@interop/wallet-core 0.67.0 → 0.69.0

package/dist/descriptors/logSource.js

@@ -1,24 +1,55 @@
-import { RESOURCE_LOG_METHOD } from '@interop/storage-core';
-import { readResourceLog, ResourceLogIntegrityError, resourceLogPinId } from '@interop/vh-resource-log';
-import { KEY_MAP_COLLECTION } from '../space/collections.js';
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The log-governed {@link EncryptionDescriptorSource}: descriptor acquisition
+ * for a collection whose encryption descriptor is governed by a resource log
+ * (the Resource Log Profile) rather than by its Collection Description. Every
+ * read -- including the unknown-epoch refresh's re-read -- resolves to the
+ * log's VERIFIED head state: chain, proofs, external authorization against
+ * the independently verified controller document, and the chain-head pin all
+ * checked before any descriptor is handed out, so a refresh re-verifies the
+ * log rather than adopting whatever the host serves. A verified head whose
+ * state is not an epoch configuration is refused fail-closed rather than
+ * handed out as a descriptor.
+ *
+ * The log lives at the collection's own `meta/log` sub-resource
+ * (`COLLECTION_HISTORY_LOG_SUBRESOURCE`), inside the URL subtree of the
+ * collection it governs. A share grantee or a connected app already holds a
+ * read capability over that subtree, so the same grant that lets them read
+ * the collection lets them verify its descriptor's history: no second grant,
+ * and no capability over the account's `key-map` collection.
+ *
+ * Reads here run under the collection-descriptor log CLASS: a ladder-signed
+ * append to one of these logs admits on `assertionMethod` membership alone,
+ * the roster's ceremony-tail license binding the roster log only. A reader
+ * that inherited the roster's rule would refuse a served log its own wallet
+ * wrote.
+ */
+import { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration } from '@interop/was-client/edv';
+import { collectionLogPinId } from '@interop/vh-resource-log';
+import { controllerForLogClass } from '../resourceLog/index.js';
 /**
- * The state-document schema identifier an encryption descriptor carries in a
- * governed log entry, per WAS-EC.
+ * The governed read boundary and the state-document schema identifier live in
+ * `@interop/was-client/edv` (the pointer-following collection store reads
+ * through the same helper); re-exported here so the roster store and this
+ * module's consumers keep one import site.
  */
-export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
+export { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration };
 /**
  * The pin-slot key for a collection's governing descriptor log: the slot a
  * keyed `ResourceLogPinStore` holds that log's chain-head pin under,
- * `space/<spaceId>/key-map/<collectionId>.jsonl`. The library names it, as it
+ * `space/<spaceId>/<collectionId>/meta/log`. The library names it, as it
  * names the account log's (`accountLogPinId`) and the roster's
- * (`userKeyRosterPinId`) slots, so no app builds one of its own: the shape is
- * host-free on purpose -- the Space id is what stays stable across a claimed
- * host move, so a log served from a new host still lands in the same slot and
- * is checked against the held pin rather than opening a fresh
- * trust-on-first-use slate. The resource half mirrors the roster log's home
- * (`key-map/user-key.jsonl`): a governing log lives in the plaintext,
- * capability-gated key-map collection, beside the roster, since a log stored
- * inside the encrypted collection it governs would itself be sealed.
+ * (`userKeyRosterPinId`) slots, so no app builds one of its own.
+ *
+ * The slot follows the log's placement: the log is the collection's own
+ * `meta/log` sub-resource, inside the URL subtree of the collection it
+ * governs, so the read capability a share grantee or a connected app already
+ * holds covers it. The shape is host-free on purpose -- the Space id is what
+ * stays stable across a claimed host move, so a log served from a new host
+ * still lands in the same slot and is checked against the held pin rather
+ * than opening a fresh trust-on-first-use slate.
  *
  * @param options {object}
  * @param options.spaceId {string}   the data Space id
@@ -26,59 +57,7 @@ export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
  * @returns {string}
  */
 export function collectionDescriptorLogPinId({ spaceId, collectionId }) {
