@interop/wallet-core 0.68.0 → 0.70.0

package/dist/descriptors/index.js

@@ -2,51 +2,27 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The `@interop/wallet-core/descriptors` subpath: collection
- * encryption-descriptor acquisition and the unknown-epoch refresh policy --
- * the one implementation of "which key epoch does this collection encrypt
- * under, and when do we ask again" that every wallet replica must share (a
- * drift here does not fail loudly; it fails as a resource one replica cannot
- * decrypt).
+ * The `@interop/wallet-core/descriptors` subpath: the log-governed descriptor
+ * source, the wallet's implementation of `@interop/was-client/edv`'s
+ * `EncryptionDescriptorSource` seam for collections whose encryption
+ * descriptor is governed by a resource log. The acquisition, cache-fallback,
+ * and unknown-epoch refresh policy that source plugs into (`acquireDescriptor`,
+ * `DescriptorRefreshPolicy`, `createRefreshingEdvDocCipher`, and the
+ * `isKeyUnwrapError` matcher) ship from `@interop/was-client/edv`, and this
+ * subpath re-exports none of them: one owner per name.
  *
- * - `EncryptionDescriptorSource` / `EncryptionDescriptorCache` -- the narrow
- *   seams a host implements: one signed Collection Description read, and a
- *   client-local get/put pre-scoped to one account's Space.
- * - `wasDescriptorSource` -- the `EncryptionDescriptorSource` over a
- *   was-client handle.
- * - `acquireDescriptor` / `acquireDescriptors` -- fetch + cache with the
- *   cached fallback whenever the fetch yields no descriptor, thrown or empty
- *   (offline, a collection keeps encrypting under its current epoch; an empty
- *   description is ambiguous, since WAS masks an unauthorized read as an
- *   absent one). No descriptor anywhere means a plaintext collection, or an
- *   encrypted one whose epoch[0] install has not landed -- which a caller that
- *   has declared the collection encrypted must refuse fail-closed. A
- *   log-governed source's refusal classes rethrow instead of falling back
- *   (except a continuity rollback, which is reconcilable divergence).
- * - `logGovernedDescriptorSource` -- the `EncryptionDescriptorSource` for
- *   collections whose descriptor is governed by a resource log: every read
- *   (including the unknown-epoch refresh) re-verifies the log and resolves to
- *   its verified head state, refusing a head that is not a
- *   `WasEpochConfiguration`. It keys each collection's chain-head pin by
- *   `collectionDescriptorLogPinId` over the Space id, the library-named slot
- *   (`space/<spaceId>/key-map/<collectionId>.jsonl`), so no app builds one.
- * - `DescriptorRefreshPolicy` -- the once-per-collection-per-session
- *   unknown-epoch refresh guard, plus the refresh-and-re-read-once wrapper
- *   for hosts whose reads scan rows and count unknown-epoch skips.
- * - `createRefreshingEdvDocCipher` -- `createEdvDocCipher` bound to both: a
- *   cipher that acquires its own descriptor and, on an unknown-epoch decrypt,
- *   re-reads the description, swaps itself, and retries exactly once per
- *   instance.
- * - `isKeyUnwrapError` -- how a host scanning rows tells "not a recipient of
- *   this epoch" from corruption, matched by `err.name` because the cipher is
- *   an injected seam. Its sibling `isUnknownEpochError` ships from
- *   `@interop/was-client/sync`, beside the class it matches. This one stays
- *   here on policy: it classifies a roster-membership failure the wallet
- *   layer owns, and no sync driver dispatches on it.
+ * - `logGovernedDescriptorSource` -- every read (including the unknown-epoch
+ *   refresh) re-verifies the log and resolves to its verified head state,
+ *   refusing a head that is not a `WasEpochConfiguration`. Reads run under the
+ *   collection-descriptor log class, so a ladder-signed append admits on
+ *   `assertionMethod` membership alone. It keys each collection's chain-head
+ *   pin by `collectionDescriptorLogPinId` over the Space id, the library-named
+ *   slot (`space/<spaceId>/<collectionId>/meta/log`, the log's own home), so no
+ *   app builds one. It is the one governed-descriptor reader this subpath
+ *   publishes: the bare-controller read under it
+ *   (`readGovernedEpochConfiguration`, was-client's) states no log class and
+ *   would read a collection log under the roster's license, so it stays
+ *   module-internal.
  */
-export { acquireDescriptor, acquireDescriptors, wasDescriptorSource } from './acquire.js';
-export { collectionDescriptorLogPinId, EPOCH_CONFIGURATION_STATE_TYPE, logGovernedDescriptorSource, readGovernedEpochConfiguration } from './logSource.js';
-export { DescriptorRefreshPolicy } from './refresh.js';
-export { createRefreshingEdvDocCipher } from './cipher.js';
-export { isKeyUnwrapError } from './errors.js';
+export { collectionDescriptorLogPinId, logGovernedDescriptorSource } from './logSource.js';
 //# sourceMappingURL=index.js.map

