@interop/wallet-core 0.68.0 → 0.70.0

package/dist/genesis/accountGenesis.js.map

@@ -1 +1 @@
-{"version":3,"file":"accountGenesis.js","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAK5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,yBAAyB,EAM1B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAsB,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AAkBzB;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,cAAc,CAAC,MAAM,CAC1B,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO;QACL,OAAO,EAAE,WAAW,EAAE;QACtB,UAAU;QACV,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,UAAU,EAAE,yBAAyB,EAAE;KACxC,CAAA;AACH,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EAMJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACnC,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;QACF,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,oEAAoE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,WAAW;SACd,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAA4C;QACtD,KAAK,CACH,kCAAkC,OAAO,CAAC,OAAO,YAAY;YAC3D,+CAA+C,EACjD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAoDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAiB,GAAG,IAAI,EACxB,OAAO,EAmBR;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,aAAa,CAAkC,OAAO,CAAC,CAAA;IAErE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,GAAG;QACH,OAAO;QACP,aAAa,EAAE,QAAQ,CAAC,EAAE;KAC3B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,6BAA6B;IAC7B,MAAM,GAAG,GAAG,sBAAsB,CAAC;QACjC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU;KACX,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAA;IAElD,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,qBAAmE,CAAA;IACrE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QACnC,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI;YACnD,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI;SAC7C,CAAC;QACF,UAAU,EAAE;YACV,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC5D,wBAAwB;SACzB;QACD,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,kBAAkB;IAClB,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,GAAG;gBACH,OAAO;gBACP,OAAO;gBACP,gBAAgB;aACjB,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,aAAa,GAAG,MAAM,CAAC,OAAO,CAAA;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAA;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,SAA+C,CAAA;IACnD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"accountGenesis.js","sourceRoot":"","sources":["../../src/genesis/accountGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAK5C,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,yBAAyB,EAM1B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAsB,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAA;AAkBzB;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,cAAc,CAAC,MAAM,CAC1B,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO;QACL,OAAO,EAAE,WAAW,EAAE;QACtB,UAAU;QACV,OAAO,EAAE,MAAM,WAAW,EAAE;QAC5B,UAAU,EAAE,yBAAyB,EAAE;KACxC,CAAA;AACH,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,EAClD,GAAG,EACH,WAAW,EACX,OAAO,EACP,GAAG,EAMJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC1C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YACnC,OAAO,WAAW,CAAA;QACpB,CAAC;QACD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC;YACpB,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,iBAAiB;YACvB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;QACF,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,oEAAoE;YACpE,uBAAuB,CAC1B,CAAA;IACH,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,WAAW;SACd,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IAC1D,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAA4C;QACtD,KAAK,CACH,kCAAkC,OAAO,CAAC,OAAO,YAAY;YAC3D,+CAA+C,EACjD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAoDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,GAAG,EACH,WAAW,EACX,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,qBAAqB,EACrB,OAAO,EACP,UAAU,EACV,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,iBAAiB,GAAG,IAAI,EACxB,OAAO,EAsBR;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,KAAK,GAAG,aAAa,CAAkC,OAAO,CAAC,CAAA;IAErE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,GAAG;QACH,OAAO;QACP,aAAa,EAAE,QAAQ,CAAC,EAAE;KAC3B,CAAC,CAAA;IAEF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,6BAA6B;IAC7B,MAAM,GAAG,GAAG,sBAAsB,CAAC;QACjC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,UAAU;KACX,CAAC,CAAA;IAEF,IAAI,CAAC;QACH,MAAM,UAAU,CAAA;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,iBAAiB,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1C,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC/B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAA;IAElD,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,GACpD,qBAAmE,CAAA;IACrE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QACnC,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI;YACnD,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI;SAC7C,CAAC;QACF,UAAU,EAAE;YACV,mBAAmB,EAAE,yBAAyB,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC5D,wBAAwB;SACzB;QACD,UAAU;QACV,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,0EAA0E;IAC1E,0EAA0E;IAC1E,oCAAoC;IACpC,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;YAC3C,KAAK,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO;YACP,qBAAqB;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,kBAAkB;IAClB,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,QAAQ,EAAE,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,OAAO;gBACP,OAAO;gBACP,gBAAgB;aACjB,CAAC,CAAA;YACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,aAAa,GAAG,MAAM,CAAC,OAAO,CAAA;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAA;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,SAA+C,CAAA;IACnD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/identity/index.d.ts

