@interop/wallet-core 0.62.0 → 0.66.0

package/dist/clientAnnex/forget.d.ts

@@ -33,7 +33,15 @@
  *    ladder-signed entry through the bridge takes the client's whole document
  *    inventory out. The app's local wipe runs after this ceremony returns, so
  *    a tear anywhere before the entry reads as "not forgotten" and a re-click
- *    resumes.
+ *    resumes. The post-removal `did:web` projection is PUT through
+ *    `clientLogStore` immediately BEFORE that entry: the entry itself
+ *    publishes `did.jsonl` alone (the bridge covers nothing else), and this
+ *    client's authority ends at it, so the projection has to be written while
+ *    it can still be written. That store is required for exactly this reason
+ *    -- without it `did.json` would keep naming this client until a later
+ *    writer ran `ensureDidWebProjection`, and a `did:web` verifier would
+ *    accept the forgotten key meanwhile (WAS authorization would not: the
+ *    server resolves the controller from `did.jsonl`).
  *
  * Torn-state map: a run torn after stage 1 leaves the account rotated off a
  * client the document still lists -- writes already land under the fresh key,
@@ -60,9 +68,10 @@
 import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption } from '@interop/was-client';
 import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import type { RevokedClientKeys } from '../webvh/revokeClient.js';
-import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
+import { type CascadeCollections, type UserKey, type UserKeyAdoptedHook, type UserKeyCascadeResult } from '../keys/index.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
 /**
  * What a completed forget reports: whether the roster's wrap for the
@@ -90,6 +99,10 @@ export interface EnrolledClientForgetResult {
  * @param options.logStore {UnlockLogStore}   the credential's delegated
  *   `did.jsonl` bridge store; also serves the ceremony's public pre-edit
  *   read
+ * @param options.clientLogStore {object}   the account's `id` collection
+ *   store invoked under THIS (still-standing) enrolled client's root
+ *   authority. Used for one thing: the post-removal `did:web` projection PUT
+ *   that precedes the removal entry (see stage 3 in the module doc)
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
  *   pins. Every read the ceremony makes -- the pre-edit read the roster
  *   rotation's recipient document comes from, and the removal entry's own
@@ -127,8 +140,9 @@ export interface EnrolledClientForgetResult {
  * @param options.collections {CascadeCollections}   the fan-out's work
  * @returns {Promise<EnrolledClientForgetResult>}
  */
-export declare function forgetEnrolledClient({ logStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }: {
+export declare function forgetEnrolledClient({ logStore, clientLogStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }: {
     logStore: UnlockLogStore;
+    clientLogStore: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
     pinStore?: ResourceLogPinStore;
     logId?: string;
     ladderSeed: Uint8Array;
@@ -140,11 +154,7 @@ export declare function forgetEnrolledClient({ logStore, pinStore, logId, ladder
     credentialKeyAgreementKey: IKeyAgreementKey;
     userKey?: UserKey;
     pinnedEpochId?: string | null;
-    onUserKeyAdopted?: (adopted: {
-        userKey: UserKey;
-        latestEpochId: string;
-        descriptor: CollectionEncryption;
-    }) => Promise<void>;
+    onUserKeyAdopted?: UserKeyAdoptedHook;
     collections: CascadeCollections;
 }): Promise<EnrolledClientForgetResult>;
 //# sourceMappingURL=forget.d.ts.map

package/dist/clientAnnex/forget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,yBAAyB,CAAA;IACtC,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAwGtC"}
+{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IACxE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,yBAAyB,CAAA;IACtC,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAmEtC"}