package/dist/descriptors/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,cAAc,CAAA;AAMrB,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/descriptors/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAA"}

package/dist/descriptors/logSource.d.ts

@@ -12,28 +12,44 @@
  * log rather than adopting whatever the host serves. A verified head whose
  * state is not an epoch configuration is refused fail-closed rather than
  * handed out as a descriptor.
+ *
+ * The log lives at the collection's own `meta/log` sub-resource
+ * (`COLLECTION_HISTORY_LOG_SUBRESOURCE`), inside the URL subtree of the
+ * collection it governs. A share grantee or a connected app already holds a
+ * read capability over that subtree, so the same grant that lets them read
+ * the collection lets them verify its descriptor's history: no second grant,
+ * and no capability over the account's `key-map` collection.
+ *
+ * Reads here run under the collection-descriptor log CLASS: a ladder-signed
+ * append to one of these logs admits on `assertionMethod` membership alone,
+ * the roster's ceremony-tail license binding the roster log only. A reader
+ * that inherited the roster's rule would refuse a served log its own wallet
+ * wrote.
  */
-import type { CollectionEncryption } from '@interop/was-client';
-import { type ResourceLogController, type ResourceLogPinStore, type ResourceLogStore, type VerifiedResourceLog } from '@interop/vh-resource-log';
-import type { EncryptionDescriptorSource } from './acquire.js';
+import { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration, type EncryptionDescriptorSource } from '@interop/was-client/edv';
+import { type ResourceLogPinStore, type ResourceLogStore } from '@interop/vh-resource-log';
+import { type WebvhResourceLogController } from '../resourceLog/index.js';
 /**
- * The state-document schema identifier an encryption descriptor carries in a
- * governed log entry, per WAS-EC.
+ * The governed read boundary and the state-document schema identifier live in
+ * `@interop/was-client/edv` (the pointer-following collection store reads
+ * through the same helper); re-exported here so the roster store and this
+ * module's consumers keep one import site.
  */
-export declare const EPOCH_CONFIGURATION_STATE_TYPE = "WasEpochConfiguration";
+export { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration };
 /**
  * The pin-slot key for a collection's governing descriptor log: the slot a
  * keyed `ResourceLogPinStore` holds that log's chain-head pin under,
- * `space/<spaceId>/key-map/<collectionId>.jsonl`. The library names it, as it
+ * `space/<spaceId>/<collectionId>/meta/log`. The library names it, as it
  * names the account log's (`accountLogPinId`) and the roster's
- * (`userKeyRosterPinId`) slots, so no app builds one of its own: the shape is
- * host-free on purpose -- the Space id is what stays stable across a claimed
- * host move, so a log served from a new host still lands in the same slot and
- * is checked against the held pin rather than opening a fresh
- * trust-on-first-use slate. The resource half mirrors the roster log's home
- * (`key-map/user-key.jsonl`): a governing log lives in the plaintext,
- * capability-gated key-map collection, beside the roster, since a log stored
- * inside the encrypted collection it governs would itself be sealed.
+ * (`userKeyRosterPinId`) slots, so no app builds one of its own.
+ *
+ * The slot follows the log's placement: the log is the collection's own
+ * `meta/log` sub-resource, inside the URL subtree of the collection it
+ * governs, so the read capability a share grantee or a connected app already
+ * holds covers it. The shape is host-free on purpose -- the Space id is what
+ * stays stable across a claimed host move, so a log served from a new host
+ * still lands in the same slot and is checked against the held pin rather
+ * than opening a fresh trust-on-first-use slate.
  *
  * @param options {object}
  * @param options.spaceId {string}   the data Space id
@@ -44,56 +60,29 @@ export declare function collectionDescriptorLogPinId({ spaceId, collectionId }:
     spaceId: string;
     collectionId: string;
 }): string;
-/**
- * The one governed epoch-configuration read: the fail-closed boundary that