@@ -16,7 +16,7 @@
  *   app-side derivations such as a keyring unlock identity).
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
- * x25519 dependency graph (the same isolation pattern as `./request`).
+ * x25519 dependency graph.
  */
 export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed, zcapClientForSigner } from './agents.js';
 export type { ProfileAgents } from './agents.js';

package/dist/identity/index.js

@@ -16,7 +16,7 @@
  *   app-side derivations such as a keyring unlock identity).
  *
  * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
- * x25519 dependency graph (the same isolation pattern as `./request`).
+ * x25519 dependency graph.
  */
 export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed, zcapClientForSigner } from './agents.js';
 export { singleKeyResolver } from './keyResolver.js';

package/dist/index.d.ts

@@ -10,10 +10,6 @@
  * - `@interop/wallet-core/identity` -- the WAS identity derivation
  *   (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
  *   apps must perform byte-for-byte identically.
- * - `@interop/wallet-core/request` -- wallet-request / exchange protocol
- *   handling (classification and parsing, QueryByExample matching, cryptosuite
- *   negotiation, VP composition, the VC-API exchange client, and VCALM
- *   `interaction:` URL handling).
  * - `@interop/wallet-core/webvh` -- the account's did:webvh identity: the
  *   hosted DID log, its per-client update-key rotation, the client enrollment
  *   entries, and ZCap signing under the did:webvh verification-method id.
@@ -40,10 +36,10 @@
  * re-implementing its swallow.
  *
  * This root re-exports `sync` and `space` for convenience. `identity`,
- * `request`, `webvh`, `keys`, `descriptors`, `keyring`,
- * `enrollment`, and `recovery` are deliberately NOT re-exported here, so
- * plaintext consumers of the root never pull the signing / KMS /
- * document-loader dependency graph (the was-client subpath-isolation pattern).
+ * `webvh`, `keys`, `descriptors`, `keyring`, `enrollment`, and `recovery`
+ * are deliberately NOT re-exported here, so plaintext consumers of the root
+ * never pull the signing / KMS dependency graph (the was-client
+ * subpath-isolation pattern).
  */
 export * from './sync/index.js';
 export * from './space/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACnD,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACnD,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -10,10 +10,6 @@
  * - `@interop/wallet-core/identity` -- the WAS identity derivation
  *   (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
  *   apps must perform byte-for-byte identically.
- * - `@interop/wallet-core/request` -- wallet-request / exchange protocol
- *   handling (classification and parsing, QueryByExample matching, cryptosuite
- *   negotiation, VP composition, the VC-API exchange client, and VCALM
- *   `interaction:` URL handling).
  * - `@interop/wallet-core/webvh` -- the account's did:webvh identity: the
  *   hosted DID log, its per-client update-key rotation, the client enrollment
  *   entries, and ZCap signing under the did:webvh verification-method id.
@@ -40,10 +36,10 @@
  * re-implementing its swallow.
  *
  * This root re-exports `sync` and `space` for convenience. `identity`,
- * `request`, `webvh`, `keys`, `descriptors`, `keyring`,
- * `enrollment`, and `recovery` are deliberately NOT re-exported here, so
- * plaintext consumers of the root never pull the signing / KMS /
- * document-loader dependency graph (the was-client subpath-isolation pattern).
+ * `webvh`, `keys`, `descriptors`, `keyring`, `enrollment`, and `recovery`
+ * are deliberately NOT re-exported here, so plaintext consumers of the root
+ * never pull the signing / KMS dependency graph (the was-client
+ * subpath-isolation pattern).
  */
 export * from './sync/index.js';
 export * from './space/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA"}

