@interop/wallet-core 0.68.0 → 0.69.0

package/dist/resourceLog/errors.js

@@ -4,17 +4,16 @@
 /**
  * The one refusal class the resource-log layer still owns after the generic
  * client side moved to `@interop/vh-resource-log` -- the ceremony-tail
- * license refusal -- and the shared read-side classification of that
- * library's taxonomy ({@link isResourceLogRefusal}: which refusals a caller
- * must not paper over with a cached copy). The generic taxonomy
- * (`ResourceLogIntegrityError`, `ResourceLogContinuityError`,
+ * license refusal -- beside a re-export of that library's read-side
+ * classification of its taxonomy ({@link isResourceLogRefusal}: which
+ * refusals a caller must not paper over with a cached copy). The generic
+ * taxonomy (`ResourceLogIntegrityError`, `ResourceLogContinuityError`,
  * `ResourceLogClosedError`, `LogNotConfirmedError`, and the store port's
- * `ResourceLogConflictError`) is the library's; wallet-core re-exports none
- * of it -- one owner per name. Like every class in that taxonomy, this one
- * assigns its `name` string explicitly and is matched by `err.name` across
- * package boundaries (the WC-64 rule; minified class names do not survive
- * bundling), which is also why the predicate compares names rather than
- * constructors and why this file stays import-free.
+ * `ResourceLogConflictError`) and the predicate over it are the library's;
+ * wallet-core defines none of them -- one owner per name. Like every class
+ * in that taxonomy, this one assigns its `name` string explicitly and is
+ * matched by `err.name` across package boundaries (the WC-64 rule; minified
+ * class names do not survive bundling).
  */
 /**
  * A ladder-signed append outside the ceremony-tail license: it is not the
@@ -33,45 +32,13 @@ export class ResourceLogLicenseError extends Error {
     }
 }
 /**
- * Whether a resource-log refusal is one a caller must NOT paper over with a
- * cached copy: a fabricated log (`ResourceLogIntegrityError`), or a log that
- * is not the continuation of the pinned history
- * (`ResourceLogContinuityError`) -- EXCEPT continuity reason `rollback`.
- *
- * This is the one implementation of the rollback carve-out ARCHITECTURE.md
- * states once as policy. A rollback is reconcilable divergence, possibly
- * nothing worse than replication lag: the pin is never regressed and nothing
- * rolled back is adopted, so serving the cached copy while a lagging replica
- * catches up is exactly the offline case, and refusing there would lock a
- * healthy account out of its own start. A `fork` or an SCID/method switch is
- * a refusal like fabrication.
- *
- * `ResourceLogLicenseError` is deliberately absent, so a license refusal on a
- * READ lands in the soft transport class (warn, serve cached). Ratified
- * behavior, not omission: the log is not corrupt and the signer genuinely
- * holds the credential, so the append is unlicensed rather than forged. The
- * two shapes that argues against -- a compromised still-listed key holder,
- * and a genuine unlicensed entry N masking a forged entry N+1 under whole-log
- * first-failure semantics -- were weighed and accepted (WC-149). The
- * pre-write half of the license is where the class does its work: a
- * conformant writer is refused before an unlicensed entry can land.
- *
- * Matched on `err.name` rather than `instanceof`: these errors are raised
- * inside app-injected seams that can resolve to a different copy of this
- * package (linked, or duplicated through a dependency tree), and an
- * `instanceof` miss would drop a security refusal into a caller's
- * warn-and-proceed branch. Callers add only the names the generic taxonomy
- * does not carry.
- *
- * @param err {unknown}
- * @returns {boolean}
+ * The read-side classification of the library's taxonomy, re-exported so
+ * every consumer here keeps one owner per name: `true` for a fabricated log
+ * (`ResourceLogIntegrityError`) and for a `ResourceLogContinuityError` with
+ * any reason but `rollback`. The rollback carve-out and the deliberate
+ * absence of {@link ResourceLogLicenseError} from the set (a license refusal
+ * met on a READ lands in the soft transport class -- ratified under WC-149)
+ * are documented on the library's own definition.
  */
-export function isResourceLogRefusal(err) {
-    const candidate = err;
-    if (candidate?.name === 'ResourceLogIntegrityError') {
-        return true;
-    }
-    return (candidate?.name === 'ResourceLogContinuityError' &&
-        candidate.reason !== 'rollback');
-}
+export { isResourceLogRefusal } from '@interop/vh-resource-log';
 //# sourceMappingURL=errors.js.map

package/dist/resourceLog/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,SAAS,GAAG,GAAkD,CAAA;IACpE,IAAI,SAAS,EAAE,IAAI,KAAK,2BAA2B,EAAE,CAAC;QACpD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,CACL,SAAS,EAAE,IAAI,KAAK,4BAA4B;QAChD,SAAS,CAAC,MAAM,KAAK,UAAU,CAChC,CAAA;AACH,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/resourceLog/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AAEH;;;;;;;;;GASG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/resourceLog/index.d.ts

@@ -9,7 +9,9 @@
  * credential-inventory view, supplying the mandatory `admitAppend` admission
  * hook), the ceremony-tail license the hook carries
  * (`assertLadderAppendLicensed`, refusing with `ResourceLogLicenseError`),
- * and the import-free account-document leaf both are built on (`document.ts`
+ * the log-class dispatch that says which log the license binds
+ * (`ResourceLogClass` / `controllerForLogClass`), and the import-free
+ * account-document leaf they are built on (`document.ts`
  * -- relation resolution, ladder-VM recognition, the credential class),
  * whose public home is `webvh`, which re-exports it.
  * Everything generic -- the JSON Lines codec, the store port and
@@ -25,4 +27,5 @@ export { webvhResourceLogController, type ControllerInventory, type WebvhResourc
 export { isResourceLogRefusal, ResourceLogLicenseError } from './errors.js';
 export { attributeLadderRungsPerVersion, type LadderRungKeys } from './ladderRungs.js';
 export { assertLadderAppendLicensed } from './license.js';
+export { controllerForLogClass, type ResourceLogClass } from './logClass.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/resourceLog/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAChC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EACL,8BAA8B,EAC9B,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAChC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EACL,8BAA8B,EAC9B,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAA"}

