@bkazemi/verily 0.2.0 → 0.3.0

package/dist/browser/index.d.ts

@@ -1,4 +1,5 @@
 import type { Evidence } from '../core/index.js';
+import { type Listing } from './evidence-dialog.js';
 export type { Evidence } from '../core/index.js';
 export interface Result {
     outcome: 'complete' | 'cancelled' | 'failed';
@@ -29,7 +30,10 @@ export declare function init({ backendUrl, handoffUrl }: {
      * Opens the connect dialog over the current page. Resolves when it closes, with how
      * the last attempt in it ended. Call from a click: a sign-in method opens a window.
      */
-    openConnect(opener?: HTMLElement, back?: () => void, provider?: string): Promise<Result>;
+    openConnect(opener?: HTMLElement, back?: () => void, provider?: string, renew?: {
+        id: string;
+        method?: string;
+    }): Promise<Result>;
     /**
      * Draws the pill that opens the connect dialog. The host receives a `verily-result`
      * event, whose detail is the Result, whenever the dialog closes on a new connection.
@@ -54,6 +58,11 @@ export declare function init({ backendUrl, handoffUrl }: {
         connectionIds: string[];
     } & Arrangement): Promise<void>;
     disconnect(id: string): Promise<unknown>;
+    /**
+     * Says how the holder would have an account listed, or retires it. Names one record
+     * and acts on the account: every record of it the holder has.
+     */
+    mark(id: string, as: Listing): Promise<unknown>;
     issueShare: (id: string) => Promise<unknown>;
     revokeShare: (id: string) => Promise<unknown>;
 };