-    return resourceLogPinId({
-        spaceId,
-        collectionId: KEY_MAP_COLLECTION.id,
-        resourceId: `${collectionId}.jsonl`
-    });
-}
-/**
- * The one governed epoch-configuration read: the fail-closed boundary that
- * decides whether a served log state may be treated as an encryption
- * descriptor. Resolves the controller view, reads and fully verifies the log
- * (chain, proofs, external authorization, and the chain-head pin, via
- * `readResourceLog`), and refuses a verified head whose state is not a
- * `WasEpochConfiguration` rather than handing it out as a descriptor.
- * Resolves `null` for an absent log (the pre-genesis state) only while no pin
- * is held for it; under a held pin an absent log is refused as a `rollback`,
- * the library's rule. Both governed
- * descriptor consumers -- the log-governed descriptor source below and the
- * roster's log-governed descriptor store -- read through this helper, so a
- * hardening applied here reaches every trusted descriptor read.
- *
- * @param options {object}
- * @param options.store {ResourceLogStore}   the log's transport seam
- * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
- * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
- *   pin for this log
- * @param options.logId {string}   the pin-slot key for this log, from
- *   `resourceLogPinId`
- * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; etag?: string } | null>}
- */
-export async function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }) {
-    const controller = await resolveController();
-    const current = await readResourceLog({
-        store,
-        controller,
-        expectedMethod: RESOURCE_LOG_METHOD,
-        pinStore,
-        logId
-    });
-    if (current === null) {
-        return null;
-    }
-    const state = current.verified.state;
-    if (state.type !== EPOCH_CONFIGURATION_STATE_TYPE) {
-        throw new ResourceLogIntegrityError(`The governed descriptor log carries state of type ` +
-            `"${state.type}", not "${EPOCH_CONFIGURATION_STATE_TYPE}".`);
-    }
-    return {
-        verified: current.verified,
-        descriptor: state,
-        etag: current.etag
-    };
+    return collectionLogPinId({ spaceId, collectionId });
 }
 /**
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
@@ -86,15 +65,23 @@ export async function readGovernedEpochConfiguration({ store, resolveController,
  * Collection Description `encryption` member (a plaintext collection, or one
  * whose provisioning has not landed), unless a pin is held for it, in which
  * case the read refuses as a `rollback`; verification failures throw through --
- * {@link acquireDescriptor} rethrows the refusal classes rather than falling
- * back to the cache.
+ * was-client's `acquireDescriptor` rethrows the refusal classes rather than
+ * falling back to the cache.
+ *
+ * Every read runs under the collection-descriptor log class
+ * ({@link controllerForLogClass}), so a ladder-signed append verifies on
+ * `assertionMethod` membership alone. Without that narrowing a reader would
+ * inherit the roster's ceremony-tail license and refuse a served log its own
+ * wallet's standing credential wrote.
  *
  * @param options {object}
  * @param options.logFor {function}   `(collectionId) => ResourceLogStore` --
- *   the collection's governing log's transport seam
+ *   the collection's governing log's transport seam (was-client's
+ *   `resourceLogStore({ collection })` over the collection's `meta/log`)
  * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view, resolved per operation and narrowed here to
+ *   this log class
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pins, keyed per log; each collection's slot is
  *   {@link collectionDescriptorLogPinId} over `spaceId`
@@ -106,7 +93,10 @@ export function logGovernedDescriptorSource({ logFor, resolveController, pinStor
         async collectionEncryption({ collectionId }) {
             const current = await readGovernedEpochConfiguration({
                 store: logFor(collectionId),
-                resolveController,
+                resolveController: async () => controllerForLogClass({
+                    controller: await resolveController(),
+                    logClass: 'collection-descriptor'
+                }),
                 pinStore,
                 logId: collectionDescriptorLogPinId({ spaceId, collectionId })
             });

