CAAA;IAEF,kEAAkE;IAClE,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;QACtC,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,qEAAqE;QACrE,0EAA0E;QAC1E,sCAAsC;QACtC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK;KAC7B,CAAC,CAAA;IAEF,yEAAyE;IACzE,iEAAiE;IACjE,0EAA0E;IAC1E,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,4BAA4B,CAAC;QACzC,gBAAgB,EAAE,OAAO,CAAC,IAAI;QAC9B,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,0BAA0B,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrE,QAAQ,EAAE,yBAAyB,EAAE;QACrC,MAAM,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,KAAK;QACL,qBAAqB,EAAE,yBAAyB;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,kCAAkC,CACrC,CAAA;IACH,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,yBAAyB,CAAC;QAC9B,KAAK;QACL,SAAS,EAAE;YACT,EAAE,EAAE,kBAAkB,CAAC;gBACrB,mBAAmB;gBACnB,wBAAwB;aACzB,CAAC;YACF,kBAAkB,EAAE,wBAAwB;SAC7C;QACD,oBAAoB,EAAE,yBAAyB;KAChD,CAAC,CAAA;IAEF,OAAO;QACL,UAAU;QACV,eAAe;QACf,SAAS,EAAE,QAAQ,CAAC,EAAE;QACtB,GAAG,EAAE,WAAW;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,wEAAwE;QACxE,wEAAwE;QACxE,gBAAgB;QAChB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAA;AACH,CAAC"}

package/dist/descriptors/index.d.ts

@@ -2,52 +2,27 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/wallet-core/descriptors` subpath: collection
- * encryption-descriptor acquisition and the unknown-epoch refresh policy --
- * the one implementation of "which key epoch does this collection encrypt
- * under, and when do we ask again" that every wallet replica must share (a
- * drift here does not fail loudly; it fails as a resource one replica cannot
- * decrypt).
+ * The `@interop/wallet-core/descriptors` subpath: the log-governed descriptor
+ * source, the wallet's implementation of `@interop/was-client/edv`'s
+ * `EncryptionDescriptorSource` seam for collections whose encryption
+ * descriptor is governed by a resource log. The acquisition, cache-fallback,
+ * and unknown-epoch refresh policy that source plugs into (`acquireDescriptor`,
+ * `DescriptorRefreshPolicy`, `createRefreshingEdvDocCipher`, and the
+ * `isKeyUnwrapError` matcher) ship from `@interop/was-client/edv`, and this
+ * subpath re-exports none of them: one owner per name.
  *
- * - `EncryptionDescriptorSource` / `EncryptionDescriptorCache` -- the narrow
- *   seams a host implements: one signed Collection Description read, and a
- *   client-local get/put pre-scoped to one account's Space.
- * - `wasDescriptorSource` -- the `EncryptionDescriptorSource` over a
- *   was-client handle.
- * - `acquireDescriptor` / `acquireDescriptors` -- fetch + cache with the
- *   cached fallback whenever the fetch yields no descriptor, thrown or empty
- *   (offline, a collection keeps encrypting under its current epoch; an empty
- *   description is ambiguous, since WAS masks an unauthorized read as an
- *   absent one). No descriptor anywhere means a plaintext collection, or an
- *   encrypted one whose epoch[0] install has not landed -- which a caller that
- *   has declared the collection encrypted must refuse fail-closed. A
- *   log-governed source's refusal classes rethrow instead of falling back
- *   (except a continuity rollback, which is reconcilable divergence).
- * - `logGovernedDescriptorSource` -- the `EncryptionDescriptorSource` for
- *   collections whose descriptor is governed by a resource log: every read
- *   (including the unknown-epoch refresh) re-verifies the log and resolves to
- *   its verified head state, refusing a head that is not a
- *   `WasEpochConfiguration`. It keys each collection's chain-head pin by
- *   `collectionDescriptorLogPinId` over the Space id, the library-named slot
- *   (`space/<spaceId>/key-map/<collectionId>.jsonl`), so no app builds one.
- * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
- *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
- *   for hosts whose reads scan rows and count unknown-epoch skips.
- * - `createRefreshingEdvDocCipher` -- `createEdvDocCipher` bound to both: a
- *   cipher that acquires its own descriptor and, on an unknown-epoch decrypt,
- *   re-reads the description, swaps itself, and retries exactly once per
- *   instance.
- * - `isKeyUnwrapError` -- how a host scanning rows tells "not a recipient of
- *   this epoch" from corruption, matched by `err.name` because the cipher is
- *   an injected seam. Its sibling `isUnknownEpochError` ships from
- *   `@interop/was-client/sync`, beside the class it matches. This one stays
- *   here on policy: it classifies a roster-membership failure the wallet
- *   layer owns, and no sync driver dispatches on it.
+ * - `logGovernedDescriptorSource` -- every read (including the unknown-epoch
+ *   refresh) re-verifies the log and resolves to its verified head state,
+ *   refusing a head that is not a `WasEpochConfiguration`. Reads run under the
+ *   collection-descriptor log class, so a ladder-signed append admits on
+ *   `assertionMethod` membership alone. It keys each collection's chain-head
+ *   pin by `collectionDescriptorLogPinId` over the Space id, the library-named
+ *   slot (`space/<spaceId>/<collectionId>/meta/log`, the log's own home), so no
+ *   app builds one. It is the one governed-descriptor reader this subpath
+ *   publishes: the bare-controller read under it
+ *   (`readGovernedEpochConfiguration`, was-client's) states no log class and
+ *   would read a collection log under the roster's license, so it stays
+ *   module-internal.
  */
-export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
-export type { EncryptionDescriptorCache, EncryptionDescriptorSource } from './acquire.js';
-export { collectionDescriptorLogPinId, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
-export { DescriptorRefreshPolicy } from './refresh.js';
-export { createRefreshingEdvDocCipher } from './cipher.js';
-export { isKeyUnwrapError } from './errors.js';
+export { collectionDescriptorLogPinId, logGovernedDescriptorSource } from './logSource.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/descriptors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAA"}