package/dist/browser/index.js

@@ -119,9 +119,11 @@ function arrange(element, { stacked, peek }) {
 }
 const live = (evidence) => evidence.status === 'verified' && evidence.expiresAt > Date.now();
 /**
- * A subject's accounts, one entry for each, in the order they were connected, earliest
- * first. Records are not accounts: the same account can stand on several, shown a second
- * way, or revoked once and connected again. Those are one account and get one card.
+ * A subject's accounts, one entry for each. The one its holder prefers comes first, then
+ * the rest in the order they were connected, earliest first, then those the holder no
+ * longer uses, and last those retired. Records are not accounts: the same account can
+ * stand on several, shown a second way, or revoked once and connected again. Those are one
+ * account and get one card.
  *
  * Where any of an account's records is verified now, the earliest of those speaks for it,
  * and the ways the others show it are listed beneath as other methods. Its lapsed
@@ -159,14 +161,26 @@ function accounts(records) {
             sources: verified.length ? verified : [base],
         };
     })
-        .sort((a, b) => a.connectedAt - b.connectedAt);
+        .sort((a, b) => place(a) - place(b) || a.connectedAt - b.connectedAt);
 }
 /**
- * One subject's accounts as a single pill: the first connected, then how many more stand
- * behind it. The order is the order they were connected in, which a renewal never changes.
- * Only accounts verified now are counted, and one of those leads when the first connected
- * has lapsed, so the pill never puts a lapsed account forward while a good one sits behind
- * a number. The lapsed ones are all still there in the dialog, each in its place.
+ * Where an account is listed among a subject's others, before the order they were
+ * connected in. This is all there is to preferring an account: there is no separate pin.
+ */
+function place(account) {
+    if (account.status === 'retired')
+        return 3;
+    return account.mark === 'preferred' ? 0 : account.mark === 'unused' ? 2 : 1;
+}
+/**
+ * One subject's accounts as a single pill: the first of them, then how many more stand
+ * behind it. The order is the holder's preferred account, then the order the rest were
+ * connected in, which a renewal never changes, then the ones no longer used.
+ * Only accounts verified now are counted, and one of those leads when the first has
+ * lapsed, so the pill never puts a lapsed account forward while a good one sits behind
+ * a number. The lapsed ones are all still there in the dialog, each in its place. A
+ * preferred account that has lapsed keeps its mark, and leads again once renewed. A
+ * retired account is never counted, and leads only where nothing else is shown.
  *
  * `load` gives the records afresh when the dialog opens and as it stays open.
  */
@@ -317,7 +331,9 @@ export function init({ backendUrl, handoffUrl }) {
                 safeUrl(data.local.profileUrl);
             return data;
         },
-        start: async (provider, method) => flowView(await ask('/sessions', { kind: 'connect', provider, method })),
+        start: async (provider, method, renew) => flowView(await ask('/sessions', renew
+            ? { kind: 'renew', connectionId: renew, provider, method }
+            : { kind: 'connect', provider, method })),
         read: async (id) => flowView(await ask(`/flows/${encodeURIComponent(id)}?format=json`, undefined, id)),
         submit: async (id, artifact) => flowView(await ask(`/flows/${encodeURIComponent(id)}/submit`, { artifact }, id)),
         async approve(id, visibility, cancel) {
@@ -362,12 +378,14 @@ export function init({ backendUrl, handoffUrl }) {
          * Opens the connect dialog over the current page. Resolves when it closes, with how
          * the last attempt in it ended. Call from a click: a sign-in method opens a window.
          */
-        openConnect(opener = document.body, back, provider) {
+        openConnect(opener = document.body, back, provider, 
+        /** A record of the holder's to renew, in place of connecting: see `openConnectDialog`. */
+        renew) {
             if (remote && !handoffUrl)
                 throw new Error('A backend on another origin requires a handoff URL');
             // Each opening is vouched for afresh, for whoever is signed in to this site now.
             session = undefined;
-            return openConnectDialog(opener, flows, back, provider);
+            return openConnectDialog(opener, flows, back, provider, renew);
         },
         /**
          * Draws the pill that opens the connect dialog. The host receives a `verily-result`
@@ -530,6 +548,15 @@ export function init({ backendUrl, handoffUrl }) {
                 session = undefined;
             return ask(`/connections/${encodeURIComponent(id)}/disconnect`, {});
         },
+        /**
+         * Says how the holder would have an account listed, or retires it. Names one record
+         * and acts on the account: every record of it the holder has.
+         */
+        mark(id, as) {
+            if (remote)
+                session = undefined;
+            return ask(`/connections/${encodeURIComponent(id)}/mark`, { as });
+        },
         issueShare: (id) => request(`/connections/${encodeURIComponent(id)}/share`, {}),
         revokeShare: (id) => request(`/connections/${encodeURIComponent(id)}/share-revoke`, {}),
     };
@@ -645,7 +672,12 @@ function validEvidence(value) {
             ['account', 'key', 'page', 'mailbox'].includes(String(value.external.kind))) &&
         (value.revokedAt === undefined ||
             (typeof value.revokedAt === 'number' && Number.isFinite(value.revokedAt))) &&
-        ['verified', 'unconfirmed', 'expired', 'revoked'].includes(String(value.status)) &&
+        ['verified', 'unconfirmed', 'expired', 'retired', 'revoked'].includes(String(value.status)) &&
+        // A retired record stands on its dates, so one that does not say when is not one.
+        (value.status === 'retired'
+            ? typeof value.retiredAt === 'number' && Number.isFinite(value.retiredAt)
+            : value.retiredAt === undefined) &&
+        (value.mark === undefined || ['preferred', 'unused'].includes(String(value.mark))) &&
         ['public', 'unlisted'].includes(String(value.visibility)) &&
         (value.connectedAt === undefined ||
             (typeof value.connectedAt === 'number' && Number.isFinite(value.connectedAt))) &&
@@ -766,6 +798,14 @@ if (typeof customElements !== 'undefined' && !customElements.get('verily-badge')
                                 changed(result);
                         });
                     },
+                    renew: (id, provider, method) => {
+                        void client
+                            .openConnect(this, () => details(this), provider, { id, method })
+                            .then((result) => {
+                            if (result.outcome === 'complete')
+                                changed(result);
+                        });
+                    },
                     // One at a time, each told as it goes: if a later one fails, the host still
                     // hears of those that went and reads its records again.
                     remove: async (ids) => {
@@ -774,6 +814,10 @@ if (typeof customElements !== 'undefined' && !customElements.get('verily-badge')
                             changed({ outcome: 'removed', connectionId: id });
                         }
                     },
+                    mark: async (id, as) => {
+                        await client.mark(id, as);
+                        changed({ outcome: 'marked', connectionId: id, as });
+                    },
                 });
             }
             else

