@bkazemi/verily 0.1.0 → 0.3.0

package/dist/server/service.js

@@ -72,15 +72,22 @@ export class VerilyService {
      * A public record that stands, signed as of now. Signed when asked for, not when
      * approved, so a signed record says the record stood on the day it was taken and none can be
      * made once it is removed.
+     *
+     * A retired record is signed too, as what it is: the durable form of the claim that the
+     * account was the holder's when it was last proved. It did not stand when it was signed,
+     * so it is a version of its own that says so, which a reader of the first refuses.
      */
     async signed(id) {
         const current = await this.signer();
         if (!current)
             throw new Unavailable();
-        const { status, revokedAt: _revokedAt, signedUrl: _signedUrl, ...record } = await this.read(id);
+        const { status, revokedAt: _revokedAt, signedUrl: _signedUrl, mark: _mark, retiredAt, ...record } = await this.read(id);
+        const document = { type: 'verily-evidence', issuedAt: this.now(), ...record };
+        if (status === 'retired')
+            return current.sign({ ...document, version: 2, status, retiredAt: retiredAt });
         if (status !== 'verified')
             throw new Unavailable();
-        return current.sign({ type: 'verily-evidence', version: 1, issuedAt: this.now(), ...record });
+        return current.sign({ ...document, version: 1 });
     }
     /** What a signed record says, if this instance signed it. */
     async checked(signed) {
@@ -135,7 +142,13 @@ export class VerilyService {
             ? this.providers[0]
             : this.resolve(flow.provider, flow.method);
     }
-    async start(local, connectionId, kind = 'connect', choice = {}, context) {
+    async start(local, connectionId, kind = 'connect', choice = {}, context, 
+    /**
+     * Whether the caller has shown the holder asked for this themselves, as a form posted
+     * from their own page shows and following a link does not. Without it the flow reads
+     * nothing at its start and ends on an approval, however little there is to approve.
+     */
+    attended = false) {
         if (kind === 'connect' && !local)
             throw new Unavailable();
         if (context !== undefined &&
@@ -157,10 +170,15 @@ export class VerilyService {
             connectionId,
             phase: 'pending',
             expiresAt: this.now() + (this.options.flowTtlMs ?? 600000),
+            ...(attended ? { attended } : {}),
         };
         // Removal from the external side answers to nobody local, so nothing local rides on it.
         if (context && !['revoke', 'share-revoke'].includes(kind))
             flow.context = { ...context };
+        // The account a sign-in is asked for by name. Only where the local holder of the record
+        // started the flow: removal from the external side is started by anyone, and is told
+        // nothing about the account it would have to show.
+        let account;
         const provider = await this.transaction(async (tx) => {
             // Whose link this is. A flow against an existing connection may carry no local
             // subject of its own, and the record is the authority on it in any case.
@@ -173,7 +191,12 @@ export class VerilyService {
                     connection.revokedAt !== undefined ||
                     (['visibility', 'renew'].includes(kind) && connection.local.id !== local?.id))
                     throw new Unavailable();
+                // Who can read a retired record is frozen with the rest of it.
+                if (kind === 'visibility' && connection.retiredAt !== undefined)
+                    throw new Unavailable();
                 subject = connection.local;
+                if (['renew', 'visibility'].includes(kind))
+                    account = connection.external;
             }
             const provider = this.chosen(kind, choice, connection);
             flow.provider = provider.id;
@@ -189,10 +212,23 @@ export class VerilyService {
                 flow.expect = artifact.expect
                     ? artifact.expect(subject)
                     : `Verily proof for ${this.siteOf(subject)}: ${secret()}`;
+            // These kinds are all started by the local holder, whose own record this is. Removal
+            // from the external side is started by anyone, and is told nothing.
+            if (artifact?.known && ['connect', 'renew', 'visibility'].includes(kind)) {
+                const suggested = connection
+                    ? artifact.known(connection.external)
+                    : await this.known(tx, subject, artifact);
+                if (suggested)
+                    flow.suggested = suggested;
+            }
             await tx.put('flows', flow.id, flow);
             return provider;
         });
         const artifact = isArtifactProvider(provider) ? provider : undefined;
+        // Where a record already says whose account this is, there is nothing to ask the
+        // holder: the proof is either there to be read or it is not.
