@interop/wallet-core 0.68.0 → 0.69.0

package/dist/descriptors/index.js

@@ -2,51 +2,27 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/wallet-core/descriptors` subpath: collection
- * encryption-descriptor acquisition and the unknown-epoch refresh policy --
- * the one implementation of "which key epoch does this collection encrypt
- * under, and when do we ask again" that every wallet replica must share (a
- * drift here does not fail loudly; it fails as a resource one replica cannot
- * decrypt).
+ * The `@interop/wallet-core/descriptors` subpath: the log-governed descriptor
+ * source, the wallet's implementation of `@interop/was-client/edv`'s
+ * `EncryptionDescriptorSource` seam for collections whose encryption
+ * descriptor is governed by a resource log. The acquisition, cache-fallback,
+ * and unknown-epoch refresh policy that source plugs into (`acquireDescriptor`,
+ * `DescriptorRefreshPolicy`, `createRefreshingEdvDocCipher`, and the
+ * `isKeyUnwrapError` matcher) ship from `@interop/was-client/edv`, and this
+ * subpath re-exports none of them: one owner per name.
  *
- * - `EncryptionDescriptorSource` / `EncryptionDescriptorCache` -- the narrow
- *   seams a host implements: one signed Collection Description read, and a
- *   client-local get/put pre-scoped to one account's Space.
- * - `wasDescriptorSource` -- the `EncryptionDescriptorSource` over a
- *   was-client handle.
- * - `acquireDescriptor` / `acquireDescriptors` -- fetch + cache with the
- *   cached fallback whenever the fetch yields no descriptor, thrown or empty
- *   (offline, a collection keeps encrypting under its current epoch; an empty
- *   description is ambiguous, since WAS masks an unauthorized read as an
- *   absent one). No descriptor anywhere means a plaintext collection, or an
- *   encrypted one whose epoch[0] install has not landed -- which a caller that
- *   has declared the collection encrypted must refuse fail-closed. A
- *   log-governed source's refusal classes rethrow instead of falling back
- *   (except a continuity rollback, which is reconcilable divergence).
- * - `logGovernedDescriptorSource` -- the `EncryptionDescriptorSource` for
- *   collections whose descriptor is governed by a resource log: every read
- *   (including the unknown-epoch refresh) re-verifies the log and resolves to
- *   its verified head state, refusing a head that is not a
- *   `WasEpochConfiguration`. It keys each collection's chain-head pin by
- *   `collectionDescriptorLogPinId` over the Space id, the library-named slot
- *   (`space/<spaceId>/key-map/<collectionId>.jsonl`), so no app builds one.
- * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
- *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
- *   for hosts whose reads scan rows and count unknown-epoch skips.
- * - `createRefreshingEdvDocCipher` -- `createEdvDocCipher` bound to both: a
- *   cipher that acquires its own descriptor and, on an unknown-epoch decrypt,
- *   re-reads the description, swaps itself, and retries exactly once per
- *   instance.
- * - `isKeyUnwrapError` -- how a host scanning rows tells "not a recipient of
- *   this epoch" from corruption, matched by `err.name` because the cipher is
- *   an injected seam. Its sibling `isUnknownEpochError` ships from
- *   `@interop/was-client/sync`, beside the class it matches. This one stays
- *   here on policy: it classifies a roster-membership failure the wallet
- *   layer owns, and no sync driver dispatches on it.
+ * - `logGovernedDescriptorSource` -- every read (including the unknown-epoch
+ *   refresh) re-verifies the log and resolves to its verified head state,
+ *   refusing a head that is not a `WasEpochConfiguration`. Reads run under the
+ *   collection-descriptor log class, so a ladder-signed append admits on
+ *   `assertionMethod` membership alone. It keys each collection's chain-head
+ *   pin by `collectionDescriptorLogPinId` over the Space id, the library-named
+ *   slot (`space/<spaceId>/<collectionId>/meta/log`, the log's own home), so no
+ *   app builds one. It is the one governed-descriptor reader this subpath
+ *   publishes: the bare-controller read under it
+ *   (`readGovernedEpochConfiguration`, was-client's) states no log class and
+ *   would read a collection log under the roster's license, so it stays
+ *   module-internal.
  */
-export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
-export { collectionDescriptorLogPinId, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
-export { DescriptorRefreshPolicy } from './refresh.js';
-export { createRefreshingEdvDocCipher } from './cipher.js';
-export { isKeyUnwrapError } from './errors.js';
+export { collectionDescriptorLogPinId, logGovernedDescriptorSource } from './logSource.js';
 //# sourceMappingURL=index.js.map

