@interop/wallet-core 0.57.0 → 0.58.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/clientAnnex/credentialAnchoredGenesis.d.ts +24 -23
- package/dist/clientAnnex/credentialAnchoredGenesis.d.ts.map +1 -1
- package/dist/clientAnnex/credentialAnchoredGenesis.js +28 -26
- package/dist/clientAnnex/credentialAnchoredGenesis.js.map +1 -1
- package/dist/clientAnnex/establish.d.ts +3 -3
- package/dist/clientAnnex/establish.js +1 -1
- package/dist/clientAnnex/forget.d.ts +9 -9
- package/dist/clientAnnex/forget.d.ts.map +1 -1
- package/dist/clientAnnex/forget.js +5 -5
- package/dist/clientAnnex/forget.js.map +1 -1
- package/dist/clientAnnex/forgetLast.d.ts +15 -15
- package/dist/clientAnnex/forgetLast.d.ts.map +1 -1
- package/dist/clientAnnex/forgetLast.js +12 -12
- package/dist/clientAnnex/forgetLast.js.map +1 -1
- package/dist/clientAnnex/gc.d.ts +6 -6
- package/dist/clientAnnex/gc.js +4 -4
- package/dist/clientAnnex/gc.js.map +1 -1
- package/dist/clientAnnex/heal.d.ts +2 -2
- package/dist/clientAnnex/index.d.ts +12 -13
- package/dist/clientAnnex/index.d.ts.map +1 -1
- package/dist/clientAnnex/index.js +10 -11
- package/dist/clientAnnex/index.js.map +1 -1
- package/dist/clientAnnex/ladder.js +1 -1
- package/dist/clientAnnex/ladderAnchored.d.ts +34 -34
- package/dist/clientAnnex/ladderAnchored.d.ts.map +1 -1
- package/dist/clientAnnex/ladderAnchored.js +66 -66
- package/dist/clientAnnex/ladderAnchored.js.map +1 -1
- package/dist/clientAnnex/log.d.ts +34 -29
- package/dist/clientAnnex/log.d.ts.map +1 -1
- package/dist/clientAnnex/log.js +39 -31
- package/dist/clientAnnex/log.js.map +1 -1
- package/dist/clientAnnex/mend.d.ts +6 -6
- package/dist/clientAnnex/mend.d.ts.map +1 -1
- package/dist/clientAnnex/mend.js +8 -7
- package/dist/clientAnnex/mend.js.map +1 -1
- package/dist/clientAnnex/recoveryLadderAnchored.d.ts +2 -2
- package/dist/clientAnnex/recoveryLadderAnchored.js +4 -4
- package/dist/clientAnnex/selfEnroll.d.ts +2 -1
- package/dist/clientAnnex/selfEnroll.d.ts.map +1 -1
- package/dist/clientAnnex/selfEnroll.js +2 -2
- package/dist/clientAnnex/selfEnroll.js.map +1 -1
- package/dist/clientAnnex/zcap.d.ts +9 -3
- package/dist/clientAnnex/zcap.d.ts.map +1 -1
- package/dist/clientAnnex/zcap.js +10 -4
- package/dist/clientAnnex/zcap.js.map +1 -1
- package/dist/clients/revocation.d.ts +4 -4
- package/dist/descriptors/acquire.d.ts +8 -7
- package/dist/descriptors/acquire.d.ts.map +1 -1
- package/dist/descriptors/acquire.js.map +1 -1
- package/dist/descriptors/index.d.ts +1 -1
- package/dist/descriptors/index.js +1 -1
- package/dist/enrollment/enrollment.d.ts +2 -2
- package/dist/enrollment/enrollment.js +4 -4
- package/dist/enrollment/enrollment.js.map +1 -1
- package/dist/genesis/accountGenesis.d.ts +4 -4
- package/dist/genesis/accountGenesis.js +2 -2
- package/dist/recovery/recoveryDelegation.d.ts.map +1 -1
- package/dist/recovery/recoveryDelegation.js +5 -6
- package/dist/recovery/recoveryDelegation.js.map +1 -1
- package/dist/recovery/recoveryWebvh.d.ts +3 -3
- package/dist/recovery/recoveryWebvh.js +7 -7
- package/dist/recovery/recoveryWebvh.js.map +1 -1
- package/dist/sync/engine.d.ts +1 -1
- package/dist/webvh/didWebvh.d.ts +31 -28
- package/dist/webvh/didWebvh.d.ts.map +1 -1
- package/dist/webvh/didWebvh.js +40 -36
- package/dist/webvh/didWebvh.js.map +1 -1
- package/dist/webvh/listClients.d.ts +5 -6
- package/dist/webvh/listClients.d.ts.map +1 -1
- package/dist/webvh/listClients.js +5 -6
- package/dist/webvh/listClients.js.map +1 -1
- package/package.json +1 -1
|
@@ -3,9 +3,9 @@
|
|
|
3
3
|
*/
|
|
4
4
|
/**
|
|
5
5
|
* The account-genesis ceremony's CREDENTIAL-ANCHORED variant: such a
|
|
6
|
-
* signup mints no
|
|
6
|
+
* signup mints no enrolled client, so the ceremony is anchored on the unlock
|
|
7
7
|
* credential's ladder alone. The stage order mirrors `ensureAccountGenesis`
|
|
8
|
-
* with the
|
|
8
|
+
* with the enrolled-client members swapped for their ladder analogs:
|
|
9
9
|
*
|
|
10
10
|
* 1. Space provisioning under the ladder VM's bare did:key -- the bootstrap
|
|
11
11
|
* controller (wallet-core decision 0004, freewallet decision 0002's
|
|
@@ -13,41 +13,42 @@
|
|
|
13
13
|
* record's ladder seed, so a tab death here strands nothing a later
|
|
14
14
|
* login cannot finish or unwind.