package/dist/resourceLog/index.js

@@ -9,7 +9,9 @@
  * credential-inventory view, supplying the mandatory `admitAppend` admission
  * hook), the ceremony-tail license the hook carries
  * (`assertLadderAppendLicensed`, refusing with `ResourceLogLicenseError`),
- * and the import-free account-document leaf both are built on (`document.ts`
+ * the log-class dispatch that says which log the license binds
+ * (`ResourceLogClass` / `controllerForLogClass`), and the import-free
+ * account-document leaf they are built on (`document.ts`
  * -- relation resolution, ladder-VM recognition, the credential class),
  * whose public home is `webvh`, which re-exports it.
  * Everything generic -- the JSON Lines codec, the store port and
@@ -25,4 +27,5 @@ export { webvhResourceLogController } from './controller.js';
 export { isResourceLogRefusal, ResourceLogLicenseError } from './errors.js';
 export { attributeLadderRungsPerVersion } from './ladderRungs.js';
 export { assertLadderAppendLicensed } from './license.js';
+export { controllerForLogClass } from './logClass.js';
 //# sourceMappingURL=index.js.map

package/dist/resourceLog/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,0BAA0B,EAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EACL,8BAA8B,EAE/B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resourceLog/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,0BAA0B,EAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EACL,8BAA8B,EAE/B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,qBAAqB,EAAyB,MAAM,eAAe,CAAA"}

package/dist/resourceLog/logClass.d.ts

@@ -0,0 +1,69 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The resource-log CLASS dispatch: which admission rule a controller view
+ * carries for the log it is about to verify or extend. One account document
+ * governs several logs -- the user key roster log, and one encryption
+ * descriptor log per governed collection -- so the rule is a property of the
+ * log, not of the document, and the adapter that reads the document
+ * (`webvhResourceLogController`) cannot know which log its view is about to
+ * serve. The class therefore rides the STORE, which is built for exactly one
+ * log and states its class at construction; the store passes its resolved
+ * view through {@link controllerForLogClass} before every read and every
+ * append, so read-side verification and write-side admission run under the
+ * same rule and no call site can exempt itself.
+ *
+ * The rules, one per member of {@link ResourceLogClass}. A new log class is
+ * added to the union with its rule stated here, rather than by exempting a
+ * caller (app-connect-spec `decisions/0003`, "Scope").
+ */
+import type { WebvhResourceLogController } from './controller.js';
+/**
+ * The classes of resource log this wallet verifies, each naming the rule its
+ * views admit ladder-signed appends under.
+ *
+ * - `'user-key-roster'`: the user key roster log (`key-map/user-key.jsonl`),
+ *   the log governing the account's root key. A ladder-signed append to it
+ *   carries the ceremony-tail license (clause B of the ladder VM's authority
+ *   clauses): one of the license's enumerated shapes, one-shot per licensed
+ *   controller version, at most one ladder proof per entry. This is the
+ *   adapter's own view, unchanged.
+ * - `'collection-descriptor'`: a per-collection encryption descriptor log
+ *   (one per governed collection, the encrypted-collections profile's log
+ *   form). A ladder-signed append admits on `assertionMethod` membership at
+ *   the anchored version alone, with no shape check and no one-shot. The
+ *   license exists to refuse the silent rekey of the account's root key to
+ *   recipients of a credential thief's choosing; a descriptor append escrows
+ *   one recipient into one collection and lands as a hash-chained entry
+ *   signed by that credential's ladder VM, auditable by the account's clients
+ *   and attributable to the credential, so the bound it leaves is
+ *   detect-and-remediate rather than silence.
+ */
+export type ResourceLogClass = 'user-key-roster' | 'collection-descriptor';
+/**
+ * Returns the controller view a log of the given class must be verified and
+ * appended to under: the adapter's licensed view for the roster class, and a
+ * view identical in every other member with a membership-only `admitAppend`
+ * for the collection-descriptor class.
+ *
+ * The hook stays a real function rather than being dropped, because the
+ * wallet-core extended view makes it mandatory: an account document can list
+ * ladder VMs, so a view over one always answers the question, and the
+ * collection-descriptor answer is "membership is enough". The library
+ * verifier has already settled `assertionMethod` membership at the entry's
+ * anchored controller version before the hook runs, so the hook resolves
+ * nothing and returns.
+ *
+ * @param options {object}
+ * @param options.controller {WebvhResourceLogController}   the adapter's
+ *   view over the verified account log
+ * @param options.logClass {ResourceLogClass}   the class of the log this view
+ *   will serve
+ * @returns {WebvhResourceLogController}
+ */
+export declare function controllerForLogClass({ controller, logClass }: {
+    controller: WebvhResourceLogController;
+    logClass: ResourceLogClass;
+}): WebvhResourceLogController;
+//# sourceMappingURL=logClass.d.ts.map

package/dist/resourceLog/logClass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logClass.d.ts","sourceRoot":"","sources":["../../src/resourceLog/logClass.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,uBAAuB,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,UAAU,EACV,QAAQ,EACT,EAAE;IACD,UAAU,EAAE,0BAA0B,CAAA;IACtC,QAAQ,EAAE,gBAAgB,CAAA;CAC3B,GAAG,0BAA0B,CAsB7B"}

package/dist/resourceLog/logClass.js

@@ -0,0 +1,43 @@
+/**
+ * Returns the controller view a log of the given class must be verified and
+ * appended to under: the adapter's licensed view for the roster class, and a
+ * view identical in every other member with a membership-only `admitAppend`
+ * for the collection-descriptor class.
+ *
+ * The hook stays a real function rather than being dropped, because the
+ * wallet-core extended view makes it mandatory: an account document can list
+ * ladder VMs, so a view over one always answers the question, and the
+ * collection-descriptor answer is "membership is enough". The library
+ * verifier has already settled `assertionMethod` membership at the entry's
+ * anchored controller version before the hook runs, so the hook resolves
+ * nothing and returns.
+ *
+ * @param options {object}
+ * @param options.controller {WebvhResourceLogController}   the adapter's
+ *   view over the verified account log
+ * @param options.logClass {ResourceLogClass}   the class of the log this view
+ *   will serve
+ * @returns {WebvhResourceLogController}
+ */
+export function controllerForLogClass({ controller, logClass }) {
+    switch (logClass) {
+        case 'user-key-roster':
+            return controller;
+        case 'collection-descriptor':
+            return {
+                ...controller,
+                async admitAppend() {
+                    // Membership at the anchored version is the whole rule for this
+                    // class, and the verifier has already checked it.
+                    return;
+                }
+            };
+        default: {
+            // Fail closed: a class this dispatch does not name (a cast, a caller
+            // outside the type system) gets no rule, not the permissive one.
+            const unknown = logClass;
+            throw new TypeError(`Unknown resource-log class ${JSON.stringify(unknown)}.`);
+        }
+    }
+}
+//# sourceMappingURL=logClass.js.map