package/dist/descriptors/index.js

@@ -2,51 +2,27 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/wallet-core/descriptors` subpath: collection
- * encryption-descriptor acquisition and the unknown-epoch refresh policy --
- * the one implementation of "which key epoch does this collection encrypt
- * under, and when do we ask again" that every wallet replica must share (a
- * drift here does not fail loudly; it fails as a resource one replica cannot
- * decrypt).
+ * The `@interop/wallet-core/descriptors` subpath: the log-governed descriptor
+ * source, the wallet's implementation of `@interop/was-client/edv`'s
+ * `EncryptionDescriptorSource` seam for collections whose encryption
+ * descriptor is governed by a resource log. The acquisition, cache-fallback,
+ * and unknown-epoch refresh policy that source plugs into (`acquireDescriptor`,
+ * `DescriptorRefreshPolicy`, `createRefreshingEdvDocCipher`, and the
+ * `isKeyUnwrapError` matcher) ship from `@interop/was-client/edv`, and this
+ * subpath re-exports none of them: one owner per name.
  *
- * - `EncryptionDescriptorSource` / `EncryptionDescriptorCache` -- the narrow
- *   seams a host implements: one signed Collection Description read, and a
- *   client-local get/put pre-scoped to one account's Space.
- * - `wasDescriptorSource` -- the `EncryptionDescriptorSource` over a
- *   was-client handle.
- * - `acquireDescriptor` / `acquireDescriptors` -- fetch + cache with the
- *   cached fallback whenever the fetch yields no descriptor, thrown or empty
- *   (offline, a collection keeps encrypting under its current epoch; an empty
- *   description is ambiguous, since WAS masks an unauthorized read as an
- *   absent one). No descriptor anywhere means a plaintext collection, or an
- *   encrypted one whose epoch[0] install has not landed -- which a caller that
- *   has declared the collection encrypted must refuse fail-closed. A
- *   log-governed source's refusal classes rethrow instead of falling back
- *   (except a continuity rollback, which is reconcilable divergence).
- * - `logGovernedDescriptorSource` -- the `EncryptionDescriptorSource` for
- *   collections whose descriptor is governed by a resource log: every read
- *   (including the unknown-epoch refresh) re-verifies the log and resolves to
- *   its verified head state, refusing a head that is not a
- *   `WasEpochConfiguration`. It keys each collection's chain-head pin by
- *   `collectionDescriptorLogPinId` over the Space id, the library-named slot
- *   (`space/<spaceId>/key-map/<collectionId>.jsonl`), so no app builds one.
- * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
- *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
- *   for hosts whose reads scan rows and count unknown-epoch skips.
- * - `createRefreshingEdvDocCipher` -- `createEdvDocCipher` bound to both: a
- *   cipher that acquires its own descriptor and, on an unknown-epoch decrypt,
- *   re-reads the description, swaps itself, and retries exactly once per
- *   instance.
- * - `isKeyUnwrapError` -- how a host scanning rows tells "not a recipient of
- *   this epoch" from corruption, matched by `err.name` because the cipher is
- *   an injected seam. Its sibling `isUnknownEpochError` ships from
- *   `@interop/was-client/sync`, beside the class it matches. This one stays
- *   here on policy: it classifies a roster-membership failure the wallet
- *   layer owns, and no sync driver dispatches on it.
+ * - `logGovernedDescriptorSource` -- every read (including the unknown-epoch
+ *   refresh) re-verifies the log and resolves to its verified head state,
+ *   refusing a head that is not a `WasEpochConfiguration`. Reads run under the
+ *   collection-descriptor log class, so a ladder-signed append admits on
+ *   `assertionMethod` membership alone. It keys each collection's chain-head
+ *   pin by `collectionDescriptorLogPinId` over the Space id, the library-named
+ *   slot (`space/<spaceId>/<collectionId>/meta/log`, the log's own home), so no
+ *   app builds one. It is the one governed-descriptor reader this subpath
+ *   publishes: the bare-controller read under it
+ *   (`readGovernedEpochConfiguration`, was-client's) states no log class and
+ *   would read a collection log under the roster's license, so it stays
+ *   module-internal.
  */
-export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
-export { collectionDescriptorLogPinId, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
-export { DescriptorRefreshPolicy } from './refresh.js';
-export { createRefreshingEdvDocCipher } from './cipher.js';
-export { isKeyUnwrapError } from './errors.js';
+export { collectionDescriptorLogPinId, logGovernedDescriptorSource } from './logSource.js';
 //# sourceMappingURL=index.js.map