package/dist/descriptors/logSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAKjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EAIb;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,GAAG,YAAY,QAAQ;KACpC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAKC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EAMR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB;gBACjB,QAAQ;gBACR,KAAK,EAAE,4BAA4B,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC/D,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAE/B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAGnB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,qBAAqB,EAEtB,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EAIb;IACC,OAAO,kBAAkB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EAMR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,qBAAqB,CAAC;oBACpB,UAAU,EAAE,MAAM,iBAAiB,EAAE;oBACrC,QAAQ,EAAE,uBAAuB;iBAClC,CAAC;gBACJ,QAAQ;gBACR,KAAK,EAAE,4BAA4B,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC/D,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/genesis/accountGenesis.d.ts

@@ -3,7 +3,6 @@ import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import { type ClientWebvhUpdateKeys, type ICapabilityAgent, type KmsAuthenticationBinding, type PublishedWebvhLog, type WebvhIdStore } from '../webvh/index.js';
 import { type UserKey, type WalletSpaceEpochsResult } from '../keys/index.js';
-import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type StageNotifier } from '../log.js';
 /**
  * The complete key set a brand-new account mints locally before anything
@@ -186,6 +185,15 @@ export interface AccountGenesisResult {
  *   EncryptionDescriptorStore` -- builds the user-key roster's descriptor
  *   store once the account DID is known (the log-governed store's controller
  *   view and chain-head pin are the app's wiring)
+ * @param options.collectionStoreFor {Function}   `({ did }) =>
+ *   (collectionId: string) => EncryptionDescriptorStore` -- builds each
+ *   encrypted collection's descriptor store once the account DID is known,
+ *   the same wiring the roster's builder takes. It is handed `did` alone,
+ *   since this ceremony's did:webvh stage returns only that: an app whose
+ *   store resolves a controller view builds it from the published log it
+ *   fetches itself (`webvhResourceLogController` over a `verifyAccountLog`
+ *   result), unlike the credential-anchored genesis, which hands its own
+ *   head through
  * @param [options.provideKmsAuthentication] {Function}   `({ spaceReady }) =>
  *   Promise<KmsAuthenticationBinding | undefined>` -- the KMS authentication
  *   binding's acquisition; absent or resolving `undefined`, the genesis is
@@ -201,9 +209,8 @@ export interface AccountGenesisResult {
  *   the thunk mints instead of adopting
  * @param [options.expectedDid] {string}   the account's did:webvh from the
  *   caller's stored account pointer, when it already names one; the genesis
- *   read then refuses a published log resolving to any other account
- * @param [options.accountLogPinStore] {ResourceLogPinStore}   this client's
- *   chain-head pin for the account log
+ *   read then refuses a published log resolving to any other account. That
+ *   read and the publish run under the `idStore`'s own chain-head pin
  * @param [options.onDidPublished] {Function}   `({ did }) => Promise<void>`
  *   -- runs between the DID publication and the roster genesis, so the app
  *   can adopt the DID (and drop any verified-log memo) before the roster
@@ -220,7 +227,7 @@ export interface AccountGenesisResult {
  *   genesis emits at the same point
  * @returns {Promise<AccountGenesisResult>}
  */
-export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, accountLogPinStore, onDidPublished, promoteController, onStage }: {
+export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, collectionStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController, onStage }: {
     was: WasClient;
     wasAsClient?: WasClient;
     wasServerUrl: string;
@@ -233,11 +240,13 @@ export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, s
     rosterStoreFor: (options: {
         did: string;
     }) => EncryptionDescriptorStore;
+    collectionStoreFor: (options: {
+        did: string;
+    }) => (collectionId: string) => EncryptionDescriptorStore;
     provideKmsAuthentication?: (options: {
         spaceReady: Promise<unknown>;
     }) => Promise<KmsAuthenticationBinding | undefined>;
     expectedDid?: string;
-    accountLogPinStore?: ResourceLogPinStore;
     onDidPublished?: (published: {
         did: string;
     }) => Promise<void>;