package/dist/clientAnnex/forget.js

@@ -1,5 +1,6 @@
-import { readPublishedLog, relationIds } from '../webvh/didWebvh.js';
-import { cascadeCollectionsToUserKey, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from '../keys/index.js';
+import { relationIds } from '../resourceLog/document.js';
+import { readPublishedLogOrThrow } from '../webvh/didWebvh.js';
+import { retireRosterRecipientAndCascade, rosterRecipientKid } from '../keys/index.js';
 import { forgetWebvhClient, LastEnrolledClientForgetError } from './ladderAnchored.js';
 /**
  * Forgets one enrolled client -- this browser's own -- from its
@@ -11,6 +12,10 @@ import { forgetWebvhClient, LastEnrolledClientForgetError } from './ladderAnchor
  * @param options.logStore {UnlockLogStore}   the credential's delegated
  *   `did.jsonl` bridge store; also serves the ceremony's public pre-edit
  *   read
+ * @param options.clientLogStore {object}   the account's `id` collection
+ *   store invoked under THIS (still-standing) enrolled client's root
+ *   authority. Used for one thing: the post-removal `did:web` projection PUT
+ *   that precedes the removal entry (see stage 3 in the module doc)
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
  *   pins. Every read the ceremony makes -- the pre-edit read the roster
  *   rotation's recipient document comes from, and the removal entry's own
@@ -48,22 +53,18 @@ import { forgetWebvhClient, LastEnrolledClientForgetError } from './ladderAnchor
  * @param options.collections {CascadeCollections}   the fan-out's work
  * @returns {Promise<EnrolledClientForgetResult>}
  */
-export async function forgetEnrolledClient({ logStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }) {
+export async function forgetEnrolledClient({ logStore, clientLogStore, pinStore, logId, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections }) {
     // The pre-edit read, doing double duty: the last-client refusal must fire
     // BEFORE the rotation (or a refused forget would already have retired this
     // client's wrap), and the rotation's recipient resolver needs the pre-edit
     // document (which still keys every other recipient).
-    const published = await readPublishedLog({
-        // readPublishedLog only calls getIdResourceRaw, so the narrow seam is
-        // safe.
+    const published = await readPublishedLogOrThrow({
         idStore: logStore,
         expectedDid,
         ...(pinStore ? { pinStore } : {}),
-        ...(logId !== undefined ? { logId } : {})
+        ...(logId !== undefined ? { logId } : {}),
+        missingMessage: 'did:webvh: did.jsonl is missing; nothing to forget from.'
     });
-    if (!published) {
-        throw new Error('did:webvh: did.jsonl is missing; nothing to forget from.');
-    }
     const signingVmId = `${published.did}#${forgottenClient.signingKeyMultibase}`;
     const invocationIds = relationIds(published.doc.capabilityInvocation);
     if (invocationIds.includes(signingVmId) &&
@@ -71,61 +72,33 @@ export async function forgetEnrolledClient({ logStore, pinStore, logId, ladderSe
         throw new LastEnrolledClientForgetError();
     }
     // Stages 1 and 2: the roster rotation off this client's wrap and the
-    // collection fan-out, both under this client's still-standing authority.
-    let rotated = false;
-    let read;
-    let cascade = { outcomes: {}, failed: [] };
-    const current = await rosterStore.read();
-    if (current !== null) {
-        const forgottenKid = rosterRecipientKid({
+    // collection fan-out, both under this client's still-standing authority
+    // -- the shared recipient-retiring tail, anchored at the pre-edit head
+    // this read verified (the orchestrator sets the roster store's minimum