package/dist/resourceLog/logClass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logClass.js","sourceRoot":"","sources":["../../src/resourceLog/logClass.ts"],"names":[],"mappings":"AA6CA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,UAAU,EACV,QAAQ,EAIT;IACC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,iBAAiB;YACpB,OAAO,UAAU,CAAA;QACnB,KAAK,uBAAuB;YAC1B,OAAO;gBACL,GAAG,UAAU;gBACb,KAAK,CAAC,WAAW;oBACf,gEAAgE;oBAChE,kDAAkD;oBAClD,OAAM;gBACR,CAAC;aACF,CAAA;QACH,OAAO,CAAC,CAAC,CAAC;YACR,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,OAAO,GAAU,QAAQ,CAAA;YAC/B,MAAM,IAAI,SAAS,CACjB,8BAA8B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CACzD,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/space/collections.d.ts

@@ -25,8 +25,10 @@ export declare const APP_CONNECTIONS_COLLECTION = "app-connections";
  * friendly display name both wallets pass as the server-side collection name,
  * and the storage attributes --
  *
- * - `encryption` -- `'edv'` stores each document as an EDV envelope; `'plaintext'`
- *   stores it verbatim.
+ * - `encryption` -- how documents are stored: `'edv'` stores each document as
+ *   an EDV envelope, `'plaintext'` stores it verbatim. It says nothing about
+ *   where the `encryption` descriptor lives; an `edv` collection is created
+ *   bare and declared encrypted by its governing history log's genesis.
  * - `isPublic` -- whether the collection is granted collection-level world read
  *   on the server.
  */
@@ -219,6 +221,24 @@ export declare const DID_KEYS_RESOURCE = "keys.json";
  * directly with a compare-and-swap etag -- never replicated.
  */
 export declare const USER_KEY_ROSTER_LOG_RESOURCE = "user-key.jsonl";
+/**
+ * The governing history log of every encrypted wallet collection: the
+ * per-collection encryption descriptor log, at the Collection's own
+ * `meta/log` sub-resource.
+ *
+ * It is a Collection SUB-RESOURCE under the reserved `meta` segment, not a
+ * Resource in the Collection: it is absent from listings and from the changes
+ * feed, exempt from the envelope rule, covered by any capability whose target
+ * covers the Collection, and created and deleted with the Collection. Its
+ * body is plaintext JSON Lines, one signed entry per line, and the verified
+ * head entry's state IS the collection's `encryption` descriptor -- the
+ * server derives the Collection Description's `encryption` member from it, so
+ * no client writes that member on a governed collection.
+ *
+ * The transport is was-client's `resourceLogStore({ collection })`, which
+ * reads and writes exactly this sub-resource through the Collection handle.
+ */
+export declare const COLLECTION_HISTORY_LOG_SUBRESOURCE = "meta/log";
 /**
  * The enrolled-client display labels, sibling of `keys.json` and
  * `user-key.jsonl` in the same private `key-map` collection: a plain-JSON map

package/dist/space/collections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../../src/space/collections.ts"],"names":[],"mappings":"AA2BA;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,iBAAiB,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,8BAA8B,wBAAwB,CAAA;AACnE;;GAEG;AACH,eAAO,MAAM,6BAA6B,uBAAuB,CAAA;AACjE;;GAEG;AACH,eAAO,MAAM,0BAA0B,oBAAoB,CAAA;AAC3D;;GAEG;AACH,eAAO,MAAM,0BAA0B,oBAAoB,CAAA;AAE3D;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,KAAK,GAAG,WAAW,CAAA;IAC/B,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,YAAY,EAAE,SAAS,GAAG,QAAQ,CAAA;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAE,mBAQjD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,EAAE,mBAQhD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,EAAE,mBAQ7C,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,mBAM5C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,EAAE,mBAMpD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAE,mBAQ7C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,aAAa;;;CAAiC,CAAA;AAC3D,eAAO,MAAM,kBAAkB;;;CAAqC,CAAA;AACpE,eAAO,MAAM,yBAAyB;;;CAGrC,CAAA;AACD,eAAO,MAAM,kBAAkB;;;CAAqC,CAAA;AAEpE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,kBAKhC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,kBAKrC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,kBAK5C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAAmB,EAO1D,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,kBAAkB,EAIzD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,kBAAkB,EAG7D,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,EAAE,CAIvD;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAA;AAC/C;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAC5C;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAA;AAC5D;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAA;AAC1D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,iBAAiB,CAAA;AACrD;;GAEG;AACH,eAAO,MAAM,gBAAgB,iBAAiB,CAAA"}
+{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../../src/space/collections.ts"],"names":[],"mappings":"AA2BA;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,iBAAiB,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,8BAA8B,wBAAwB,CAAA;AACnE;;GAEG;AACH,eAAO,MAAM,6BAA6B,uBAAuB,CAAA;AACjE;;GAEG;AACH,eAAO,MAAM,0BAA0B,oBAAoB,CAAA;AAC3D;;GAEG;AACH,eAAO,MAAM,0BAA0B,oBAAoB,CAAA;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,KAAK,GAAG,WAAW,CAAA;IAC/B,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,YAAY,EAAE,SAAS,GAAG,QAAQ,CAAA;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;;GAGG;AACH,eAAO,MAAM,mCAAmC,EAAE,mBAQjD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,EAAE,mBAQhD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,EAAE,mBAQ7C,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,mBAM5C,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,EAAE,mBAMpD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAE,mBAQ7C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,aAAa;;;CAAiC,CAAA;AAC3D,eAAO,MAAM,kBAAkB;;;CAAqC,CAAA;AACpE,eAAO,MAAM,yBAAyB;;;CAGrC,CAAA;AACD,eAAO,MAAM,kBAAkB;;;CAAqC,CAAA;AAEpE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,kBAKhC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,kBAKrC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,kBAK5C,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAAmB,EAO1D,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,kBAAkB,EAIzD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,kBAAkB,EAG7D,CAAA;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,EAAE,CAIvD;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAA;AAC/C;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,cAAc,CAAA;AAC5C;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,mBAAmB,CAAA;AAC5D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kCAAkC,aAAa,CAAA;AAC5D;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,uBAAuB,CAAA;AAC1D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,iBAAiB,CAAA;AACrD;;GAEG;AACH,eAAO,MAAM,gBAAgB,iBAAiB,CAAA"}