package/dist/descriptors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAA"}

package/dist/descriptors/logSource.d.ts

@@ -12,28 +12,44 @@
  * log rather than adopting whatever the host serves. A verified head whose
  * state is not an epoch configuration is refused fail-closed rather than
  * handed out as a descriptor.
+ *
+ * The log lives at the collection's own `meta/log` sub-resource
+ * (`COLLECTION_HISTORY_LOG_SUBRESOURCE`), inside the URL subtree of the
+ * collection it governs. A share grantee or a connected app already holds a
+ * read capability over that subtree, so the same grant that lets them read
+ * the collection lets them verify its descriptor's history: no second grant,
+ * and no capability over the account's `key-map` collection.
+ *
+ * Reads here run under the collection-descriptor log CLASS: a ladder-signed
+ * append to one of these logs admits on `assertionMethod` membership alone,
+ * the roster's ceremony-tail license binding the roster log only. A reader
+ * that inherited the roster's rule would refuse a served log its own wallet
+ * wrote.
  */
-import type { CollectionEncryption } from '@interop/was-client';
-import { type ResourceLogController, type ResourceLogPinStore, type ResourceLogStore, type VerifiedResourceLog } from '@interop/vh-resource-log';
-import type { EncryptionDescriptorSource } from './acquire.js';
+import { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration, type EncryptionDescriptorSource } from '@interop/was-client/edv';
+import { type ResourceLogPinStore, type ResourceLogStore } from '@interop/vh-resource-log';
+import { type WebvhResourceLogController } from '../resourceLog/index.js';
 /**
- * The state-document schema identifier an encryption descriptor carries in a
- * governed log entry, per WAS-EC.
+ * The governed read boundary and the state-document schema identifier live in
+ * `@interop/was-client/edv` (the pointer-following collection store reads
+ * through the same helper); re-exported here so the roster store and this
+ * module's consumers keep one import site.
  */
-export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
+export { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration };
 /**
  * The pin-slot key for a collection's governing descriptor log: the slot a
  * keyed `ResourceLogPinStore` holds that log's chain-head pin under,
- * `space/<spaceId>/key-map/<collectionId>.jsonl`. The library names it, as it
+ * `space/<spaceId>/<collectionId>/meta/log`. The library names it, as it
  * names the account log's (`accountLogPinId`) and the roster's
- * (`userKeyRosterPinId`) slots, so no app builds one of its own: the shape is
- * host-free on purpose -- the Space id is what stays stable across a claimed
- * host move, so a log served from a new host still lands in the same slot and
- * is checked against the held pin rather than opening a fresh
- * trust-on-first-use slate. The resource half mirrors the roster log's home
- * (`key-map/user-key.jsonl`): a governing log lives in the plaintext,
- * capability-gated key-map collection, beside the roster, since a log stored
- * inside the encrypted collection it governs would itself be sealed.
+ * (`userKeyRosterPinId`) slots, so no app builds one of its own.
+ *
+ * The slot follows the log's placement: the log is the collection's own
+ * `meta/log` sub-resource, inside the URL subtree of the collection it
+ * governs, so the read capability a share grantee or a connected app already
+ * holds covers it. The shape is host-free on purpose -- the Space id is what
+ * stays stable across a claimed host move, so a log served from a new host
+ * still lands in the same slot and is checked against the held pin rather
+ * than opening a fresh trust-on-first-use slate.
  *
  * @param options {object}
  * @param options.spaceId {string}   the data Space id
@@ -44,56 +60,29 @@ export declare function collectionDescriptorLogPinId({ spaceId, collectionId }:
     spaceId: string;
