@interop/wallet-core 0.50.0 → 0.52.1

package/README.md

@@ -65,10 +65,6 @@ The subpaths:
   [`@interop/data-integrity-core`](https://npm.im/@interop/data-integrity-core)
   and is re-exported here.
 
-- **`@interop/wallet-core/display`** -- pure verifiable-credential derivation /
-  display helpers and credential input parsing. Raw values out (ISO strings,
-  `Date`, booleans); date formatting, i18n, and UI concerns stay in the app.
-
 - **`@interop/wallet-core/webvh`** -- the account's did:webvh identity: the
   hosted DID log, its per-client update-key rotation, the client enrollment
   entries, the one-entry client-revocation edit (verification methods, update
@@ -145,13 +141,13 @@ The subpaths:
 
 - **`@interop/wallet-core/unlock`** -- standing unlock credentials: every unlock
   method (passphrase, passkey PRF, recovery code) as a standing credential in
-  the recovery-code posture, with self-enrolling login. The credential-derived
-  client identity and binding MAC key, the update-key ladder
+  the recovery-code configuration, with self-enrolling login. The
+  credential-derived client identity and binding MAC key, the update-key ladder
   (latent-and-consumed did:webvh update authority from a random seed carried in
   the unlock record, the current rung recovered from the log itself), the unlock
   record codec (shell / bridge delegation / ladder members under a
   credential-authenticated binding, with the bridge-only re-mint), the merged
-  document-posture edit (a verbatim `keyAgreement` entry or a
+  document-inventory edit (a verbatim `keyAgreement` entry or a
   `publicKeyCommitment` entry for a low-entropy-derived key), and the
   self-enrolling continuation with its composed completion.
 
@@ -192,10 +188,10 @@ import {
 ```
 
 The `sync` and `space` subpaths are re-exported from the package root as well.
-Every other subpath (`identity`, `request`, `display`, `webvh`, `keys`,
-`clients`, `descriptors`, `keyring`, `enrollment`, `recovery`) is
-import-directly-only, so consumers of the root never pull the signing / KMS /
-document-loader dependency graph.
+Every other subpath (`identity`, `request`, `webvh`, `keys`, `clients`,
+`descriptors`, `keyring`, `enrollment`, `recovery`) is import-directly-only, so
+consumers of the root never pull the signing / KMS / document-loader dependency
+graph.
 
 ## Contribute
 

package/dist/clientAnnex/credentialAnchoredGenesis.d.ts

@@ -15,7 +15,7 @@
  * 2. The ladder-anchored did:webvh genesis
  *    (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0, `updateKeys` = [rung 0], `nextKeyHashes`
  *    = [hash(rung 0), hash(rung 1)], the ladder VM and the credential's
- *    `keyAgreement` posture folded in, `portable` unchanged. There is no KMS
+ *    `keyAgreement` inventory folded in, `portable` unchanged. There is no KMS
  *    stage: the keystore is DEFERRED to the first durable enrollment (a
  *    ladder-anchored account has no consumer for the convenience VM, and a
  *    keystore under an evaporating identity would orphan).
@@ -24,12 +24,21 @@
  *    -- with the entry proof signed by the ladder VM (the ceremony-tail
  *    license's first-entry shape). The account is credential-recoverable
  *    from the moment this lands.
- * 4. Epoch[0] on every encrypted roster collection -- gated on the roster
- *    stage landing, unlike the durable flow: the user key here exists only
- *    in this tab's memory, so installing collection epochs under a key the
- *    roster does not deliver would strand the collections on a key that
- *    dies with the tab. With the gate, the tear heal is always clean: no
- *    roster means no epochs, and a fresh user key re-runs both.
+ * 4. Epoch[0] on every encrypted roster collection -- gated twice, unlike
+ *    the durable flow. The roster stage must have landed, AND the roster's
+ *    current epoch must BE the `userKey` this run was handed: the user key
+ *    here exists only in this tab's memory, so installing collection epochs
+ *    under a key the roster does not deliver would strand the collections
+ *    on a key that dies with the tab. The second gate is what a re-run over
+ *    an earlier run's roster hits: `read()` adopts a roster keyed to that
+ *    run's user key, and this run's candidate key is a throwaway nobody
+ *    holds -- installing epoch[0] under it on a collection the earlier run
+ *    never reached would key that collection to nothing, permanently, since
+ *    the install is create-if-absent and every later ensure adopts it. So
+ *    the stage is skipped whole and reported on `epochsSkipped`; the caller
+ *    that recovers the roster's real key is the one installer. With both
+ *    gates the tear heal is always clean: no roster means no epochs, and a
+ *    fresh user key re-runs both.
