@interop/wallet-core 0.68.0 → 0.69.0

package/dist/keys/collectionLogStore.js

@@ -0,0 +1,60 @@
+import { resourceLogStore } from '@interop/was-client/log';
+import { collectionDescriptorLogPinId } from '../descriptors/logSource.js';
+import { logGovernedDescriptorStore } from './rosterLogStore.js';
+/**
+ * Builds the log-governed, sealable descriptor store over one collection's
+ * governing history log.
+ *
+ * Reads resolve to the log's verified head (chain, entry proofs, external
+ * authorization against the independently verified account document, and the
+ * chain-head pin, all checked before a descriptor is handed out); writes are
+ * signed appends of the full next state; `create` is the guarded genesis that
+ * declares the Collection governed -- the epoch[0] install
+ * ({@link ensureIndexedFirstEpoch}) is what runs it. `seal()` is the backstop
+ * for a rotation that no-op'd and so left the log anchored before the account
+ * document's latest membership change, and `setMinimumControllerVersion` is
+ * the post-edit anchor a ceremony sets so its appends never resolve to a
+ * cached pre-edit view.
+ *
+ * The signer is the same `ResourceLogSigner` the roster takes: an enrolled
+ * client's account key ({@link userKeyRosterLogSigner}), or a standing
+ * credential's ladder VM on a credential-anchored account.
+ *
+ * The store's class is `collection-descriptor`, so a ladder-signed append is
+ * admitted on `assertionMethod` membership at the anchored version alone.
+ * The ceremony-tail license binds the user key roster log only: a descriptor
+ * append escrows one recipient into one collection, lands as a hash-chained
+ * entry attributable to that credential, and is auditable by the account's
+ * clients.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}   the collection handle whose
+ *   `meta/log` is the log; its `spaceId` and `id` are what the pin slot is
+ *   derived from, and its capability wiring is what every request rides
+ * @param options.resolveController {function}
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view (`webvhResourceLogController` over a
+ *   `verifyAccountLog` result), resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pins, keyed per log
+ * @param options.signer {ResourceLogSigner}   the signing key the appends
+ *   this store writes are proved by. It must be listed under
+ *   `assertionMethod` in the account document at the version the append
+ *   anchors at, so a ceremony that strikes a key builds its collection stores
+ *   on one its own edit leaves standing
+ * @returns {SealableEncryptionDescriptorStore}
+ */
+export function collectionDescriptorLogStore({ collection, resolveController, pinStore, signer }) {
+    return logGovernedDescriptorStore({
+        log: resourceLogStore({ collection }),
+        resolveController,
+        pinStore,
+        logId: collectionDescriptorLogPinId({
+            spaceId: collection.spaceId,
+            collectionId: collection.id
+        }),
+        signer,
+        logClass: 'collection-descriptor'
+    });
+}
+//# sourceMappingURL=collectionLogStore.js.map

package/dist/keys/collectionLogStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectionLogStore.js","sourceRoot":"","sources":["../../src/keys/collectionLogStore.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAK1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAE1E,OAAO,EACL,0BAA0B,EAE3B,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,MAAM,EAMP;IACC,OAAO,0BAA0B,CAAC;QAChC,GAAG,EAAE,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC;QACrC,iBAAiB;QACjB,QAAQ;QACR,KAAK,EAAE,4BAA4B,CAAC;YAClC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,YAAY,EAAE,UAAU,CAAC,EAAE;SAC5B,CAAC;QACF,MAAM;QACN,QAAQ,EAAE,uBAAuB;KAClC,CAAC,CAAA;AACJ,CAAC"}

package/dist/keys/index.d.ts

@@ -22,13 +22,23 @@
  *   current epoch, refusing a `currentEpoch` that names no epoch in its own
  *   list" (`UserKeyRosterIntegrityError`); every roster and collection
  *   descriptor read that needs the current epoch goes through it.
- * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
- *   descriptor store: reads resolve to the roster log's verified head
+ * - `collectionDescriptorLogStore` -- the same store over ONE encrypted
+ *   collection's governing history log (the collection's `meta/log`
+ *   sub-resource, whose verified head state is its `encryption` descriptor).
+ *   It derives its own chain-head pin slot from the collection handle, and
+ *   carries the `collection-descriptor` log class, whose ladder-signed
+ *   appends admit on `assertionMethod` membership alone.
+ * - `userKeyRosterDescriptorStore` -- the same store over the user key roster:
+ *   reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
  *   bare signing client for the login-time direct read. Sealable
  *   (`SealableEncryptionDescriptorStore` / `isSealableDescriptorStore`):
  *   `seal()` appends the idempotent backstop entry when the log's head still
  *   anchors before the account document's latest membership change.