     collectionId: string;
 }): string;
-/**
- * The one governed epoch-configuration read: the fail-closed boundary that
- * decides whether a served log state may be treated as an encryption
- * descriptor. Resolves the controller view, reads and fully verifies the log
- * (chain, proofs, external authorization, and the chain-head pin, via
- * `readResourceLog`), and refuses a verified head whose state is not a
- * `WasEpochConfiguration` rather than handing it out as a descriptor.
- * Resolves `null` for an absent log (the pre-genesis state) only while no pin
- * is held for it; under a held pin an absent log is refused as a `rollback`,
- * the library's rule. Both governed
- * descriptor consumers -- the log-governed descriptor source below and the
- * roster's log-governed descriptor store -- read through this helper, so a
- * hardening applied here reaches every trusted descriptor read.
- *
- * @param options {object}
- * @param options.store {ResourceLogStore}   the log's transport seam
- * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
- * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
- *   pin for this log
- * @param options.logId {string}   the pin-slot key for this log, from
- *   `resourceLogPinId`
- * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; etag?: string } | null>}
- */
-export declare function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }: {
-    store: ResourceLogStore;
-    resolveController: () => Promise<ResourceLogController>;
-    pinStore: ResourceLogPinStore;
-    logId: string;
-}): Promise<{
-    verified: VerifiedResourceLog;
-    descriptor: CollectionEncryption;
-    etag?: string;
-} | null>;
 /**
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
  * logs. An absent log resolves `undefined` exactly like an absent
  * Collection Description `encryption` member (a plaintext collection, or one
  * whose provisioning has not landed), unless a pin is held for it, in which
  * case the read refuses as a `rollback`; verification failures throw through --
- * {@link acquireDescriptor} rethrows the refusal classes rather than falling
- * back to the cache.
+ * was-client's `acquireDescriptor` rethrows the refusal classes rather than
+ * falling back to the cache.
+ *
+ * Every read runs under the collection-descriptor log class
+ * ({@link controllerForLogClass}), so a ladder-signed append verifies on
+ * `assertionMethod` membership alone. Without that narrowing a reader would
+ * inherit the roster's ceremony-tail license and refuse a served log its own
+ * wallet's standing credential wrote.
  *
  * @param options {object}
  * @param options.logFor {function}   `(collectionId) => ResourceLogStore` --
- *   the collection's governing log's transport seam
+ *   the collection's governing log's transport seam (was-client's
+ *   `resourceLogStore({ collection })` over the collection's `meta/log`)
  * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view, resolved per operation and narrowed here to
+ *   this log class
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pins, keyed per log; each collection's slot is
  *   {@link collectionDescriptorLogPinId} over `spaceId`
@@ -102,7 +91,7 @@ export declare function readGovernedEpochConfiguration({ store, resolveControlle
  */
 export declare function logGovernedDescriptorSource({ logFor, resolveController, pinStore, spaceId }: {
     logFor: (collectionId: string) => ResourceLogStore;
-    resolveController: () => Promise<ResourceLogController>;
+    resolveController: () => Promise<WebvhResourceLogController>;
     pinStore: ResourceLogPinStore;
     spaceId: string;
 }): EncryptionDescriptorSource;

package/dist/descriptors/logSource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAwBR;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACR,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAe7B"}
+{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACR,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAmB7B"}