+        if (artifact && flow.suggested && attended)
+            await this.offered(flow.id, binding, artifact, flow.expect, flow.suggested);
         // A redirect provider hands the holder to its own site; an artifact provider tells
         // them what to publish and waits for them to say where they put it; a code provider
         // has nothing to say until the holder names the address to send to.
@@ -211,10 +247,54 @@ export class VerilyService {
                         state,
                         challenge: hash(verifier),
                         redirectUri: `${this.baseUrl}/callback`,
+                        ...(account ? { account } : {}),
                     }),
                 }
                 : { flowId: flow.id, binding };
     }
+    /**
+     * What a new flow can offer the holder to hand back: the one account this subject has
+     * already shown some other way, which is the record the flow would join. With several,
+     * which one they mean is theirs to say.
+     */
+    async known(tx, local, provider) {
+        const offers = (await tx.list('connections'))
+            .filter((c) => c.revokedAt === undefined &&
+            c.retiredAt === undefined &&
+            c.local.id === local.id &&
+            c.provider === provider.id &&
+            (c.attestations?.external[0].method ?? 'oauth') !== provider.method)
+            .map((c) => provider.known(c.external))
+            .filter((offer) => offer !== undefined);
+        return new Set(offers.map((offer) => offer.toLowerCase())).size === 1 ? offers[0] : undefined;
+    }
+    /**
+     * Reads the proof at the account a record already names, before the holder is asked for
+     * anything. Found, the flow goes straight to approval, as if they had handed it back.
+     * Not found is no failure: they have not been told what to publish yet, so the flow
+     * stays where it was and tells them.
+     */
+    async offered(id, binding, provider, expect, suggested) {
+        try {
+            const handed = provider.resolve?.(suggested) ?? suggested;
+            const external = await this.deadline(provider.verify({ artifact: handed, expect }));
+            await this.transaction(async (tx) => {
+                const flow = await this.bound(tx, id, binding);
+                flow.phase = 'exchanging';
+                await tx.put('flows', id, flow);
+            });
+            await this.established(id, binding, external, handed);
+        }
+        catch {
+            await this.transaction(async (tx) => {
+                const flow = await tx.get('flows', id);
+                if (flow?.phase === 'exchanging') {
+                    flow.phase = 'pending';
+                    await tx.put('flows', id, flow);
+                }
+            });
+        }
+    }
     /**
      * Which method a flow runs. A flow on an existing record stays in that record's
      * namespace, and without a choice it uses the method the record was first shown by.
@@ -222,6 +302,10 @@ export class VerilyService {
      * Removing a link from the external side takes a method whose proof is fresh. A standing
      * proof, such as a link back, is there for anyone to point at: handing one back shows
      * the link exists, not that whoever handed it back holds the account.
+     *
+     * A retired record is renewed by the method it was first shown by and no other. Another
+     * would be listed beneath a main proof nobody has read since, and the record would come
+     * back unconfirmed.
      */
     chosen(kind, choice, connection) {
         let provider;
@@ -235,6 +319,8 @@ export class VerilyService {
             provider = this.resolve(choice.provider, choice.method);
         if (connection && provider.id !== connection.provider)
             throw new Unavailable();
+        if (kind === 'renew' && connection && !revives(connection, provider))
+            throw new Unavailable();
         if (['revoke', 'share-revoke'].includes(kind) &&
             isArtifactProvider(provider) &&
             provider.expect)
@@ -263,14 +349,40 @@ export class VerilyService {
             return { provider, expect: flow.expect };
         });
         try {
-            const external = await provider.verify({ artifact, expect });
-            await this.established(id, binding, external, artifact);
+            // Kept as the address that was read, never as the shorthand that named it: it is
+            // where a reader is sent, and what is read again later.