- * decides whether a served log state may be treated as an encryption
- * descriptor. Resolves the controller view, reads and fully verifies the log
- * (chain, proofs, external authorization, and the chain-head pin, via
- * `readResourceLog`), and refuses a verified head whose state is not a
- * `WasEpochConfiguration` rather than handing it out as a descriptor.
- * Resolves `null` for an absent log (the pre-genesis state) only while no pin
- * is held for it; under a held pin an absent log is refused as a `rollback`,
- * the library's rule. Both governed
- * descriptor consumers -- the log-governed descriptor source below and the
- * roster's log-governed descriptor store -- read through this helper, so a
- * hardening applied here reaches every trusted descriptor read.
- *
- * @param options {object}
- * @param options.store {ResourceLogStore}   the log's transport seam
- * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
- * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
- *   pin for this log
- * @param options.logId {string}   the pin-slot key for this log, from
- *   `resourceLogPinId`
- * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; etag?: string } | null>}
- */
-export declare function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }: {
-    store: ResourceLogStore;
-    resolveController: () => Promise<ResourceLogController>;
-    pinStore: ResourceLogPinStore;
-    logId: string;
-}): Promise<{
-    verified: VerifiedResourceLog;
-    descriptor: CollectionEncryption;
-    etag?: string;
-} | null>;
 /**
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
  * logs. An absent log resolves `undefined` exactly like an absent
  * Collection Description `encryption` member (a plaintext collection, or one
  * whose provisioning has not landed), unless a pin is held for it, in which
  * case the read refuses as a `rollback`; verification failures throw through --
- * {@link acquireDescriptor} rethrows the refusal classes rather than falling
- * back to the cache.
+ * was-client's `acquireDescriptor` rethrows the refusal classes rather than
+ * falling back to the cache.
+ *
+ * Every read runs under the collection-descriptor log class
+ * ({@link controllerForLogClass}), so a ladder-signed append verifies on
+ * `assertionMethod` membership alone. Without that narrowing a reader would
+ * inherit the roster's ceremony-tail license and refuse a served log its own
+ * wallet's standing credential wrote.
  *
  * @param options {object}
  * @param options.logFor {function}   `(collectionId) => ResourceLogStore` --
- *   the collection's governing log's transport seam
+ *   the collection's governing log's transport seam (was-client's
+ *   `resourceLogStore({ collection })` over the collection's `meta/log`)
  * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view, resolved per operation and narrowed here to
+ *   this log class
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pins, keyed per log; each collection's slot is
  *   {@link collectionDescriptorLogPinId} over `spaceId`
@@ -102,7 +91,7 @@ export declare function readGovernedEpochConfiguration({ store, resolveControlle
  */
 export declare function logGovernedDescriptorSource({ logFor, resolveController, pinStore, spaceId }: {
     logFor: (collectionId: string) => ResourceLogStore;
-    resolveController: () => Promise<ResourceLogController>;
+    resolveController: () => Promise<WebvhResourceLogController>;
     pinStore: ResourceLogPinStore;
     spaceId: string;
 }): EncryptionDescriptorSource;

package/dist/descriptors/logSource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE/D,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D;;;GAGG;AACH,eAAO,MAAM,8BAA8B,0BAA0B,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACN,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,IAAI,CAAC,CAwBR;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACR,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACvD,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAe7B"}
+{"version":3,"file":"logSource.d.ts","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EACR,EAAE;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,gBAAgB,CAAA;IAClD,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,0BAA0B,CAmB7B"}