+ *
+ *   Those two builders are the subpath's whole store surface. Each states its
+ *   log class at construction, and the generic wrapper under them takes a
+ *   caller-chosen class and log id, so it stays module-internal.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap and the roster read. A retiring rotation names no kid:
  *   it converges onto the account document instead.
@@ -52,9 +62,10 @@
  *   names (also the completion sweep's driver).
  * - `rotateRosterToDocumentAndCascade` -- the shared roster-and-cascade tail
  *   every account-membership ceremony ends with (a client disconnected, a
- *   standing unlock credential retired): the post-edit minimum controller version, the
- *   convergence rotation with its seal backstop, and the collection fan-out
- *   onto the fresh user key.
+ *   standing unlock credential retired): the post-edit minimum controller
+ *   version on the roster store AND on every log-governed collection store
+ *   the fan-out touches, the convergence rotation with its seal backstop, and
+ *   the collection fan-out onto the fresh user key.
  * - `retireRosterRecipientAndCascade` -- the same tail for a ceremony that
  *   rotates BEFORE its document edit (the two forgets): the minimum
  *   controller version at the caller's anchor, one named recipient retired
@@ -82,8 +93,9 @@ export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDoc
 export type { CascadeCollections, RosterCascadeResult, RosterSealReport, UserKeyAdoptedHook } from './userKeyRosterCascade.js';
 export type { DescriptorStoreRead, UserKeyRosterReadResult } from './userKeyRoster.js';
 export type { KeyAgreementDocument } from '../resourceLog/document.js';
+export { collectionDescriptorLogStore } from './collectionLogStore.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
+export { isSealableDescriptorStore } from './rosterLogStore.js';
 export type { SealableEncryptionDescriptorStore } from './rosterLogStore.js';
 export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs, WalletSpaceProvisioningError, walletSpaceProvisioner } from './spaceEpochs.js';
 export type { WalletSpaceEpochsResult } from './spaceEpochs.js';

package/dist/keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/index.js

@@ -22,13 +22,23 @@
  *   current epoch, refusing a `currentEpoch` that names no epoch in its own
  *   list" (`UserKeyRosterIntegrityError`); every roster and collection
  *   descriptor read that needs the current epoch goes through it.
- * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
- *   descriptor store: reads resolve to the roster log's verified head
+ * - `collectionDescriptorLogStore` -- the same store over ONE encrypted
+ *   collection's governing history log (the collection's `meta/log`
+ *   sub-resource, whose verified head state is its `encryption` descriptor).
+ *   It derives its own chain-head pin slot from the collection handle, and
+ *   carries the `collection-descriptor` log class, whose ladder-signed
+ *   appends admit on `assertionMethod` membership alone.
+ * - `userKeyRosterDescriptorStore` -- the same store over the user key roster:
+ *   reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
  *   bare signing client for the login-time direct read. Sealable
  *   (`SealableEncryptionDescriptorStore` / `isSealableDescriptorStore`):
  *   `seal()` appends the idempotent backstop entry when the log's head still
  *   anchors before the account document's latest membership change.
+ *
+ *   Those two builders are the subpath's whole store surface. Each states its
+ *   log class at construction, and the generic wrapper under them takes a
+ *   caller-chosen class and log id, so it stays module-internal.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap and the roster read. A retiring rotation names no kid:
  *   it converges onto the account document instead.
@@ -52,9 +62,10 @@
  *   names (also the completion sweep's driver).
  * - `rotateRosterToDocumentAndCascade` -- the shared roster-and-cascade tail
  *   every account-membership ceremony ends with (a client disconnected, a
- *   standing unlock credential retired): the post-edit minimum controller version, the
- *   convergence rotation with its seal backstop, and the collection fan-out
- *   onto the fresh user key.
+ *   standing unlock credential retired): the post-edit minimum controller
+ *   version on the roster store AND on every log-governed collection store
+ *   the fan-out touches, the convergence rotation with its seal backstop, and
+ *   the collection fan-out onto the fresh user key.