|
|
15
15
|
* 2. The optional KMS key map (`provideDidWebKeys`), acquired only once the
|
|
16
|
-
* Space exists -- the
|
|
17
|
-
* wallet creates the keystore under the ladder VM's bare
|
|
18
|
-
* writes keys.json and did.json into the Space here.
|
|
19
|
-
* is collected and the genesis proceeds
|
|
20
|
-
* heal supplies the missing convenience
|
|
16
|
+
* Space exists -- the enrolled-client ceremony's stage, verbatim: a
|
|
17
|
+
* KMS-keeping wallet creates the keystore under the ladder VM's bare
|
|
18
|
+
* did:key and writes keys.json and did.json into the Space here.
|
|
19
|
+
* Best-effort: a throw is collected and the genesis proceeds
|
|
20
|
+
* keystore-less; a later login's heal supplies the missing convenience
|
|
21
|
+
* key.
|
|
21
22
|
* 3. The ladder-anchored did:webvh genesis
|
|
22
|
-
* (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0,
|
|
23
|
-
* = [hash(rung 0), hash(rung 1)],
|
|
24
|
-
* `keyAgreement` inventory folded in --
|
|
25
|
-
* map, the KMS-held authentication VM
|
|
26
|
-
* `portable` unchanged.
|
|
23
|
+
* (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0,
|
|
24
|
+
* `updateKeys` = [rung 0], `nextKeyHashes` = [hash(rung 0), hash(rung 1)],
|
|
25
|
+
* the ladder VM and the credential's `keyAgreement` inventory folded in --
|
|
26
|
+
* plus, when stage 2 delivered a key map, the KMS-held authentication VM
|
|
27
|
+
* under `authentication` only -- `portable` unchanged.
|
|
27
28
|
* 4. The user-key roster genesis, wrapped to the CREDENTIAL's standing
|
|
28
29
|
* key-agreement key -- the only recipient a ladder-anchored account has
|
|
29
30
|
* -- with the entry proof signed by the ladder VM (the ceremony-tail
|
|
30
31
|
* license's first-entry shape). The account is credential-recoverable
|
|
31
32
|
* from the moment this lands.
|
|
32
|
-
* 5. Epoch[0] on every encrypted roster collection -- gated twice, unlike
|
|
33
|
-
*
|
|
33
|
+
* 5. Epoch[0] on every encrypted roster collection -- gated twice, unlike the
|
|
34
|
+
* enrolled-client flow. The roster stage must have landed, AND the roster's
|
|
34
35
|
* current epoch must BE the `userKey` this run was handed: the user key
|
|
35
36
|
* here exists only in this tab's memory, so installing collection epochs
|
|
36
|
-
* under a key the roster does not deliver would strand the collections
|
|
37
|
-
*
|
|
38
|
-
*
|
|
39
|
-
*
|
|
40
|
-
*
|
|
41
|
-
*
|
|
42
|
-
*
|
|
43
|
-
*
|
|
37
|
+
* under a key the roster does not deliver would strand the collections on a
|
|
38
|
+
* key that dies with the tab. The second gate is what a re-run over an
|
|
39
|
+
* earlier run's roster hits: `read()` adopts a roster keyed to that run's
|
|
40
|
+
* user key, and this run's candidate key is a throwaway nobody holds --
|
|
41
|
+
* installing epoch[0] under it on a collection the earlier run never
|
|
42
|
+
* reached would key that collection to nothing, permanently, since the
|
|
43
|
+
* install is create-if-absent and every later ensure adopts it. So the
|
|
44
|
+
* stage is skipped whole and reported on `epochsSkipped`; the caller
|
|
44
45
|
* that recovers the roster's real key is the one installer. With both
|
|
45
46
|
* gates the tear heal is always clean: no roster means no epochs, and a
|
|
46
47
|
* fresh user key re-runs both.
|
|
47
48
|
* 6. Space-controller promotion, last -- every earlier stage ran under the
|
|
48
49
|
* bootstrap did:key the Space's stored controller authorizes.
|
|
49
50
|
*
|
|
50
|
-
* Idempotent end to end on the
|
|
51
|
+
* Idempotent end to end on the enrolled-client flow's convention; the did:webvh
|
|
51
52
|
* stage adopts a published log iff the ladder attributes it (a naive re-run
|
|
52
53
|
* would mint a different SCID, so adoption IS the torn-signup convergence).
|
|
53
54
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"credentialAnchoredGenesis.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAA;AAC/E,OAAO,EAGL,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;CAC3B,CAAC,CAED;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAwB,EACzB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,6BAA6B,CAAA;IAC3C,iBAAiB,EAAE,kBAAkB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,YAAY,CAAA;IACrB,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,yBAAyB,CAAA;IACvE,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2GhC"}
|
|
@@ -3,9 +3,9 @@
|
|
|
3
3
|
*/
|
|
4
4
|
/**
|
|
5
5
|
* The account-genesis ceremony's CREDENTIAL-ANCHORED variant: such a
|
|
6
|
-
* signup mints no
|
|
6
|
+
* signup mints no enrolled client, so the ceremony is anchored on the unlock
|
|
7
7
|
* credential's ladder alone. The stage order mirrors `ensureAccountGenesis`
|
|
8
|
-
* with the
|
|
8
|
+
* with the enrolled-client members swapped for their ladder analogs:
|
|
9
9
|
*
|
|
10
10
|
* 1. Space provisioning under the ladder VM's bare did:key -- the bootstrap
|
|
11
11
|
* controller (wallet-core decision 0004, freewallet decision 0002's
|
|
@@ -13,41 +13,42 @@
|
|
|
13
13
|
* record's ladder seed, so a tab death here strands nothing a later
|
|
14
14
|
* login cannot finish or unwind.
|
|
15
15
|
* 2. The optional KMS key map (`provideDidWebKeys`), acquired only once the
|
|
16
|
-
* Space exists -- the
|
|
17
|
-
* wallet creates the keystore under the ladder VM's bare
|
|
18
|
-
* writes keys.json and did.json into the Space here.