  * 5. Space-controller promotion, last -- every earlier stage ran under the
  *    bootstrap did:key the Space's stored controller authorizes.
  *
@@ -43,7 +52,7 @@ import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import type { UnlockKeyAgreementPublication } from '../unlock/standingWebvh.js';
 import { type UserKey } from '../keys/index.js';
-import type { ResourceLogPinStore } from '../resourceLog/index.js';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type AccountGenesisResult } from '../genesis/accountGenesis.js';
 /**
  * The key set a credential-anchored signup mints locally before anything

package/dist/clientAnnex/credentialAnchoredGenesis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAC,CAED;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;IAC3C,iBAAiB,EAAE,kBAAkB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+EhC"}
+{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAC,CAED;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;IAC3C,iBAAiB,EAAE,kBAAkB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0FhC"}

package/dist/clientAnnex/credentialAnchoredGenesis.js

@@ -15,7 +15,7 @@
  * 2. The ladder-anchored did:webvh genesis
  *    (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0, `updateKeys` = [rung 0], `nextKeyHashes`
  *    = [hash(rung 0), hash(rung 1)], the ladder VM and the credential's
- *    `keyAgreement` posture folded in, `portable` unchanged. There is no KMS
+ *    `keyAgreement` inventory folded in, `portable` unchanged. There is no KMS
  *    stage: the keystore is DEFERRED to the first durable enrollment (a
  *    ladder-anchored account has no consumer for the convenience VM, and a
  *    keystore under an evaporating identity would orphan).
@@ -24,12 +24,21 @@
  *    -- with the entry proof signed by the ladder VM (the ceremony-tail
  *    license's first-entry shape). The account is credential-recoverable
  *    from the moment this lands.
- * 4. Epoch[0] on every encrypted roster collection -- gated on the roster
- *    stage landing, unlike the durable flow: the user key here exists only
- *    in this tab's memory, so installing collection epochs under a key the
- *    roster does not deliver would strand the collections on a key that
- *    dies with the tab. With the gate, the tear heal is always clean: no
- *    roster means no epochs, and a fresh user key re-runs both.
+ * 4. Epoch[0] on every encrypted roster collection -- gated twice, unlike
+ *    the durable flow. The roster stage must have landed, AND the roster's
+ *    current epoch must BE the `userKey` this run was handed: the user key
+ *    here exists only in this tab's memory, so installing collection epochs
+ *    under a key the roster does not deliver would strand the collections
+ *    on a key that dies with the tab. The second gate is what a re-run over
+ *    an earlier run's roster hits: `read()` adopts a roster keyed to that
+ *    run's user key, and this run's candidate key is a throwaway nobody
+ *    holds -- installing epoch[0] under it on a collection the earlier run
+ *    never reached would key that collection to nothing, permanently, since
+ *    the install is create-if-absent and every later ensure adopts it. So
+ *    the stage is skipped whole and reported on `epochsSkipped`; the caller
+ *    that recovers the roster's real key is the one installer. With both
+ *    gates the tear heal is always clean: no roster means no epochs, and a
+ *    fresh user key re-runs both.
  * 5. Space-controller promotion, last -- every earlier stage ran under the
  *    bootstrap did:key the Space's stored controller authorizes.
  *
@@ -137,14 +146,25 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
         failed.push({ stage: 'roster', error: err });
     }
     // 4. Epoch[0] on every encrypted roster collection, only behind a landed
-    // roster (see the module doc: the user key is memory-only here).
+    // roster whose current epoch IS this run's user key (see the module doc:
+    // the user key is memory-only here, and an adopted roster keyed to another
+    // run's key would have the collections installed under a throwaway).