package/dist/descriptors/logSource.js

@@ -1,24 +1,55 @@
-import { RESOURCE_LOG_METHOD } from '@interop/storage-core';
-import { readResourceLog, ResourceLogIntegrityError, resourceLogPinId } from '@interop/vh-resource-log';
-import { KEY_MAP_COLLECTION } from '../space/collections.js';
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The log-governed {@link EncryptionDescriptorSource}: descriptor acquisition
+ * for a collection whose encryption descriptor is governed by a resource log
+ * (the Resource Log Profile) rather than by its Collection Description. Every
+ * read -- including the unknown-epoch refresh's re-read -- resolves to the
+ * log's VERIFIED head state: chain, proofs, external authorization against
+ * the independently verified controller document, and the chain-head pin all
+ * checked before any descriptor is handed out, so a refresh re-verifies the
+ * log rather than adopting whatever the host serves. A verified head whose
+ * state is not an epoch configuration is refused fail-closed rather than
+ * handed out as a descriptor.
+ *
+ * The log lives at the collection's own `meta/log` sub-resource
+ * (`COLLECTION_HISTORY_LOG_SUBRESOURCE`), inside the URL subtree of the
+ * collection it governs. A share grantee or a connected app already holds a
+ * read capability over that subtree, so the same grant that lets them read
+ * the collection lets them verify its descriptor's history: no second grant,
+ * and no capability over the account's `key-map` collection.
+ *
+ * Reads here run under the collection-descriptor log CLASS: a ladder-signed
+ * append to one of these logs admits on `assertionMethod` membership alone,
+ * the roster's ceremony-tail license binding the roster log only. A reader
+ * that inherited the roster's rule would refuse a served log its own wallet
+ * wrote.
+ */
+import { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration } from '@interop/was-client/edv';
+import { collectionLogPinId } from '@interop/vh-resource-log';
+import { controllerForLogClass } from '../resourceLog/index.js';
 /**
- * The state-document schema identifier an encryption descriptor carries in a
- * governed log entry, per WAS-EC.
+ * The governed read boundary and the state-document schema identifier live in
+ * `@interop/was-client/edv` (the pointer-following collection store reads
+ * through the same helper); re-exported here so the roster store and this
+ * module's consumers keep one import site.
  */
-export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
+export { EPOCH_CONFIGURATION_STATE_TYPE, readGovernedEpochConfiguration };
 /**
  * The pin-slot key for a collection's governing descriptor log: the slot a
  * keyed `ResourceLogPinStore` holds that log's chain-head pin under,
- * `space/<spaceId>/key-map/<collectionId>.jsonl`. The library names it, as it
+ * `space/<spaceId>/<collectionId>/meta/log`. The library names it, as it
  * names the account log's (`accountLogPinId`) and the roster's
- * (`userKeyRosterPinId`) slots, so no app builds one of its own: the shape is
- * host-free on purpose -- the Space id is what stays stable across a claimed
- * host move, so a log served from a new host still lands in the same slot and
- * is checked against the held pin rather than opening a fresh
- * trust-on-first-use slate. The resource half mirrors the roster log's home
- * (`key-map/user-key.jsonl`): a governing log lives in the plaintext,
- * capability-gated key-map collection, beside the roster, since a log stored
- * inside the encrypted collection it governs would itself be sealed.
+ * (`userKeyRosterPinId`) slots, so no app builds one of its own.
+ *
+ * The slot follows the log's placement: the log is the collection's own
+ * `meta/log` sub-resource, inside the URL subtree of the collection it
+ * governs, so the read capability a share grantee or a connected app already
+ * holds covers it. The shape is host-free on purpose -- the Space id is what
+ * stays stable across a claimed host move, so a log served from a new host
+ * still lands in the same slot and is checked against the held pin rather
+ * than opening a fresh trust-on-first-use slate.
  *
  * @param options {object}
  * @param options.spaceId {string}   the data Space id
@@ -26,59 +57,7 @@ export const EPOCH_CONFIGURATION_STATE_TYPE = 'WasEpochConfiguration';
  * @returns {string}
  */
 export function collectionDescriptorLogPinId({ spaceId, collectionId }) {
-    return resourceLogPinId({
-        spaceId,
-        collectionId: KEY_MAP_COLLECTION.id,
-        resourceId: `${collectionId}.jsonl`