package/dist/space/collections.js

@@ -269,6 +269,24 @@ export const DID_KEYS_RESOURCE = 'keys.json';
  * directly with a compare-and-swap etag -- never replicated.
  */
 export const USER_KEY_ROSTER_LOG_RESOURCE = 'user-key.jsonl';
+/**
+ * The governing history log of every encrypted wallet collection: the
+ * per-collection encryption descriptor log, at the Collection's own
+ * `meta/log` sub-resource.
+ *
+ * It is a Collection SUB-RESOURCE under the reserved `meta` segment, not a
+ * Resource in the Collection: it is absent from listings and from the changes
+ * feed, exempt from the envelope rule, covered by any capability whose target
+ * covers the Collection, and created and deleted with the Collection. Its
+ * body is plaintext JSON Lines, one signed entry per line, and the verified
+ * head entry's state IS the collection's `encryption` descriptor -- the
+ * server derives the Collection Description's `encryption` member from it, so
+ * no client writes that member on a governed collection.
+ *
+ * The transport is was-client's `resourceLogStore({ collection })`, which
+ * reads and writes exactly this sub-resource through the Collection handle.
+ */
+export const COLLECTION_HISTORY_LOG_SUBRESOURCE = 'meta/log';
 /**
  * The enrolled-client display labels, sibling of `keys.json` and
  * `user-key.jsonl` in the same private `key-map` collection: a plain-JSON map

package/dist/space/collections.js.map

@@ -1 +1 @@
-{"version":3,"file":"collections.js","sourceRoot":"","sources":["../../src/space/collections.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EACjC,MAAM,sBAAsB,CAAA;AAE7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAA;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,qBAAqB,CAAA;AACnE;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,oBAAoB,CAAA;AACjE;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAA;AAC3D;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAA;AA2C3D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAwB;IACtE,YAAY,EAAE,8BAA8B;IAC5C,IAAI,EAAE,wBAAwB;IAC9B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,IAAI;CAChB,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB;IACrE,YAAY,EAAE,6BAA6B;IAC3C,IAAI,EAAE,0CAA0C;IAChD,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,KAAK;CACjB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,YAAY,EAAE,0BAA0B;IACxC,IAAI,EAAE,qBAAqB;IAC3B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,IAAI;CAChB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB;IACjE,GAAG,wBAAwB;IAC3B,IAAI,EAAE,UAAU;IAChB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,IAAI;CAChB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAwB;IACzE,GAAG,gCAAgC;IACnC,IAAI,EAAE,kBAAkB;IACxB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,IAAI;CAChB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,YAAY,EAAE,0BAA0B;IACxC,IAAI,EAAE,iBAAiB;IACvB,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,gBAAgB;CACvB,CAAA;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAuB;IACpD,YAAY,EAAE,aAAa,CAAC,EAAE;IAC9B,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,IAAI;CACf,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAuB;IACzD,YAAY,EAAE,kBAAkB,CAAC,EAAE;IACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;IAC7B,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,KAAK;CAChB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAuB;IAChE,YAAY,EAAE,yBAAyB,CAAC,EAAE;IAC1C,IAAI,EAAE,yBAAyB,CAAC,IAAI;IACpC,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,KAAK;CAChB,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA0B;IAC9D,mCAAmC;IACnC,kCAAkC;IAClC,+BAA+B;IAC/B,8BAA8B;IAC9B,sCAAsC;IACtC,+BAA+B;CAChC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAyB;IAC7D,kBAAkB;IAClB,uBAAuB;IACvB,8BAA8B;CAC/B,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAyB;IACjE,GAAG,yBAAyB;IAC5B,GAAG,yBAAyB;CAC7B,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,6BAA6B,CAAC,MAAM,CACzC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAClC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAA;AAC/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC5C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAA;AAC5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAA;AAC1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAA;AACrD;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAA"}
+{"version":3,"file":"collections.js","sourceRoot":"","sources":["../../src/space/collections.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EACjC,MAAM,sBAAsB,CAAA;AAE7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAA;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,qBAAqB,CAAA;AACnE;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,oBAAoB,CAAA;AACjE;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAA;AAC3D;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAA;AA6C3D;;;GAGG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAwB;IACtE,YAAY,EAAE,8BAA8B;IAC5C,IAAI,EAAE,wBAAwB;IAC9B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,IAAI;CAChB,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB;IACrE,YAAY,EAAE,6BAA6B;IAC3C,IAAI,EAAE,0CAA0C;IAChD,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,KAAK;CACjB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,YAAY,EAAE,0BAA0B;IACxC,IAAI,EAAE,qBAAqB;IAC3B,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,IAAI;CAChB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB;IACjE,GAAG,wBAAwB;IAC3B,IAAI,EAAE,UAAU;IAChB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,IAAI;CAChB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAwB;IACzE,GAAG,gCAAgC;IACnC,IAAI,EAAE,kBAAkB;IACxB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,IAAI;CAChB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,YAAY,EAAE,0BAA0B;IACxC,IAAI,EAAE,iBAAiB;IACvB,YAAY,EAAE,SAAS;IACvB,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;CACjB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAC3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AACpE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,gBAAgB;CACvB,CAAA;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAuB;IACpD,YAAY,EAAE,aAAa,CAAC,EAAE;IAC9B,IAAI,EAAE,aAAa,CAAC,IAAI;IACxB,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,IAAI;CACf,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAuB;IACzD,YAAY,EAAE,kBAAkB,CAAC,EAAE;IACnC,IAAI,EAAE,kBAAkB,CAAC,IAAI;IAC7B,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,KAAK;CAChB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAuB;IAChE,YAAY,EAAE,yBAAyB,CAAC,EAAE;IAC1C,IAAI,EAAE,yBAAyB,CAAC,IAAI;IACpC,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,KAAK;CAChB,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA0B;IAC9D,mCAAmC;IACnC,kCAAkC;IAClC,+BAA+B;IAC/B,8BAA8B;IAC9B,sCAAsC;IACtC,+BAA+B;CAChC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAyB;IAC7D,kBAAkB;IAClB,uBAAuB;IACvB,8BAA8B;CAC/B,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAyB;IACjE,GAAG,yBAAyB;IAC5B,GAAG,yBAAyB;CAC7B,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,6BAA6B,CAAC,MAAM,CACzC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAClC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAA;AAC/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAC5C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAA;AAC5D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,UAAU,CAAA;AAC5D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAA;AAC1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAA;AACrD;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAA"}