|
|
19
|
-
* is collected and the genesis proceeds
|
|
20
|
-
* heal supplies the missing convenience
|
|
16
|
+
* Space exists -- the enrolled-client ceremony's stage, verbatim: a
|
|
17
|
+
* KMS-keeping wallet creates the keystore under the ladder VM's bare
|
|
18
|
+
* did:key and writes keys.json and did.json into the Space here.
|
|
19
|
+
* Best-effort: a throw is collected and the genesis proceeds
|
|
20
|
+
* keystore-less; a later login's heal supplies the missing convenience
|
|
21
|
+
* key.
|
|
21
22
|
* 3. The ladder-anchored did:webvh genesis
|
|
22
|
-
* (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0,
|
|
23
|
-
* = [hash(rung 0), hash(rung 1)],
|
|
24
|
-
* `keyAgreement` inventory folded in --
|
|
25
|
-
* map, the KMS-held authentication VM
|
|
26
|
-
* `portable` unchanged.
|
|
23
|
+
* (`ensureLadderAnchoredDidWebvh`): the entry signed by ladder rung 0,
|
|
24
|
+
* `updateKeys` = [rung 0], `nextKeyHashes` = [hash(rung 0), hash(rung 1)],
|
|
25
|
+
* the ladder VM and the credential's `keyAgreement` inventory folded in --
|
|
26
|
+
* plus, when stage 2 delivered a key map, the KMS-held authentication VM
|
|
27
|
+
* under `authentication` only -- `portable` unchanged.
|
|
27
28
|
* 4. The user-key roster genesis, wrapped to the CREDENTIAL's standing
|
|
28
29
|
* key-agreement key -- the only recipient a ladder-anchored account has
|
|
29
30
|
* -- with the entry proof signed by the ladder VM (the ceremony-tail
|
|
30
31
|
* license's first-entry shape). The account is credential-recoverable
|
|
31
32
|
* from the moment this lands.
|
|
32
|
-
* 5. Epoch[0] on every encrypted roster collection -- gated twice, unlike
|
|
33
|
-
*
|
|
33
|
+
* 5. Epoch[0] on every encrypted roster collection -- gated twice, unlike the
|
|
34
|
+
* enrolled-client flow. The roster stage must have landed, AND the roster's
|
|
34
35
|
* current epoch must BE the `userKey` this run was handed: the user key
|
|
35
36
|
* here exists only in this tab's memory, so installing collection epochs
|
|
36
|
-
* under a key the roster does not deliver would strand the collections
|
|
37
|
-
*
|
|
38
|
-
*
|
|
39
|
-
*
|
|
40
|
-
*
|
|
41
|
-
*
|
|
42
|
-
*
|
|
43
|
-
*
|
|
37
|
+
* under a key the roster does not deliver would strand the collections on a
|
|
38
|
+
* key that dies with the tab. The second gate is what a re-run over an
|
|
39
|
+
* earlier run's roster hits: `read()` adopts a roster keyed to that run's
|
|
40
|
+
* user key, and this run's candidate key is a throwaway nobody holds --
|
|
41
|
+
* installing epoch[0] under it on a collection the earlier run never
|
|
42
|
+
* reached would key that collection to nothing, permanently, since the
|
|
43
|
+
* install is create-if-absent and every later ensure adopts it. So the
|
|
44
|
+
* stage is skipped whole and reported on `epochsSkipped`; the caller
|
|
44
45
|
* that recovers the roster's real key is the one installer. With both
|
|
45
46
|
* gates the tear heal is always clean: no roster means no epochs, and a
|
|
46
47
|
* fresh user key re-runs both.
|
|
47
48
|
* 6. Space-controller promotion, last -- every earlier stage ran under the
|
|
48
49
|
* bootstrap did:key the Space's stored controller authorizes.
|
|
49
50
|
*
|
|
50
|
-
* Idempotent end to end on the
|
|
51
|
+
* Idempotent end to end on the enrolled-client flow's convention; the did:webvh
|
|
51
52
|
* stage adopts a published log iff the ladder attributes it (a naive re-run
|
|
52
53
|
* would mint a different SCID, so adoption IS the torn-signup convergence).
|
|
53
54
|
*/
|
|
@@ -119,8 +120,8 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
|
|
|
119
120
|
const failed = [];
|
|
120
121
|
const bootstrap = await ladderVmAgent({ ladderSeed });
|
|
121
122
|
// 1. The Space and its collection roster, create-if-absent under the
|
|
122
|
-
// ladder VM's bare did:key. The typed refusal, exactly as on the
|
|
123
|
-
// flow: nothing downstream can proceed without a Space.
|
|
123
|
+
// ladder VM's bare did:key. The typed refusal, exactly as on the
|
|
124
|
+
// enrolled-client flow: nothing downstream can proceed without a Space.
|
|
124
125
|
try {
|
|
125
126
|
await provisionWalletSpace({ was, spaceId, controllerDid: bootstrap.id });
|
|
126
127
|
}
|
|
@@ -143,7 +144,8 @@ export async function ensureCredentialAnchoredAccountGenesis({ was, wasServerUrl
|
|
|
143
144
|
}
|
|
144
145
|
}
|
|
145
146
|
// 3. The ladder-anchored did:webvh genesis -- probe, adopt
|
|
146
|
-
// (ladder-attributed), or create-and-publish. Fatal on failure, like the
|
|
147
|
+
// (ladder-attributed), or create-and-publish. Fatal on failure, like the
|
|
148
|
+
// enrolled-client stage.