package/dist/keyring/kdf.d.ts

@@ -10,18 +10,24 @@ import type { RecordSigner } from './record.js';
 export declare const UNLOCK_HANDLE = "unlock";
 export declare const UNLOCK_KEY_NAME = "unlock-key";
 /**
- * Unlock-derivation parameters, one variant per KDF family: PBKDF2 stretches
- * a low-entropy passphrase; HKDF expands already-uniform key material (e.g. a
- * passkey PRF output). Each unlock method pins its own parameter set -- and
- * its own salt, so two methods can never derive the same unlock identity.
- * The `version` records which parameter set produced a derivation; the
- * keyring record's own `version` is stamped separately.
+ * Unlock-derivation parameters, one variant per KDF family: Argon2id
+ * (memory-hard) stretches a low-entropy passphrase; HKDF expands
+ * already-uniform key material (e.g. a passkey PRF output). Each unlock method
+ * pins its own parameter set -- and its own salt, so two methods can never
+ * derive the same unlock identity. The `version` is one counter per unlock
+ * method, recording which parameter set produced that method's derivation;
+ * the keyring record's own `version` is stamped separately.
+ *
+ * The Argon2id arm carries no `hash` member: Argon2 fixes Blake2b internally.
+ * `memory` is in KiB (RFC 9106's and noble's unit); the RFC's `m` / `t` / `p`
+ * are named `memory` / `passes` / `parallelism`.
  */
 export type UnlockKdf = {
     version: number;
-    algorithm: 'PBKDF2';
-    iterations: number;
-    hash: string;
+    algorithm: 'Argon2id';
+    memory: number;
+    passes: number;
+    parallelism: number;
     salt: string;
 } | {
     version: number;
@@ -31,20 +37,28 @@ export type UnlockKdf = {
     info: string;
 };
 /**
- * PBKDF2 parameters for the passphrase unlock derivation
- * (`unlockSeed = PBKDF2(passphrase)`). Version 1 pins exactly these
- * parameters; the keyring record's `version` field records which set produced
- * it, so changing any of them (iterations, hash, salt) requires minting a new
- * record version rather than silently breaking existing unlock derivations.
- * The salt is a fixed app-wide constant -- login stays passphrase-only, with
- * no email (or other) input mixed into the derivation. Every unlock method's
- * KDF carries a distinct salt, so two methods can never derive the same
- * unlock Space.
+ * Argon2id parameters for the passphrase unlock derivation
+ * (`unlockSeed = Argon2id(passphrase)`): 64 MiB of memory, 3 passes,
+ * parallelism 1, a 32-byte tag. The memory and pass counts are those of RFC
+ * 9106 section 4's second recommended option (m = 64 MiB, t = 3, p = 4); the
+ * parallelism is a deliberate departure from that option's four lanes. It
+ * stays 1 because noble is single-threaded, so a higher value changes the
+ * bytes and buys no speed. Passphrase version 2 pins exactly
+ * these parameters; version 1 was PBKDF2-600k over SHA-256 under the salt
+ * `freewallet/keyring/unlock/v1`, and it was replaced outright rather than
+ * kept beside this set, so a passphrase bound under it no longer addresses
+ * its unlock Space. The KDF's own `version` is what records the parameter
+ * set: the keyring record's frame version is unchanged, since a record cannot
+ * be read before its derivation has already succeeded, so a version inside it
+ * could never steer a lookup. The salt is a fixed app-wide constant -- login
+ * stays passphrase-only, with no email (or other) input mixed into the
+ * derivation. Every unlock method's KDF carries a distinct salt, so two
+ * methods can never derive the same unlock Space.
  */
 export declare const KEYRING_KDF: UnlockKdf;
 /**
  * Derives the 32-byte unlock seed from an unlock secret, branching on the KDF
- * family: PBKDF2 stretches a passphrase, HKDF expands already-uniform key
+ * family: Argon2id stretches a passphrase, HKDF expands already-uniform key
  * material such as a passkey PRF output.
  *
  * Exported for the standing-credential derivation (`unlock/standingClient`):

package/dist/keyring/kdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAQ3C;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,QAAQ,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAEL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,SAMzB,CAAA;AAmBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,cAAc,CAAC,CAG1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4B1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,IAAI,CAC1C,aAAa,EACb,YAAY,GAAG,iBAAiB,GAAG,aAAa,CACjD;IACC,KAAK,EAAE,eAAe,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB"}
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAKxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AACrC,eAAO,MAAM,eAAe,eAAe,CAAA;AAQ3C;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GACjB;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,UAAU,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;CACb,GACD;IACE,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAEL;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,WAAW,EAAE,SAOzB,CAAA;AAoBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EACJ,EAAE;IACD,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;IAC3B,GAAG,EAAE,SAAS,CAAA;CACf,GAAG,OAAO,CAAC,cAAc,CAAC,CAG1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4B1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,IAAI,CAC1C,aAAa,EACb,YAAY,GAAG,iBAAiB,GAAG,aAAa,CACjD;IACC,KAAK,EAAE,eAAe,CAAA;IACtB,YAAY,EAAE,YAAY,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/dist/keyring/kdf.js