     let epochs;
+    let epochsSkipped;
     if (rosterDescriptor) {
-        try {
-            epochs = await ensureWalletSpaceEpochs({ was, spaceId, userKey });
+        if (rosterDescriptor.currentEpoch === userKey.id) {
+            try {
+                epochs = await ensureWalletSpaceEpochs({ was, spaceId, userKey });
+            }
+            catch (err) {
+                failed.push({ stage: 'epochs', error: err });
+            }
         }
-        catch (err) {
-            failed.push({ stage: 'epochs', error: err });
+        else {
+            epochsSkipped =
+                rosterDescriptor.currentEpoch !== undefined
+                    ? { rosterEpochId: rosterDescriptor.currentEpoch }
+                    : {};
         }
     }
     // 5. The controller promotion, last. The bootstrap client IS the bare
@@ -167,6 +187,7 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
         did,
         ...(rosterDescriptor ? { rosterDescriptor } : {}),
         ...(epochs ? { epochs } : {}),
+        ...(epochsSkipped ? { epochsSkipped } : {}),
         ...(promotion ? { promotion } : {}),
         failed
     };

package/dist/clientAnnex/credentialAnchoredGenesis.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentialAnchoredGenesis.js","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EACL,cAAc,EAEf,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,WAAW,EAEZ,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IAIvD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAAG,IAAI,EAezB;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAErD,qEAAqE;IACrE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,2DAA2D;IAC3D,wFAAwF;IACxF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO;QACP,YAAY;QACZ,OAAO;QACP,UAAU;QACV,YAAY;QACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,gBAAgB;YACd,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC,MAAM,cAAc,CAAC;oBACnB,KAAK;oBACL,UAAU,EAAE,CAAC,iBAAiB,CAAC;oBAC/B,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;iBACvD,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,MAA2C,CAAA;IAC/C,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,SAA4C,CAAA;IAChD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,WAAW,EAAE,GAAG;gBAChB,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"credentialAnchoredGenesis.js","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EACL,cAAc,EAEf,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,WAAW,EAEZ,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IAIvD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAAG,IAAI,EAezB;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAErD,qEAAqE;IACrE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,2DAA2D;IAC3D,wFAAwF;IACxF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO;QACP,YAAY;QACZ,OAAO;QACP,UAAU;QACV,YAAY;QACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,gBAAgB;YACd,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC,MAAM,cAAc,CAAC;oBACnB,KAAK;oBACL,UAAU,EAAE,CAAC,iBAAiB,CAAC;oBAC/B,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;iBACvD,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,gBAAgB,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa;gBACX,gBAAgB,CAAC,YAAY,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,YAAY,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,SAA4C,CAAA;IAChD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,WAAW,EAAE,GAAG;gBAChB,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/clientAnnex/forget.d.ts

@@ -16,7 +16,7 @@
  * so it can sign no roster append (the entry-proof rule), and its WAS
  * invocations stop verifying (the current-key-set rule), so the collection
  * fan-out cannot run either -- while a ladder-signed append is licensed only
- * at a posture-changing document version, which a not-last-client removal is
+ * at a inventory-changing document version, which a not-last-client removal is
  * not. So:
  *
  * 1. **The roster rotation**, PRE-edit, signed by the still-enrolled
@@ -31,7 +31,7 @@
  *    residue could open.
  * 3. **The removal entry** ({@link forgetWebvhClient}): one atomic
  *    ladder-signed entry through the bridge takes the client's whole document
- *    footprint out. The app's local wipe runs after this ceremony returns, so
+ *    inventory out. The app's local wipe runs after this ceremony returns, so
  *    a tear anywhere before the entry reads as "not forgotten" and a re-click
  *    resumes.
  *
@@ -60,6 +60,7 @@
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import type { RevokedClientKeys } from '../webvh/revokeClient.js';
 import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
@@ -88,9 +89,18 @@ export interface DurableClientForgetResult {
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
  *   `did.jsonl` bridge store; also serves the ceremony's public pre-edit
- *   read. The caller is expected to have verified the account log under its
- *   own chain-head pins in the same session (the ceremony re-reads through
- *   the seam and checks `expectedDid`, but carries no pin store itself)
+ *   read
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins. Every read the ceremony makes -- the pre-edit read the roster
+ *   rotation's recipient document comes from, and the removal entry's own
+ *   read inside its conflict-retry loop -- is checked against the pinned
+ *   head, so a served truncated prefix is refused (`ResourceLogContinuityError`,
+ *   `rollback`) before any roster append or log publish, and the pin
+ *   advances to the head the removal entry publishes. Without it the
+ *   ceremony checks `expectedDid` only
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
  * @param options.forgottenClient {RevokedClientKeys}   this client's public