|
|
147
149
|
const { did } = await ensureLadderAnchoredDidWebvh({
|
|
148
150
|
idStore,
|
|
149
151
|
wasServerUrl,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentialAnchoredGenesis.js","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH
|
|
1
|
+
{"version":3,"file":"credentialAnchoredGenesis.js","sourceRoot":"","sources":["../../src/clientAnnex/credentialAnchoredGenesis.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EACL,cAAc,EAEf,MAAM,yBAAyB,CAAA;AAIhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,uBAAuB,EACvB,WAAW,EAGZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,WAAW,EAEZ,MAAM,8BAA8B,CAAA;AAErC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IAIvD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,EAC3D,GAAG,EACH,YAAY,EACZ,OAAO,EACP,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,OAAO,EACP,OAAO,EACP,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAAG,IAAI,EAgBzB;IACC,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAErD,qEAAqE;IACrE,iEAAiE;IACjE,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,UAAsC,CAAA;IAC1C,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,yEAAyE;IACzE,yBAAyB;IACzB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,4BAA4B,CAAC;QACjD,OAAO;QACP,YAAY;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,UAAU;QACV,YAAY;QACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,MAAM,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAE/B,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,gBAAkD,CAAA;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;QAClC,gBAAgB;YACd,OAAO,KAAK,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC,MAAM,cAAc,CAAC;oBACnB,KAAK;oBACL,UAAU,EAAE,CAAC,iBAAiB,CAAC;oBAC/B,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;iBACvD,CAAC,CAAA;IACV,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,MAA2C,CAAA;IAC/C,IAAI,aAAoD,CAAA;IACxD,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,gBAAgB,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa;gBACX,gBAAgB,CAAC,YAAY,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,aAAa,EAAE,gBAAgB,CAAC,YAAY,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAA;QACV,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,SAA4C,CAAA;IAChD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,6BAA6B,CAAC;gBAC9C,GAAG;gBACH,WAAW,EAAE,GAAG;gBAChB,OAAO;gBACP,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAA;AACH,CAAC"}
|
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
*/
|
|
4
4
|
/**
|
|
5
5
|
* The credential-anchored establishment: everything between a derived unlock
|
|
6
|
-
* credential and an account a transient login can enter, with no
|
|
6
|
+
* credential and an account a transient login can enter, with no enrolled
|
|
7
7
|
* client minted anywhere. One orchestrator serves the fresh signup and the
|
|
8
8
|
* login-time re-run alike -- every stage is an ensure, so a run torn at any
|
|
9
9
|
* point converges by running the whole thing again (the account log is
|
|
@@ -155,7 +155,7 @@ export interface CredentialAnchoredBindResult {
|
|
|
155
155
|
* the codec is caller-supplied: the record it writes MUST carry the standing
|
|
156
156
|
* layout (ladder seed, bridge, binding MAC -- no plain bind), and the
|
|
157
157
|
* caller's local keyring-freshness pin floor is consumed INSIDE this closure
|
|
158
|
-
* (advance-past stamping), so a
|
|
158
|
+
* (advance-past stamping), so a remembered caller must wire it there.
|
|
159
159
|
*/
|
|
160
160
|
export type CredentialAnchoredBindRecordHook = (options: {
|
|
161
161
|
controller: string;
|
|
@@ -322,7 +322,7 @@ export declare function ensurePointedClientAnnexGeneration({ account, wasServerU
|
|
|
322
322
|
* that must be best-effort swallows its own failures
|
|
323
323
|
* @param [options.pinStore] {ResourceLogPinStore} the chain-head pin store
|
|
324
324
|
* for every log read here (a transient visit's in-memory handle, or a
|
|
325
|
-
*
|
|
325
|
+
* client-local one when a remembered caller seeds its own pin)
|
|
326
326
|
* @param [options.now] {number} epoch milliseconds, for tests
|
|
327
327
|
* @returns {Promise<CredentialAnchoredEstablishment>}
|
|
328
328
|
* @throws {TypeError} synchronously, when a required hook is missing
|
|
@@ -311,7 +311,7 @@ function authorizationRefusal(err) {
|
|
|
311
311
|
* that must be best-effort swallows its own failures
|
|
312
312
|
* @param [options.pinStore] {ResourceLogPinStore} the chain-head pin store
|
|
313
313
|
* for every log read here (a transient visit's in-memory handle, or a
|
|
314
|
-
*
|
|
314
|
+
* client-local one when a remembered caller seeds its own pin)
|
|
315
315
|
* @param [options.now] {number} epoch milliseconds, for tests
|
|
316
316
|
* @returns {Promise<CredentialAnchoredEstablishment>}
|
|
317
317
|
* @throws {TypeError} synchronously, when a required hook is missing
|
|
@@ -2,12 +2,12 @@
|
|
|
2
2
|
* Copyright (c) 2026 Interop Alliance. All rights reserved.
|
|
3
3
|
*/
|
|
4
4
|
/**
|
|
5
|
-
* The forget ceremony: a remembered browser's
|
|
5
|
+
* The forget ceremony: a remembered browser's enrolled client removes ITSELF
|
|
6
6
|
* from the account, through the standing unlock credential's bridge, before
|
|
7
7
|
* the app wipes its local state. Self-enrollment in reverse, run with what a
|
|
8
|
-
* live
|
|
8
|
+
* live remembered session already holds -- the credential's ladder seed and its
|
|
9
9
|
* delegated `did.jsonl` bridge -- and refused for the account's last enrolled
|
|
10
|
-
*
|
|
10
|
+
* client ({@link LastEnrolledClientForgetError}), whose forget is the
|
|
11
11
|
* ladder-anchored transition, a separate ceremony.
|
|
12
12
|
*
|
|
13
13
|
* The stage order INVERTS the revocation cascade's document-edit-first rule,
|
|
@@ -48,7 +48,7 @@
|
|
|
48
48
|
* There is deliberately no recovery-delegation or generation-delegation
|
|
49
49
|
* re-mint stage: the forgetting client cannot re-mint with a key that dies at
|
|
50
50
|
* stage 3 (the replacement would rot moments later), so a delegation this
|
|
51
|
-
* client had signed is left to the standing self-heals (a
|
|
51
|
+
* client had signed is left to the standing self-heals (a remembered login's
|
|
52
52
|
* bridge refresh and `ensureGenerationDelegationCurrent` on the
|
|
53
53
|
* account-document axis).