  * - `retireRosterRecipientAndCascade` -- the same tail for a ceremony that
  *   rotates BEFORE its document edit (the two forgets): the minimum
  *   controller version at the caller's anchor, one named recipient retired
@@ -76,8 +87,9 @@ export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRe
 export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientKid, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
 export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
 export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
+export { collectionDescriptorLogStore } from './collectionLogStore.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
+export { isSealableDescriptorStore } from './rosterLogStore.js';
 export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs, WalletSpaceProvisioningError, walletSpaceProvisioner } from './spaceEpochs.js';
 export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';
 export { wasClientLabelsStore } from './wasLabelsStore.js';

package/dist/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAalC,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAalC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAG/D,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/rosterLogStore.d.ts

@@ -1,7 +1,39 @@
-import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
-import { type ResourceLogPinStore, type ResourceLogSigner, type ResourceLogStore } from '@interop/vh-resource-log';
-import type { WebvhResourceLogController } from '../resourceLog/index.js';
-import { EPOCH_CONFIGURATION_STATE_TYPE } from '../descriptors/logSource.js';
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The log-governed descriptor store: was-client's generic
+ * `logGovernedDescriptorStore` (reads resolve to the VERIFIED head entry's
+ * state, writes become signed log appends, a lost race is the
+ * `PreconditionFailedError` the recipient loops rebase on, and `seal()` is
+ * the sealing sweep) wrapped with the two things the wallet adds, the
+ * post-edit minimum controller version and the log's CLASS.
+ *
+ * The class is stated once, at construction, and the store applies it to
+ * every controller view it resolves (`controllerForLogClass`), so both the
+ * read-side verification and every append run under the rule the log's class
+ * names -- the ceremony-tail license for the user key roster log,
+ * `assertionMethod` membership alone for a per-collection encryption
+ * descriptor log. Parameterizing the admission rule here is what keeps a
+ * call site from exempting itself: a store cannot be built without saying
+ * which class of log it governs.
+ *
+ * This is the enforcement point for "roster state is adopted only from a
+ * verified log head": there is no read path around the verifier, and the
+ * retired detached `epochsSig` has no successor to check -- the entry
+ * proof's controller versionId in the did:webvh document took over its job
+ * wholesale.
+ *
+ * The store is {@link SealableEncryptionDescriptorStore}: `seal()` exposes
+ * the resource-log sealing sweep through the descriptor-store seam, so the
+ * ceremonies and the login sweep can close the one durable gap the recipient
+ * machinery leaves -- a rotation that no-ops (the retiree held no
+ * current-epoch wrap) appends nothing, leaving the log's head carrying a
+ * controller version before the membership change it should have sealed.
+ */
+import { EPOCH_CONFIGURATION_STATE_TYPE, type EncryptionDescriptorStore } from '@interop/was-client/edv';
+import type { ResourceLogPinStore, ResourceLogSigner, ResourceLogStore } from '@interop/vh-resource-log';
+import { type ResourceLogClass, type WebvhResourceLogController } from '../resourceLog/index.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE };
 /**
  * An `EncryptionDescriptorStore` whose resource is governed by a resource
@@ -52,7 +84,9 @@ export declare function isSealableDescriptorStore(store: EncryptionDescriptorSto
  * orchestrator does not leave that freshness to the injected resolver's
  * wiring: it calls `setMinimumControllerVersion` with the view built from the edit's
  * own post-edit log, and a resolver still serving a stale cached view is
- * superseded by it (see the interface doc).
+ * superseded by it (see the interface doc). Whichever view wins, the store
+ * hands it out under its own log class's admission rule, so a minimum
+ * version set by a ceremony cannot smuggle in another class's rule.