package/dist/browser/logo.d.ts

@@ -1,2 +1,4 @@
+/** Where the logotype under a dialog leads: the project, for a reader asking what drew this. */
+export declare const projectUrl = "https://github.com/bkazemi/verily";
 /** The logotype, drawn as nodes: nothing in the badge sets innerHTML. */
 export declare function verilyLogo(): SVGSVGElement;

package/dist/browser/logo.js

@@ -1,4 +1,6 @@
 import { logoPaths, logoViewBox } from '../logo.js';
+/** Where the logotype under a dialog leads: the project, for a reader asking what drew this. */
+export const projectUrl = 'https://github.com/bkazemi/verily';
 /** The logotype, drawn as nodes: nothing in the badge sets innerHTML. */
 export function verilyLogo() {
     const namespace = 'http://www.w3.org/2000/svg';

package/dist/browser/mark.d.ts

@@ -15,5 +15,7 @@ export declare function paintMark(svg: SVGSVGElement, tone: MarkTone): void;
 export declare function verificationMark(tone?: MarkTone): SVGSVGElement;
 /** The clock on an expired record: a face, and hands at three o'clock. */
 export declare const clockMark: () => SVGSVGElement;
+/** The box on a retired record: a lid, what it holds, and a slot to take it down by. */
+export declare const boxMark: () => SVGSVGElement;
 /** The dash on a record that is revoked or cannot be shown. */
 export declare const dashMark: () => SVGSVGElement;

package/dist/browser/mark.js

@@ -73,5 +73,11 @@ export const clockMark = () => statusMark('clock', [
     ['circle', { cx: '8', cy: '8', r: '6.2' }],
     ['path', { d: 'M8 4.6V8h2.6' }],
 ]);
+/** The box on a retired record: a lid, what it holds, and a slot to take it down by. */
+export const boxMark = () => statusMark('box', [
+    ['path', { d: 'M2.6 3.8h10.8v2.6H2.6z' }],
+    ['path', { d: 'M3.7 6.4v5.8h8.6V6.4' }],
+    ['path', { d: 'M6.6 9h2.8' }],
+]);
 /** The dash on a record that is revoked or cannot be shown. */
 export const dashMark = () => statusMark('dash', [['path', { d: 'M4.4 8h7.2' }]]);

package/dist/browser/signed.d.ts

@@ -28,6 +28,10 @@ export declare function signature(evidence: Evidence): Promise<Signature>;
  * it, with only its present state taken from the record as read, so what stands beside the
  * signature mark is what was signed. One whose signed record failed is not shown as verified: the
  * verifier's own signature does not bear it out, so it reads as unconfirmed.
+ *
+ * The holder's mark is taken from the record as read too, each time, and never from the
+ * signed record kept: a mark would otherwise vanish the moment its record checked, and one
+ * changed since would go on being shown as it was.
  */
 export declare function standing<T extends Evidence>(evidence: T): T;
 /**