|
|
54
54
|
*
|
|
@@ -72,7 +72,7 @@ import type { UnlockLogStore } from '../unlock/standingWebvh.js';
|
|
|
72
72
|
* has a roster -- the rotated key with the roster descriptor it was read
|
|
73
73
|
* from.
|
|
74
74
|
*/
|
|
75
|
-
export interface
|
|
75
|
+
export interface EnrolledClientForgetResult {
|
|
76
76
|
rotated: boolean;
|
|
77
77
|
collections: UserKeyCascadeResult;
|
|
78
78
|
did: string;
|
|
@@ -81,7 +81,7 @@ export interface DurableClientForgetResult {
|
|
|
81
81
|
rosterDescriptor?: CollectionEncryption;
|
|
82
82
|
}
|
|
83
83
|
/**
|
|
84
|
-
* Forgets one enrolled
|
|
84
|
+
* Forgets one enrolled client -- this browser's own -- from its
|
|
85
85
|
* account. See the module doc for the stage order (rotation and fan-out
|
|
86
86
|
* BEFORE the removal entry, the self-forget inversion) and the torn-state
|
|
87
87
|
* map. The caller runs the local wipe only after this resolves.
|
|
@@ -125,9 +125,9 @@ export interface DurableClientForgetResult {
|
|
|
125
125
|
* called with `{ userKey, latestEpochId, descriptor }` after the roster
|
|
126
126
|
* read and BEFORE the fan-out
|
|
127
127
|
* @param options.collections {CascadeCollections} the fan-out's work
|
|
128
|
-
* @returns {Promise<
|
|
128
|
+
* @returns {Promise<EnrolledClientForgetResult>}
|
|
129
129
|
*/
|
|
130
|
-
export declare function
|
|
130
|
+
export declare function forgetEnrolledClient({ logStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }: {
|
|
131
131
|
logStore: UnlockLogStore;
|
|
132
132
|
pinStore?: ResourceLogPinStore;
|
|
133
133
|
logId?: string;
|
|
@@ -146,5 +146,5 @@ export declare function forgetDurableClient({ logStore, pinStore, logId, ladderS
|
|
|
146
146
|
descriptor: CollectionEncryption;
|
|
147
147
|
}) => Promise<void>;
|
|
148
148
|
collections: CascadeCollections;
|
|
149
|
-
}): Promise<
|
|
149
|
+
}): Promise<EnrolledClientForgetResult>;
|
|
150
150
|
//# sourceMappingURL=forget.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,
|
|
1
|
+
{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,yBAAyB,CAAA;IACtC,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAwGtC"}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
import { readPublishedLog, relationIds } from '../webvh/didWebvh.js';
|
|
2
2
|
import { cascadeCollectionsToUserKey, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from '../keys/index.js';
|
|
3
|
-
import { forgetWebvhClient,
|
|
3
|
+
import { forgetWebvhClient, LastEnrolledClientForgetError } from './ladderAnchored.js';
|
|
4
4
|
/**
|
|
5
|
-
* Forgets one enrolled
|
|
5
|
+
* Forgets one enrolled client -- this browser's own -- from its
|
|
6
6
|
* account. See the module doc for the stage order (rotation and fan-out
|
|
7
7
|
* BEFORE the removal entry, the self-forget inversion) and the torn-state
|
|
8
8
|
* map. The caller runs the local wipe only after this resolves.
|
|
@@ -46,9 +46,9 @@ import { forgetWebvhClient, LastDurableClientForgetError } from './ladderAnchore
|
|
|
46
46
|
* called with `{ userKey, latestEpochId, descriptor }` after the roster
|
|
47
47
|
* read and BEFORE the fan-out
|
|
48
48
|
* @param options.collections {CascadeCollections} the fan-out's work
|
|
49
|
-
* @returns {Promise<
|
|
49
|
+
* @returns {Promise<EnrolledClientForgetResult>}
|
|
50
50
|
*/
|
|
51
|
-
export async function
|
|
51
|
+
export async function forgetEnrolledClient({ logStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }) {
|
|
52
52
|
// The pre-edit read, doing double duty: the last-client refusal must fire
|
|
53
53
|
// BEFORE the rotation (or a refused forget would already have retired this
|
|
54
54
|
// client's wrap), and the rotation's recipient resolver needs the pre-edit
|
|
@@ -68,7 +68,7 @@ export async function forgetDurableClient({ logStore, pinStore, logId, ladderSee
|
|
|
68
68
|
const invocationIds = relationIds(published.doc.capabilityInvocation);
|
|
69
69
|
if (invocationIds.includes(signingVmId) &&
|
|
70
70
|
invocationIds.every(id => id === signingVmId)) {
|
|
71
|
-
throw new
|
|
71
|
+
throw new LastEnrolledClientForgetError();
|
|
72
72
|
}
|
|
73
73
|
// Stages 1 and 2: the roster rotation off this client's wrap and the
|
|
74
74
|
// collection fan-out, both under this client's still-standing authority.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AA8DA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAIpE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,
|
|
1
|
+
{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AA8DA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAIpE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EAoBZ;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,sEAAsE;QACtE,QAAQ;QACR,OAAO,EAAE,QAAwB;QACjC,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IACrE,IACE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,6BAA6B,EAAE,CAAA;IAC3C,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,SAAS,CAAC,GAAG;gBACvB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IAEF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}
|
|
@@ -2,8 +2,8 @@
|
|
|
2
2
|
* Copyright (c) 2026 Interop Alliance. All rights reserved.