-    });
-}
-/**
- * The one governed epoch-configuration read: the fail-closed boundary that
- * decides whether a served log state may be treated as an encryption
- * descriptor. Resolves the controller view, reads and fully verifies the log
- * (chain, proofs, external authorization, and the chain-head pin, via
- * `readResourceLog`), and refuses a verified head whose state is not a
- * `WasEpochConfiguration` rather than handing it out as a descriptor.
- * Resolves `null` for an absent log (the pre-genesis state) only while no pin
- * is held for it; under a held pin an absent log is refused as a `rollback`,
- * the library's rule. Both governed
- * descriptor consumers -- the log-governed descriptor source below and the
- * roster's log-governed descriptor store -- read through this helper, so a
- * hardening applied here reaches every trusted descriptor read.
- *
- * @param options {object}
- * @param options.store {ResourceLogStore}   the log's transport seam
- * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
- * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
- *   pin for this log
- * @param options.logId {string}   the pin-slot key for this log, from
- *   `resourceLogPinId`
- * @returns {Promise<{ verified: VerifiedResourceLog; descriptor: CollectionEncryption; etag?: string } | null>}
- */
-export async function readGovernedEpochConfiguration({ store, resolveController, pinStore, logId }) {
-    const controller = await resolveController();
-    const current = await readResourceLog({
-        store,
-        controller,
-        expectedMethod: RESOURCE_LOG_METHOD,
-        pinStore,
-        logId
-    });
-    if (current === null) {
-        return null;
-    }
-    const state = current.verified.state;
-    if (state.type !== EPOCH_CONFIGURATION_STATE_TYPE) {
-        throw new ResourceLogIntegrityError(`The governed descriptor log carries state of type ` +
-            `"${state.type}", not "${EPOCH_CONFIGURATION_STATE_TYPE}".`);
-    }
-    return {
-        verified: current.verified,
-        descriptor: state,
-        etag: current.etag
-    };
+    return collectionLogPinId({ spaceId, collectionId });
 }
 /**
  * Builds the {@link EncryptionDescriptorSource} over per-collection resource
@@ -86,15 +65,23 @@ export async function readGovernedEpochConfiguration({ store, resolveController,
  * Collection Description `encryption` member (a plaintext collection, or one
  * whose provisioning has not landed), unless a pin is held for it, in which
  * case the read refuses as a `rollback`; verification failures throw through --
- * {@link acquireDescriptor} rethrows the refusal classes rather than falling
- * back to the cache.
+ * was-client's `acquireDescriptor` rethrows the refusal classes rather than
+ * falling back to the cache.
+ *
+ * Every read runs under the collection-descriptor log class
+ * ({@link controllerForLogClass}), so a ladder-signed append verifies on
+ * `assertionMethod` membership alone. Without that narrowing a reader would
+ * inherit the roster's ceremony-tail license and refuse a served log its own
+ * wallet's standing credential wrote.
  *
  * @param options {object}
  * @param options.logFor {function}   `(collectionId) => ResourceLogStore` --
- *   the collection's governing log's transport seam
+ *   the collection's governing log's transport seam (was-client's
+ *   `resourceLogStore({ collection })` over the collection's `meta/log`)
  * @param options.resolveController {function}
- *   `() => Promise<ResourceLogController>` -- the caller's currently verified
- *   controller view, resolved per operation
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view, resolved per operation and narrowed here to
+ *   this log class
  * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
  *   pins, keyed per log; each collection's slot is
  *   {@link collectionDescriptorLogPinId} over `spaceId`
@@ -106,7 +93,10 @@ export function logGovernedDescriptorSource({ logFor, resolveController, pinStor
         async collectionEncryption({ collectionId }) {
             const current = await readGovernedEpochConfiguration({
                 store: logFor(collectionId),
-                resolveController,
+                resolveController: async () => controllerForLogClass({
+                    controller: await resolveController(),
+                    logClass: 'collection-descriptor'
+                }),
                 pinStore,
                 logId: collectionDescriptorLogPinId({ spaceId, collectionId })
             });