package/dist/space/index.d.ts

@@ -17,8 +17,9 @@
  *   `keyring.json`) -- outside the synced set, never replicated.
  * - `provisionWalletSpace`, the one-shot full-roster provisioner every
  *   controller-tier wallet client runs (create-if-absent, never clobbering
- *   settled configuration). It declares the encrypted collections; their
- *   epoch[0] install is the EDV-bearing `ensureWalletSpaceEpochs` in
+ *   settled configuration). It creates the encrypted collections BARE; their
+ *   declaration and epoch[0] both arrive with the genesis of each one's
+ *   governing history log, in the EDV-bearing `ensureWalletSpaceEpochs` in
  *   `@interop/wallet-core/keys`, kept out of this crypto-free module.
  * - `plaintextCollection`, the one handle builder for the system collections
  *   whose resources never go through the encryption codec.
@@ -35,7 +36,7 @@
  */
 export { deleteSpaceWithCapability } from './deleteSpace.js';
 export { WALLET_SPACE_NAME, PRIVATE_CREDENTIALS_COLLECTION, PUBLIC_CREDENTIALS_COLLECTION, WALLET_ACTIVITY_COLLECTION, APP_CONNECTIONS_COLLECTION, PRIVATE_CREDENTIALS_COLLECTION_SPEC, PUBLIC_CREDENTIALS_COLLECTION_SPEC, WALLET_ACTIVITY_COLLECTION_SPEC, CONTACTS_SPACE_COLLECTION_SPEC, CONTACTS_HISTORY_SPACE_COLLECTION_SPEC, APP_CONNECTIONS_COLLECTION_SPEC, WALLET_SPACE_SYNCED_SPECS, WALLET_SPACE_SYSTEM_SPECS, WALLET_SPACE_PROVISION_ROSTER } from './collections.js';
-export { ID_COLLECTION, KEY_MAP_COLLECTION, UNLOCK_METHODS_COLLECTION, KEYRING_COLLECTION, ID_COLLECTION_SPEC, KEY_MAP_COLLECTION_SPEC, UNLOCK_METHODS_COLLECTION_SPEC, DID_DOCUMENT_RESOURCE, DID_LOG_RESOURCE, DID_KEYS_RESOURCE, USER_KEY_ROSTER_LOG_RESOURCE, CLIENT_LABELS_RESOURCE, UNLOCK_METHODS_RESOURCE, KEYRING_RESOURCE } from './collections.js';
+export { ID_COLLECTION, KEY_MAP_COLLECTION, UNLOCK_METHODS_COLLECTION, KEYRING_COLLECTION, ID_COLLECTION_SPEC, KEY_MAP_COLLECTION_SPEC, UNLOCK_METHODS_COLLECTION_SPEC, DID_DOCUMENT_RESOURCE, DID_LOG_RESOURCE, DID_KEYS_RESOURCE, USER_KEY_ROSTER_LOG_RESOURCE, COLLECTION_HISTORY_LOG_SUBRESOURCE, CLIENT_LABELS_RESOURCE, UNLOCK_METHODS_RESOURCE, KEYRING_RESOURCE } from './collections.js';
 export type { SpaceProvisionSpec, SpaceCollectionSpec } from './collections.js';
 export { provisionWalletSpace } from './provisioning.js';
 export { plaintextCollection } from './plaintextCollection.js';

package/dist/space/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,kCAAkC,EAClC,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA"}

package/dist/space/index.js

@@ -17,8 +17,9 @@
  *   `keyring.json`) -- outside the synced set, never replicated.
  * - `provisionWalletSpace`, the one-shot full-roster provisioner every
  *   controller-tier wallet client runs (create-if-absent, never clobbering
- *   settled configuration). It declares the encrypted collections; their
- *   epoch[0] install is the EDV-bearing `ensureWalletSpaceEpochs` in
+ *   settled configuration). It creates the encrypted collections BARE; their
+ *   declaration and epoch[0] both arrive with the genesis of each one's
+ *   governing history log, in the EDV-bearing `ensureWalletSpaceEpochs` in
  *   `@interop/wallet-core/keys`, kept out of this crypto-free module.
  * - `plaintextCollection`, the one handle builder for the system collections
  *   whose resources never go through the encryption codec.
@@ -35,7 +36,7 @@
  */
 export { deleteSpaceWithCapability } from './deleteSpace.js';
 export { WALLET_SPACE_NAME, PRIVATE_CREDENTIALS_COLLECTION, PUBLIC_CREDENTIALS_COLLECTION, WALLET_ACTIVITY_COLLECTION, APP_CONNECTIONS_COLLECTION, PRIVATE_CREDENTIALS_COLLECTION_SPEC, PUBLIC_CREDENTIALS_COLLECTION_SPEC, WALLET_ACTIVITY_COLLECTION_SPEC, CONTACTS_SPACE_COLLECTION_SPEC, CONTACTS_HISTORY_SPACE_COLLECTION_SPEC, APP_CONNECTIONS_COLLECTION_SPEC, WALLET_SPACE_SYNCED_SPECS, WALLET_SPACE_SYSTEM_SPECS, WALLET_SPACE_PROVISION_ROSTER } from './collections.js';
-export { ID_COLLECTION, KEY_MAP_COLLECTION, UNLOCK_METHODS_COLLECTION, KEYRING_COLLECTION, ID_COLLECTION_SPEC, KEY_MAP_COLLECTION_SPEC, UNLOCK_METHODS_COLLECTION_SPEC, DID_DOCUMENT_RESOURCE, DID_LOG_RESOURCE, DID_KEYS_RESOURCE, USER_KEY_ROSTER_LOG_RESOURCE, CLIENT_LABELS_RESOURCE, UNLOCK_METHODS_RESOURCE, KEYRING_RESOURCE } from './collections.js';
+export { ID_COLLECTION, KEY_MAP_COLLECTION, UNLOCK_METHODS_COLLECTION, KEYRING_COLLECTION, ID_COLLECTION_SPEC, KEY_MAP_COLLECTION_SPEC, UNLOCK_METHODS_COLLECTION_SPEC, DID_DOCUMENT_RESOURCE, DID_LOG_RESOURCE, DID_KEYS_RESOURCE, USER_KEY_ROSTER_LOG_RESOURCE, COLLECTION_HISTORY_LOG_SUBRESOURCE, CLIENT_LABELS_RESOURCE, UNLOCK_METHODS_RESOURCE, KEYRING_RESOURCE } from './collections.js';
 export { provisionWalletSpace } from './provisioning.js';
 export { plaintextCollection } from './plaintextCollection.js';
 export { ACTIVITY_TYPE, addHistoryNewAccount, addHistorySpaceCreated, addHistoryCredentialCreated, addHistoryCredentialDeleted, addHistoryCredentialShared, addHistoryCredentialUnshared, addHistoryLogin, addHistoryWalletLogin, addHistoryAppRevoke, addHistoryAgentRevoke, addHistoryClientRevoked, addHistoryGenerationCollected } from './activity.js';