|
|
3
3
|
*/
|
|
4
4
|
/**
|
|
5
|
-
* The LAST
|
|
6
|
-
* takes an account from one enrolled
|
|
5
|
+
* The LAST enrolled client's forget: the two-entry transition ceremony that
|
|
6
|
+
* takes an account from one enrolled client to the client-less,
|
|
7
7
|
* ladder-anchored state -- the same state a credential-anchored signup and a
|
|
8
8
|
* transient recovery produce. Decision 0004's 2026-08-19 amendment fixes the
|
|
9
9
|
* entry order, and it is forced twice over: the server's revocation endpoint
|
|
@@ -45,7 +45,7 @@
|
|
|
45
45
|
* and record-signing key and the forgotten client named as retiring, so
|
|
46
46
|
* every delegation it signed counts as rotted ahead of the removal entry.
|
|
47
47
|
* Delegations the removed client had signed rot at that entry, and on a
|
|
48
|
-
* client-less account no
|
|
48
|
+
* client-less account no remembered login's refresh block will ever run
|
|
49
49
|
* again to heal them, so this is the one pass that reaches them. The
|
|
50
50
|
* HTTP side still invokes under the still-standing client (the
|
|
51
51
|
* management zcaps are granted to the account DID, which only an enrolled
|
|
@@ -65,7 +65,7 @@
|
|
|
65
65
|
* credential in hand rather than through a management zcap), so the
|
|
66
66
|
* seam is the only thing that ever re-signs the login credential's own
|
|
67
67
|
* bridge with the ladder VM. Without it the removal entry would leave
|
|
68
|
-
* every bridge signed by the struck key on an account with no
|
|
68
|
+
* every bridge signed by the struck key on an account with no enrolled
|
|
69
69
|
* client -- an account nothing can write to -- which is why a call that
|
|
70
70
|
* omits the seam is refused before any read.
|
|
71
71
|
* 7. **The removal entry** ({@link forgetLastWebvhClient}): the client's
|
|
@@ -150,7 +150,7 @@ export interface UnlockMethodsRemintReach<Entry extends RecoveryDelegationEntry
|
|
|
150
150
|
* entry left it, and -- when the account has a roster -- the rotated key with
|
|
151
151
|
* the roster descriptor it was read from.
|
|
152
152
|
*/
|
|
153
|
-
export interface
|
|
153
|
+
export interface LastEnrolledClientForgetResult {
|
|
154
154
|
installed: boolean;
|
|
155
155
|
rotated: boolean;
|
|
156
156
|
collections: UserKeyCascadeResult;
|
|
@@ -174,7 +174,7 @@ export interface LastDurableClientForgetResult {
|
|
|
174
174
|
* `unlockMethods` is the whole stage report. A pending-shaped entry blocks
|
|
175
175
|
* for the same reason a failed one does: its bridge is left signed by the
|
|
176
176
|
* key the removal entry strikes, and on a client-less account no login will
|
|
177
|
-
* ever heal it. The mender is a
|
|
177
|
+
* ever heal it. The mender is a remembered login, which is exactly what the
|
|
178
178
|
* removal would end. The forgotten client is still enrolled and every stage
|
|
179
179
|
* before this one has landed, so a re-run resumes at the re-mint. Matched
|
|
180
180
|
* on `name` (the errors cross app-injected seams that may resolve to another
|
|
@@ -182,19 +182,19 @@ export interface LastDurableClientForgetResult {
|
|
|
182
182
|
*/
|
|
183
183
|
export declare class RecordRemintFailedError extends Error {
|
|
184
184
|
readonly failed: RecordRemintOutcome[];
|
|
185
|
-
readonly unlockMethods: NonNullable<
|
|
185
|
+
readonly unlockMethods: NonNullable<LastEnrolledClientForgetResult['unlockMethods']>;
|
|
186
186
|
constructor({ unlockMethods }: {
|
|
187
|
-
unlockMethods: NonNullable<
|
|
187
|
+
unlockMethods: NonNullable<LastEnrolledClientForgetResult['unlockMethods']>;
|
|
188
188
|
});
|
|
189
189
|
}
|
|
190
190
|
/**
|
|
191
|
-
* Forgets the account's LAST enrolled
|
|
191
|
+
* Forgets the account's LAST enrolled client -- this browser's own
|
|
192
192
|
* -- transitioning the account to the client-less, ladder-anchored state.
|
|
193
193
|
* See the module doc for the stage order and the torn-state map. The caller
|
|
194
194
|
* runs the local wipe only after this resolves. An account with another
|
|
195
|
-
* enrolled
|
|
196
|
-
* (`
|
|
197
|
-
* is what routes callers here.
|
|
195
|
+
* enrolled client refuses: that forget is the ordinary ceremony
|
|
196
|
+
* (`forgetEnrolledClient`), reached first, whose
|
|
197
|
+
* `LastEnrolledClientForgetError` is what routes callers here.
|
|
198
198
|
*
|
|
199
199
|
* @param options {object}
|
|
200
200
|
* @param options.logStore {UnlockLogStore} the credential's delegated
|
|
@@ -268,9 +268,9 @@ export declare class RecordRemintFailedError extends Error {
|
|
|
268
268
|
* be idempotent (a resumed run invokes it again). Required: a call
|
|
269
269
|
* without it throws a `TypeError` before any read
|
|
270
270
|
* @param [options.now] {number} epoch milliseconds, for tests
|
|
271
|
-
* @returns {Promise<
|
|
271
|
+
* @returns {Promise<LastEnrolledClientForgetResult>}
|
|
272
272
|
*/
|
|
273
|
-
export declare function
|
|
273
|
+
export declare function forgetLastEnrolledClient({ logStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
|
|
274
274
|
logStore: UnlockLogStore;
|
|
275
275
|
pinStore?: ResourceLogPinStore;
|
|
276
276
|
ladderSeed: Uint8Array;
|
|
@@ -308,5 +308,5 @@ export declare function forgetLastDurableClient({ logStore, pinStore, ladderSeed
|
|
|
308
308
|
log: DIDLog;
|
|
309
309
|
}) => Promise<void>;
|
|
310
310
|
now?: number;
|
|
311
|
-
}): Promise<
|
|
311
|
+
}): Promise<LastEnrolledClientForgetResult>;
|
|
312
312
|
//# sourceMappingURL=forgetLast.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AACH,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAO1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,
|
|
1
|
+
{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AACH,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAO1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAeD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,8BAA8B,CAAC,eAAe,CAAC,CAChD,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC5E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAgM1C"}
|
|
@@ -16,7 +16,7 @@ import { clientAnnexDidParts, clientAnnexLogPinId, delegatedClientsDelegationMin
|
|
|
16
16
|
* could not reach, and a pending-shaped entry it deliberately did not write
|
|
17
17
|
* (re-minting one would seal a half-retired credential a fresh bridge into
|
|
18
18
|
* the standing credential's record). Both leave a bridge the removal entry
|
|
19
|
-
* would rot for good on an account that will never see a
|
|
19
|
+
* would rot for good on an account that will never see a remembered login
|
|
20
20
|
* again.