package/dist/descriptors/logSource.js

@@ -1,24 +1,55 @@
-import { RESOURCE_LOG_METHOD } from '@interop/storage-core';
-import { readResourceLog, ResourceLogIntegrityError, resourceLogPinId } from '@interop/vh-resource-log';
-import { KEY_MAP_COLLECTION } from '../space/collections.js';
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The log-governed {@link EncryptionDescriptorSource}: descriptor acquisition
+ * for a collection whose encryption descriptor is governed by a resource log
+ * (the Resource Log Profile) rather than by its Collection Description. Every
+ * read -- including the unknown-epoch refresh's re-read -- resolves to the
+ * log's VERIFIED head state: chain, proofs, external authorization against
+ * the independently verified controller document, and the chain-head pin all
+ * checked before any descriptor is handed out, so a refresh re-verifies the
+ * log rather than adopting whatever the host serves. A verified head whose
+ * state is not an epoch configuration is refused fail-closed rather than
+ * handed out as a descriptor.
+ *
+ * The log lives at the collection's own `meta/log` sub-resource
+ * (`COLLECTION_HISTORY_LOG_SUBRESOURCE`), inside the URL subtree of the
+ * collection it governs. A share grantee or a connected app already holds a
+ * read capability over that subtree, so the same grant that lets them read
+ * the collection lets them verify its descriptor's history: no second grant,
+ * and no capability over the account's `key-map` collection.
+ *
+ * Reads here run under the collection-descriptor log CLASS: a ladder-signed
+ * append to one of these logs admits on `assertionMethod` membership alone,
+ * the roster's ceremony-tail license binding the roster log only. A reader
+ * that inherited the roster's rule would refuse a served log its own wallet
+ * wrote.
+ */
+import { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration } from '@interop/was-client/edv';
+import { collectionLogPinId } from '@interop/vh-resource-log';
+import { controllerForLogClass } from '../resourceLog/index.js';
 /**
- * The state-document schema identifier an encryption descriptor carries in a
- * governed log entry, per WAS-EC.
+ * The governed read boundary and the state-document schema identifier live in
+ * `@interop/was-client/edv` (the pointer-following collection store reads
+ * through the same helper); re-exported here so the roster store and this
+ * module's consumers keep one import site.
  */
-export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
+export { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration };
 /**
  * The pin-slot key for a collection's governing descriptor log: the slot a
  * keyed `ResourceLogPinStore` holds that log's chain-head pin under,
- * `space/<spaceId>/key-map/<collectionId>.jsonl`. The library names it, as it
+ * `space/<spaceId>/<collectionId>/meta/log`. The library names it, as it
  * names the account log's (`accountLogPinId`) and the roster's
- * (`userKeyRosterPinId`) slots, so no app builds one of its own: the shape is
- * host-free on purpose -- the Space id is what stays stable across a claimed
- * host move, so a log served from a new host still lands in the same slot and
- * is checked against the held pin rather than opening a fresh
- * trust-on-first-use slate. The resource half mirrors the roster log's home
- * (`key-map/user-key.jsonl`): a governing log lives in the plaintext,
- * capability-gated key-map collection, beside the roster, since a log stored
- * inside the encrypted collection it governs would itself be sealed.
+ * (`userKeyRosterPinId`) slots, so no app builds one of its own.
+ *
+ * The slot follows the log's placement: the log is the collection's own
+ * `meta/log` sub-resource, inside the URL subtree of the collection it
+ * governs, so the read capability a share grantee or a connected app already
+ * holds covers it. The shape is host-free on purpose -- the Space id is what
+ * stays stable across a claimed host move, so a log served from a new host
+ * still lands in the same slot and is checked against the held pin rather
+ * than opening a fresh trust-on-first-use slate.
  *
  * @param options {object}
  * @param options.spaceId {string}   the data Space id
@@ -26,59 +57,7 @@ export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
  * @returns {string}
  */
 export function collectionDescriptorLogPinId({ spaceId, collectionId }) {