package/dist/browser/signed.js

@@ -27,9 +27,12 @@ function canonical(value) {
         .map(([key, field]) => `${JSON.stringify(key)}:${canonical(field)}`)
         .join(',')}}`;
 }
-/** What a record claims, apart from whether it stands now: all a signed record can bear out. */
+/**
+ * What a record claims, apart from whether it stands now: all a signed record can bear out.
+ * The holder's mark is no claim of the verifier's and is in no signed record.
+ */
 function claims(record) {
-    const { status: _status, revokedAt: _revokedAt, signedUrl: _signedUrl, links: _links, type: _type, version: _version, issuedAt: _issuedAt, ...rest } = record;
+    const { status: _status, revokedAt: _revokedAt, signedUrl: _signedUrl, mark: _mark, links: _links, type: _type, version: _version, issuedAt: _issuedAt, ...rest } = record;
     return canonical(rest);
 }
 /**
@@ -124,13 +127,20 @@ async function check(evidence) {
             document.provider !== evidence.provider ||
             document.external.id !== evidence.external.id)
             return { state: 'invalid' };
+        // A retired record is signed as a version of its own, and a record that stands as the
+        // other. One served for the other is the record caught between the two, and no verdict.
+        if ((document.version === 2) !== (evidence.status === 'retired'))
+            return { state: 'unchecked', why: 'unreadable' };
         // The record as it was signed. Whether it stands now is no part of a signed record, so
-        // that alone is kept from the record as it was read.
-        const { type: _type, version: _version, issuedAt: _issuedAt, ...said } = document;
+        // that is kept from the record as it was read, and so is the holder's mark, which is in
+        // no signed record: whatever a document says of either is left behind.
+        const { type: _type, version: _version, issuedAt: _issuedAt, status: _status, retiredAt: _retiredAt, mark: _mark, ...said } = document;
         const record = {
             ...said,
             status: evidence.status,
             ...(evidence.revokedAt === undefined ? {} : { revokedAt: evidence.revokedAt }),
+            ...(document.version === 2 ? { retiredAt: document.retiredAt } : {}),
+            ...(evidence.mark === undefined ? {} : { mark: evidence.mark }),
             signedUrl: evidence.signedUrl,
         };
         // Signed, but not something a page may draw: it is shown as read, with no mark.
@@ -178,18 +188,25 @@ export function signature(evidence) {
  * it, with only its present state taken from the record as read, so what stands beside the
  * signature mark is what was signed. One whose signed record failed is not shown as verified: the
  * verifier's own signature does not bear it out, so it reads as unconfirmed.
+ *
+ * The holder's mark is taken from the record as read too, each time, and never from the
+ * signed record kept: a mark would otherwise vanish the moment its record checked, and one
+ * changed since would go on being shown as it was.
  */
 export function standing(evidence) {
     if (evidence.signedUrl === undefined)
         return evidence;
     const key = shown(evidence);
     const signed = signedAs.get(key);
-    if (signed)
+    if (signed) {
+        const { mark: _mark, ...said } = signed;
         return {
-            ...signed,
+            ...said,
             status: evidence.status,
             ...(evidence.revokedAt === undefined ? {} : { revokedAt: evidence.revokedAt }),
+            ...(evidence.mark === undefined ? {} : { mark: evidence.mark }),
         };
+    }
     return evidence.status === 'verified' && failures.has(key)
         ? { ...evidence, status: 'unconfirmed' }
         : evidence;