|
|
21
21
|
*/
|
|
22
22
|
const REMINT_BLOCKING_OUTCOMES = [
|
|
@@ -32,7 +32,7 @@ const REMINT_BLOCKING_OUTCOMES = [
|
|
|
32
32
|
* `unlockMethods` is the whole stage report. A pending-shaped entry blocks
|
|
33
33
|
* for the same reason a failed one does: its bridge is left signed by the
|
|
34
34
|
* key the removal entry strikes, and on a client-less account no login will
|
|
35
|
-
* ever heal it. The mender is a
|
|
35
|
+
* ever heal it. The mender is a remembered login, which is exactly what the
|
|
36
36
|
* removal would end. The forgotten client is still enrolled and every stage
|
|
37
37
|
* before this one has landed, so a re-run resumes at the re-mint. Matched
|
|
38
38
|
* on `name` (the errors cross app-injected seams that may resolve to another
|
|
@@ -54,13 +54,13 @@ export class RecordRemintFailedError extends Error {
|
|
|
54
54
|
}
|
|
55
55
|
}
|
|
56
56
|
/**
|
|
57
|
-
* Forgets the account's LAST enrolled
|
|
57
|
+
* Forgets the account's LAST enrolled client -- this browser's own
|
|
58
58
|
* -- transitioning the account to the client-less, ladder-anchored state.
|
|
59
59
|
* See the module doc for the stage order and the torn-state map. The caller
|
|
60
60
|
* runs the local wipe only after this resolves. An account with another
|
|
61
|
-
* enrolled
|
|
62
|
-
* (`
|
|
63
|
-
* is what routes callers here.
|
|
61
|
+
* enrolled client refuses: that forget is the ordinary ceremony
|
|
62
|
+
* (`forgetEnrolledClient`), reached first, whose
|
|
63
|
+
* `LastEnrolledClientForgetError` is what routes callers here.
|
|
64
64
|
*
|
|
65
65
|
* @param options {object}
|
|
66
66
|
* @param options.logStore {UnlockLogStore} the credential's delegated
|
|
@@ -134,21 +134,21 @@ export class RecordRemintFailedError extends Error {
|
|
|
134
134
|
* be idempotent (a resumed run invokes it again). Required: a call
|
|
135
135
|
* without it throws a `TypeError` before any read
|
|
136
136
|
* @param [options.now] {number} epoch milliseconds, for tests
|
|
137
|
-
* @returns {Promise<
|
|
137
|
+
* @returns {Promise<LastEnrolledClientForgetResult>}
|
|
138
138
|
*/
|
|
139
|
-
export async function
|
|
139
|
+
export async function forgetLastEnrolledClient({ logStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now = Date.now() }) {
|
|
140
140
|
// The seam is the only stage that re-signs the login credential's bridge
|
|
141
141
|
// with the ladder VM; a run without it would land the removal entry over
|
|
142
142
|
// a record the struck key signed, on an account nothing could then write
|
|
143
143
|
// to. Refused before any read, so nothing is published.
|
|
144
144
|
if (typeof onBeforeRemoval !== 'function') {
|
|
145
|
-
throw new TypeError('
|
|
145
|
+
throw new TypeError('forgetLastEnrolledClient requires onBeforeRemoval: the login ' +
|
|
146
146
|
"credential's record is re-bound only through that seam");
|
|
147
147
|
}
|
|
148
148
|
// The pre-install read and the two guards: a client with no remaining
|
|
149
149
|
// presence means the removal entry already landed (the finish-the-wipe
|
|
150
150
|
// state the app's next login maps -- nothing here can still invoke), and
|
|
151
|
-
// an account with another enrolled
|
|
151
|
+
// an account with another enrolled client belongs to the ordinary
|
|
152
152
|
// forget ceremony.
|
|
153
153
|
// The account log's pin slot, shared by every read and entry below.
|
|
154
154
|
const pinned = pinStore
|
|
@@ -176,7 +176,7 @@ export async function forgetLastDurableClient({ logStore, pinStore, ladderSeed,
|
|
|
176
176
|
const signingVmId = `${before.did}#${forgottenClient.signingKeyMultibase}`;
|
|
177
177
|
const invocationIds = relationIds(before.doc.capabilityInvocation);
|
|
178
178
|
if (invocationIds.some(id => id !== signingVmId)) {
|
|
179
|
-
throw new Error('did:webvh: another enrolled
|
|
179
|
+
throw new Error('did:webvh: another enrolled client remains; the last-client ' +
|
|
180
180
|
'transition ceremony does not apply -- run the ordinary forget.');
|
|
181
181
|
}
|
|
182
182
|
// Stage 1: the install entry -- the ladder VM in, the client untouched.