  *
  * @param options {object}
  * @param options.log {ResourceLogStore}   the log's transport seam
@@ -66,13 +100,17 @@ export declare function isSealableDescriptorStore(store: EncryptionDescriptorSto
  *   `resourceLogPinId`
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key, for the appends this store writes
+ * @param options.logClass {ResourceLogClass}   which class of log this store
+ *   governs, which is what decides the admission rule its ladder-signed
+ *   appends run under
  * @returns {SealableEncryptionDescriptorStore}
  */
-export declare function logGovernedDescriptorStore({ log, resolveController, pinStore, logId, signer }: {
+export declare function logGovernedDescriptorStore({ log, resolveController, pinStore, logId, signer, logClass }: {
     log: ResourceLogStore;
     resolveController: () => Promise<WebvhResourceLogController>;
     pinStore: ResourceLogPinStore;
     logId: string;
     signer: ResourceLogSigner;
+    logClass: ResourceLogClass;
 }): SealableEncryptionDescriptorStore;
 //# sourceMappingURL=rosterLogStore.d.ts.map

package/dist/keys/rosterLogStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAExE,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAEtB,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EACL,8BAA8B,EAE/B,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;IAClC,2BAA2B,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,0BAA0B,CAAA;KACvC,GAAG,IAAI,CAAA;CACT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,yBAAyB,GAC/B,KAAK,IAAI,iCAAiC,CAM5C;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACP,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CAmQpC"}
+{"version":3,"file":"rosterLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAEL,8BAA8B,EAC9B,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,iCAAkC,SAAQ,yBAAyB;IAClF,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;IAClC,2BAA2B,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,0BAA0B,CAAA;KACvC,GAAG,IAAI,CAAA;CACT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,yBAAyB,GAC/B,KAAK,IAAI,iCAAiC,CAM5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,QAAQ,EACT,EAAE;IACD,GAAG,EAAE,gBAAgB,CAAA;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,iBAAiB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,iCAAiC,CA2DpC"}

package/dist/keys/rosterLogStore.js

@@ -2,19 +2,21 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The log-governed descriptor store: an `EncryptionDescriptorStore` whose
- * resource is governed by a resource log (the Resource Log Profile). Reads
- * resolve to the VERIFIED head entry's state -- chain, proofs, external
- * authorization, and the chain-head pin all checked before any descriptor is
- * handed out -- and writes become signed log appends. Because the seam is
- * unchanged, all of
- * was-client's roster machinery (`initRecipients` / `addRecipient` /
- * `removeRecipient`, with their compare-and-swap retry loops) drives the log
- * without knowing it: a CAS conflict on the log (the library's
- * `ResourceLogConflictError`, minted by the store adapter) is translated
- * back to the `PreconditionFailedError` those loops already rebase on, at
- * this boundary -- the `EncryptionDescriptorStore` port documents that
- * class, and was-client's edv recipient loops match on it.
+ * The log-governed descriptor store: was-client's generic
+ * `logGovernedDescriptorStore` (reads resolve to the VERIFIED head entry's
+ * state, writes become signed log appends, a lost race is the
+ * `PreconditionFailedError` the recipient loops rebase on, and `seal()` is
+ * the sealing sweep) wrapped with the two things the wallet adds, the
+ * post-edit minimum controller version and the log's CLASS.
+ *
+ * The class is stated once, at construction, and the store applies it to
+ * every controller view it resolves (`controllerForLogClass`), so both the
+ * read-side verification and every append run under the rule the log's class
+ * names -- the ceremony-tail license for the user key roster log,
+ * `assertionMethod` membership alone for a per-collection encryption
+ * descriptor log. Parameterizing the admission rule here is what keeps a
+ * call site from exempting itself: a store cannot be built without saying
+ * which class of log it governs.
  *
  * This is the enforcement point for "roster state is adopted only from a
  * verified log head": there is no read path around the verifier, and the
@@ -29,10 +31,8 @@
  * current-epoch wrap) appends nothing, leaving the log's head carrying a
  * controller version before the membership change it should have sealed.
  */
-import { PreconditionFailedError } from '@interop/was-client';
-import { RESOURCE_LOG_METHOD } from '@interop/storage-core';
-import { buildResourceLogEntry, buildResourceLogGenesis, confirmAppend, isResourceLogConflictError, ResourceLogClosedError, sealResourceLog, verifyResourceLog, verifyResourceLogAppend } from '@interop/vh-resource-log';
-import { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration } from '../descriptors/logSource.js';
+import { logGovernedDescriptorStore as wasLogGovernedDescriptorStore, EPOCH_CONFIGURATION_STATE_TYPE } from '@interop/was-client/edv';
+import { controllerForLogClass } from '../resourceLog/index.js';
 export { EPOCH_CONFIGURATION_STATE_TYPE };
 /**
  * Whether a descriptor store is log-governed and sealable -- the guard the
@@ -50,26 +50,6 @@ export function isSealableDescriptorStore(store) {
     return (typeof candidate.seal === 'function' &&
         typeof candidate.setMinimumControllerVersion === 'function');
 }
-/**
- * Translates the log-store port's CAS conflict (the library's
- * `ResourceLogConflictError`, matched by `name` -- it is minted in the store
- * adapter's package, which may resolve its own library copy) into the
- * `PreconditionFailedError` the `EncryptionDescriptorStore` port documents
- * and was-client's edv recipient loops rebase on. Any other error -- an
- * untranslated `PreconditionFailedError` included -- returns unchanged.
- *
- * @param err {unknown}
- * @returns {unknown}   the error to rethrow
- */
-function asDescriptorStoreConflict(err) {
-    if (isResourceLogConflictError(err)) {
-        return new PreconditionFailedError(err.message, {
-            status: 412,
-            cause: err
-        });
-    }
-    return err;
-}
 /**
  * Builds the log-governed `EncryptionDescriptorStore`.