@@ -12,13 +12,13 @@
  * output for the same secret and parameter set, or the same passphrase would
  * address two different unlock Spaces. It is therefore implemented over
  * `@noble/hashes` rather than WebCrypto's `crypto.subtle.deriveBits`, which
- * React Native does not provide; PBKDF2 and HKDF are both fully specified
- * (RFC 8018 / RFC 5869), so the two implementations agree bit for bit.
+ * React Native does not provide; Argon2id and HKDF are both fully specified
+ * (RFC 9106 / RFC 5869), so any two implementations agree bit for bit.
  */
 import { deriveSpaceId } from '@interop/was-client/sync';
 import { CapabilityAgent } from '@interop/webkms-client';
+import { argon2idAsync } from '@noble/hashes/argon2.js';
 import { hkdf } from '@noble/hashes/hkdf.js';
-import { pbkdf2Async } from '@noble/hashes/pbkdf2.js';
 import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import { agentsFromKeyAgent } from '../identity/agents.js';
 import { recordSignerFromAgent } from './record.js';
@@ -36,26 +36,36 @@ export const UNLOCK_KEY_NAME = 'unlock-key';
  */
 const UNLOCK_SEED_BYTES = 32;
 /**
- * PBKDF2 parameters for the passphrase unlock derivation
- * (`unlockSeed = PBKDF2(passphrase)`). Version 1 pins exactly these
- * parameters; the keyring record's `version` field records which set produced
- * it, so changing any of them (iterations, hash, salt) requires minting a new
- * record version rather than silently breaking existing unlock derivations.
- * The salt is a fixed app-wide constant -- login stays passphrase-only, with
- * no email (or other) input mixed into the derivation. Every unlock method's
- * KDF carries a distinct salt, so two methods can never derive the same
- * unlock Space.
+ * Argon2id parameters for the passphrase unlock derivation
+ * (`unlockSeed = Argon2id(passphrase)`): 64 MiB of memory, 3 passes,
+ * parallelism 1, a 32-byte tag. The memory and pass counts are those of RFC
+ * 9106 section 4's second recommended option (m = 64 MiB, t = 3, p = 4); the
+ * parallelism is a deliberate departure from that option's four lanes. It
+ * stays 1 because noble is single-threaded, so a higher value changes the
+ * bytes and buys no speed. Passphrase version 2 pins exactly
+ * these parameters; version 1 was PBKDF2-600k over SHA-256 under the salt
+ * `freewallet/keyring/unlock/v1`, and it was replaced outright rather than
+ * kept beside this set, so a passphrase bound under it no longer addresses
+ * its unlock Space. The KDF's own `version` is what records the parameter
+ * set: the keyring record's frame version is unchanged, since a record cannot
+ * be read before its derivation has already succeeded, so a version inside it
+ * could never steer a lookup. The salt is a fixed app-wide constant -- login
+ * stays passphrase-only, with no email (or other) input mixed into the
+ * derivation. Every unlock method's KDF carries a distinct salt, so two
+ * methods can never derive the same unlock Space.
  */
 export const KEYRING_KDF = {
-    version: 1,
-    algorithm: 'PBKDF2',
-    iterations: 600_000,
-    hash: 'SHA-256',
-    salt: 'freewallet/keyring/unlock/v1'
+    version: 2,
+    algorithm: 'Argon2id',
+    memory: 65_536,
+    passes: 3,
+    parallelism: 1,
+    salt: 'freewallet/keyring/unlock/argon2id/v1'
 };
 /**
- * The noble hash constructor a WebCrypto hash name selects, so the derivation
- * matches `crypto.subtle.deriveBits` for the same parameters.
+ * The noble hash constructor a WebCrypto hash name selects for the HKDF arm,
+ * so the derivation matches `crypto.subtle.deriveBits` for the same
+ * parameters.
  *
  * @param hash {string}   a WebCrypto digest name (`SHA-256`, `SHA-512`)
  * @returns {object}   the noble hash
@@ -71,7 +81,7 @@ function nobleHash(hash) {
 }
 /**
  * Derives the 32-byte unlock seed from an unlock secret, branching on the KDF
- * family: PBKDF2 stretches a passphrase, HKDF expands already-uniform key
+ * family: Argon2id stretches a passphrase, HKDF expands already-uniform key
  * material such as a passkey PRF output.
  *
  * Exported for the standing-credential derivation (`unlock/standingClient`):
@@ -90,15 +100,16 @@ export async function deriveUnlockSeed({ secret, kdf }) {
     const secretBytes = typeof secret === 'string'
         ? new TextEncoder().encode(secret)
         : new Uint8Array(secret);
-    const hash = nobleHash(kdf.hash);
     const salt = new TextEncoder().encode(kdf.salt);
-    if (kdf.algorithm === 'PBKDF2') {
-        return pbkdf2Async(hash, secretBytes, salt, {
-            c: kdf.iterations,
+    if (kdf.algorithm === 'Argon2id') {
+        return argon2idAsync(secretBytes, salt, {
+            m: kdf.memory,
+            t: kdf.passes,
+            p: kdf.parallelism,
             dkLen: UNLOCK_SEED_BYTES
         });
     }
-    return hkdf(hash, secretBytes, salt, new TextEncoder().encode(kdf.info), UNLOCK_SEED_BYTES);
+    return hkdf(nobleHash(kdf.hash), secretBytes, salt, new TextEncoder().encode(kdf.info), UNLOCK_SEED_BYTES);
 }
 /**
  * Derives the full unlock identity from an unlock secret: the unlock