package/dist/descriptors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAA"}

package/dist/descriptors/logSource.d.ts

@@ -12,28 +12,44 @@
  * log rather than adopting whatever the host serves. A verified head whose
  * state is not an epoch configuration is refused fail-closed rather than
  * handed out as a descriptor.
+ *
+ * The log lives at the collection's own `meta/log` sub-resource
+ * (`COLLECTION_HISTORY_LOG_SUBRESOURCE`), inside the URL subtree of the
+ * collection it governs. A share grantee or a connected app already holds a
+ * read capability over that subtree, so the same grant that lets them read
+ * the collection lets them verify its descriptor's history: no second grant,
+ * and no capability over the account's `key-map` collection.
+ *
+ * Reads here run under the collection-descriptor log CLASS: a ladder-signed
+ * append to one of these logs admits on `assertionMethod` membership alone,
+ * the roster's ceremony-tail license binding the roster log only. A reader
+ * that inherited the roster's rule would refuse a served log its own wallet
+ * wrote.
  */
-import type { CollectionEncryption } from '@interop/was-client';
-import { type ResourceLogController, type ResourceLogPinStore, type ResourceLogStore, type VerifiedResourceLog } from '@interop/vh-resource-log';
-import type { EncryptionDescriptorSource } from './acquire.js';
+import { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration, type EncryptionDescriptorSource } from '@interop/was-client/edv';
+import { type ResourceLogPinStore, type ResourceLogStore } from '@interop/vh-resource-log';
+import { type WebvhResourceLogController } from '../resourceLog/index.js';
 /**
- * The state-document schema identifier an encryption descriptor carries in a
- * governed log entry, per WAS-EC.
+ * The governed read boundary and the state-document schema identifier live in
+ * `@interop/was-client/edv` (the pointer-following collection store reads
+ * through the same helper); re-exported here so the roster store and this
+ * module's consumers keep one import site.
  */
-export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
+export { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration };
 /**
  * The pin-slot key for a collection's governing descriptor log: the slot a
  * keyed `ResourceLogPinStore` holds that log's chain-head pin under,
- * `space/<spaceId>/key-map/<collectionId>.jsonl`. The library names it, as it
+ * `space/<spaceId>/<collectionId>/meta/log`. The library names it, as it
  * names the account log's (`accountLogPinId`) and the roster's
- * (`userKeyRosterPinId`) slots, so no app builds one of its own: the shape is
- * host-free on purpose -- the Space id is what stays stable across a claimed
- * host move, so a log served from a new host still lands in the same slot and
- * is checked against the held pin rather than opening a fresh
- * trust-on-first-use slate. The resource half mirrors the roster log's home
- * (`key-map/user-key.jsonl`): a governing log lives in the plaintext,
- * capability-gated key-map collection, beside the roster, since a log stored
- * inside the encrypted collection it governs would itself be sealed.
+ * (`userKeyRosterPinId`) slots, so no app builds one of its own.
+ *
+ * The slot follows the log's placement: the log is the collection's own
+ * `meta/log` sub-resource, inside the URL subtree of the collection it
+ * governs, so the read capability a share grantee or a connected app already
+ * holds covers it. The shape is host-free on purpose -- the Space id is what
+ * stays stable across a claimed host move, so a log served from a new host
+ * still lands in the same slot and is checked against the held pin rather
+ * than opening a fresh trust-on-first-use slate.
  *
  * @param options {object}
  * @param options.spaceId {string}   the data Space id
@@ -44,56 +60,29 @@ export declare function collectionDescriptorLogPinId({ spaceId, collectionId }:
     spaceId: string;