  *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
@@ -117,8 +127,10 @@ export interface DurableClientForgetResult {
  * @param options.collections {CascadeCollections}   the fan-out's work
  * @returns {Promise<DurableClientForgetResult>}
  */
-export declare function forgetDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }: {
+export declare function forgetDurableClient({ logStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }: {
     logStore: UnlockLogStore;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
     ladderSeed: Uint8Array;
     forgottenClient: RevokedClientKeys;
     forgottenKeyAgreementKeyMultibase: string;

package/dist/clientAnnex/forget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,yBAAyB,CAAA;IACtC,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAoGrC"}
+{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,yBAAyB,CAAA;IACtC,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAwGrC"}

package/dist/clientAnnex/forget.js

@@ -10,9 +10,18 @@ import { forgetWebvhClient, LastDurableClientForgetError } from './ladderAnchore
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
  *   `did.jsonl` bridge store; also serves the ceremony's public pre-edit
- *   read. The caller is expected to have verified the account log under its
- *   own chain-head pins in the same session (the ceremony re-reads through
- *   the seam and checks `expectedDid`, but carries no pin store itself)
+ *   read
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins. Every read the ceremony makes -- the pre-edit read the roster
+ *   rotation's recipient document comes from, and the removal entry's own
+ *   read inside its conflict-retry loop -- is checked against the pinned
+ *   head, so a served truncated prefix is refused (`ResourceLogContinuityError`,
+ *   `rollback`) before any roster append or log publish, and the pin
+ *   advances to the head the removal entry publishes. Without it the
+ *   ceremony checks `expectedDid` only
+ * @param [options.logId] {string}   the account log's pin slot
+ *   (`accountLogPinId({ spaceId })`); required whenever a `pinStore` is
+ *   supplied
  * @param options.ladderSeed {Uint8Array}   the credential's ladder seed
  * @param options.forgottenClient {RevokedClientKeys}   this client's public
  *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
@@ -39,7 +48,7 @@ import { forgetWebvhClient, LastDurableClientForgetError } from './ladderAnchore
  * @param options.collections {CascadeCollections}   the fan-out's work
  * @returns {Promise<DurableClientForgetResult>}
  */
-export async function forgetDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }) {
+export async function forgetDurableClient({ logStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }) {
     // The pre-edit read, doing double duty: the last-client refusal must fire
     // BEFORE the rotation (or a refused forget would already have retired this
     // client's wrap), and the rotation's recipient resolver needs the pre-edit
@@ -48,7 +57,9 @@ export async function forgetDurableClient({ logStore, ladderSeed, forgottenClien
         // readPublishedLog only calls getIdResourceRaw, so the narrow seam is
         // safe.
         idStore: logStore,
-        expectedDid
+        expectedDid,
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {})
     });
     if (!published) {
         throw new Error('did:webvh: did.jsonl is missing; nothing to forget from.');
@@ -118,7 +129,9 @@ export async function forgetDurableClient({ logStore, ladderSeed, forgottenClien
         ladderSeed,
         forgottenClient,
         ...(knownLatentHashes ? { knownLatentHashes } : {}),
-        expectedDid
+        expectedDid,
+        ...(pinStore ? { pinStore } : {}),
+        ...(logId !== undefined ? { logId } : {})
     });
     return {
         rotated,

package/dist/clientAnnex/forget.js.map

@@ -1 +1 @@
-{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AA8DA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGpE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EAkBZ;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,sEAAsE;QACtE,QAAQ;QACR,OAAO,EAAE,QAAwB;QACjC,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IACrE,IACE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,4BAA4B,EAAE,CAAA;IAC1C,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,SAAS,CAAC,GAAG;gBACvB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;KACZ,CAAC,CAAA;IAEF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}
+{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AA8DA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAIpE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,4BAA4B,EAC7B,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EAoBZ;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,sEAAsE;QACtE,QAAQ;QACR,OAAO,EAAE,QAAwB;QACjC,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IACrE,IACE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,4BAA4B,EAAE,CAAA;IAC1C,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,SAAS,CAAC,GAAG;gBACvB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IAEF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}

package/dist/clientAnnex/forgetLast.d.ts

@@ -14,9 +14,9 @@
  * POST at all). So:
  *
  * 1. **The install entry** ({@link installLadderVmWebvh}): the ladder VM
- *    joins the document while the client's whole footprint stays -- the
+ *    joins the document while the client's whole inventory stays -- the
  *    both-present transitional state. This is the ceremony's
- *    posture-changing document version under the ceremony-tail license.
+ *    inventory-changing document version under the ceremony-tail license.