+    // controller version there, so a store wired over a stale cached view
+    // still appends under a view that carries every recipient the rotation
+    // resolves). The wrap is retired by its roster kid explicitly, since the
+    // document still lists this client, and the fresh key comes back through
+    // the credential's standing wrap.
+    const tail = await retireRosterRecipientAndCascade({
+        rosterStore,
+        did: published.did,
+        doc: published.doc,
+        log: published.log,
+        retireRecipientId: rosterRecipientKid({
             signingKeyMultibase: forgottenClient.signingKeyMultibase,
             keyAgreementKeyMultibase: forgottenKeyAgreementKeyMultibase
-        });
-        let descriptor = current.descriptor;
-        const currentEpoch = (descriptor.epochs ?? []).find(epoch => epoch.id === descriptor.currentEpoch);
-        const wrapped = currentEpoch?.recipients.some(entry => entry.header.kid === forgottenKid);
-        if (wrapped) {
-            descriptor = await rotateUserKeyRoster({
-                store: rosterStore,
-                document: published.doc,
-                retireRecipientId: forgottenKid
-            });
-            rotated = true;
-        }
-        // The fresh key comes back through the credential's standing wrap -- this
-        // client's own is gone from the current epoch -- with the continuity and
-        // possession checks still running on the threaded descriptor.
-        const adopted = await readUserKeyRoster({
-            store: rosterStore,
-            descriptor,
-            ...(userKey ? { userKey } : {}),
-            clientKeyAgreementKey: credentialKeyAgreementKey,
-            pinnedEpochId
-        });
-        if (adopted.rotated) {
-            await onUserKeyAdopted?.({
-                userKey: adopted.userKey,
-                latestEpochId: adopted.latestEpochId,
-                descriptor: adopted.descriptor
-            });
-        }
-        read = { userKey: adopted.userKey, descriptor: adopted.descriptor };
-        cascade = await cascadeCollectionsToUserKey({
-            collectionIds: typeof collections.collectionIds === 'function'
-                ? await collections.collectionIds()
-                : collections.collectionIds,
-            storeFor: collections.storeFor,
-            ...(collections.isEncrypted
-                ? { isEncrypted: collections.isEncrypted }
-                : {}),
-            rosterDescriptor: adopted.descriptor,
-            clientKeyAgreementKey: credentialKeyAgreementKey,
-            userKey: adopted.userKey
-        });
-    }
+        }),
+        ...(userKey ? { userKey } : {}),
+        readBackKeyAgreementKey: credentialKeyAgreementKey,
+        pinnedEpochId,
+        ...(onUserKeyAdopted ? { onUserKeyAdopted } : {}),
+        collections
+    });
     // Stage 3: the atomic ladder-signed removal entry, through the bridge.
     const removed = await forgetWebvhClient({
         store: logStore,
+        projectionStore: clientLogStore,
         ladderSeed,
         forgottenClient,
         ...(knownLatentHashes ? { knownLatentHashes } : {}),
@@ -134,12 +107,12 @@ export async function forgetEnrolledClient({ logStore, pinStore, logId, ladderSe
         ...(logId !== undefined ? { logId } : {})
     });
     return {
-        rotated,
-        collections: cascade,
+        rotated: tail.rotated,
+        collections: tail.collections,
         did: removed.did,
         document: removed.doc,
-        ...(read
-            ? { userKey: read.userKey, rosterDescriptor: read.descriptor }
+        ...(tail.userKey && tail.rosterDescriptor
+            ? { userKey: tail.userKey, rosterDescriptor: tail.rosterDescriptor }
             : {})
     };
 }