package/dist/keyring/kdf.js.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAGnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAA;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAA;AAE3C;;;GAGG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAA;AA0B5B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,OAAO;IACnB,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,8BAA8B;CACrC,CAAA;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,IAAI,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EACN,GAAG,EAIJ;IACC,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,WAAW,GACf,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YAC1C,CAAC,EAAE,GAAG,CAAC,UAAU;YACjB,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CACT,IAAI,EACJ,WAAW,EACX,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAClC,iBAAiB,CAClB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EAIJ;IACC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpD,OAAO,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,eAAe;KACzB,CAAC,CAAA;IACF,8EAA8E;IAC9E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;QACtE,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAA;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAE/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO;QACL,KAAK;QACL,UAAU;QACV,eAAe;QACf,WAAW;QACX,YAAY;QACZ,OAAO;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,GAAG,EAAmB;IACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC"}
+{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../src/keyring/kdf.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAGnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAA;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAA;AAE3C;;;GAGG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAgC5B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,CAAC;IACT,WAAW,EAAE,CAAC;IACd,IAAI,EAAE,uCAAuC;CAC9C,CAAA;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,IAAI,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EACN,GAAG,EAIJ;IACC,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,WAAW,GACf,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE;YACtC,CAAC,EAAE,GAAG,CAAC,MAAM;YACb,CAAC,EAAE,GAAG,CAAC,MAAM;YACb,CAAC,EAAE,GAAG,CAAC,WAAW;YAClB,KAAK,EAAE,iBAAiB;SACzB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CACT,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EACnB,WAAW,EACX,IAAI,EACJ,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAClC,iBAAiB,CAClB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,MAAM,EACN,GAAG,EAIJ;IACC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACpD,OAAO,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EAGL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,eAAe;KACzB,CAAC,CAAA;IACF,8EAA8E;IAC9E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;QACtE,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAA;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,YAAY,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAE/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IACnD,OAAO;QACL,KAAK;QACL,UAAU;QACV,eAAe;QACf,WAAW;QACX,YAAY;QACZ,OAAO;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAE,GAAG,EAAmB;IACvD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC"}

package/dist/keys/collectionLogStore.d.ts

@@ -0,0 +1,73 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The descriptor store over ONE encrypted collection's governing history log
+ * -- the collection's own `meta/log` sub-resource, whose verified head state
+ * IS its `encryption` descriptor. The sibling of the user key roster's
+ * builder ({@link userKeyRosterDescriptorStore}), over the same wrapped
+ * `logGovernedDescriptorStore`: reads resolve to the verified head, writes
+ * are signed appends, and `create` is the guarded genesis (`If-None-Match:
+ * *`) that declares the Collection governed. The server derives the
+ * Collection Description's `encryption` member from that log, so a governed
+ * collection's descriptor is never client-written into its Description.
+ *
+ * The transport seam is was-client's `resourceLogStore({ collection })`, so
+ * the handle passed in is the whole address: the store derives its own
+ * chain-head pin slot from the handle's Space and collection ids
+ * ({@link collectionDescriptorLogPinId}), and no caller names a `logId`.
+ */
+import type { Collection } from '@interop/was-client';
+import type { ResourceLogPinStore, ResourceLogSigner } from '@interop/vh-resource-log';
+import type { WebvhResourceLogController } from '../resourceLog/index.js';
+import { type SealableEncryptionDescriptorStore } from './rosterLogStore.js';
+/**
+ * Builds the log-governed, sealable descriptor store over one collection's
+ * governing history log.
+ *
+ * Reads resolve to the log's verified head (chain, entry proofs, external
+ * authorization against the independently verified account document, and the
+ * chain-head pin, all checked before a descriptor is handed out); writes are
+ * signed appends of the full next state; `create` is the guarded genesis that
+ * declares the Collection governed -- the epoch[0] install
+ * ({@link ensureIndexedFirstEpoch}) is what runs it. `seal()` is the backstop
+ * for a rotation that no-op'd and so left the log anchored before the account
+ * document's latest membership change, and `setMinimumControllerVersion` is
+ * the post-edit anchor a ceremony sets so its appends never resolve to a
+ * cached pre-edit view.
+ *
+ * The signer is the same `ResourceLogSigner` the roster takes: an enrolled
+ * client's account key ({@link userKeyRosterLogSigner}), or a standing
+ * credential's ladder VM on a credential-anchored account.
+ *
+ * The store's class is `collection-descriptor`, so a ladder-signed append is
+ * admitted on `assertionMethod` membership at the anchored version alone.
+ * The ceremony-tail license binds the user key roster log only: a descriptor
+ * append escrows one recipient into one collection, lands as a hash-chained
+ * entry attributable to that credential, and is auditable by the account's
+ * clients.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}   the collection handle whose
+ *   `meta/log` is the log; its `spaceId` and `id` are what the pin slot is
+ *   derived from, and its capability wiring is what every request rides
+ * @param options.resolveController {function}
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view (`webvhResourceLogController` over a
+ *   `verifyAccountLog` result), resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pins, keyed per log
+ * @param options.signer {ResourceLogSigner}   the signing key the appends
+ *   this store writes are proved by. It must be listed under
+ *   `assertionMethod` in the account document at the version the append
+ *   anchors at, so a ceremony that strikes a key builds its collection stores
+ *   on one its own edit leaves standing
+ * @returns {SealableEncryptionDescriptorStore}
+ */
+export declare function collectionDescriptorLogStore({ collection, resolveController, pinStore, signer }: {
+    collection: Collection;
+    resolveController: () => Promise<WebvhResourceLogController>;
+    pinStore: ResourceLogPinStore;
+    signer: ResourceLogSigner;
+}): SealableEncryptionDescriptorStore;
+//# sourceMappingURL=collectionLogStore.d.ts.map