+            const handed = provider.resolve?.(artifact) ?? artifact;
+            const external = await provider.verify({ artifact: handed, expect });
+            await this.established(id, binding, external, handed);
         }
         catch (error) {
-            await this.failed(id, error);
+            await this.refused(id, error, artifact);
         }
         return id;
     }
+    /**
+     * Takes a refused proof as something the holder can put right, and leaves the flow
+     * waiting for it. What they must publish is minted per flow, so a flow ended here would
+     * have them publish or sign all over again for a mistyped address. The tries are counted
+     * all the same: each one is a fetch somewhere the holder chose.
+     */
+    async refused(id, error, artifact) {
+        await this.transaction(async (tx) => {
+            const flow = await tx.get('flows', id);
+            if (flow?.phase !== 'exchanging')
+                return;
+            flow.tries = (flow.tries ?? 0) + 1;
+            // Only a `Refused` reason is kept: any other error may describe this backend.
+            flow.reason = error instanceof Refused ? error.message : undefined;
+            if (flow.tries >= artifactAttempts)
+                await this.ended(tx, flow, 'failed');
+            else {
+                flow.phase = 'pending';
+                flow.artifact = artifact;
+            }
+            await tx.put('flows', id, flow);
+        });
+    }
     /**
      * One step of a mailed code. The first answer is an address: a code is minted, sent
      * there, and only its hash kept. The second is the code, which the holder could only
@@ -484,7 +596,9 @@ export class VerilyService {
             // A mailbox has no page to point at, so its own address stands in for one.
             new URL(external.profileUrl).protocol !== (external.kind === 'mailbox' ? 'mailto:' : 'https:'))
             throw new Unavailable();
-        await this.transaction(async (tx) => {
+        // The flow as it stands once this account is accepted for it, or a refusal. Asked
+        // twice, because what it is checked against can change while proofs are being read.
+        const accepted = async (tx) => {
             const flow = binding === undefined ? await tx.get('flows', id) : await this.bound(tx, id, binding);
             if (flow?.phase !== 'exchanging')
                 throw new Unavailable();
@@ -499,15 +613,91 @@ export class VerilyService {
                 flow.local = connection.local;
             }
             flow.external = external;
+            return flow;
+        };
+        // The account is named now, so a proof that needs nothing but its name can be read
+        // without the holder choosing that method or handing anything back. Read while the
+        // flow is still exchanging: approval is shown once, and must show all it will record.
+        const shown = await this.transaction(accepted);
+        const standing = ['connect', 'renew'].includes(shown.kind) ? await this.standing(shown) : [];
+        await this.transaction(async (tx) => {
+            const flow = await accepted(tx);
             flow.artifact = artifact;
+            flow.reason = undefined;
             flow.authenticatedAt = this.now();
+            if (standing.length)
+                flow.standing = standing;
             flow.phase = 'approval';
-            await tx.put('flows', id, flow);
+            // Nothing for the holder to decide, so nothing to ask them. The visibility passed is
+            // never read: both of these keep the record's own.
+            if (await this.settled(tx, flow))
+                await this.conclude(tx, flow, 'unlisted');
+            else
+                await tx.put('flows', id, flow);
         });
     }
     /**
-     * A failed check leaves the flow dead rather than retryable in place. Only a `Refused`
-     * reason is kept: any other error may describe this backend rather than the proof.
+     * The proofs already standing for the account a flow just showed, by the other methods
+     * configured for its provider that can tell where to look from the account alone. One
+     * that is not there, or cannot be read, is simply not found: the holder asked for none
+     * of them, so none of them can fail the flow.