|
|
@@ -322,7 +322,7 @@ export async function forgetLastDurableClient({ logStore, pinStore, ladderSeed,
|
|
|
322
322
|
* @param options.doc {DIDDoc} the post-install account document
|
|
323
323
|
* @param options.accountDid {string}
|
|
324
324
|
* @param options.ladderSeed {Uint8Array}
|
|
325
|
-
* @param options.annex {object} see {@link
|
|
325
|
+
* @param options.annex {object} see {@link forgetLastEnrolledClient}
|
|
326
326
|
* @param options.now {number}
|
|
327
327
|
* @returns {Promise<GenerationDelegationRetirement>}
|
|
328
328
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"forgetLast.js","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAiGA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,mBAAmB,EAEpB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAG3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EACL,yBAAyB,EAG1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,iCAAiC,EACjC,2BAA2B,EAC3B,wBAAwB,EACxB,qCAAqC,EAEtC,MAAM,UAAU,CAAA;AAmEjB;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAqC;IACjE,QAAQ;IACR,eAAe;CAChB,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,MAAM,CAAuB;IAC7B,aAAa,CAErB;IAED,YAAY,EACV,aAAa,EAGd;QACC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CACrD,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CACnD,CAAA;QACD,KAAK,CACH,mEAAmE;YACjE,GAAG,MAAM,CAAC,MAAM,2BAA2B;YAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACtD,qEAAqE;YACrE,uBAAuB,CAC1B,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,MAAM,CAAC,KAAK,UAAU,
|
|
1
|
+
{"version":3,"file":"forgetLast.js","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAiGA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EACL,mBAAmB,EAEpB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAG3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EACL,yBAAyB,EAG1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gCAAgC,EAChC,uBAAuB,EACvB,iCAAiC,EACjC,2BAA2B,EAC3B,wBAAwB,EACxB,qCAAqC,EAEtC,MAAM,UAAU,CAAA;AAmEjB;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAqC;IACjE,QAAQ;IACR,eAAe;CAChB,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,MAAM,CAAuB;IAC7B,aAAa,CAErB;IAED,YAAY,EACV,aAAa,EAGd;QACC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CACrD,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CACnD,CAAA;QACD,KAAK,CACH,mEAAmE;YACjE,GAAG,MAAM,CAAC,MAAM,2BAA2B;YAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACtD,qEAAqE;YACrE,uBAAuB,CAC1B,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAuCjB;IACC,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,+DAA+D;YAC7D,wDAAwD,CAC3D,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,kEAAkE;IAClE,mBAAmB;IACnB,oEAAoE;IACpE,MAAM,MAAM,GAAG,QAAQ;QACrB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,EAAE;QACzE,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,KAAK,EAAE,QAAQ;QACf,WAAW;QACX,GAAG,MAAM;KACV,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;QAC1C,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,eAAe;KACxB,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACzC,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;YACxE,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,GAAG;SACrB,CAAA;IACH,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC1E,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAClE,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,8DAA8D;YAC5D,gEAAgE,CACnE,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,WAAW;QACX,GAAG,MAAM;KACV,CAAC,CAAA;IAEF,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,iEAAiE;IACjE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,WAAW,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,OAAO,CAAC,GAAG;gBACrB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,iCAAiC,CAAC;QACzD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,UAAU;QACV,KAAK;QACL,GAAG;KACJ,CAAC,CAAA;IAEF,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,MAAuD,CAAA;IAC3D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,MAAM,iCAAiC,CAAC;YAC/C,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,OAAO,CAAC,GAAG;YACvB,UAAU;YACV,2BAA2B,EAAE,eAAe,CAAC,mBAAmB;YAChE,KAAK,EAAE,aAAa;YACpB,GAAG;SACJ,CAAC,CAAA;QACF,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,2BAA2B;QAC3B,IACE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC7B,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CACnD,EACD,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,6DAA6D;IAC7D,0EAA0E;IAC1E,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,eAAe,CAAC;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAA;IAEF,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;QACX,GAAG,MAAM;KACV,CAAC,CAAA;IAEF,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,UAAU;QACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,iCAAiC,CAAC,EAC/C,GAAG,EACH,UAAU,EACV,UAAU,EACV,KAAK,EACL,GAAG,EAgBJ;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACnD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IACxC,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,OAAO,EAAE,KAAqB;QAC9B,WAAW,EAAE,UAAU;QACvB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAA;IACF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAA;IACpE,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,2BAA2B,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CACvE,UAAU,CAAC,EAAE;QACX,MAAM,UAAU,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;QACnD,MAAM,QAAQ,GACZ,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QAC5D,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACvB,UAAmC,CAAC,OAAO,IAAI,EAAE,CACnD,CAAA;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,GAAG,CAAA;IAC/C,CAAC,CACF,CAAA;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,mCAAmC;IACnC,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACzE,IAAI,CAAC;QACH,MAAM,iCAAiC,CAAC;YACtC,KAAK;YACL,UAAU;YACV,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,wBAAwB,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CACrD,wBAAwB,CAAC;gBACvB,UAAU,EAAE,YAAY;gBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,cAAc;gBACd,GAAG;aACJ,CAAC;YACJ,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,IAAI;YACX,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG;SACJ,CAAC,CAAA;QACF,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAAyB,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC1E,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,qCAAqC,CAAC;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU;SACX,CAAC,CAAA;QACF,MAAM,EAAE,GAAI,UAA8B,CAAC,EAAE,CAAA;QAC7C,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ;QACb,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;QACvB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,iCAAiC,CAAC,EAC/C,GAAG,EACH,UAAU,EACV,UAAU,EACV,2BAA2B,EAC3B,KAAK,EACL,GAAG,EAQJ;IACC,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACzE,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,QAAQ,EAAE,MAAM,aAAa,CAAC,EAAE,UAAU,EAAE,CAAC;KAC9C,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,GAAG;QACH,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,UAAU,EAAE,YAAY;QACxB,YAAY;QACZ,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,8BAA8B,EAAE,gCAAgC,CAAC;YAC/D,GAAG;YACH,UAAU,EAAE,YAAY;YACxB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;SACjC,CAAC;QACF,qBAAqB,EAAE,CAAC,2BAA2B,CAAC;QACpD,GAAG;KACJ,CAAC,CAAA;AACJ,CAAC"}
|