-    return resourceLogPinId({
-        spaceId,
-        collectionId: KEY_MAP_COLLECTION.id,
-        resourceId: `${collectionId}.jsonl`
-    });
-}
-/**
- * The one governed epoch-configuration read: the fail-closed boundary that
- * decides whether a served log state may be treated as an encryption
- * descriptor. Resolves the controller view, reads and fully verifies the log
- * (chain, proofs, external authorization, and the chain-head pin, via
- * `readResourceLog`), and refuses a verified head whose state is not a
- * `WasEpochConfiguration` rather than handing it out as a descriptor.
- * Resolves `null` for an absent log (the pre-genesis state) only while no pin
- * is held for it; under a held pin an absent log is refused as a `rollback`,
- * the library's rule. Both governed
- * descriptor consumers -- the log-governed descriptor source below and the
- * roster's log-governed descriptor store -- read through this helper, so a
- * hardening applied here reaches every trusted descriptor read.
- *
- * @param options {object}
- * @param options.store {ResourceLogStore}   the log's transport seam
- * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
- * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
- *   pin for this log
- * @param options.logId {string}   the pin-slot key for this log, from
- *   `resourceLogPinId`
- * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; etag?: string } | null>}
- */
-export async function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }) {
-    const controller = await resolveController();
-    const current = await readResourceLog({
-        store,
-        controller,
-        expectedMethod: RESOURCE_LOG_METHOD,
-        pinStore,
-        logId
-    });
-    if (current === null) {
-        return null;
-    }
-    const state = current.verified.state;
-    if (state.type !== EPOCH_CONFIGURATION_STATE_TYPE) {
-        throw new ResourceLogIntegrityError(`The governed descriptor log carries state of type ` +
-            `"${state.type}", not "${EPOCH_CONFIGURATION_STATE_TYPE}".`);
-    }
-    return {
-        verified: current.verified,
-        descriptor: state,
-        etag: current.etag
-    };
+    return collectionLogPinId({ spaceId, collectionId });
 }
 /**
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
@@ -86,15 +65,23 @@ export async function readGovernedEpochConfiguration({ store, resolveController,
  * Collection Description `encryption` member (a plaintext collection, or one
  * whose provisioning has not landed), unless a pin is held for it, in which
  * case the read refuses as a `rollback`; verification failures throw through --
- * {@link acquireDescriptor} rethrows the refusal classes rather than falling
- * back to the cache.
+ * was-client's `acquireDescriptor` rethrows the refusal classes rather than
+ * falling back to the cache.
+ *
+ * Every read runs under the collection-descriptor log class
+ * ({@link controllerForLogClass}), so a ladder-signed append verifies on
+ * `assertionMethod` membership alone. Without that narrowing a reader would
+ * inherit the roster's ceremony-tail license and refuse a served log its own
+ * wallet's standing credential wrote.
  *
  * @param options {object}
  * @param options.logFor {function}   `(collectionId) => ResourceLogStore` --
- *   the collection's governing log's transport seam
+ *   the collection's governing log's transport seam (was-client's
+ *   `resourceLogStore({ collection })` over the collection's `meta/log`)
  * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view, resolved per operation and narrowed here to
+ *   this log class
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pins, keyed per log; each collection's slot is
  *   {@link collectionDescriptorLogPinId} over `spaceId`
@@ -106,7 +93,10 @@ export function logGovernedDescriptorSource({ logFor, resolveController, pinStor
         async collectionEncryption({ collectionId }) {
             const current = await readGovernedEpochConfiguration({
                 store: logFor(collectionId),
-                resolveController,
+                resolveController: async () => controllerForLogClass({
+                    controller: await resolveController(),
+                    logClass: 'collection-descriptor'
+                }),
                 pinStore,
                 logId: collectionDescriptorLogPinId({ spaceId, collectionId })
             });