package/dist/keys/collectionLogStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectionLogStore.d.ts","sourceRoot":"","sources":["../../src/keys/collectionLogStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,MAAM,EACP,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,iBAAiB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC5D,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;CAC1B,GAAG,iCAAiC,CAYpC"}

package/dist/keys/collectionLogStore.js

@@ -0,0 +1,60 @@
+import { resourceLogStore } from '@interop/was-client/log';
+import { collectionDescriptorLogPinId } from '../descriptors/logSource.js';
+import { logGovernedDescriptorStore } from './rosterLogStore.js';
+/**
+ * Builds the log-governed, sealable descriptor store over one collection's
+ * governing history log.
+ *
+ * Reads resolve to the log's verified head (chain, entry proofs, external
+ * authorization against the independently verified account document, and the
+ * chain-head pin, all checked before a descriptor is handed out); writes are
+ * signed appends of the full next state; `create` is the guarded genesis that
+ * declares the Collection governed -- the epoch[0] install
+ * ({@link ensureIndexedFirstEpoch}) is what runs it. `seal()` is the backstop
+ * for a rotation that no-op'd and so left the log anchored before the account
+ * document's latest membership change, and `setMinimumControllerVersion` is
+ * the post-edit anchor a ceremony sets so its appends never resolve to a
+ * cached pre-edit view.
+ *
+ * The signer is the same `ResourceLogSigner` the roster takes: an enrolled
+ * client's account key ({@link userKeyRosterLogSigner}), or a standing
+ * credential's ladder VM on a credential-anchored account.
+ *
+ * The store's class is `collection-descriptor`, so a ladder-signed append is
+ * admitted on `assertionMethod` membership at the anchored version alone.
+ * The ceremony-tail license binds the user key roster log only: a descriptor
+ * append escrows one recipient into one collection, lands as a hash-chained
+ * entry attributable to that credential, and is auditable by the account's
+ * clients.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}   the collection handle whose
+ *   `meta/log` is the log; its `spaceId` and `id` are what the pin slot is
+ *   derived from, and its capability wiring is what every request rides
+ * @param options.resolveController {function}
+ *   `() => Promise<WebvhResourceLogController>` -- the caller's currently
+ *   verified controller view (`webvhResourceLogController` over a
+ *   `verifyAccountLog` result), resolved per operation
+ * @param options.pinStore {ResourceLogPinStore}   this client's chain-head
+ *   pins, keyed per log
+ * @param options.signer {ResourceLogSigner}   the signing key the appends
+ *   this store writes are proved by. It must be listed under
+ *   `assertionMethod` in the account document at the version the append
+ *   anchors at, so a ceremony that strikes a key builds its collection stores
+ *   on one its own edit leaves standing
+ * @returns {SealableEncryptionDescriptorStore}
+ */
+export function collectionDescriptorLogStore({ collection, resolveController, pinStore, signer }) {
+    return logGovernedDescriptorStore({
+        log: resourceLogStore({ collection }),
+        resolveController,
+        pinStore,
+        logId: collectionDescriptorLogPinId({
+            spaceId: collection.spaceId,
+            collectionId: collection.id
+        }),
+        signer,
+        logClass: 'collection-descriptor'
+    });
+}
+//# sourceMappingURL=collectionLogStore.js.map