package/dist/descriptors/logSource.js.map

@@ -1 +1 @@
-{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAKjB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAA;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EAIb;IACC,OAAO,gBAAgB,CAAC;QACtB,OAAO;QACP,YAAY,EAAE,kBAAkB,CAAC,EAAE;QACnC,UAAU,EAAE,GAAG,YAAY,QAAQ;KACpC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EACnD,KAAK,EACL,iBAAiB,EACjB,QAAQ,EACR,KAAK,EAMN;IAKC,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;QACpC,KAAK;QACL,UAAU;QACV,cAAc,EAAE,mBAAmB;QACnC,QAAQ;QACR,KAAK;KACN,CAAC,CAAA;IACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAA;IACpC,IAAI,KAAK,CAAC,IAAI,KAAK,8BAA8B,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CACjC,oDAAoD;YAClD,IAAI,KAAK,CAAC,IAAI,WAAW,8BAA8B,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,KAA6B;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EAMR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB;gBACjB,QAAQ;gBACR,KAAK,EAAE,4BAA4B,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC/D,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"logSource.js","sourceRoot":"","sources":["../../src/descriptors/logSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAE/B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,kBAAkB,EAGnB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,qBAAqB,EAEtB,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,OAAO,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,OAAO,EACP,YAAY,EAIb;IACC,OAAO,kBAAkB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,OAAO,EAMR;IACC,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,YAAY,EAAE;YACzC,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3B,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC5B,qBAAqB,CAAC;oBACpB,UAAU,EAAE,MAAM,iBAAiB,EAAE;oBACrC,QAAQ,EAAE,uBAAuB;iBAClC,CAAC;gBACJ,QAAQ;gBACR,KAAK,EAAE,4BAA4B,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC/D,CAAC,CAAA;YACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,OAAO,CAAC,UAAU,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/enrollment/connectCode.d.ts

@@ -7,9 +7,10 @@
  *
  * It is a leaf module deliberately. Recognizing a connect code is something a
  * paste box or a QR scanner does long before any ceremony machinery is
- * involved, so the input classifier can depend on this without pulling in the
- * enrollment ceremony's whole graph -- and there is still exactly one spelling
- * of the prefix in the codebase.
+ * involved: {@link isConnectCode} is the recognizer a wallet hands
+ * `@interop/wallet-request`'s input classifier for its `connect-code` branch,
+ * and importing it here pulls in none of the enrollment ceremony's graph --
+ * while there is still exactly one spelling of the prefix in the codebase.
  */
 /**
  * The connect-code prefix; the payload after it is base64url(JSON) of an

package/dist/enrollment/connectCode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connectCode.d.ts","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}
+{"version":3,"file":"connectCode.d.ts","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/enrollment/connectCode.js

@@ -7,9 +7,10 @@
  *
  * It is a leaf module deliberately. Recognizing a connect code is something a
  * paste box or a QR scanner does long before any ceremony machinery is
- * involved, so the input classifier can depend on this without pulling in the
- * enrollment ceremony's whole graph -- and there is still exactly one spelling
- * of the prefix in the codebase.
+ * involved: {@link isConnectCode} is the recognizer a wallet hands
+ * `@interop/wallet-request`'s input classifier for its `connect-code` branch,
+ * and importing it here pulls in none of the enrollment ceremony's graph --
+ * while there is still exactly one spelling of the prefix in the codebase.
  */
 /**
  * The connect-code prefix; the payload after it is base64url(JSON) of an

package/dist/enrollment/connectCode.js.map

@@ -1 +1 @@
-{"version":3,"file":"connectCode.js","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAA;AACpD,CAAC"}
+{"version":3,"file":"connectCode.js","sourceRoot":"","sources":["../../src/enrollment/connectCode.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAA;AACpD,CAAC"}