package/dist/descriptors/logSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAKjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EAIb;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,GAAG,YAAY,QAAQ;KACpC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAKC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EAMR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB;gBACjB,QAAQ;gBACR,KAAK,EAAE,4BAA4B,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC/D,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAE/B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAGnB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,qBAAqB,EAEtB,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EAIb;IACC,OAAO,kBAAkB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EAMR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,qBAAqB,CAAC;oBACpB,UAAU,EAAE,MAAM,iBAAiB,EAAE;oBACrC,QAAQ,EAAE,uBAAuB;iBAClC,CAAC;gBACJ,QAAQ;gBACR,KAAK,EAAE,4BAA4B,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC/D,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/genesis/accountGenesis.d.ts

@@ -185,6 +185,15 @@ export interface AccountGenesisResult {
  *   EncryptionDescriptorStore` -- builds the user-key roster's descriptor
  *   store once the account DID is known (the log-governed store's controller
  *   view and chain-head pin are the app's wiring)
+ * @param options.collectionStoreFor {Function}   `({ did }) =>
+ *   (collectionId: string) => EncryptionDescriptorStore` -- builds each
+ *   encrypted collection's descriptor store once the account DID is known,
+ *   the same wiring the roster's builder takes. It is handed `did` alone,
+ *   since this ceremony's did:webvh stage returns only that: an app whose
+ *   store resolves a controller view builds it from the published log it
+ *   fetches itself (`webvhResourceLogController` over a `verifyAccountLog`
+ *   result), unlike the credential-anchored genesis, which hands its own
+ *   head through
  * @param [options.provideKmsAuthentication] {Function}   `({ spaceReady }) =>
  *   Promise<KmsAuthenticationBinding | undefined>` -- the KMS authentication
  *   binding's acquisition; absent or resolving `undefined`, the genesis is
@@ -218,7 +227,7 @@ export interface AccountGenesisResult {
  *   genesis emits at the same point
  * @returns {Promise<AccountGenesisResult>}
  */
-export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController, onStage }: {
+export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, collectionStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController, onStage }: {
     was: WasClient;
     wasAsClient?: WasClient;
     wasServerUrl: string;
@@ -231,6 +240,9 @@ export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, s
     rosterStoreFor: (options: {
         did: string;
     }) => EncryptionDescriptorStore;
+    collectionStoreFor: (options: {
+        did: string;
+    }) => (collectionId: string) => EncryptionDescriptorStore;
     provideKmsAuthentication?: (options: {
         spaceReady: Promise<unknown>;
     }) => Promise<KmsAuthenticationBinding | undefined>;

package/dist/genesis/accountGenesis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accountGenesis.d.ts","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAQ7D;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1B,UAAU,EAAE,qBAAqB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAQhE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8BpC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE;CAQzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC7B,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,MAAM,CAAC,EAAE,uBAAuB,CAAA;IAChC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAA;IAClD,SAAS,CAAC,EAAE,wBAAwB,CAAA;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAwB,EACxB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,qBAAqB,CAAA;IACjC,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoIhC"}
+{"version":3,"file":"accountGenesis.d.ts","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAQ7D;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1B,UAAU,EAAE,qBAAqB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAQhE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8BpC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE;CAQzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC7B,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,MAAM,CAAC,EAAE,uBAAuB,CAAA;IAChC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAA;IAClD,SAAS,CAAC,EAAE,wBAAwB,CAAA;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAwB,EACxB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,qBAAqB,CAAA;IACjC,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,kBAAkB,EAAE,CAAC,OAAO,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IACzD,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoIhC"}