package/dist/keys/collectionLogStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectionLogStore.js","sourceRoot":"","sources":["../../src/keys/collectionLogStore.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAK1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAE1E,OAAO,EACL,0BAA0B,EAE3B,MAAM,qBAAqB,CAAA;AAE5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,MAAM,EAMP;IACC,OAAO,0BAA0B,CAAC;QAChC,GAAG,EAAE,gBAAgB,CAAC,EAAE,UAAU,EAAE,CAAC;QACrC,iBAAiB;QACjB,QAAQ;QACR,KAAK,EAAE,4BAA4B,CAAC;YAClC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,YAAY,EAAE,UAAU,CAAC,EAAE;SAC5B,CAAC;QACF,MAAM;QACN,QAAQ,EAAE,uBAAuB;KAClC,CAAC,CAAA;AACJ,CAAC"}

package/dist/keys/index.d.ts

@@ -22,13 +22,23 @@
  *   current epoch, refusing a `currentEpoch` that names no epoch in its own
  *   list" (`UserKeyRosterIntegrityError`); every roster and collection
  *   descriptor read that needs the current epoch goes through it.
- * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
- *   descriptor store: reads resolve to the roster log's verified head
+ * - `collectionDescriptorLogStore` -- the same store over ONE encrypted
+ *   collection's governing history log (the collection's `meta/log`
+ *   sub-resource, whose verified head state is its `encryption` descriptor).
+ *   It derives its own chain-head pin slot from the collection handle, and
+ *   carries the `collection-descriptor` log class, whose ladder-signed
+ *   appends admit on `assertionMethod` membership alone.
+ * - `userKeyRosterDescriptorStore` -- the same store over the user key roster:
+ *   reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
  *   bare signing client for the login-time direct read. Sealable
  *   (`SealableEncryptionDescriptorStore` / `isSealableDescriptorStore`):
  *   `seal()` appends the idempotent backstop entry when the log's head still
  *   anchors before the account document's latest membership change.
+ *
+ *   Those two builders are the subpath's whole store surface. Each states its
+ *   log class at construction, and the generic wrapper under them takes a
+ *   caller-chosen class and log id, so it stays module-internal.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap and the roster read. A retiring rotation names no kid:
  *   it converges onto the account document instead.
@@ -52,9 +62,10 @@
  *   names (also the completion sweep's driver).
  * - `rotateRosterToDocumentAndCascade` -- the shared roster-and-cascade tail
  *   every account-membership ceremony ends with (a client disconnected, a
- *   standing unlock credential retired): the post-edit minimum controller version, the
- *   convergence rotation with its seal backstop, and the collection fan-out
- *   onto the fresh user key.
+ *   standing unlock credential retired): the post-edit minimum controller
+ *   version on the roster store AND on every log-governed collection store
+ *   the fan-out touches, the convergence rotation with its seal backstop, and
+ *   the collection fan-out onto the fresh user key.
  * - `retireRosterRecipientAndCascade` -- the same tail for a ceremony that
  *   rotates BEFORE its document edit (the two forgets): the minimum
  *   controller version at the caller's anchor, one named recipient retired
@@ -82,8 +93,9 @@ export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDoc
 export type { CascadeCollections, RosterCascadeResult, RosterSealReport, UserKeyAdoptedHook } from './userKeyRosterCascade.js';
 export type { DescriptorStoreRead, UserKeyRosterReadResult } from './userKeyRoster.js';
 export type { KeyAgreementDocument } from '../resourceLog/document.js';
+export { collectionDescriptorLogStore } from './collectionLogStore.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
+export { isSealableDescriptorStore } from './rosterLogStore.js';
 export type { SealableEncryptionDescriptorStore } from './rosterLogStore.js';
 export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs, WalletSpaceProvisioningError, walletSpaceProvisioner } from './spaceEpochs.js';
 export type { WalletSpaceEpochsResult } from './spaceEpochs.js';

package/dist/keys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAEtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE/D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/keys/index.js