  *
@@ -80,7 +60,9 @@ function asDescriptorStoreConflict(err) {
  * orchestrator does not leave that freshness to the injected resolver's
  * wiring: it calls `setMinimumControllerVersion` with the view built from the edit's
  * own post-edit log, and a resolver still serving a stale cached view is
- * superseded by it (see the interface doc).
+ * superseded by it (see the interface doc). Whichever view wins, the store
+ * hands it out under its own log class's admission rule, so a minimum
+ * version set by a ceremony cannot smuggle in another class's rule.
  *
  * @param options {object}
  * @param options.log {ResourceLogStore}   the log's transport seam
@@ -94,22 +76,34 @@ function asDescriptorStoreConflict(err) {
  *   `resourceLogPinId`
  * @param options.signer {ResourceLogSigner}   this client's enrolled signing
  *   key, for the appends this store writes
+ * @param options.logClass {ResourceLogClass}   which class of log this store
+ *   governs, which is what decides the admission rule its ladder-signed
+ *   appends run under
  * @returns {SealableEncryptionDescriptorStore}
  */
-export function logGovernedDescriptorStore({ log, resolveController, pinStore, logId, signer }) {
-    // The verified log observed by the most recent read on this store instance;
-    // a replace builds its entry on that head, pinned to the same read's etag,
-    // so a stale head loses the CAS instead of forking.
-    let lastVerified = null;
-    // The controller view `lastVerified` was verified under: the library's
-    // pre-write pass reads the head's controller version as an index into
-    // THAT view's version list, so a replace may only run it against a view
-    // this one is a prefix of.
-    let lastVerifiedView = null;
+export function logGovernedDescriptorStore({ log, resolveController, pinStore, logId, signer, logClass }) {
     // The minimum controller version a post-edit ceremony set (see the
     // interface doc).
     let minimumControllerVersion = null;
+    /**
+     * The view every operation runs under: the freshest of the resolved and
+     * minimum views, narrowed to this store's log class.
+     *
+     * @returns {Promise<WebvhResourceLogController>}
+     */
     async function currentController() {
+        return controllerForLogClass({
+            controller: await resolvedController(),
+            logClass
+        });
+    }
+    /**
+     * The freshness half: the injected resolver's view, superseded by the
+     * minimum a post-edit ceremony set when the resolver is behind it.
+     *
+     * @returns {Promise<WebvhResourceLogController>}
+     */
+    async function resolvedController() {
         const resolved = await resolveController();
         if (minimumControllerVersion === null) {
             return resolved;
@@ -124,199 +118,18 @@ export function logGovernedDescriptorStore({ log, resolveController, pinStore, l
         }
         return resolved;
     }
-    function toState(descriptor) {
-        const { history: _history, ...rest } = descriptor;
-        return { ...rest, type: EPOCH_CONFIGURATION_STATE_TYPE };
-    }
-    async function settle({ entry, controller }) {
-        const readBack = await confirmAppend({ store: log, entry });
-        const confirmed = await verifyResourceLog({
-            entries: readBack.entries,
-            controller,
-            expectedMethod: RESOURCE_LOG_METHOD,
-            pin: await pinStore.read({ logId })
-        });
-        await pinStore.write({ logId, pin: confirmed.pin });
-        lastVerified = confirmed;
-        lastVerifiedView = controller;
-    }
-    const store = {
-        async read() {
-            let view = null;
-            const current = await readGovernedEpochConfiguration({
-                store: log,
-                resolveController: async () => {
-                    view = await currentController();
-                    return view;
-                },
-                pinStore,
-                logId
-            });
-            if (current === null) {
-                lastVerified = null;
-                lastVerifiedView = null;
-                return null;
-            }
-            lastVerified = current.verified;
-            lastVerifiedView = view;
-            return {
-                descriptor: current.descriptor,
-                etag: current.etag
-            };
-        },
-        async replace(descriptor, { ifMatch }) {
-            if (ifMatch === undefined) {
-                throw new Error('Cannot replace the governed descriptor: the backend returned no ' +
-                    'validator, and the profile forbids an unconditional write.');
-            }
-            // An append builds on the head this instance last verified. A replace
-            // that no read on this instance precedes -- a caller seeding was-client's
-            // compare-and-swap from a read another instance made -- acquires that
-            // head now, the one acquisition the seed was meant to save; the
-            // caller's validator still guards the append, so a seed behind the
-            // served log loses the compare-and-swap as it would anywhere.