package/dist/clientAnnex/forget.js.map

@@ -1 +1 @@
-{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AA8DA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAIpE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EAoBZ;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,sEAAsE;QACtE,QAAQ;QACR,OAAO,EAAE,QAAwB;QACjC,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IACrE,IACE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,6BAA6B,EAAE,CAAA;IAC3C,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,SAAS,CAAC,GAAG;gBACvB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IAEF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}
+{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAsEA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAI9D,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAKnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EAiBZ;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC;QAC9C,OAAO,EAAE,QAAQ;QACjB,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,cAAc,EAAE,0DAA0D;KAC3E,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IACrE,IACE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,6BAA6B,EAAE,CAAA;IAC3C,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,+BAA+B,CAAC;QACjD,WAAW;QACX,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,iBAAiB,EAAE,kBAAkB,CAAC;YACpC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,uBAAuB,EAAE,yBAAyB;QAClD,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IAEF,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,KAAK,EAAE,QAAQ;QACf,eAAe,EAAE,cAAc;QAC/B,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,gBAAgB;YACvC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}

package/dist/clientAnnex/forgetLast.d.ts

@@ -48,22 +48,31 @@
  * 2. **The roster rotation**, ladder-signed, anchored at the reinstall entry,
  *    HTTP-invoked under the still-standing client: the user key rotates off
  *    this client's wrap in ONE append (the license's one-shot shape), read
- *    back through the credential's standing wrap. Because the append's
+ *    back through the credential's standing wrap. The anchoring is this
+ *    ceremony's guarantee rather than the app's wiring: the shared
+ *    recipient-retiring tail (`retireRosterRecipientAndCascade`) sets the
+ *    roster store's minimum controller version from the post-reinstall log,
+ *    so a store resolving its controller from a cached pre-transition view
+ *    still lands the append at the reinstall version. Because the append's
  *    signer is the ladder VM -- a key the post-removal document still lists
  *    -- the roster log needs no seal repair afterwards, which matters on
  *    an account where no enrolled client's login sweep will ever run again.
  * 3. **The collection fan-out**, still under this client's invocation
  *    authority: every encrypted collection re-epochs onto the fresh key.
  * 4. **The generation-delegation replacement and revocations**: a fresh
- *    ladder-signed generation delegation replaces the embedded one
- *    unconditionally (the forced renewal), and then EVERY still-unexpired
- *    delegation the annex log's history ever embedded that this
- *    credential's ladder VM signed is revoked at the server (a renewal
- *    inside the 30-day window can leave two) -- closing the resurrection
- *    window a reinstalled derived-key VM would otherwise reopen. The
- *    replacement is what keeps the account transient-login-reachable after
- *    the transition; replace-before-revoke is what keeps a torn run from
- *    stranding the generation delegation-less.
+ *    ladder-signed generation delegation replaces the embedded one when the
+ *    house staleness policy, read against a projected post-edit document,
+ *    says it is owed -- this credential's ladder VM and the forgotten client
+ *    are both named retiring, which is every key this ceremony ends. Then
+ *    EVERY still-unexpired delegation the annex log's history ever embedded
+ *    that this credential's ladder VM signed is revoked at the server (a
+ *    renewal inside the 30-day window can leave two) -- closing the
+ *    resurrection window a reinstalled derived-key VM would otherwise
+ *    reopen. The replacement is what keeps the account
+ *    transient-login-reachable after the transition; replace-before-revoke
+ *    is what keeps a torn run from stranding the generation delegation-less.
+ *    A delegation a surviving sibling credential's ladder signed is left
+ *    standing, since the revocation loop never reaches it either.
  * 5. **The other unlock methods' record re-mint** (`unlockMethods`): every
  *    other standing credential's and recovery code's bridge (and
  *    `delegatedClients` sibling, where the record carries one) is re-signed
@@ -98,8 +107,15 @@
  *    omits the seam is refused before any read.
  * 7. **The removal entry** ({@link forgetLastWebvhClient}): the client's
  *    whole document inventory out while the reinstalled ladder VM keeps the
- *    account anchored. The app's local wipe runs after this ceremony
- *    returns.
+ *    account anchored. The post-removal `did:web` projection is PUT through
+ *    `clientLogStore` immediately BEFORE that entry, since the entry itself
+ *    is ladder-signed and writes `did.jsonl` alone while the client's root
+ *    authority ends at it -- without that the account would land client-less
+ *    with `did.json` still publishing the forgotten client's keys and nothing
+ *    left able to rewrite it. A run torn between the PUT and the entry leaves
+ *    `did.json` omitting a client the log still lists, which is fail-closed