@@ -22,13 +22,23 @@
  *   current epoch, refusing a `currentEpoch` that names no epoch in its own
  *   list" (`UserKeyRosterIntegrityError`); every roster and collection
  *   descriptor read that needs the current epoch goes through it.
- * - `userKeyRosterDescriptorStore` / `logGovernedDescriptorStore` -- that
- *   descriptor store: reads resolve to the roster log's verified head
+ * - `collectionDescriptorLogStore` -- the same store over ONE encrypted
+ *   collection's governing history log (the collection's `meta/log`
+ *   sub-resource, whose verified head state is its `encryption` descriptor).
+ *   It derives its own chain-head pin slot from the collection handle, and
+ *   carries the `collection-descriptor` log class, whose ladder-signed
+ *   appends admit on `assertionMethod` membership alone.
+ * - `userKeyRosterDescriptorStore` -- the same store over the user key roster:
+ *   reads resolve to the roster log's verified head
  *   (`key-map/user-key.jsonl`), writes append signed entries; built from a
  *   bare signing client for the login-time direct read. Sealable
  *   (`SealableEncryptionDescriptorStore` / `isSealableDescriptorStore`):
  *   `seal()` appends the idempotent backstop entry when the log's head still
  *   anchors before the account document's latest membership change.
+ *
+ *   Those two builders are the subpath's whole store surface. Each states its
+ *   log class at construction, and the generic wrapper under them takes a
+ *   caller-chosen class and log id, so it stays module-internal.
  * - `rosterRecipientKid` -- the one builder of a client's roster kid, shared by
  *   the enrollment wrap and the roster read. A retiring rotation names no kid:
  *   it converges onto the account document instead.
@@ -52,9 +62,10 @@
  *   names (also the completion sweep's driver).
  * - `rotateRosterToDocumentAndCascade` -- the shared roster-and-cascade tail
  *   every account-membership ceremony ends with (a client disconnected, a
- *   standing unlock credential retired): the post-edit minimum controller version, the
- *   convergence rotation with its seal backstop, and the collection fan-out
- *   onto the fresh user key.
+ *   standing unlock credential retired): the post-edit minimum controller
+ *   version on the roster store AND on every log-governed collection store
+ *   the fan-out touches, the convergence rotation with its seal backstop, and
+ *   the collection fan-out onto the fresh user key.
  * - `retireRosterRecipientAndCascade` -- the same tail for a ceremony that
  *   rotates BEFORE its document edit (the two forgets): the minimum
  *   controller version at the caller's anchor, one named recipient retired
@@ -76,8 +87,9 @@ export { assertEnrolledClientKeyRecord, decodeClientKeyRecord, encodeClientKeyRe
 export { addUserKeyRosterRecipient, convergeUserKeyRosterToDocument, currentEpochOf, enrolledClientRosterRecipients, ensureUserKeyRoster, UserKeyRosterContinuityError, UserKeyRosterIntegrityError, UserKeyRosterUnwrapError, userKeyRosterLogSigner, userKeyRosterRecipientResolver, readUserKeyRoster, replaceUserKeyRosterRecipients, rosterRecipientKid, rosterRecipientsToRetire, rosterWrapsRecipient, rotateUserKeyRoster } from './userKeyRoster.js';
 export { cascadeCollectionsToUserKey, userKeyAsRecipient, rotateCollectionEpochsToUserKey, unwrapUserKeyGenerations } from './userKeyCascade.js';
 export { anchorRosterStoreAt, retireRosterRecipientAndCascade, rotateRosterToDocumentAndCascade } from './userKeyRosterCascade.js';
+export { collectionDescriptorLogStore } from './collectionLogStore.js';
 export { userKeyRosterDescriptorStore, userKeyRosterPinId } from './rosterStore.js';
-export { EPOCH_CONFIGURATION_STATE_TYPE, isSealableDescriptorStore, logGovernedDescriptorStore } from './rosterLogStore.js';
+export { isSealableDescriptorStore } from './rosterLogStore.js';
 export { ensureIndexedFirstEpoch, ensureWalletSpaceEpochs, WalletSpaceProvisioningError, walletSpaceProvisioner } from './spaceEpochs.js';
 export { readClientLabels, removeClientLabel, setClientLabel } from './clientLabels.js';
 export { wasClientLabelsStore } from './wasLabelsStore.js';

package/dist/keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAalC,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAA;AAQ7B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,cAAc,EACd,8BAA8B,EAC9B,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,+BAA+B,EAC/B,wBAAwB,EACzB,MAAM,qBAAqB,CAAA;AAK5B,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,gCAAgC,EACjC,MAAM,2BAA2B,CAAA;AAalC,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EACL,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AAG/D,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA"}