-            if (lastVerified === null) {
-                await store.read();
-            }
-            if (lastVerified === null) {
-                throw new Error('Cannot replace the governed descriptor: the log is absent.');
-            }
-            if (lastVerified.terminal) {
-                throw new ResourceLogClosedError({ nextLog: lastVerified.terminal });
-            }
-            const controller = await currentController();
-            // The pre-write pass's precondition, enforced rather than assumed: the
-            // view that verified `lastVerified` must be a prefix of this one (the
-            // account log is append-only, so carrying its head version is enough).
-            // A resolver that regressed is reported as the port's conflict class,
-            // so the edv machinery re-reads under the current view and rebases
-            // instead of the pass refusing on a bound that indexes another list.
-            const verifiedHead = lastVerifiedView?.versionIds[lastVerifiedView.versionIds.length - 1];
-            if (verifiedHead !== undefined &&
-                !controller.versionIds.includes(verifiedHead)) {
-                throw new PreconditionFailedError('Cannot replace the governed descriptor: the controller view ' +
-                    `resolved for this write does not carry version "${verifiedHead}", ` +
-                    'which the preceding read verified against; re-read and retry.', { status: 412 });
-            }
-            const entry = await buildResourceLogEntry({
-                head: lastVerified.head,
-                state: toState(descriptor),
-                controller,
-                signer
-            });
-            // The library's pre-write pass, run BEFORE the append lands: the entry
-            // is verified as a reader would verify it at its ordinal (shape, chain,
-            // proof, membership at the head's controller version, and the
-            // controller's `admitAppend` hook carrying the ceremony-tail license).
-            // Read-back would refuse the same entry anyway, but only after it
-            // poisoned the served log for every reader.
-            await verifyResourceLogAppend({
-                entry,
-                controller,
-                head: lastVerified
-            });
-            // A stale validator throws the library's conflict error here,
-            // translated back to the PreconditionFailedError the edv machinery's
-            // CAS loop re-reads and rebases on (the descriptor-store port's
-            // documented class). An untranslated PreconditionFailedError from a
-            // store passes through unchanged, already satisfying the port.
-            try {
-                await log.append(entry, { ifMatch });
-            }
-            catch (err) {
-                throw asDescriptorStoreConflict(err);
-            }
-            await settle({ entry, controller });
-        },
-        async create(descriptor) {
-            // A held pin means this client has already verified a roster log in
-            // this slot, so there is nothing to create. The pinned read refuses an
-            // absent log as a rollback (a host hiding the pinned log must not be
-            // answered with a fresh genesis over it); a served one is the lost
-            // create race, translated so the edv machinery re-reads and adopts it.
-            if ((await pinStore.read({ logId })) !== null) {
-                await readGovernedEpochConfiguration({
-                    store: log,
-                    resolveController: currentController,
-                    pinStore,
-                    logId
-                });
-                throw new PreconditionFailedError('The resource log create lost its guarded-create race: a log is ' +
-                    'already pinned and served; re-read and adopt it.', { status: 412 });
-            }
-            const controller = await currentController();
-            const genesis = await buildResourceLogGenesis({
-                state: toState(descriptor),
-                method: RESOURCE_LOG_METHOD,
-                controller,
-                signer
-            });
-            // The pre-write pass for a genesis: verified as a one-entry log before
-            // anything is created, so a non-member signer never leaves behind a
-            // log no reader accepts. `pin: null` is deliberate: the candidate is
-            // not served history, and continuity belongs to the read-back.
-            try {
-                await verifyResourceLog({
-                    entries: [genesis],
-                    controller,
-                    expectedMethod: RESOURCE_LOG_METHOD,
-                    pin: null
-                });
-            }
-            catch (err) {
-                // A refused genesis against a log that already exists is a lost
-                // create race (matched by name: the class may come from another
-                // library copy), translated to the port's conflict class so the edv
-                // machinery re-reads and adopts the winner's descriptor. With no log
-                // served, or on any other class (a port bug), the error propagates
-                // with nothing adopted.
-                if (!(err instanceof Error && err.name === 'ResourceLogIntegrityError')) {
-                    throw err;
-                }
-                if ((await log.read()) === null) {
-                    throw err;
-                }
-                throw new PreconditionFailedError('The resource log create lost its guarded-create race: the genesis ' +
-                    `was refused pre-write (${err.message}) and a log is already ` +
-                    'served; re-read and adopt it.', { status: 412, cause: err });
-            }
-            // A lost guarded-create race throws the library's conflict error,
-            // translated so the edv machinery re-reads and adopts the winner's
-            // descriptor.