package/dist/genesis/accountGenesis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accountGenesis.d.ts","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAQ7D;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1B,UAAU,EAAE,qBAAqB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAQhE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8BpC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE;CAQzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC7B,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,MAAM,CAAC,EAAE,uBAAuB,CAAA;IAChC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAA;IAClD,SAAS,CAAC,EAAE,wBAAwB,CAAA;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACxB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,qBAAqB,CAAA;IACjC,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqIhC"}
+{"version":3,"file":"accountGenesis.d.ts","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAQ7D;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1B,UAAU,EAAE,qBAAqB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAQhE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8BpC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE;CAQzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC7B,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,MAAM,CAAC,EAAE,uBAAuB,CAAA;IAChC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAA;IAClD,SAAS,CAAC,EAAE,wBAAwB,CAAA;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAwB,EACxB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,qBAAqB,CAAA;IACjC,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,kBAAkB,EAAE,CAAC,OAAO,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IACzD,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoIhC"}

package/dist/genesis/accountGenesis.js

@@ -184,6 +184,15 @@ export class AccountGenesisSpaceError extends Error {
  *   EncryptionDescriptorStore` -- builds the user-key roster's descriptor
  *   store once the account DID is known (the log-governed store's controller
  *   view and chain-head pin are the app's wiring)
+ * @param options.collectionStoreFor {Function}   `({ did }) =>
+ *   (collectionId: string) => EncryptionDescriptorStore` -- builds each
+ *   encrypted collection's descriptor store once the account DID is known,
+ *   the same wiring the roster's builder takes. It is handed `did` alone,
+ *   since this ceremony's did:webvh stage returns only that: an app whose
+ *   store resolves a controller view builds it from the published log it
+ *   fetches itself (`webvhResourceLogController` over a `verifyAccountLog`
+ *   result), unlike the credential-anchored genesis, which hands its own
+ *   head through
  * @param [options.provideKmsAuthentication] {Function}   `({ spaceReady }) =>
  *   Promise<KmsAuthenticationBinding | undefined>` -- the KMS authentication
  *   binding's acquisition; absent or resolving `undefined`, the genesis is
@@ -199,9 +208,8 @@ export class AccountGenesisSpaceError extends Error {
  *   the thunk mints instead of adopting
  * @param [options.expectedDid] {string}   the account's did:webvh from the
  *   caller's stored account pointer, when it already names one; the genesis
- *   read then refuses a published log resolving to any other account
- * @param [options.accountLogPinStore] {ResourceLogPinStore}   this client's
- *   chain-head pin for the account log
+ *   read then refuses a published log resolving to any other account. That
+ *   read and the publish run under the `idStore`'s own chain-head pin
  * @param [options.onDidPublished] {Function}   `({ did }) => Promise<void>`
  *   -- runs between the DID publication and the roster genesis, so the app
  *   can adopt the DID (and drop any verified-log memo) before the roster
@@ -218,7 +226,7 @@ export class AccountGenesisSpaceError extends Error {
  *   genesis emits at the same point
  * @returns {Promise<AccountGenesisResult>}
  */
-export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, accountLogPinStore, onDidPublished, promoteController = true, onStage }) {
+export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, collectionStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController = true, onStage }) {
     const failed = [];
     const stage = stageNotifier(onStage);
     // 1. The Space and its collection roster, create-if-absent under this
@@ -274,8 +282,7 @@ export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spa
             keyAgreementKeyMultibase
         },
         updateKeys,
-        ...(expectedDid !== undefined ? { expectedDid } : {}),
-        ...(accountLogPinStore ? { pinStore: accountLogPinStore } : {})
+        ...(expectedDid !== undefined ? { expectedDid } : {})
     });
     await onDidPublished?.({ did });
     // 4. The user-key roster genesis, strictly after the DID publication: the
@@ -305,7 +312,7 @@ export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spa
     if (rosterDescriptor) {
         try {
             const fanOut = await ensureWalletSpaceEpochs({
-                was,
+                storeFor: collectionStoreFor({ did }),
                 spaceId,
                 userKey,
                 rosterDescriptor