package/dist/core/index.d.ts

@@ -2,9 +2,16 @@ export type Visibility = 'public' | 'unlisted';
 /**
  * `unconfirmed` is a published proof that has not been read lately. It is not disproved,
  * and turns back to `verified` the moment the proof reads again. `expired` is an approval
- * that ran out, which only the holder renewing it undoes.
+ * that ran out, which only the holder renewing it undoes. `retired` is an account its
+ * holder said is finished: the record is kept as it stood at its last proof and never
+ * reads as verified again, unless that proof is made afresh.
  */
-export type Status = 'verified' | 'unconfirmed' | 'expired' | 'revoked';
+export type Status = 'verified' | 'unconfirmed' | 'expired' | 'retired' | 'revoked';
+/**
+ * How the holder would have an account listed: the one to lead with, or one they still
+ * control and no longer use. The holder's own statement, and no part of what was verified.
+ */
+export type Mark = 'preferred' | 'unused';
 /** What a site links: one of its accounts, a single page, or the site itself. */
 export type LocalKind = 'account' | 'page' | 'site';
 /** id is private and must never be reassigned. reference is durable and public-safe. */
@@ -106,6 +113,13 @@ export interface Connection {
     attestations?: Attestations;
     /** The proof itself, for a method whose artifact this backend publishes rather than reads. */
     proof?: string;
+    /** Set and cleared by the holder. Absent is an ordinary current account. */
+    mark?: Mark;
+    /**
+     * When the holder said the account is finished. From then the record is frozen at its
+     * last proof: never renewed by another method, never reread, never verified.
+     */
+    retiredAt?: number;
 }
 export interface Flow {
     id: string;
@@ -426,10 +440,17 @@ export interface Evidence {
     visibilityApprovedAt: number;
     expiresAt: number;
     revokedAt?: number;
+    /**
+     * What the holder says of the account, and when they said it was finished. Both are the
+     * holder's statements, beside the attestations and never among them: nothing checked them.
+     */
+    mark?: Mark;
+    retiredAt?: number;
     evidenceUrl: string;
     /**
      * Where this record can be had signed, on a verifier that signs. Only a public record
-     * that stands has a signed form: once saved, a signed record cannot be taken back.
+     * that stands, or one retired, has a signed form: once saved, a signed record cannot be
+     * taken back.
      */
     signedUrl?: string;
 }
@@ -452,6 +473,11 @@ export declare function status(connection: Connection, now: number, freshness?:
  * reverses the moment it reads again.
  */
 export declare function fresh(attestation: Attestation, now: number, freshness?: number): boolean;
+/**
+ * The date a retired record stands on: when its account was last proved. A sign-in was
+ * proved when it happened, and a published proof when it was last read.
+ */
+export declare function lastProved(evidence: Pick<Evidence, 'authenticatedAt' | 'attestations'>): number;
 /**
  * The word for a record's state. Evidence can be read after it was issued, so an approval
  * that has run out since reads as expired whatever status it was issued with.

package/dist/core/index.js

@@ -35,6 +35,9 @@ export const freshnessMs = 7 * 86400000;
 export function status(connection, now, freshness = freshnessMs) {
     if (connection.revokedAt !== undefined)
         return 'revoked';
+    // Frozen at its last proof, so neither its expiry nor its freshness is read again.
+    if (connection.retiredAt !== undefined)
+        return 'retired';
     if (now >= connection.expiresAt)
         return 'expired';
     const main = connection.attestations?.external[0];
@@ -53,6 +56,14 @@ export function fresh(attestation, now, freshness = freshnessMs) {
         freshness === Infinity ||
         now < attestation.confirmedAt + freshness);
 }
+/**
+ * The date a retired record stands on: when its account was last proved. A sign-in was
+ * proved when it happened, and a published proof when it was last read.
+ */
+export function lastProved(evidence) {
+    const main = evidence.attestations.external[0];
+    return main.artifactUrl ? main.confirmedAt : evidence.authenticatedAt;
+}
 /**
  * The word for a record's state. Evidence can be read after it was issued, so an approval
  * that has run out since reads as expired whatever status it was issued with.
@@ -60,6 +71,9 @@ export function fresh(attestation, now, freshness = freshnessMs) {
 export function statusLabel(evidence, now) {
     if (evidence.status === 'revoked')
         return 'Revoked';
+    // Before expiry: a retired record's approval has long run out, and that is not its state.
+    if (evidence.status === 'retired')
+        return 'Retired';
     if (evidence.status === 'expired' || evidence.expiresAt <= now)
         return 'Expired';
     return evidence.status === 'unconfirmed' ? 'Unconfirmed' : 'Verified';