-            try {
-                await log.create(genesis);
-            }
-            catch (err) {
-                throw asDescriptorStoreConflict(err);
-            }
-            await settle({ entry: genesis, controller });
-        },
-        async seal() {
-            const controller = await currentController();
-            // Reuse the log view the most recent read or confirmed append on this
-            // store instance verified: a rotation that just appended carries a
-            // version past the removal, so the sweep resolves noop with no
-            // re-fetch, and a stale view is safe (sealResourceLog's append path
-            // re-reads before writing).
-            const { sealed, verified } = await sealResourceLog({
-                store: log,
-                controller,
-                expectedMethod: RESOURCE_LOG_METHOD,
-                pinStore,
-                logId,
-                signer,
-                ...(lastVerified === null ? {} : { verified: lastVerified })
-            });
-            if (verified !== null) {
-                lastVerified = verified;
-                lastVerifiedView = controller;
-            }
-            return sealed ? 'sealed' : 'noop';
-        },
+    const store = wasLogGovernedDescriptorStore({
+        log,
+        resolveController: currentController,
+        pinStore,
+        logId,
+        signer
+    });
+    return {
+        ...store,
         setMinimumControllerVersion({ controller }) {
             minimumControllerVersion = controller;
         }
     };
-    return store;
 }
 //# sourceMappingURL=rosterLogStore.js.map

package/dist/keys/rosterLogStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"rosterLogStore.js","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,0BAA0B,EAC1B,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EAKxB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,6BAA6B,CAAA;AAEpC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AA8BzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAgC;IAEhC,MAAM,SAAS,GAAG,KAAmD,CAAA;IACrE,OAAO,CACL,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;QACpC,OAAO,SAAS,CAAC,2BAA2B,KAAK,UAAU,CAC5D,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,uBAAuB,CAAE,GAAa,CAAC,OAAO,EAAE;YACzD,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EAOP;IACC,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,YAAY,GAA+B,IAAI,CAAA;IACnD,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,2BAA2B;IAC3B,IAAI,gBAAgB,GAAsC,IAAI,CAAA;IAE9D,mEAAmE;IACnE,kBAAkB;IAClB,IAAI,wBAAwB,GAAsC,IAAI,CAAA;IAEtE,KAAK,UAAU,iBAAiB;QAC9B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAA;QAC1C,IAAI,wBAAwB,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,MAAM,WAAW,GACf,wBAAwB,CAAC,UAAU,CACjC,wBAAwB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAC/C,CAAA;QACH,uEAAuE;QACvE,sEAAsE;QACtE,oDAAoD;QACpD,IACE,WAAW,KAAK,SAAS;YACzB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC1C,CAAC;YACD,OAAO,wBAAwB,CAAA;QACjC,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,SAAS,OAAO,CACd,UAAgC;QAEhC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAA;QACjD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAA;IAC1D,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,EACpB,KAAK,EACL,UAAU,EAIX;QACC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc,EAAE,mBAAmB;YACnC,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;SACpC,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAA;QACnD,YAAY,GAAG,SAAS,CAAA;QACxB,gBAAgB,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,MAAM,KAAK,GAAsC;QAC/C,KAAK,CAAC,IAAI;YACR,IAAI,IAAI,GAAsC,IAAI,CAAA;YAClD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,GAAG;gBACV,iBAAiB,EAAE,KAAK,IAAI,EAAE;oBAC5B,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAA;oBAChC,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,QAAQ;gBACR,KAAK;aACN,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,YAAY,GAAG,IAAI,CAAA;gBACnB,gBAAgB,GAAG,IAAI,CAAA;gBACvB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAA;YAC/B,gBAAgB,GAAG,IAAI,CAAA;YACvB,OAAO;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE;YACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,kEAAkE;oBAChE,4DAA4D,CAC/D,CAAA;YACH,CAAC;YACD,sEAAsE