package/dist/genesis/accountGenesis.js.map

@@ -1 +1 @@
-{"version":3,"file":"accountGenesis.js","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAK5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,yBAAyB,EAM1B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAsB,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AAkBzB;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,cAAc,CAAC,MAAM,CAC1B,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO;QACL,OAAO,EAAE,WAAW,EAAE;QACtB,UAAU;QACV,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,UAAU,EAAE,yBAAyB,EAAE;KACxC,CAAA;AACH,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EAMJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACnC,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;QACF,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,oEAAoE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,WAAW;SACd,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAA4C;QACtD,KAAK,CACH,kCAAkC,OAAO,CAAC,OAAO,YAAY;YAC3D,+CAA+C,EACjD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAoDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAAG,IAAI,EACxB,OAAO,EAoBR;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,aAAa,CAAkC,OAAO,CAAC,CAAA;IAErE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,GAAG;QACH,OAAO;QACP,aAAa,EAAE,QAAQ,CAAC,EAAE;KAC3B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,6BAA6B;IAC7B,MAAM,GAAG,GAAG,sBAAsB,CAAC;QACjC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU;KACX,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAA;IAElD,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,qBAAmE,CAAA;IACrE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QACnC,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI;YACnD,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI;SAC7C,CAAC;QACF,UAAU,EAAE;YACV,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC5D,wBAAwB;SACzB;QACD,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,kBAAkB;IAClB,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,GAAG;gBACH,OAAO;gBACP,OAAO;gBACP,gBAAgB;aACjB,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,aAAa,GAAG,MAAM,CAAC,OAAO,CAAA;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAA;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,SAA+C,CAAA;IACnD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"accountGenesis.js","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAK5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,yBAAyB,EAM1B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAsB,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AAkBzB;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,cAAc,CAAC,MAAM,CAC1B,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO;QACL,OAAO,EAAE,WAAW,EAAE;QACtB,UAAU;QACV,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,UAAU,EAAE,yBAAyB,EAAE;KACxC,CAAA;AACH,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EAMJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACnC,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;QACF,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,oEAAoE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,WAAW;SACd,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAA4C;QACtD,KAAK,CACH,kCAAkC,OAAO,CAAC,OAAO,YAAY;YAC3D,+CAA+C,EACjD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAoDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAiB,GAAG,IAAI,EACxB,OAAO,EAsBR;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,aAAa,CAAkC,OAAO,CAAC,CAAA;IAErE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,GAAG;QACH,OAAO;QACP,aAAa,EAAE,QAAQ,CAAC,EAAE;KAC3B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,6BAA6B;IAC7B,MAAM,GAAG,GAAG,sBAAsB,CAAC;QACjC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU;KACX,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAA;IAElD,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,qBAAmE,CAAA;IACrE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QACnC,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI;YACnD,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI;SAC7C,CAAC;QACF,UAAU,EAAE;YACV,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC5D,wBAAwB;SACzB;QACD,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,kBAAkB;IAClB,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,QAAQ,EAAE,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,OAAO;gBACP,OAAO;gBACP,gBAAgB;aACjB,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,aAAa,GAAG,MAAM,CAAC,OAAO,CAAA;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAA;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,SAA+C,CAAA;IACnD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/keys/collectionLogStore.d.ts