  * 2. **The roster rotation**, ladder-signed, anchored at the install entry,
  *    HTTP-invoked under the still-standing client: the user key rotates off
  *    this client's wrap in ONE append (the license's one-shot shape), read
@@ -50,14 +50,25 @@
  *    HTTP side still invokes under the still-standing client (the
  *    management zcaps are granted to the account DID, which only an enrolled
  *    client can invoke) -- which is why the stage must run before the
- *    removal entry. Best-effort per entry, every entry's fate reported.
- * 6. **The record re-bind seam** (`onBeforeRemoval`): the caller re-signs
- *    the LOGIN credential's bridge and `delegatedClients` sibling with the
- *    ladder VM and re-seals its unlock record with the credential in hand
- *    (a full re-wrap, proof verified rather than settled) -- the one record
- *    stage 5 need not reach.
+ *    removal entry. The pass walks every entry and reports each one's fate,
+ *    but the ceremony does not carry a failure past this point: a `failed`
+ *    entry refuses the removal entry ({@link RecordRemintFailedError},
+ *    naming the records the pass could not reach), since after the removal
+ *    nothing could ever re-sign that record's bridge. The client stays
+ *    enrolled, and a re-run reaches the entry again.
+ * 6. **The record re-bind seam** (`onBeforeRemoval`, required): the caller
+ *    re-signs the LOGIN credential's bridge and `delegatedClients` sibling
+ *    with the ladder VM and re-seals its unlock record with the credential
+ *    in hand (a full re-wrap, proof verified rather than settled). Stage 5
+ *    deliberately skips that credential (its record is re-sealed with the
+ *    credential in hand rather than through a management zcap), so the
+ *    seam is the only thing that ever re-signs the login credential's own
+ *    bridge with the ladder VM. Without it the removal entry would leave
+ *    every bridge signed by the struck key on an account with no durable
+ *    client -- an account nothing can write to -- which is why a call that
+ *    omits the seam is refused before any read.
  * 7. **The removal entry** ({@link forgetLastWebvhClient}): the client's
- *    whole document footprint out while the installed ladder VM keeps the
+ *    whole document inventory out while the installed ladder VM keeps the
  *    account anchored. The app's local wipe runs after this ceremony
  *    returns.
  *
@@ -70,8 +81,9 @@
  * and the forced replacement re-mints (the prior run's fresh delegation is
  * then revoked as history, so a re-run churns one delegation and strands
  * nothing), and the record re-mint re-checks staleness per entry (a record
- * already ladder-signed reads as current). Torn after the removal entry is
- * the finish-the-wipe state the app's next login maps.
+ * already ladder-signed reads as current, one whose re-mint failed is still
+ * rotted and is re-minted). Torn after the removal entry is the
+ * finish-the-wipe state the app's next login maps.
  *
  * The honest limitation is the cascade's, as everywhere: ciphertext this
  * browser already fetched stays forensically recoverable from its storage,
@@ -83,7 +95,7 @@ import type { ZcapClient } from '@interop/ezcap';
 import type { CollectionEncryption, IDelegatedZcap } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import { type RevokedClientKeys } from '../webvh/revokeClient.js';
-import type { ResourceLogPinStore } from '../resourceLog/index.js';
+import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
 import type { AccountPointer } from '../keyring/record.js';
@@ -132,10 +144,10 @@ export interface UnlockMethodsRemintReach<Entry extends RecoveryDelegationEntry
  * forgotten client was retired on this run, the per-collection fan-out
  * result, the generation stage's report, the other unlock methods' record
  * re-mint report (present when the caller supplied the reach: the counts and
- * every entry's fate, so a record the pass could not reach is named rather
- * than silently left with a rotted bridge), the document as the removal entry
- * left it, and -- when the account has a roster -- the rotated key with the
- * roster descriptor it was read from.
+ * every entry's fate; a completed ceremony never carries a `failed` outcome,
+ * since that refuses the removal entry instead), the document as the removal
+ * entry left it, and -- when the account has a roster -- the rotated key with
+ * the roster descriptor it was read from.
  */
 export interface LastDurableClientForgetResult {
     installed: boolean;
@@ -152,6 +164,22 @@ export interface LastDurableClientForgetResult {
     userKey?: UserKey;
     rosterDescriptor?: CollectionEncryption;
 }
+/**
+ * The record re-mint stage could not reach every other unlock method's
+ * record, so the removal entry was refused: `failed` names the entries whose
+ * re-mint threw (each carrying its cause), and `unlockMethods` is the whole
+ * stage report. The forgotten client is still enrolled and every stage
+ * before this one has landed, so a re-run resumes at the re-mint. Matched
+ * on `name` (the errors cross app-injected seams that may resolve to another
+ * copy of this package).