;YACtE,0EAA0E;YAC1E,sEAAsE;YACtE,gEAAgE;YAChE,mEAAmE;YACnE,8DAA8D;YAC9D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YACpB,CAAC;YACD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAA;YACH,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAA;YACtE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,MAAM,YAAY,GAChB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACtE,IACE,YAAY,KAAK,SAAS;gBAC1B,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC7C,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,8DAA8D;oBAC5D,mDAAmD,YAAY,KAAK;oBACpE,+DAA+D,EACjE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBACxC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,uEAAuE;YACvE,wEAAwE;YACxE,8DAA8D;YAC9D,uEAAuE;YACvE,kEAAkE;YAClE,4CAA4C;YAC5C,MAAM,uBAAuB,CAAC;gBAC5B,KAAK;gBACL,UAAU;gBACV,IAAI,EAAE,YAAY;aACnB,CAAC,CAAA;YACF,8DAA8D;YAC9D,qEAAqE;YACrE,gEAAgE;YAChE,oEAAoE;YACpE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QACrC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,oEAAoE;YACpE,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,8BAA8B,CAAC;oBACnC,KAAK,EAAE,GAAG;oBACV,iBAAiB,EAAE,iBAAiB;oBACpC,QAAQ;oBACR,KAAK;iBACN,CAAC,CAAA;gBACF,MAAM,IAAI,uBAAuB,CAC/B,iEAAiE;oBAC/D,kDAAkD,EACpD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;gBAC5C,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC1B,MAAM,EAAE,mBAAmB;gBAC3B,UAAU;gBACV,MAAM;aACP,CAAC,CAAA;YACF,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC;oBACtB,OAAO,EAAE,CAAC,OAAO,CAAC;oBAClB,UAAU;oBACV,cAAc,EAAE,mBAAmB;oBACnC,GAAG,EAAE,IAAI;iBACV,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gEAAgE;gBAChE,gEAAgE;gBAChE,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,wBAAwB;gBACxB,IAAI,CAAC,CACH,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,CACjE,EAAE,CAAC;oBACF,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;oBAChC,MAAM,GAAG,CAAA;gBACX,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAC/B,oEAAoE;oBAClE,0BAA0B,GAAG,CAAC,OAAO,yBAAyB;oBAC9D,+BAA+B,EACjC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAC5B,CAAA;YACH,CAAC;YACD,kEAAkE;YAClE,mEAAmE;YACnE,cAAc;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;QAC9C,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;YAC5C,sEAAsE;YACtE,mEAAmE;YACnE,+DAA+D;YAC/D,oEAAoE;YACpE,4BAA4B;YAC5B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;gBACjD,KAAK,EAAE,GAAG;gBACV,UAAU;gBACV,cAAc,EAAE,mBAAmB;gBACnC,QAAQ;gBACR,KAAK;gBACL,MAAM;gBACN,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;aAC7D,CAAC,CAAA;YACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,YAAY,GAAG,QAAQ,CAAA;gBACvB,gBAAgB,GAAG,UAAU,CAAA;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;QACnC,CAAC;QAED,2BAA2B,CAAC,EAAE,UAAU,EAAE;YACxC,wBAAwB,GAAG,UAAU,CAAA;QACvC,CAAC;KACF,CAAA;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"rosterLogStore.js","sourceRoot":"","sources":["../../src/keys/rosterLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EACL,0BAA0B,IAAI,6BAA6B,EAC3D,8BAA8B,EAE/B,MAAM,yBAAyB,CAAA;AAMhC,OAAO,EACL,qBAAqB,EAGtB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,8BAA8B,EAAE,CAAA;AA8BzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAgC;IAEhC,MAAM,SAAS,GAAG,KAAmD,CAAA;IACrE,OAAO,CACL,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;QACpC,OAAO,SAAS,CAAC,2BAA2B,KAAK,UAAU,CAC5D,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,QAAQ,EAQT;IACC,mEAAmE;IACnE,kBAAkB;IAClB,IAAI,wBAAwB,GAAsC,IAAI,CAAA;IAEtE;;;;;OAKG;IACH,KAAK,UAAU,iBAAiB;QAC9B,OAAO,qBAAqB,CAAC;YAC3B,UAAU,EAAE,MAAM,kBAAkB,EAAE;YACtC,QAAQ;SACT,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,kBAAkB;QAC/B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAA;QAC1C,IAAI,wBAAwB,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,MAAM,WAAW,GACf,wBAAwB,CAAC,UAAU,CACjC,wBAAwB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAC/C,CAAA;QACH,uEAAuE;QACvE,sEAAsE;QACtE,oDAAoD;QACpD,IACE,WAAW,KAAK,SAAS;YACzB,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC1C,CAAC;YACD,OAAO,wBAAwB,CAAA;QACjC,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,6BAA6B,CAAC;QAC1C,GAAG;QACH,iBAAiB,EAAE,iBAAiB;QACpC,QAAQ;QACR,KAAK;QACL,MAAM;KACP,CAAC,CAAA;IAEF,OAAO;QACL,GAAG,KAAK;QACR,2BAA2B,CAAC,EAAE,UAAU,EAAE;YACxC,wBAAwB,GAAG,UAAU,CAAA;QACvC,CAAC;KACF,CAAA;AACH,CAAC"}