package/dist/space/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/space/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,8BAA8B,EAC9B,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,mCAAmC,EACnC,kCAAkC,EAClC,+BAA+B,EAC/B,8BAA8B,EAC9B,sCAAsC,EACtC,+BAA+B,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,4BAA4B,EAC5B,kCAAkC,EAClC,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA"}

package/dist/space/provisioning.d.ts

@@ -7,6 +7,15 @@
  * `WALLET_SPACE_PROVISION_ROSTER` -- the synced feeds plus the non-synced
  * system collections (`id`, `key-map`) -- so a Space's layout never depends on
  * which app happened to provision it.
+ *
+ * An `edv` roster collection is created BARE here: no `encryption` member in
+ * its Collection Description. Such a collection is declared encrypted by its
+ * governing history log's genesis instead -- the guarded create the epoch[0]
+ * install runs (`ensureWalletSpaceEpochs`, `@interop/wallet-core/keys`). The
+ * order is forced: the server refuses to govern a Description that already
+ * carries a client-written `encryption` member, so a collection declared
+ * encrypted here could never become governed. `plaintext` specs are
+ * unchanged.
  */
 import type { WasClient } from '@interop/was-client';
 /**
@@ -24,12 +33,13 @@ import type { WasClient } from '@interop/was-client';
  * heals a torn signup's missing collections without touching settled
  * configuration.
  *
- * This declares the encrypted collections but installs no key material: every
- * encrypted collection's descriptor must then get its epoch[0] from
- * `ensureWalletSpaceEpochs` (`@interop/wallet-core/keys`), the EDV-bearing
- * second step kept out of this module so the root barrel stays crypto-free.
- * Reads and writes on an encrypted collection are refused fail-closed until
- * that install lands.
+ * This creates the containers and installs no key material and no descriptor:
+ * an `edv` roster collection is created with no `encryption` member at all,
+ * and both its declaration and its epoch[0] arrive together as the genesis of
+ * its governing history log, in `ensureWalletSpaceEpochs`
+ * (`@interop/wallet-core/keys`) -- the EDV-bearing second step kept out of
+ * this module so the root barrel stays crypto-free. Reads and writes on such
+ * a collection are refused fail-closed until that genesis lands.
  *
  * @param options {object}
  * @param options.was {WasClient}

package/dist/space/provisioning.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../../src/space/provisioning.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,KAAK,EAAoB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAStE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,OAAO,EACP,aAAa,EACd,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB"}
+{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../../src/space/provisioning.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAoB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAStE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,OAAO,EACP,aAAa,EACd,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB"}

package/dist/space/provisioning.js

@@ -15,12 +15,13 @@ import { WALLET_SPACE_NAME, WALLET_SPACE_PROVISION_ROSTER } from './collections.
  * heals a torn signup's missing collections without touching settled
  * configuration.
  *
- * This declares the encrypted collections but installs no key material: every
- * encrypted collection's descriptor must then get its epoch[0] from
- * `ensureWalletSpaceEpochs` (`@interop/wallet-core/keys`), the EDV-bearing
- * second step kept out of this module so the root barrel stays crypto-free.
- * Reads and writes on an encrypted collection are refused fail-closed until
- * that install lands.
+ * This creates the containers and installs no key material and no descriptor:
+ * an `edv` roster collection is created with no `encryption` member at all,
+ * and both its declaration and its epoch[0] arrive together as the genesis of
+ * its governing history log, in `ensureWalletSpaceEpochs`
+ * (`@interop/wallet-core/keys`) -- the EDV-bearing second step kept out of
+ * this module so the root barrel stays crypto-free. Reads and writes on such
+ * a collection are refused fail-closed until that genesis lands.
  *
  * @param options {object}
  * @param options.was {WasClient}
@@ -51,7 +52,10 @@ async function ensureCollection({ was, spaceId, controllerDid, spaceDescription,
             controllerDid,
             collectionId,
             collectionName: name,
-            encryption,
+            // An `edv` roster collection is declared encrypted by its governing
+            // log's genesis, never by a Description member: the server refuses to
+            // govern a Description that already carries one.
+            encryption: encryption === 'edv' ? 'governed' : encryption,
             isPublic,
             spaceDescription,
             spaceName: WALLET_SPACE_NAME