@@ -0,0 +1,73 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The descriptor store over ONE encrypted collection's governing history log
+ * -- the collection's own `meta/log` sub-resource, whose verified head state
+ * IS its `encryption` descriptor. The sibling of the user key roster's
+ * builder ({@link userKeyRosterDescriptorStore}), over the same wrapped
+ * `logGovernedDescriptorStore`: reads resolve to the verified head, writes
+ * are signed appends, and `create` is the guarded genesis (`If-None-Match:
+ * *`) that declares the Collection governed. The server derives the
+ * Collection Description's `encryption` member from that log, so a governed
+ * collection's descriptor is never client-written into its Description.
+ *
+ * The transport seam is was-client's `resourceLogStore({ collection })`, so
+ * the handle passed in is the whole address: the store derives its own
+ * chain-head pin slot from the handle's Space and collection ids
+ * ({@link collectionDescriptorLogPinId}), and no caller names a `logId`.
+ */
+import type { Collection } from '@interop/was-client';
+import type { ResourceLogPinStore, ResourceLogSigner } from '@interop/vh-resource-log';
+import type { WebvhResourceLogController } from '../resourceLog/index.js';
+import { type SealableEncryptionDescriptorStore } from './rosterLogStore.js';
+/**
+ * Builds the log-governed, sealable descriptor store over one collection's
+ * governing history log.
+ *
+ * Reads resolve to the log's verified head (chain, entry proofs, external
+ * authorization against the independently verified account document, and the
+ * chain-head pin, all checked before a descriptor is handed out); writes are
+ * signed appends of the full next state; `create` is the guarded genesis that
+ * declares the Collection governed -- the epoch[0] install
+ * ({@link ensureIndexedFirstEpoch}) is what runs it. `seal()` is the backstop
+ * for a rotation that no-op'd and so left the log anchored before the account
+ * document's latest membership change, and `setMinimumControllerVersion` is
+ * the post-edit anchor a ceremony sets so its appends never resolve to a
+ * cached pre-edit view.
+ *
+ * The signer is the same `ResourceLogSigner` the roster takes: an enrolled
+ * client's account key ({@link userKeyRosterLogSigner}), or a standing
+ * credential's ladder VM on a credential-anchored account.
+ *
+ * The store's class is `collection-descriptor`, so a ladder-signed append is
+ * admitted on `assertionMethod` membership at the anchored version alone.
+ * The ceremony-tail license binds the user key roster log only: a descriptor
+ * append escrows one recipient into one collection, lands as a hash-chained
+ * entry attributable to that credential, and is auditable by the account's
+ * clients.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}   the collection handle whose
+ *   `meta/log` is the log; its `spaceId` and `id` are what the pin slot is
+ *   derived from, and its capability wiring is what every request rides
+ * @param options.resolveController {function}
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view (`webvhResourceLogController` over a
+ *   `verifyAccountLog` result), resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pins, keyed per log
+ * @param options.signer {ResourceLogSigner}   the signing key the appends
+ *   this store writes are proved by. It must be listed under
+ *   `assertionMethod` in the account document at the version the append
+ *   anchors at, so a ceremony that strikes a key builds its collection stores
+ *   on one its own edit leaves standing
+ * @returns {SealableEncryptionDescriptorStore}
+ */
+export declare function collectionDescriptorLogStore({ collection, resolveController, pinStore, signer }: {
+    collection: Collection;
+    resolveController: () => Promise<WebvhResourceLogController>;
+    pinStore: ResourceLogPinStore;
+    signer: ResourceLogSigner;
+}): SealableEncryptionDescriptorStore;
+//# sourceMappingURL=collectionLogStore.d.ts.map

package/dist/keys/collectionLogStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectionLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/collectionLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACP,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CAYpC"}