package/dist/enrollment/index.d.ts

@@ -19,11 +19,11 @@
  * - `encodeOnboardingResponse` / `parseOnboardingResponse` -- the onboarding-
  *   response envelope, the transport that carries a connect code (verbatim)
  *   plus a suggested display label back over an exchange whose request asked
- *   with a `WalletOnboardingQuery` (`@interop/wallet-core/request`).
+ *   with a `WalletOnboardingQuery` (`@interop/wallet-request`).
  * - `ONBOARDING_INVITE_TTL_MS` -- how long a wallet offers an invite for. The
  *   invite's transport (creating the ephemeral exchange that carries the
  *   query, polling it until the envelope arrives) is the generic requester in
- *   `@interop/wallet-core/request` (`createEphemeralExchange` /
+ *   `@interop/wallet-request` (`createEphemeralExchange` /
  *   `pollEphemeralExchange`).
  * - `completeEnrollmentCore` -- the enrollee's half: verify from the published
  *   log, read the roster, hand back the user key and the epoch to pin. Persisting

package/dist/enrollment/index.js

@@ -19,11 +19,11 @@
  * - `encodeOnboardingResponse` / `parseOnboardingResponse` -- the onboarding-
  *   response envelope, the transport that carries a connect code (verbatim)
  *   plus a suggested display label back over an exchange whose request asked
- *   with a `WalletOnboardingQuery` (`@interop/wallet-core/request`).
+ *   with a `WalletOnboardingQuery` (`@interop/wallet-request`).
  * - `ONBOARDING_INVITE_TTL_MS` -- how long a wallet offers an invite for. The
  *   invite's transport (creating the ephemeral exchange that carries the
  *   query, polling it until the envelope arrives) is the generic requester in
- *   `@interop/wallet-core/request` (`createEphemeralExchange` /
+ *   `@interop/wallet-request` (`createEphemeralExchange` /
  *   `pollEphemeralExchange`).
  * - `completeEnrollmentCore` -- the enrollee's half: verify from the published
  *   log, read the roster, hand back the user key and the epoch to pin. Persisting

package/dist/enrollment/onboardingInvite.d.ts

@@ -4,7 +4,7 @@
 /**
  * The wallet-onboarding invite's one policy constant. The invite's transport
  * is the generic ephemeral-exchange requester in
- * `@interop/wallet-core/request` (`createEphemeralExchange` /
+ * `@interop/wallet-request` (`createEphemeralExchange` /
  * `pollEphemeralExchange`); what stays here is how long a wallet offers the
  * invite for.
  */

package/dist/enrollment/onboardingInvite.js

@@ -4,7 +4,7 @@
 /**
  * The wallet-onboarding invite's one policy constant. The invite's transport
  * is the generic ephemeral-exchange requester in
- * `@interop/wallet-core/request` (`createEphemeralExchange` /
+ * `@interop/wallet-request` (`createEphemeralExchange` /
  * `pollEphemeralExchange`); what stays here is how long a wallet offers the
  * invite for.
  */

package/dist/enrollment/onboardingResponse.js

@@ -4,7 +4,7 @@
 /**
  * The onboarding-response envelope: what a fresh wallet (the enrollee) POSTs
  * back to an ephemeral exchange whose request carried a
- * `WalletOnboardingQuery` (`@interop/wallet-core/request`). It is transport
+ * `WalletOnboardingQuery` (`@interop/wallet-request`). It is transport
  * vocabulary only -- the enrollment ceremony is untouched.
  *
  * The envelope carries an ordinary connect code VERBATIM as its payload, so

package/dist/genesis/accountGenesis.d.ts

@@ -185,6 +185,15 @@ export interface AccountGenesisResult {
  *   EncryptionDescriptorStore` -- builds the user-key roster's descriptor
  *   store once the account DID is known (the log-governed store's controller
  *   view and chain-head pin are the app's wiring)
+ * @param options.collectionStoreFor {Function}   `({ did }) =>
+ *   (collectionId: string) => EncryptionDescriptorStore` -- builds each
+ *   encrypted collection's descriptor store once the account DID is known,
+ *   the same wiring the roster's builder takes. It is handed `did` alone,
+ *   since this ceremony's did:webvh stage returns only that: an app whose
+ *   store resolves a controller view builds it from the published log it
+ *   fetches itself (`webvhResourceLogController` over a `verifyAccountLog`
+ *   result), unlike the credential-anchored genesis, which hands its own
+ *   head through
  * @param [options.provideKmsAuthentication] {Function}   `({ spaceReady }) =>
  *   Promise<KmsAuthenticationBinding | undefined>` -- the KMS authentication
  *   binding's acquisition; absent or resolving `undefined`, the genesis is
@@ -218,7 +227,7 @@ export interface AccountGenesisResult {
  *   genesis emits at the same point
  * @returns {Promise<AccountGenesisResult>}
  */
-export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController, onStage }: {
+export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, collectionStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController, onStage }: {
     was: WasClient;
     wasAsClient?: WasClient;
     wasServerUrl: string;
@@ -231,6 +240,9 @@ export declare function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, s
     rosterStoreFor: (options: {
         did: string;
     }) => EncryptionDescriptorStore;
+    collectionStoreFor: (options: {
+        did: string;
+    }) => (collectionId: string) => EncryptionDescriptorStore;
     provideKmsAuthentication?: (options: {
         spaceReady: Promise<unknown>;
     }) => Promise<KmsAuthenticationBinding | undefined>;