package/dist/space/provisioning.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../src/space/provisioning.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAEhF,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AAGzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,OAAO,EACP,aAAa,EAKd;IACC,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC;QACzC,GAAG;QACH,OAAO;QACP,aAAa;QACb,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAA;IACF,MAAM,OAAO,CAAC,GAAG,CACf,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACvC,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC1E,CACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAC9B,GAAG,EACH,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAOnD;IACC,IAAI,CAAC;QACH,MAAM,wBAAwB,CAAC;YAC7B,GAAG;YACH,OAAO;YACP,aAAa;YACb,YAAY;YACZ,cAAc,EAAE,IAAI;YACpB,UAAU;YACV,QAAQ;YACR,gBAAgB;YAChB,SAAS,EAAE,iBAAiB;SAC7B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kCAAkC,YAAY,eAAe,OAAO,IAAI,EACxE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../src/space/provisioning.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AAEhF,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAA;AAGzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,OAAO,EACP,aAAa,EAKd;IACC,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC;QACzC,GAAG;QACH,OAAO;QACP,aAAa;QACb,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAA;IACF,MAAM,OAAO,CAAC,GAAG,CACf,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACvC,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC1E,CACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAC9B,GAAG,EACH,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAOnD;IACC,IAAI,CAAC;QACH,MAAM,wBAAwB,CAAC;YAC7B,GAAG;YACH,OAAO;YACP,aAAa;YACb,YAAY;YACZ,cAAc,EAAE,IAAI;YACpB,oEAAoE;YACpE,sEAAsE;YACtE,iDAAiD;YACjD,UAAU,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YAC1D,QAAQ;YACR,gBAAgB;YAChB,SAAS,EAAE,iBAAiB;SAC7B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kCAAkC,YAAY,eAAe,OAAO,IAAI,EACxE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/sync/engine.d.ts

@@ -43,8 +43,10 @@ export interface SyncEngineDeps {
     /**
      * Idempotent space + collection provisioning. For an encrypted collection
      * this MUST include publishing the collection's encryption descriptor with
-     * its key-epoch roster (the wallet Space two-step: `provisionWalletSpace`,
-     * then `ensureWalletSpaceEpochs`; `walletSpaceProvisioner` in
+     * its key-epoch roster (the wallet Space two-step: `provisionWalletSpace`
+     * creates the collections bare, then `ensureWalletSpaceEpochs` declares
+     * each encrypted one and lands its epoch[0], as the genesis of the
+     * collection's own governing history log; `walletSpaceProvisioner` in
      * `@interop/wallet-core/keys` builds the closure that runs both). The
      * engine runs it ahead of every cycle's migration sweep and push, which is
      * what enforces the descriptor-before-first-content-push ordering

package/dist/sync/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/sync/engine.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAQ/E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,CAAA;IACjB,KAAK,EAAE,SAAS,CAAA;IAChB;;OAEG;IACH,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,CAAA;IAC5C;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD;;OAEG;IACH,UAAU,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAClC;;OAEG;IACH,gBAAgB,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD;;OAEG;IACH,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC;;OAEG;IACH,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAA;IAC7C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,IAAI,CAAA;IAE1B,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,CAAA;IAC1D;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;CACtB;AAOD,qBAAa,UAAU;IAmBT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAlBjC,MAAM,EAAE,UAAU,CAAS;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IAErC,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,WAAW,CAAQ;IAC3B,OAAO,CAAC,sBAAsB,CAAI;gBAEL,IAAI,EAAE,cAAc;IAQjD;;;;;;;;OAQG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrB;;;;;;OAMG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;OAKG;IACH,IAAI,IAAI,IAAI;YAOE,GAAG;IA8BjB;;;;;;;;;;;;;;;;;;;OAmBG;YACW,QAAQ;YAsER,IAAI;IAYlB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,SAAS;CAOlB"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/sync/engine.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAQ/E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,CAAA;IACjB,KAAK,EAAE,SAAS,CAAA;IAChB;;OAEG;IACH,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,CAAA;IAC5C;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD;;OAEG;IACH,UAAU,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAClC;;OAEG;IACH,gBAAgB,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD;;OAEG;IACH,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC;;OAEG;IACH,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpC;;OAEG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAA;IAC7C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,IAAI,CAAA;IAE1B,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,CAAA;IAC1D;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;CACtB;AAOD,qBAAa,UAAU;IAmBT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAlBjC,MAAM,EAAE,UAAU,CAAS;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IAErC,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,WAAW,CAAQ;IAC3B,OAAO,CAAC,sBAAsB,CAAI;gBAEL,IAAI,EAAE,cAAc;IAQjD;;;;;;;;OAQG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrB;;;;;;OAMG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;OAKG;IACH,IAAI,IAAI,IAAI;YAOE,GAAG;IA8BjB;;;;;;;;;;;;;;;;;;;OAmBG;YACW,QAAQ;YAsER,IAAI;IAYlB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,SAAS;CAOlB"}