package/dist/core/signed.d.ts

@@ -11,15 +11,29 @@ export interface VerifierKey {
     publicKey: string;
 }
 /**
- * What a signature covers: the record as it stood at `issuedAt`. Whether it still stands
- * is a live fact no signature holds, so its status is left out and `evidenceUrl` is where
- * to ask.
+ * What either version says of a record. The holder's mark is left out: it is about how
+ * their accounts are listed, and no part of what was verified.
  */
-export type SignedDocument = Omit<Evidence, 'status' | 'revokedAt' | 'signedUrl'> & {
+type Signable = Omit<Evidence, 'status' | 'revokedAt' | 'signedUrl' | 'mark' | 'retiredAt'> & {
     type: 'verily-evidence';
-    version: 1;
     issuedAt: number;
 };
+/**
+ * What a signature covers: the record as it stood at `issuedAt`. Whether it still stands
+ * is a live fact no signature holds, so version 1 leaves its status out, means the record
+ * stood when it was signed, and gives `evidenceUrl` as where to ask.
+ *
+ * Version 2 is a retired record, which did not stand when it was signed and says so. It is
+ * a version of its own because a reader of version 1 ignores fields it does not know, and
+ * would read a retired record signed as version 1 as one that stood.
+ */
+export type SignedDocument = (Signable & {
+    version: 1;
+}) | (Signable & {
+    version: 2;
+    status: 'retired';
+    retiredAt: number;
+});
 /**
  * A record that can be checked away from the verifier that served it: the document as
  * text under an OpenPGP cleartext signature, which `gpg --verify` reads as it is.
@@ -47,3 +61,4 @@ export declare function signedBy(signed: unknown): Promise<string | undefined>;
  * of it, so the fingerprint a record names is the one a list holds.
  */
 export declare function verifySigned(signed: unknown, keys: VerifierKey[]): Promise<SignedDocument | undefined>;
+export {};

package/dist/core/signed.js

@@ -100,8 +100,11 @@ export async function verifySigned(signed, keys) {
             await signatures[0].verified;
             const document = JSON.parse(data);
             return document?.type === 'verily-evidence' &&
-                document.version === 1 &&
-                typeof document.issuedAt === 'number'
+                typeof document.issuedAt === 'number' &&
+                (document.version === 1 ||
+                    (document.version === 2 &&
+                        document.status === 'retired' &&
+                        typeof document.retiredAt === 'number'))
                 ? document
                 : undefined;
         }