package/dist/genesis/accountGenesis.js

@@ -184,6 +184,15 @@ export class AccountGenesisSpaceError extends Error {
  *   EncryptionDescriptorStore` -- builds the user-key roster's descriptor
  *   store once the account DID is known (the log-governed store's controller
  *   view and chain-head pin are the app's wiring)
+ * @param options.collectionStoreFor {Function}   `({ did }) =>
+ *   (collectionId: string) => EncryptionDescriptorStore` -- builds each
+ *   encrypted collection's descriptor store once the account DID is known,
+ *   the same wiring the roster's builder takes. It is handed `did` alone,
+ *   since this ceremony's did:webvh stage returns only that: an app whose
+ *   store resolves a controller view builds it from the published log it
+ *   fetches itself (`webvhResourceLogController` over a `verifyAccountLog`
+ *   result), unlike the credential-anchored genesis, which hands its own
+ *   head through
  * @param [options.provideKmsAuthentication] {Function}   `({ spaceReady }) =>
  *   Promise<KmsAuthenticationBinding | undefined>` -- the KMS authentication
  *   binding's acquisition; absent or resolving `undefined`, the genesis is
@@ -217,7 +226,7 @@ export class AccountGenesisSpaceError extends Error {
  *   genesis emits at the same point
  * @returns {Promise<AccountGenesisResult>}
  */
-export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController = true, onStage }) {
+export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, collectionStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController = true, onStage }) {
     const failed = [];
     const stage = stageNotifier(onStage);
     // 1. The Space and its collection roster, create-if-absent under this
@@ -303,7 +312,7 @@ export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spa
     if (rosterDescriptor) {
         try {
             const fanOut = await ensureWalletSpaceEpochs({
-                was,
+                storeFor: collectionStoreFor({ did }),
                 spaceId,
                 userKey,
                 rosterDescriptor

package/dist/genesis/accountGenesis.js.map

@@ -1 +1 @@
-{"version":3,"file":"accountGenesis.js","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAK5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,yBAAyB,EAM1B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAsB,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AAkBzB;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,cAAc,CAAC,MAAM,CAC1B,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO;QACL,OAAO,EAAE,WAAW,EAAE;QACtB,UAAU;QACV,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,UAAU,EAAE,yBAAyB,EAAE;KACxC,CAAA;AACH,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EAMJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACnC,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;QACF,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,oEAAoE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,WAAW;SACd,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAA4C;QACtD,KAAK,CACH,kCAAkC,OAAO,CAAC,OAAO,YAAY;YAC3D,+CAA+C,EACjD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAoDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAiB,GAAG,IAAI,EACxB,OAAO,EAmBR;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,aAAa,CAAkC,OAAO,CAAC,CAAA;IAErE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,GAAG;QACH,OAAO;QACP,aAAa,EAAE,QAAQ,CAAC,EAAE;KAC3B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,6BAA6B;IAC7B,MAAM,GAAG,GAAG,sBAAsB,CAAC;QACjC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU;KACX,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAA;IAElD,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,qBAAmE,CAAA;IACrE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QACnC,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI;YACnD,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI;SAC7C,CAAC;QACF,UAAU,EAAE;YACV,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC5D,wBAAwB;SACzB;QACD,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,kBAAkB;IAClB,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,GAAG;gBACH,OAAO;gBACP,OAAO;gBACP,gBAAgB;aACjB,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,aAAa,GAAG,MAAM,CAAC,OAAO,CAAA;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAA;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,SAA+C,CAAA;IACnD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"accountGenesis.js","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAK5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,yBAAyB,EAM1B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAsB,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AAkBzB;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,cAAc,CAAC,MAAM,CAC1B,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO;QACL,OAAO,EAAE,WAAW,EAAE;QACtB,UAAU;QACV,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,UAAU,EAAE,yBAAyB,EAAE;KACxC,CAAA;AACH,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EAMJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACnC,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;QACF,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,oEAAoE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,WAAW;SACd,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAA4C;QACtD,KAAK,CACH,kCAAkC,OAAO,CAAC,OAAO,YAAY;YAC3D,+CAA+C,EACjD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAoDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAiB,GAAG,IAAI,EACxB,OAAO,EAsBR;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,aAAa,CAAkC,OAAO,CAAC,CAAA;IAErE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,GAAG;QACH,OAAO;QACP,aAAa,EAAE,QAAQ,CAAC,EAAE;KAC3B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,6BAA6B;IAC7B,MAAM,GAAG,GAAG,sBAAsB,CAAC;QACjC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU;KACX,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAA;IAElD,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,qBAAmE,CAAA;IACrE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QACnC,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI;YACnD,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI;SAC7C,CAAC;QACF,UAAU,EAAE;YACV,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC5D,wBAAwB;SACzB;QACD,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,kBAAkB;IAClB,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,QAAQ,EAAE,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,OAAO;gBACP,OAAO;gBACP,gBAAgB;aACjB,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,aAAa,GAAG,MAAM,CAAC,OAAO,CAAA;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAA;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,SAA+C,CAAA;IACnD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/keys/collectionLogStore.d.ts