+     */
+    async standing(flow) {
+        const shownBy = this.providerOf(flow);
+        const found = [];
+        for (const provider of this.providers) {
+            if (!isArtifactProvider(provider) ||
+                provider.id !== shownBy.id ||
+                provider.method === providerMethod(shownBy) ||
+                provider.artifact !== 'location' ||
+                !provider.expect ||
+                !provider.known)
+                continue;
+            try {
+                const expect = provider.expect(flow.local);
+                const known = provider.known(flow.external);
+                if (!known)
+                    continue;
+                const handed = provider.resolve?.(known) ?? known;
+                const external = await this.deadline(provider.verify({ artifact: handed, expect }));
+                if (!sameAccount(flow.external, external))
+                    continue;
+                found.push({
+                    by: 'provider',
+                    method: provider.method,
+                    confirmedAt: this.now(),
+                    artifactUrl: handed,
+                    expect,
+                });
+            }
+            catch {
+                continue;
+            }
+        }
+        return found;
+    }
+    /** Adds the proofs a flow found standing beneath the method the record was first shown by. */
+    recordStanding(connection, flow) {
+        if (!flow.standing?.length || !connection.attestations)
+            return;
+        const [main, ...rest] = connection.attestations.external;
+        for (const attestation of flow.standing) {
+            // The main method is reread against the id it named, so it is only ever replaced
+            // by a flow that ran it.
+            if (attestation.method === main.method)
+                continue;
+            const at = rest.findIndex((a) => a.method === attestation.method);
+            if (at < 0)
+                rest.push(attestation);
+            else
+                rest[at] = attestation;
+        }
+        connection.attestations = { ...connection.attestations, external: [main, ...rest] };
+    }
+    /**
+     * A sign-in or a mailed code that fails leaves the flow dead: there is nothing in it to
+     * put right, and starting again costs the holder nothing. Only a `Refused` reason is
+     * kept: any other error may describe this backend rather than the proof.
      */
     async failed(id, error) {
         await this.transaction(async (tx) => {
@@ -542,6 +732,26 @@ export class VerilyService {
                 await tx.put('flows', id, flow);
                 return undefined;
             }
+            return this.conclude(tx, flow, visibility, allowed);
+        });
+    }
+    /**
+     * Whether approving a flow would decide anything. A renewal, or another way of showing
+     * an account the subject is already linked to, changes neither who is linked nor who
+     * can read it: the holder asked for exactly this and the account has been checked
+     * against the record, so it is recorded without asking them to say so again.
+     */
+    async settled(tx, flow) {
+        // A flow anyone could have sent the holder's browser into is theirs only once they
+        // approve it, and the approval is a form that only their own page can post.
+        if (!flow.attended)
+            return false;
+        return flow.kind === 'renew' || (flow.kind === 'connect' && !!(await this.joins(tx, flow)));
+    }
+    /** Records what an approved flow does, and ends it. The caller has checked who approves. */
+    async conclude(tx, flow, visibility, allowed) {
+        const id = flow.id;
+        {
             let connection;
             const provider = this.providerOf(flow);
             const joined = flow.kind === 'connect' ? await this.joins(tx, flow) : undefined;
@@ -557,6 +767,7 @@ export class VerilyService {
                     throw new Unavailable();
                 // The id exists before the record does, because a hosted proof is addressed by it.
                 const connectionId = secret();
+                const mark = await this.accountMark(tx, flow.local, provider.id, flow.external);
                 connection = {
                     id: connectionId,
                     local: flow.local,
@@ -573,6 +784,8 @@ export class VerilyService {
                         external: [this.attestation(flow, provider, connectionId)],
                     },
                     proof: hosted(provider) ? flow.artifact : undefined,
+                    // The account's other records say how the holder has it listed, and so does this.
+                    ...(mark ? { mark } : {}),
                 };
             }
             else {
@@ -590,7 +803,20 @@ export class VerilyService {
                     // subject snapshot refreshes because the holder just approved what it shows.
                     if (flow.local.id !== existing.local.id)
                         throw new Unavailable();
+                    // Asked again here: the record may have been retired since the flow started.
+                    if (!revives(existing, provider))
+                        throw new Unavailable();
                     this.recordMethod(connection, flow, provider);
+                    if (connection.retiredAt !== undefined) {
+                        // Live again on the strength of the proof just made and nothing older. A record
+                        // made for the account while this one sat retired may have been marked since,
+                        // and this one would otherwise be drawn in its place and hide that choice.