+ */
+export declare class RecordRemintFailedError extends Error {
+    readonly failed: RecordRemintOutcome[];
+    readonly unlockMethods: NonNullable<LastDurableClientForgetResult['unlockMethods']>;
+    constructor({ unlockMethods }: {
+        unlockMethods: NonNullable<LastDurableClientForgetResult['unlockMethods']>;
+    });
+}
 /**
  * Forgets the account's LAST enrolled durable client -- this browser's own
  * -- transitioning the account to the client-less, ladder-anchored state.
@@ -163,11 +191,15 @@ export interface LastDurableClientForgetResult {
  *
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
- *   `did.jsonl` bridge store; also serves the ceremony's public reads. The
- *   caller is expected to have verified the account log under its own
- *   chain-head pins in the same session (the ceremony re-reads through the
- *   seam and checks `expectedDid`, but carries no account-log pin store
- *   itself)
+ *   `did.jsonl` bridge store; also serves the ceremony's public reads
+ * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
+ *   pins, the account log's slot derived from `annex.accountSpaceId`. Every
+ *   account-log read the ceremony makes -- the pre-install read, and the
+ *   install and removal entries' own reads inside their conflict-retry
+ *   loops -- is checked against the pinned head, so a served truncated
+ *   prefix is refused (`ResourceLogContinuityError`, `rollback`) before any
+ *   roster append or log publish, and each entry advances the pin to the
+ *   head it publishes. Without it the ceremony checks `expectedDid` only
  * @param options.ladderSeed {Uint8Array}   the login credential's ladder seed
  * @param options.forgottenClient {RevokedClientKeys}   this client's public
  *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
@@ -182,7 +214,7 @@ export interface LastDurableClientForgetResult {
  * @param options.rosterStoreFor {Function}   `({ did, log }) => store` --
  *   builds the `key-map/user-key.jsonl` roster store whose appends are
  *   SIGNED BY THE LADDER VM and whose controller view resolves from the
- *   supplied post-install log (the posture-changing anchor the ceremony-tail
+ *   supplied post-install log (the inventory-changing anchor the ceremony-tail
  *   license admits), while its HTTP requests invoke under the still-standing
  *   client
  * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the standing
@@ -215,19 +247,24 @@ export interface LastDurableClientForgetResult {
  *   whose bridge (and sibling) the ladder VM re-signs and whose records it
  *   re-seals through their management zcaps, invoked as the still-standing
  *   client. Omitted, the stage is skipped and the result carries no
- *   `unlockMethods` report -- the residue decision 0004's amendment stated
- * @param [options.onBeforeRemoval] {Function}
+ *   `unlockMethods` report -- the residue decision 0004's amendment stated.
+ *   Supplied, an entry the pass could not re-mint refuses the removal entry
+ *   (`RecordRemintFailedError`)
+ * @param options.onBeforeRemoval {Function}
  *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
  *   after the record re-mint stage, immediately before the removal entry,
  *   with the post-install published state. The caller re-signs the login
  *   credential's bridge and `delegatedClients` sibling with the ladder VM
- *   and re-seals its unlock record here. Must be idempotent (a resumed run
- *   invokes it again)
+ *   and re-seals its unlock record here -- the only stage that reaches the
+ *   login credential's record, which the `unlockMethods` pass skips. Must
+ *   be idempotent (a resumed run invokes it again). Required: a call
+ *   without it throws a `TypeError` before any read
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<LastDurableClientForgetResult>}
  */
-export declare function forgetLastDurableClient({ logStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
+export declare function forgetLastDurableClient({ logStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
     logStore: UnlockLogStore;
+    pinStore?: ResourceLogPinStore;
     ladderSeed: Uint8Array;
     forgottenClient: RevokedClientKeys;
     forgottenKeyAgreementKeyMultibase: string;
@@ -257,7 +294,7 @@ export declare function forgetLastDurableClient({ logStore, ladderSeed, forgotte
         pinStore?: ResourceLogPinStore;
     };
     unlockMethods?: UnlockMethodsRemintReach;
-    onBeforeRemoval?: (published: {
+    onBeforeRemoval: (published: {
         did: string;
         doc: object;
         log: DIDLog;

package/dist/clientAnnex/forgetLast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAElE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAO1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE;QAC5B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA6JzC"}
+{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAO1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,6BAA6B,CAAC,eAAe,CAAC,CAC/C,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC3E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA2LzC"}