@@ -0,0 +1,73 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The descriptor store over ONE encrypted collection's governing history log
+ * -- the collection's own `meta/log` sub-resource, whose verified head state
+ * IS its `encryption` descriptor. The sibling of the user key roster's
+ * builder ({@link userKeyRosterDescriptorStore}), over the same wrapped
+ * `logGovernedDescriptorStore`: reads resolve to the verified head, writes
+ * are signed appends, and `create` is the guarded genesis (`If-None-Match:
+ * *`) that declares the Collection governed. The server derives the
+ * Collection Description's `encryption` member from that log, so a governed
+ * collection's descriptor is never client-written into its Description.
+ *
+ * The transport seam is was-client's `resourceLogStore({ collection })`, so
+ * the handle passed in is the whole address: the store derives its own
+ * chain-head pin slot from the handle's Space and collection ids
+ * ({@link collectionDescriptorLogPinId}), and no caller names a `logId`.
+ */
+import type { Collection } from '@interop/was-client';
+import type { ResourceLogPinStore, ResourceLogSigner } from '@interop/vh-resource-log';
+import type { WebvhResourceLogController } from '../resourceLog/index.js';
+import { type SealableEncryptionDescriptorStore } from './rosterLogStore.js';
+/**
+ * Builds the log-governed, sealable descriptor store over one collection's
+ * governing history log.
+ *
+ * Reads resolve to the log's verified head (chain, entry proofs, external
+ * authorization against the independently verified account document, and the
+ * chain-head pin, all checked before a descriptor is handed out); writes are
+ * signed appends of the full next state; `create` is the guarded genesis that
+ * declares the Collection governed -- the epoch[0] install
+ * ({@link ensureIndexedFirstEpoch}) is what runs it. `seal()` is the backstop
+ * for a rotation that no-op'd and so left the log anchored before the account
+ * document's latest membership change, and `setMinimumControllerVersion` is
+ * the post-edit anchor a ceremony sets so its appends never resolve to a
+ * cached pre-edit view.
+ *
+ * The signer is the same `ResourceLogSigner` the roster takes: an enrolled
+ * client's account key ({@link userKeyRosterLogSigner}), or a standing
+ * credential's ladder VM on a credential-anchored account.
+ *
+ * The store's class is `collection-descriptor`, so a ladder-signed append is
+ * admitted on `assertionMethod` membership at the anchored version alone.
+ * The ceremony-tail license binds the user key roster log only: a descriptor
+ * append escrows one recipient into one collection, lands as a hash-chained
+ * entry attributable to that credential, and is auditable by the account's
+ * clients.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}   the collection handle whose
+ *   `meta/log` is the log; its `spaceId` and `id` are what the pin slot is
+ *   derived from, and its capability wiring is what every request rides
+ * @param options.resolveController {function}
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view (`webvhResourceLogController` over a
+ *   `verifyAccountLog` result), resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pins, keyed per log
+ * @param options.signer {ResourceLogSigner}   the signing key the appends
+ *   this store writes are proved by. It must be listed under
+ *   `assertionMethod` in the account document at the version the append
+ *   anchors at, so a ceremony that strikes a key builds its collection stores
+ *   on one its own edit leaves standing
+ * @returns {SealableEncryptionDescriptorStore}
+ */
+export declare function collectionDescriptorLogStore({ collection, resolveController, pinStore, signer }: {
+    collection: Collection;
+    resolveController: () => Promise<WebvhResourceLogController>;
+    pinStore: ResourceLogPinStore;
+    signer: ResourceLogSigner;
+}): SealableEncryptionDescriptorStore;
+//# sourceMappingURL=collectionLogStore.d.ts.map

package/dist/keys/collectionLogStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectionLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/collectionLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACP,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CAYpC"}