package/dist/server/index.js

@@ -1,4 +1,4 @@
-import { attestationLabel, externalLink, externalName, isArtifactProvider, isCodeProvider, isRedirectProvider, localSide, proofTitle, providerMethod, statusLabel, signedBy, } from '../core/index.js';
+import { attestationLabel, externalLink, externalName, isArtifactProvider, isCodeProvider, isRedirectProvider, lastProved, localSide, proofTitle, providerMethod, statusLabel, signedBy, } from '../core/index.js';
 import { artifactAttempts, codeAttempts, VerilyService, Unavailable, } from './service.js';
 import { copyScript, waitScript } from './copy.js';
 import { escape } from './escape.js';
@@ -245,20 +245,32 @@ function evidencePage(e, base, report, keyId) {
         card(names.provider, externalName(e.external), externalLink(e.external), 
         // A mailbox's address is its name already, so there is no second identifier.
         e.external.kind === 'mailbox' ? undefined : e.external.id, externalNotes(e.attestations, names)) +
-        times([
-            ['Approved', e.approvedAt],
-            ['Authenticated', e.authenticatedAt],
-            [current ? 'Valid until' : 'Expired on', e.status === 'revoked' ? undefined : e.expiresAt],
-            ['Revoked on', e.revokedAt],
-            // Only a method that publishes an artifact drifts; a sign-in does not go stale.
-            [
-                'Last checked',
-                e.attestations.external[0].artifactUrl
-                    ? e.attestations.external[0].confirmedAt
-                    : undefined,
-            ],
-            ['Sharing link expires', e.linkExpiresAt],
-        ]) +
+        times(e.status === 'retired'
+            ? [
+                ['Approved', e.approvedAt],
+                // Two rows, always, so a reader sees any gap between them: an account retired
+                // weeks after it was last proved went unproved for those weeks.
+                ['Last verified', lastProved(e)],
+                ['Retired', e.retiredAt],
+                ['Sharing link expires', e.linkExpiresAt],
+            ]
+            : [
+                ['Approved', e.approvedAt],
+                ['Authenticated', e.authenticatedAt],
+                [
+                    current ? 'Valid until' : 'Expired on',
+                    e.status === 'revoked' ? undefined : e.expiresAt,
+                ],
+                ['Revoked on', e.revokedAt],
+                // Only a method that publishes an artifact drifts; a sign-in does not go stale.
+                [
+                    'Last checked',
+                    e.attestations.external[0].artifactUrl
+                        ? e.attestations.external[0].confirmedAt
+                        : undefined,
+                ],
+                ['Sharing link expires', e.linkExpiresAt],
+            ]) +
         `${e.linkExpiresAt ? '<p class="fine">Anyone with this link can view and forward it.</p>' : ''}
     ${e.signedUrl ? `<p class="signed" id="signed"><strong>Signed by ${escape(e.verifierName)}</strong>${keyId ? ` with OpenPGP key <a href="${escape(base)}/keys.asc">${escape(keyId)}</a>` : ''}. <a href="${escape(safeUrl(e.signedUrl))}">Download the signed record</a>, which <a href="${escape(base)}/check">can be checked</a> without this page.</p>` : ''}
     <p class="fine">This connection does not establish legal identity, trustworthiness, content authorship, or permanent ownership.</p>
@@ -275,14 +287,23 @@ const checkForm = '<form method="post"><label>Signed record <textarea name="reco
 function checkedPage(d, keyId, base) {
     const names = { site: d.siteName, provider: d.providerName };
     const local = localSide(d.local, d.siteName);
-    return page(base, 'Signed record', `<p>${escape(d.verifierName)} signed this record. It shows what stood when it was signed, not what stands now.</p>` +
+    // A retired record did not stand when it was signed, and its heading says so first.
+    const retired = d.version === 2;
+    return page(base, retired ? 'Retired connection' : 'Signed record', `<p>${escape(d.verifierName)} signed this record. It shows what stood when it was signed, not what stands now.</p>` +
         card(local.heading, local.value, d.local.profileUrl, undefined, attestationNote(d.attestations.local, names)) +
         card(names.provider, externalName(d.external), externalLink(d.external), d.external.kind === 'mailbox' ? undefined : d.external.id, externalNotes(d.attestations, names)) +
-        times([
-            ['Signed', d.issuedAt],
-            ['Approved', d.approvedAt],
-            ['Valid until', d.expiresAt],
-        ]) +
+        times(retired
+            ? [
+                ['Signed', d.issuedAt],
+                ['Approved', d.approvedAt],
+                ['Last verified', lastProved(d)],
+                ['Retired', d.retiredAt],
+            ]
+            : [
+                ['Signed', d.issuedAt],
+                ['Approved', d.approvedAt],
+                ['Valid until', d.expiresAt],
+            ]) +
         `<p class="fine">Signing key <a href="${escape(base)}/keys.asc">${escape(keyId)}</a>.</p>
