v0.68.0

Changed

• The account log's chain-head pin is a property of the store rather than an
  optional argument of every ceremony. WebvhIdStore gains a required
  pin: { store, logId } member; wasWebvhIdStore, wasWebvhLogStore,
  delegatedWebvhLogStore, and clientAnnexLogStore take a required pinStore
  at construction and derive the slot themselves. readPublishedLog /
  readPublishedLogOrThrow check and advance the store's pin on every read, and
  putLogResource (so publishEntryPinned and every ceremony entry's publish)
  advances it on every write. Enrollment approval, client revocation, credential
  retirement, and self-enrollment therefore refuse a served truncated prefix of
  the log before any entry publishes, where the approver's and the revoker's
  reads used to run unpinned.

Removed

• The pinStore / logId options of every account-log and annex-log ceremony
  (signAccountEntry, ladderSignedAccountEntry, enrollWebvhClient,
  revokeWebvhClient, publishUnlockKey / removeUnlockKey,
  rotateWebvhUpdateKey, ensureDidWebvh, the recovery continuations, the
  annex ceremonies, and their orchestrators) and the half-supplied TypeError,
  together with advanceLogPin. verifyAccountLog keeps its optional
  pinStore, since it fetches by URL and holds no store. A ceremony that builds
  stores from a client still takes a pinStore, now required.
• The pinStore option of the annex orchestrators that already take an
  idStore (establishCredentialAnchoredAccount,
  ensurePointedClientAnnexGeneration, mendCredentialAnchoredAccount,
  ensureCredentialClientAnnexGeneration, runClientAnnexGc,
  swapClientAnnexGeneration): the annex logs pin in the account-log store's
  pin store, read off idStore.pin.store, so the two log families can no longer
  be handed two stores.
• clientAnnexLogPinId. Every log store derives its slot through the new
  logResourcePinId({ spaceId, collectionId }) in ./webvh, which
  accountLogPinId is now defined over.
• ensureAccountGenesis, ensureCredentialAnchoredAccountGenesis, and
  selfEnrollClientCore's accountLogPinStore option, and
  ensurePointedClientAnnexGeneration's accountSpaceId option (it only named
  a pin slot the store now derives).

Fixed

• The three reads that tell a dead or absent annex generation from a live one
  (the transient readiness ensure's pointed read, the last-client transition's
  generation stage, the GC's orphan and pointed reads) go through
  readClientAnnexLogOrAbsent: an absent log under a pin this client still
  holds is read as absence, so a collected generation is re-pointed, skipped as
  log-unreadable, or collected rather than refused as a rollback, while a
  served prefix of a pinned generation log stays refused. The helper is exported
  from ./clientAnnex, and it is one read: readPublishedLog gains an
  absentUnderPin: 'absent' mode instead of the helper re-fetching after a
  rollback refusal.
• swapClientAnnexGeneration resolves to { clientAnnexDid, revoke } rather
  than the bare DID: revoke reports whether the old generation's delegation
  was revoked, or skipped because the old log embeds no-delegation or is
  log-absent, so a swap that could not revoke is no longer reported as one
  that did.