+                        const mark = await this.accountMark(tx, connection.local, connection.provider, connection.external, connection.id);
+                        delete connection.retiredAt;
+                        delete connection.mark;
+                        if (mark)
+                            connection.mark = mark;
+                    }
                 }
                 else if (flow.kind === 'revoke') {
                     connection.revokedAt = this.now();
@@ -599,17 +825,21 @@ export class VerilyService {
                 else if (flow.kind === 'visibility') {
                     if (allowed && !allowed.includes(visibility))
                         throw new Unavailable();
+                    if (connection.retiredAt !== undefined)
+                        throw new Unavailable();
                     connection.visibility = visibility;
                     connection.visibilityApprovedAt = this.now();
                 }
             }
+            if (['connect', 'renew'].includes(flow.kind))
+                this.recordStanding(connection, flow);
             await tx.put('connections', connection.id, connection);
             await this.audit(tx, connection.id, flow.kind, ['revoke', 'share-revoke'].includes(flow.kind) ? 'external' : 'local', id, connection.visibility);
             flow.resultId = connection.id;
             await this.ended(tx, flow, 'complete', connection);
             await tx.put('flows', id, flow);
             return connection.id;
-        });
+        }
     }
     /**
      * Ends a flow and records how, inside the transaction that ends it: the connection as it
@@ -644,9 +874,11 @@ export class VerilyService {
                 external: [{ by: 'provider', method: 'oauth', confirmedAt: connection.authenticatedAt }],
             };
         const [main, ...rest] = connection.attestations.external;
+        // A retired record is as it stood when it was retired, and nothing is read after that.
+        const at = connection.retiredAt ?? this.now();
         return {
             ...connection.attestations,
-            external: [main, ...rest.filter((a) => fresh(a, this.now(), this.freshness))],
+            external: [main, ...rest.filter((a) => fresh(a, at, this.freshness))],
         };
     }
     evidence(connection) {
@@ -670,10 +902,15 @@ export class VerilyService {
             visibilityApprovedAt: connection.visibilityApprovedAt,
             expiresAt: connection.expiresAt,
             revokedAt: connection.revokedAt,
+            // How an account is listed says nothing once its record is removed or retired.
+            ...(connection.mark && !['revoked', 'retired'].includes(standing)
+                ? { mark: connection.mark }
+                : {}),
+            ...(standing === 'retired' ? { retiredAt: connection.retiredAt } : {}),
             evidenceUrl,
             ...(this.options.signingKey !== undefined &&
                 connection.visibility === 'public' &&
-                standing === 'verified'
+                ['verified', 'retired'].includes(standing)
                 ? { signedUrl: `${evidenceUrl}?format=signed` }
                 : {}),
         };
@@ -682,12 +919,14 @@ export class VerilyService {
      * The live record a connect flow reproves by another method, if there is one: the same
      * subject linked to the same account on the same provider, first shown some other way.
      * The same method again is a second record, as it always was; renewing is how that
-     * one is extended.
+     * one is extended. A retired record is never joined: it is frozen, so proving its account
+     * another way makes a new record and leaves that one as history behind it.
      */
     async joins(tx, flow) {
         const provider = this.providerOf(flow);
         return (await tx.list('connections'))
             .filter((c) => c.revokedAt === undefined &&
+            c.retiredAt === undefined &&
             c.local.id === flow.local.id &&
             c.provider === provider.id &&
             (c.attestations?.external[0].method ?? 'oauth') !== providerMethod(provider) &&
@@ -851,6 +1090,84 @@ export class VerilyService {
             await this.audit(tx, id, 'revoke', 'local');
         });
     }
+    /**
+     * The holder's records of one account that are not revoked. A mark belongs to an account,
+     * and an account can stand on several records: shown a second way on a record of its own,
+     * or removed once and connected again. They are told apart as a badge tells them, by
+     * provider and the id the provider gave.
+     */
+    async account(tx, local, provider, external) {
+        return (await tx.list('connections')).filter((c) => c.revokedAt === undefined &&
+            c.local.id === local.id &&
+            c.provider === provider &&
+            c.external.id === external.id);
+    }
+    /**
+     * The mark an account's records carry, for a record about to stand beside them: every
+     * one neither revoked nor retired, lapsed ones included, since those hold a mark that
+     * must survive their own renewal.