package/dist/genesis/accountGenesis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accountGenesis.d.ts","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAQ7D;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1B,UAAU,EAAE,qBAAqB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAQhE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8BpC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE;CAQzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC7B,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,MAAM,CAAC,EAAE,uBAAuB,CAAA;IAChC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAA;IAClD,SAAS,CAAC,EAAE,wBAAwB,CAAA;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAwB,EACxB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,qBAAqB,CAAA;IACjC,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoIhC"}
+{"version":3,"file":"accountGenesis.d.ts","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAGpE,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAQ7D;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC1B,UAAU,EAAE,qBAAqB,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAQhE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8BpC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE;CAQzD;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC7B,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IACvC,MAAM,CAAC,EAAE,uBAAuB,CAAA;IAChC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAA;IAClD,SAAS,CAAC,EAAE,wBAAwB,CAAA;IACpC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAwB,EACxB,OAAO,EACR,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,WAAW,CAAC,EAAE,SAAS,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,qBAAqB,EAAE,gBAAgB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,qBAAqB,CAAA;IACjC,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,kBAAkB,EAAE,CAAC,OAAO,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,yBAAyB,CAAA;IACzD,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE;QACnC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;KAC7B,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAA;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoIhC"}

package/dist/genesis/accountGenesis.js

@@ -184,6 +184,15 @@ export class AccountGenesisSpaceError extends Error {
  *   EncryptionDescriptorStore` -- builds the user-key roster's descriptor
  *   store once the account DID is known (the log-governed store's controller
  *   view and chain-head pin are the app's wiring)
+ * @param options.collectionStoreFor {Function}   `({ did }) =>
+ *   (collectionId: string) => EncryptionDescriptorStore` -- builds each
+ *   encrypted collection's descriptor store once the account DID is known,
+ *   the same wiring the roster's builder takes. It is handed `did` alone,
+ *   since this ceremony's did:webvh stage returns only that: an app whose
+ *   store resolves a controller view builds it from the published log it
+ *   fetches itself (`webvhResourceLogController` over a `verifyAccountLog`
+ *   result), unlike the credential-anchored genesis, which hands its own
+ *   head through
  * @param [options.provideKmsAuthentication] {Function}   `({ spaceReady }) =>
  *   Promise<KmsAuthenticationBinding | undefined>` -- the KMS authentication
  *   binding's acquisition; absent or resolving `undefined`, the genesis is
@@ -217,7 +226,7 @@ export class AccountGenesisSpaceError extends Error {
  *   genesis emits at the same point
  * @returns {Promise<AccountGenesisResult>}
  */
-export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController = true, onStage }) {
+export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spaceId, keyAgent, clientKeyAgreementKey, userKey, updateKeys, idStore, rosterStoreFor, collectionStoreFor, provideKmsAuthentication, expectedDid, onDidPublished, promoteController = true, onStage }) {
     const failed = [];
     const stage = stageNotifier(onStage);
     // 1. The Space and its collection roster, create-if-absent under this
@@ -303,7 +312,7 @@ export async function ensureAccountGenesis({ was, wasAsClient, wasServerUrl, spa
     if (rosterDescriptor) {
         try {
             const fanOut = await ensureWalletSpaceEpochs({
-                was,
+                storeFor: collectionStoreFor({ did }),
                 spaceId,
                 userKey,
                 rosterDescriptor