package/dist/sync/engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/sync/engine.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,kBAAkB,GAAG,GAAG,CAAA;AAC9B,MAAM,qBAAqB,GAAG,KAAK,CAAA;AACnC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAmGnC,SAAS,eAAe,CAAC,EAAc,EAAE,OAAe;IACtD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACrC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,OAAO,UAAU;IAmBQ;IAlB7B,MAAM,GAAe,MAAM,CAAA;IAEV,SAAS,CAAQ;IACjB,WAAW,CAAQ;IACnB,UAAU,CAAQ;IAClB,QAAQ,CAAiD;IACzD,MAAM,CAAc;IAE7B,OAAO,GAAG,KAAK,CAAA;IACf,cAAc,GAAG,KAAK,CAAA;IACtB,OAAO,GAAG,KAAK,CAAA;IACf,YAAY,GAAG,CAAC,CAAA;IAChB,UAAU,GAAyB,IAAI,CAAA;IACvC,eAAe,GAA2B,IAAI,CAAA;IAC9C,WAAW,GAAwB,IAAI,CAAA;IACvC,WAAW,GAAG,KAAK,CAAA;IACnB,sBAAsB,GAAG,CAAC,CAAA;IAElC,YAA6B,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;QACrD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAA;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,oBAAoB,CAAA;QAClE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAA;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB;QACpB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAA;QACxB,yEAAyE;QACzE,kEAAkE;QAClE,wDAAwD;QACxD,IAAI,CAAC,sBAAsB,IAAI,CAAC,CAAA;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAA;QAC7B,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxB,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACzB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAA;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAA;QAC7B,IAAI,CAAC;YACH,GAAG,CAAC;gBACF,IAAI,CAAC,cAAc,GAAG,KAAK,CAAA;gBAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAC;YAEjE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAA;gBACrB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBACvB,IAAI,CAAC,aAAa,EAAE,CAAA;YACtB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;YACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,QAAQ,CAAC,MAAmB;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAA;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACnC,IAAI,UAAU,KAAK,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;YACzB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAM;YACR,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,YAAY,GAAG,CAAC,CAAA;QAEpB,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,YAAY,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAA;YAC/B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,OAAO,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;YAC1C,MAAM;SACP,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,wEAAwE;QACxE,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;QAC5B,CAAC;QAED,YAAY,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAA;QACjC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAA;QAC7B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAmB;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;YAC1C,MAAM;SACP,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,aAAa;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CACrB,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,EACzC,IAAI,CAAC,UAAU,CAChB,CAAA;QACD,yEAAyE;QACzE,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,YAAY,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;YACvB,KAAK,IAAI,CAAC,IAAI,EAAE,CAAA;QAClB,CAAC,EAAE,KAAK,CAAC,CAAA;IACX,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,EAAE,CAAA;YAClB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACzB,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAkB;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAA;IACpC,CAAC;CACF"}
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/sync/engine.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,kBAAkB,GAAG,GAAG,CAAA;AAC9B,MAAM,qBAAqB,GAAG,KAAK,CAAA;AACnC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAqGnC,SAAS,eAAe,CAAC,EAAc,EAAE,OAAe;IACtD,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACrC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,OAAO,UAAU;IAmBQ;IAlB7B,MAAM,GAAe,MAAM,CAAA;IAEV,SAAS,CAAQ;IACjB,WAAW,CAAQ;IACnB,UAAU,CAAQ;IAClB,QAAQ,CAAiD;IACzD,MAAM,CAAc;IAE7B,OAAO,GAAG,KAAK,CAAA;IACf,cAAc,GAAG,KAAK,CAAA;IACtB,OAAO,GAAG,KAAK,CAAA;IACf,YAAY,GAAG,CAAC,CAAA;IAChB,UAAU,GAAyB,IAAI,CAAA;IACvC,eAAe,GAA2B,IAAI,CAAA;IAC9C,WAAW,GAAwB,IAAI,CAAA;IACvC,WAAW,GAAG,KAAK,CAAA;IACnB,sBAAsB,GAAG,CAAC,CAAA;IAElC,YAA6B,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;QACrD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,IAAI,qBAAqB,CAAA;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,oBAAoB,CAAA;QAClE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAA;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;YAC1B,OAAO,IAAI,CAAC,UAAU,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED;;;;;;OAMG;IACH,sBAAsB;QACpB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAA;QACxB,yEAAyE;QACzE,kEAAkE;QAClE,wDAAwD;QACxD,IAAI,CAAC,sBAAsB,IAAI,CAAC,CAAA;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAA;QAC7B,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACxB,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,UAAU,EAAE,CAAA;QACjB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACzB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAA;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAA;QAC7B,IAAI,CAAC;YACH,GAAG,CAAC;gBACF,IAAI,CAAC,cAAc,GAAG,KAAK,CAAA;gBAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC7B,CAAC,QAAQ,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAC;YAEjE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAA;gBACrB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBACvB,IAAI,CAAC,aAAa,EAAE,CAAA;YACtB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;YACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,QAAQ,CAAC,MAAmB;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAA;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACnC,IAAI,UAAU,KAAK,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;YACzB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAM;YACR,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,YAAY,GAAG,CAAC,CAAA;QAEpB,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,YAAY,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QACxC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAA;YAC/B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,OAAO,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;YAC1C,MAAM;SACP,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,wEAAwE;QACxE,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA;QAC5B,CAAC;QAED,YAAY,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAA;QACjC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAA;QAC7B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAmB;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;YAC1C,MAAM;SACP,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,aAAa;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CACrB,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,EACzC,IAAI,CAAC,UAAU,CAChB,CAAA;QACD,yEAAyE;QACzE,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAClD,IAAI,CAAC,YAAY,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;YACvB,KAAK,IAAI,CAAC,IAAI,EAAE,CAAA;QAClB,CAAC,EAAE,KAAK,CAAC,CAAA;IACX,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,EAAE,CAAA;YAClB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACzB,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAkB;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAA;IACpC,CAAC;CACF"}

package/dist/sync/index.d.ts

@@ -7,10 +7,13 @@
  * WAS-enabled wallet apps share.
  *
  * - The wire contract and port seam (`WasSyncPort`, `SyncCheckpoint`, `WireDoc`,
- *   `Json`, `DocCipher`, `MasterState`, and the `WasSyncConflictError` /
- *   `WasSyncNotFoundError` / `UnknownEpochError` signals) come from
- *   `@interop/was-client/sync` and are re-exported here so an engine consumer
- *   imports one package.
+ *   `Json`, `DocCipher`, `MasterState`, `WriteAck`, and the
+ *   `WasSyncConflictError` / `WasSyncNotFoundError` / `UnknownEpochError`
+ *   signals) come from `@interop/was-client/sync` and are re-exported here so
+ *   an engine consumer imports one package. The server's `ETag` is opaque and
+ *   carried verbatim on `MasterState.etag` / `WireDoc.etag` / `WriteAck.etag`
+ *   -- a caller echoes it back as a later write's `ifMatch` rather than
+ *   rebuilding it from `version`.
  * - The predicates that classify those signals (`isSyncConflictError` /
  *   `isSyncNotFoundError` / `isUnknownEpochError`) and the `SyncStatus`
  *   vocabulary ship from `@interop/was-client/sync` too. They are imported
@@ -34,10 +37,10 @@
  * the shared core.
  */
 export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '@interop/was-client/sync';
-export type { Json, SyncCheckpoint, WireDoc, MasterState, WasSyncPort, DocCipher } from '@interop/was-client/sync';
+export type { Json, SyncCheckpoint, WireDoc, MasterState, WriteAck, WasSyncPort, DocCipher } from '@interop/was-client/sync';
 export type { SyncStore, SyncedRow, ProjectionAction, ResolveConflict } from './types.js';
 export { runPull, projectionForDoc } from './pull.js';
-export { runPush, formatEtag } from './push.js';
+export { runPush } from './push.js';
 export { remintPendingEnvelopes } from './remint.js';
 export { SyncEngine } from './engine.js';
 export type { SyncEngineDeps } from './engine.js';

package/dist/sync/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,YAAY,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,QAAQ,EACR,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,YAAY,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}