package/dist/keys/collectionLogStore.js

@@ -0,0 +1,60 @@
+import { resourceLogStore } from '@interop/was-client/log';
+import { collectionDescriptorLogPinId } from '../descriptors/logSource.js';
+import { logGovernedDescriptorStore } from './rosterLogStore.js';
+/**
+ * Builds the log-governed, sealable descriptor store over one collection's
+ * governing history log.
+ *
+ * Reads resolve to the log's verified head (chain, entry proofs, external
+ * authorization against the independently verified account document, and the
+ * chain-head pin, all checked before a descriptor is handed out); writes are
+ * signed appends of the full next state; `create` is the guarded genesis that
+ * declares the Collection governed -- the epoch[0] install
+ * ({@link ensureIndexedFirstEpoch}) is what runs it. `seal()` is the backstop
+ * for a rotation that no-op'd and so left the log anchored before the account
+ * document's latest membership change, and `setMinimumControllerVersion` is
+ * the post-edit anchor a ceremony sets so its appends never resolve to a
+ * cached pre-edit view.
+ *
+ * The signer is the same `ResourceLogSigner` the roster takes: an enrolled
+ * client's account key ({@link userKeyRosterLogSigner}), or a standing
+ * credential's ladder VM on a credential-anchored account.
+ *
+ * The store's class is `collection-descriptor`, so a ladder-signed append is
+ * admitted on `assertionMethod` membership at the anchored version alone.
+ * The ceremony-tail license binds the user key roster log only: a descriptor
+ * append escrows one recipient into one collection, lands as a hash-chained
+ * entry attributable to that credential, and is auditable by the account's
+ * clients.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}   the collection handle whose
+ *   `meta/log` is the log; its `spaceId` and `id` are what the pin slot is
+ *   derived from, and its capability wiring is what every request rides
+ * @param options.resolveController {function}
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view (`webvhResourceLogController` over a
+ *   `verifyAccountLog` result), resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pins, keyed per log
+ * @param options.signer {ResourceLogSigner}   the signing key the appends
+ *   this store writes are proved by. It must be listed under
+ *   `assertionMethod` in the account document at the version the append
+ *   anchors at, so a ceremony that strikes a key builds its collection stores
+ *   on one its own edit leaves standing
+ * @returns {SealableEncryptionDescriptorStore}
+ */
+export function collectionDescriptorLogStore({ collection, resolveController, pinStore, signer }) {
+    return logGovernedDescriptorStore({
+        log: resourceLogStore({ collection }),
+        resolveController,
+        pinStore,
+        logId: collectionDescriptorLogPinId({
+            spaceId: collection.spaceId,
+            collectionId: collection.id
+        }),
+        signer,
+        logClass: 'collection-descriptor'
+    });
+}
+//# sourceMappingURL=collectionLogStore.js.map

package/dist/keys/collectionLogStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectionLogStore.js","sourceRoot":"","sources":["../../src/keys/collectionLogStore.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAK1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAE1E,OAAO,EACL,0BAA0B,EAE3B,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,MAAM,EAMP;IACC,OAAO,0BAA0B,CAAC;QAChC,GAAG,EAAE,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC;QACrC,iBAAiB;QACjB,QAAQ;QACR,KAAK,EAAE,4BAA4B,CAAC;YAClC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,YAAY,EAAE,UAAU,CAAC,EAAE;SAC5B,CAAC;QACF,MAAM;QACN,QAAQ,EAAE,uBAAuB;KAClC,CAAC,CAAA;AACJ,CAAC"}

package/dist/keys/index.d.ts

@@ -22,13 +22,23 @@
  *   current epoch, refusing a `currentEpoch` that names no epoch in its own
  *   list" (`UserKeyRosterIntegrityError`); every roster and collection
  *   descriptor read that needs the current epoch goes through it.
- * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
- *   descriptor store: reads resolve to the roster log's verified head
+ * - `collectionDescriptorLogStore` -- the same store over ONE encrypted
+ *   collection's governing history log (the collection's `meta/log`
+ *   sub-resource, whose verified head state is its `encryption` descriptor).
+ *   It derives its own chain-head pin slot from the collection handle, and
+ *   carries the `collection-descriptor` log class, whose ladder-signed
+ *   appends admit on `assertionMethod` membership alone.
+ * - `userKeyRosterDescriptorStore` -- the same store over the user key roster:
+ *   reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
  *   bare signing client for the login-time direct read. Sealable
  *   (`SealableEncryptionDescriptorStore` / `isSealableDescriptorStore`):
  *   `seal()` appends the idempotent backstop entry when the log's head still
  *   anchors before the account document's latest membership change.
+ *
+ *   Those two builders are the subpath's whole store surface. Each states its
+ *   log class at construction, and the generic wrapper under them takes a
+ *   caller-chosen class and log id, so it stays module-internal.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap and the roster read. A retiring rotation names no kid:
  *   it converges onto the account document instead.
@@ -52,9 +62,10 @@
  *   names (also the completion sweep's driver).
  * - `rotateRosterToDocumentAndCascade` -- the shared roster-and-cascade tail
  *   every account-membership ceremony ends with (a client disconnected, a
- *   standing unlock credential retired): the post-edit minimum controller version, the
- *   convergence rotation with its seal backstop, and the collection fan-out
- *   onto the fresh user key.
+ *   standing unlock credential retired): the post-edit minimum controller
+ *   version on the roster store AND on every log-governed collection store
+ *   the fan-out touches, the convergence rotation with its seal backstop, and
+ *   the collection fan-out onto the fresh user key.
  * - `retireRosterRecipientAndCascade` -- the same tail for a ceremony that
  *   rotates BEFORE its document edit (the two forgets): the minimum
  *   controller version at the caller's anchor, one named recipient retired
@@ -82,8 +93,9 @@ export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDoc
 export type { CascadeCollections, RosterCascadeResult, RosterSealReport, UserKeyAdoptedHook } from './userKeyRosterCascade.js';
 export type { DescriptorStoreRead, UserKeyRosterReadResult } from './userKeyRoster.js';
 export type { KeyAgreementDocument } from '../resourceLog/document.js';
+export { collectionDescriptorLogStore } from './collectionLogStore.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
+export { isSealableDescriptorStore } from './rosterLogStore.js';
 export type { SealableEncryptionDescriptorStore } from './rosterLogStore.js';
 export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs, WalletSpaceProvisioningError, walletSpaceProvisioner } from './spaceEpochs.js';
 export type { WalletSpaceEpochsResult } from './spaceEpochs.js';