     <p class="fine"><a href="${escape(safeUrl(d.evidenceUrl))}">See whether this connection still stands</a></p>`);
 }
@@ -374,13 +395,24 @@ export function createVerily(options) {
     /**
      * The methods a page offers. A flow on an existing record stays in its namespace, so
      * where the holder is signed in that record narrows the list; removing a link from the
-     * external side refuses a standing proof, which anybody can hand back.
+     * external side refuses a standing proof, which anybody can hand back. A retired record
+     * is renewed by the method it was first shown by, so that one is offered alone.
      */
     async function offer(kind, id, user, requested) {
         let namespace = requested ?? undefined;
-        if (user && id)
-            namespace = (await service.read(id, user)).provider;
+        let only;
+        if (user && id) {
+            const held = await service.read(id, user);
+            namespace = held.provider;
+            if (held.status === 'retired') {
+                // Who can read a retired record is frozen with the rest of it.
+                if (kind === 'visibility')
+                    throw new Unavailable();
+                only = held.attestations.external[0].method;
+            }
+        }
         const offered = (user ? permitted(user) : service.providers).filter((p) => (namespace === undefined || p.id === namespace) &&
+            (only === undefined || providerMethod(p) === only) &&
             !(['revoke', 'share-revoke'].includes(kind) && isArtifactProvider(p) && p.expect));
         if (!offered.length)
             throw new Unavailable();
@@ -428,8 +460,8 @@ export function createVerily(options) {
         profileUrl: user.profileUrl,
     });
     /**
-     * A connect flow as the in-page dialog draws it: the same steps the flow pages walk
-     * through, as data, so the holder never has to leave the page they started on.
+     * A connect or renew flow as the in-page dialog draws it: the same steps the flow pages
+     * walk through, as data, so the holder never has to leave the page they started on.
      */
     async function flowView(flow, authorizationUrl) {
         const provider = service.providerOf(flow);
@@ -472,10 +504,10 @@ export function createVerily(options) {
             view.connectionId = flow.resultId;
         return view;
     }
-    /** A flow the dialog may read: one this holder started, to connect an account. */
+    /** A flow the dialog may read: one this holder started, to connect an account or renew one. */
     async function ownFlow(request, id) {
         const flow = await service.flow(id, binding(request));
-        if (flow.kind !== 'connect' || (await local(request)).id !== flow.local?.id)
+        if (!['connect', 'renew'].includes(flow.kind) || (await local(request)).id !== flow.local?.id)
             throw new Unavailable();
         return flow;
     }
@@ -775,7 +807,7 @@ export function createVerily(options) {
                     }), await context(request, kind), 
                     // Posted from this origin, which the check on every POST has already held it to.
                     true);
-                    if (asJson && kind === 'connect')
+                    if (asJson && ['connect', 'renew'].includes(kind))
                         return json(await flowView(await service.flow(flow.flowId, flow.binding), flow.authorizationUrl), flowCookie(flow.binding));
                     return redirect(entry(flow), flowCookie(flow.binding));
                 }
@@ -815,15 +847,21 @@ export function createVerily(options) {
                         return json(id ? { outcome: 'complete', connectionId: id } : { outcome: 'cancelled' });
                     return await ended(await service.flow(flow.id, binding(request)));
                 }
-                const management = path.match(/^\/connections\/([^/]+)\/(disconnect|share|share-revoke|visibility)$/);
+                const management = path.match(/^\/connections\/([^/]+)\/(disconnect|mark|share|share-revoke|visibility)$/);
                 if (management) {
                     const user = await local(request), id = management[1];
                     if (management[2] === 'disconnect') {
                         await service.revoke(id, user);
                         return json({ ok: true });
                     }
+                    // Acts on the account the record names: every record of it this holder has.
+                    if (management[2] === 'mark') {
+                        await service.mark(id, user, data.as);
+                        return json({ ok: true });
+                    }
                     if (management[2] === 'visibility') {
-                        await service.read(id, user);
+                        if ((await service.read(id, user)).status === 'retired')
+                            throw new Unavailable();
                         return json({ url: `${service.baseUrl}/visibility/${id}` });
                     }
                     return json((await service.share(id, user, management[2] === 'share-revoke')) ?? { ok: true });