     collectionId: string;
 }): string;
-/**
- * The one governed epoch-configuration read: the fail-closed boundary that
- * decides whether a served log state may be treated as an encryption
- * descriptor. Resolves the controller view, reads and fully verifies the log
- * (chain, proofs, external authorization, and the chain-head pin, via
- * `readResourceLog`), and refuses a verified head whose state is not a
- * `WasEpochConfiguration` rather than handing it out as a descriptor.
- * Resolves `null` for an absent log (the pre-genesis state) only while no pin
- * is held for it; under a held pin an absent log is refused as a `rollback`,
- * the library's rule. Both governed
- * descriptor consumers -- the log-governed descriptor source below and the
- * roster's log-governed descriptor store -- read through this helper, so a
- * hardening applied here reaches every trusted descriptor read.
- *
- * @param options {object}
- * @param options.store {ResourceLogStore}   the log's transport seam
- * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
- * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
- *   pin for this log
- * @param options.logId {string}   the pin-slot key for this log, from
- *   `resourceLogPinId`
- * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; etag?: string } | null>}
- */
-export declare function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }: {
-    store: ResourceLogStore;
-    resolveController: () => Promise<ResourceLogController>;
-    pinStore: ResourceLogPinStore;
-    logId: string;
-}): Promise<{
-    verified: VerifiedResourceLog;
-    descriptor: CollectionEncryption;
-    etag?: string;
-} | null>;
 /**
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
  * logs. An absent log resolves `undefined` exactly like an absent
  * Collection Description `encryption` member (a plaintext collection, or one
  * whose provisioning has not landed), unless a pin is held for it, in which
  * case the read refuses as a `rollback`; verification failures throw through --
- * {@link acquireDescriptor} rethrows the refusal classes rather than falling
- * back to the cache.
+ * was-client's `acquireDescriptor` rethrows the refusal classes rather than
+ * falling back to the cache.
+ *
+ * Every read runs under the collection-descriptor log class
+ * ({@link controllerForLogClass}), so a ladder-signed append verifies on
+ * `assertionMethod` membership alone. Without that narrowing a reader would
+ * inherit the roster's ceremony-tail license and refuse a served log its own
+ * wallet's standing credential wrote.
  *
  * @param options {object}
  * @param options.logFor {function}   `(collectionId) => ResourceLogStore` --
- *   the collection's governing log's transport seam
+ *   the collection's governing log's transport seam (was-client's
+ *   `resourceLogStore({ collection })` over the collection's `meta/log`)
  * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view, resolved per operation and narrowed here to
+ *   this log class
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pins, keyed per log; each collection's slot is
  *   {@link collectionDescriptorLogPinId} over `spaceId`
@@ -102,7 +91,7 @@ export declare function readGovernedEpochConfiguration({ store, resolveControlle
  */
 export declare function logGovernedDescriptorSource({ logFor, resolveController, pinStore, spaceId }: {
     logFor: (collectionId: string) => ResourceLogStore;
-    resolveController: () => Promise<ResourceLogController>;
+    resolveController: () => Promise<WebvhResourceLogController>;
     pinStore: ResourceLogPinStore;
     spaceId: string;
 }): EncryptionDescriptorSource;

package/dist/descriptors/logSource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAwBR;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACR,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAe7B"}
+{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACR,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAmB7B"}