+     */
+    async accountMark(tx, local, provider, external, except) {
+        return (await this.account(tx, local, provider, external)).find((c) => c.id !== except && c.retiredAt === undefined && c.mark !== undefined)?.mark;
+    }
+    /**
+     * Marks an account as the holder would have it listed, or retires it. Names one record
+     * and acts on the account, or a mark on one record could vanish behind a sibling, and
+     * retiring one could leave the account reading as verified through another.
+     *
+     * No fresh proof is asked for. A mark never widens who can read a record or makes one
+     * read as verified, and a holder retiring an account often can no longer prove it.
+     */
+    async mark(id, local, as) {
+        if (!['preferred', 'current', 'unused', 'retired'].includes(as))
+            throw new Unavailable();
+        await this.transaction(async (tx) => {
+            const named = await this.owned(tx, id, local);
+            if (named.revokedAt !== undefined)
+                throw new Unavailable();
+            // A record already retired is left exactly as it is: its dates are what it stands on.
+            const records = (await this.account(tx, local, named.provider, named.external)).filter((c) => c.retiredAt === undefined);
+            if (as === 'retired') {
+                // Whatever its status: a lapsed one left live could be read again later and bring
+                // the account back. Nothing is revoked.
+                for (const record of records) {
+                    record.retiredAt = this.now();
+                    delete record.mark;
+                    await tx.put('connections', record.id, record);
+                    await this.audit(tx, record.id, 'retire', 'local');
+                }
+                return;
+            }
+            // Only a retired account is left, and that is listed as retired and nothing else.
+            if (!records.length)
+                throw new Unavailable();
+            const mark = as === 'current' ? undefined : as;
+            for (const record of records) {
+                if (record.mark === mark)
+                    continue;
+                if (mark)
+                    record.mark = mark;
+                else
+                    delete record.mark;
+                await tx.put('connections', record.id, record);
+                await this.audit(tx, record.id, `mark-${as}`, 'local');
+            }
+            if (as !== 'preferred')
+                return;
+            // One preferred account per holder: picking another moves the mark. Only that mark
+            // is taken from the others, and what they say of being unused is left alone.
+            for (const other of await tx.list('connections')) {
+                if (other.local.id !== local.id ||
+                    other.revokedAt !== undefined ||
+                    other.mark !== 'preferred' ||
+                    records.some((record) => record.id === other.id))
+                    continue;
+                delete other.mark;
+                await tx.put('connections', other.id, other);
+                await this.audit(tx, other.id, 'mark-current', 'local');
+            }
+        });
+    }
     async share(id, local, revoke = false) {
         const token = secret();
         return this.transaction(async (tx) => {
@@ -908,6 +1225,8 @@ export class VerilyService {
      * `budget` bounds the reads per run, since providers rate-limit and the alarm this runs
      * on is shared. Oldest first, so nothing starves however many connections are waiting.
      *
+     * A retired record is never asked about: its proof is no longer expected to be there.
+     *
      * Returns how many were confirmed. A connection revoked here is not one of them.
      */
     async recheck(budget = 5) {
@@ -916,7 +1235,10 @@ export class VerilyService {
         const interval = this.options.recheckMs ?? 86400000;
         const now = this.now();
         const due = await this.transaction(async (tx) => (await tx.list('connections'))
-            .filter((c) => c.revokedAt === undefined && c.expiresAt > now && c.attestations)
+            .filter((c) => c.revokedAt === undefined &&
+            c.retiredAt === undefined &&
+            c.expiresAt > now &&
+            c.attestations)
             .flatMap((connection) => connection
             .attestations.external.map((attestation) => ({
             connection,
@@ -971,8 +1293,12 @@ export class VerilyService {
         }
         return this.transaction(async (tx) => {
             const current = await tx.get('connections', connection.id);
-            // It may have been revoked or reproved while the fetch was in flight.