package/dist/keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/index.js

@@ -22,13 +22,23 @@
  *   current epoch, refusing a `currentEpoch` that names no epoch in its own
  *   list" (`UserKeyRosterIntegrityError`); every roster and collection
  *   descriptor read that needs the current epoch goes through it.
- * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
- *   descriptor store: reads resolve to the roster log's verified head
+ * - `collectionDescriptorLogStore` -- the same store over ONE encrypted
+ *   collection's governing history log (the collection's `meta/log`
+ *   sub-resource, whose verified head state is its `encryption` descriptor).
+ *   It derives its own chain-head pin slot from the collection handle, and
+ *   carries the `collection-descriptor` log class, whose ladder-signed
+ *   appends admit on `assertionMethod` membership alone.
+ * - `userKeyRosterDescriptorStore` -- the same store over the user key roster:
+ *   reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
  *   bare signing client for the login-time direct read. Sealable
  *   (`SealableEncryptionDescriptorStore` / `isSealableDescriptorStore`):
  *   `seal()` appends the idempotent backstop entry when the log's head still
  *   anchors before the account document's latest membership change.
+ *
+ *   Those two builders are the subpath's whole store surface. Each states its
+ *   log class at construction, and the generic wrapper under them takes a
+ *   caller-chosen class and log id, so it stays module-internal.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap and the roster read. A retiring rotation names no kid:
  *   it converges onto the account document instead.
@@ -52,9 +62,10 @@
  *   names (also the completion sweep's driver).
  * - `rotateRosterToDocumentAndCascade` -- the shared roster-and-cascade tail
  *   every account-membership ceremony ends with (a client disconnected, a
- *   standing unlock credential retired): the post-edit minimum controller version, the
- *   convergence rotation with its seal backstop, and the collection fan-out
- *   onto the fresh user key.
+ *   standing unlock credential retired): the post-edit minimum controller
+ *   version on the roster store AND on every log-governed collection store
+ *   the fan-out touches, the convergence rotation with its seal backstop, and
+ *   the collection fan-out onto the fresh user key.
  * - `retireRosterRecipientAndCascade` -- the same tail for a ceremony that
  *   rotates BEFORE its document edit (the two forgets): the minimum
  *   controller version at the caller's anchor, one named recipient retired
@@ -76,8 +87,9 @@ export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRe
 export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientKid, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
 export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
 export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
+export { collectionDescriptorLogStore } from './collectionLogStore.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
+export { isSealableDescriptorStore } from './rosterLogStore.js';
 export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs, WalletSpaceProvisioningError, walletSpaceProvisioner } from './spaceEpochs.js';
 export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';
 export { wasClientLabelsStore } from './wasLabelsStore.js';

package/dist/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAalC,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAalC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAG/D,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}