-            if (!current?.attestations || current.revokedAt !== undefined)
+            // It may have been revoked or reproved while the fetch was in flight. Or retired, and
+            // then an answer written now would move the proof date it was frozen with, or revoke
+            // it on a withdrawal.
+            if (!current?.attestations ||
+                current.revokedAt !== undefined ||
+                current.retiredAt !== undefined)
                 return 0;
             const [first, ...rest] = current.attestations.external;
             const held = main ? first : rest.find((a) => a.method === method);
@@ -1002,7 +1328,11 @@ export class VerilyService {
             }),
         ]);
     }
-    /** Run periodically. Pending secrets expire immediately; historical evidence defaults to 90 days. */
+    /**
+     * Run periodically. Pending secrets expire immediately; historical evidence defaults to 90
+     * days. A retired record is history its holder asked to keep, so it stays for as long as
+     * it is not revoked, and once revoked goes like any other.
+     */
     async prune(retentionMs = 90 * 86400000) {
         if (!Number.isSafeInteger(retentionMs) || retentionMs < 0)
             throw new Error('Invalid retention');
@@ -1016,7 +1346,9 @@ export class VerilyService {
                     await tx.delete('limits', limit.id);
             const audit = await tx.list('audit');
             for (const connection of await tx.list('connections')) {
-                if ((connection.revokedAt ?? connection.expiresAt) + retentionMs <= now) {
+                const ended = connection.revokedAt ??
+                    (connection.retiredAt === undefined ? connection.expiresAt : Infinity);
+                if (ended + retentionMs <= now) {
                     await tx.delete('connections', connection.id);
                     await tx.delete('shares', connection.id);
                 }
@@ -1067,6 +1399,15 @@ function connected(connection) {
     return (connection.connectedAt ??
         Math.min(connection.approvedAt, connection.authenticatedAt, connection.visibilityApprovedAt, ...(connection.attestations?.external.map((a) => a.confirmedAt) ?? [])));
 }
+/**
+ * Whether a renewal by this method may go ahead. Any may renew a live record. A retired one
+ * is revived by the method it was first shown by alone, which replaces the proof the
+ * record is judged by.
+ */
+function revives(connection, provider) {
+    return (connection.retiredAt === undefined ||
+        (connection.attestations?.external[0].method ?? 'oauth') === providerMethod(provider));
+}
 /**
  * Whether two methods named the same account. Where both carry an id their provider
  * issued, that id settles it. A method that learns only an address, as a link back does,
@@ -1149,6 +1490,8 @@ function profile(url) {
 const dayMs = 86400000;
 /** How many wrong codes a flow takes before it is dead. */
 export const codeAttempts = 5;
+/** How many times a published proof may be refused before its flow is dead. */
+export const artifactAttempts = 5;
 /** Crockford's base 32: no I, L, O or U, so no letter is mistaken for a digit when typed. */
 const codeAlphabet = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
 /**

package/dist/server/youtube.js

@@ -15,7 +15,9 @@ export function youtubeProvider(options) {
         authorizationUrl({ state, challenge, redirectUri }) {
             const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
             // select_account lets a holder with several Google accounts, or a channel under a
-            // brand account, pick the one they mean rather than whichever is signed in.
+            // brand account, pick the one they mean rather than whichever is signed in. A flow on
+            // a record asks too: a channel is not a Google account, so nothing here can name the
+            // one to use, and the wrong one signed in silently would be refused with no way round.
             url.search = new URLSearchParams({
                 response_type: 'code',
                 client_id: options.clientId,

package/dist/site/index.d.ts

@@ -61,7 +61,8 @@ export interface SiteSubject {
 export interface SiteResult {
     site: string;
     id: string;
-    operation: 'connect' | 'renew' | 'visibility' | 'disconnect';
+    /** `mark` is an account listed another way or retired: read its records again to see how. */
+    operation: 'connect' | 'renew' | 'visibility' | 'disconnect' | 'mark';
     outcome: 'complete' | 'cancelled' | 'failed';
     /** Present when the outcome is complete. */
     connection?: string;