+ *    for a `did:web` verifier and re-PUT by the re-run. The app's local wipe
+ *    runs after this ceremony returns.
  *
  * Torn-state map: every stage detects completion from durable state, so a
  * run torn anywhere before the removal entry reads as "not forgotten" and a
@@ -114,9 +130,10 @@
  * roster skips the append (no second ladder-signed append is ever
  * attempted), the fan-out is staleness-driven, a re-POSTed revocation's 400
  * already-revoked answer reads as success (decision 0006's resume contract),
- * and the forced replacement re-mints (the prior run's fresh delegation is
- * then revoked as history, so a re-run churns one delegation and strands
- * nothing), and the record re-mint re-checks staleness per entry (a record
+ * the generation stage re-asks the same staleness policy (a prior run's own
+ * fresh delegation reads as retiring, so a re-run churns one delegation and
+ * strands nothing, while a sibling-signed one churns none), and the record
+ * re-mint re-checks staleness per entry (a record
  * already ladder-signed reads as current, one whose re-mint failed is still
  * rotted and is re-minted). Torn after the removal entry is the
  * finish-the-wipe state the app's next login maps.
@@ -125,21 +142,23 @@
  * browser already fetched stays forensically recoverable from its storage,
  * and old epochs stay open to keys it already held.
  */
-import type { DIDLog } from '@interop/did-method-webvh';
+import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
 import type { IKeyAgreementKey, IZcap } from '@interop/data-integrity-core';
 import type { ZcapClient } from '@interop/ezcap';
 import type { CollectionEncryption, IDelegatedZcap } from '@interop/was-client';
-import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
+import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import { type RevokedClientKeys } from '../webvh/revokeClient.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
-import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
+import { type CascadeCollections, type SealableEncryptionDescriptorStore, type UserKey, type UserKeyAdoptedHook, type UserKeyCascadeResult } from '../keys/index.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
 import type { AccountPointer } from '../keyring/record.js';
 import { type RecordRemintOutcome, type RecoveryDelegationEntry } from '../recovery/recoveryDelegation.js';
 import { type ClientAnnexWriteStore } from './log.js';
 /**
  * What the ceremony's generation stage did: the revoked delegation ids, and
- * whether the forced replacement landed. A `skipped` reason names the stage
+ * whether it wrote a replacement -- `false` with no `skipped` reason means
+ * nothing was owed, the standing delegation being one a surviving sibling
+ * credential's ladder signed. A `skipped` reason names the stage
  * that could not run -- `no-pointer` (the account points at no generation:
  * nothing to revoke or replace), `log-unreadable` (the pointed generation's
  * `did.jsonl` is gone; the delegation bytes are unrecoverable, decision
@@ -242,8 +261,10 @@ export declare class RecordRemintFailedError extends Error {
  *   strike-and-reinstall pair publishes through it, because the bridge
  *   `logStore` is often signed by the ladder VM the strike removes and the
  *   reinstall would then be refused under the current-key-set rule. Both
- *   entries stay ladder-signed; only the HTTP invocation differs. Required:
- *   a call without it throws a `TypeError` before any read
+ *   entries stay ladder-signed; only the HTTP invocation differs. It also
+ *   carries the removal entry's pre-entry `did:web` projection PUT (stage 7),
+ *   the one write the bridge store cannot make. Required: a call without it
+ *   throws a `TypeError` before any read
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
  *   pins, the account log's slot derived from `annex.accountSpaceId`. Every
  *   account-log read the ceremony makes -- the opening read, and the strike,
@@ -263,13 +284,19 @@ export declare class RecordRemintFailedError extends Error {
  *   excluded from the staged-hash attribution
  * @param options.expectedDid {string}   the account DID from the caller's
  *   stored account pointer
- * @param options.rosterStoreFor {Function}   `({ did, log }) => store` --
- *   builds the `key-map/user-key.jsonl` roster store whose appends are
- *   SIGNED BY THE LADDER VM and whose controller view resolves from the
- *   supplied log -- the pre-transition head for the opening read, the
- *   post-reinstall head for the rotation (the inventory-changing anchor the
- *   ceremony-tail license admits), while its HTTP requests invoke under the still-standing
- *   client
+ * @param options.rosterStore {SealableEncryptionDescriptorStore}   the
+ *   log-governed `key-map/user-key.jsonl` roster store whose appends are
+ *   SIGNED BY THE LADDER VM while its HTTP requests invoke under the
+ *   still-standing client. Its controller view is the ceremony's to anchor,
+ *   not the app's: the orchestrator sets the minimum controller version at
+ *   the pre-transition head for the opening read and at the post-reinstall
+ *   head for the rotation (the inventory-changing anchor the ceremony-tail
+ *   license admits), so a store wired over a cached pre-transition view
+ *   still anchors the one ladder-signed append past the reinstall entry.
+ *   Required to be anchorable: a store without `setMinimumControllerVersion`
+ *   is refused with a `TypeError` before any read, since the pair would
+ *   otherwise publish two entries per attempt ahead of a rotation the
+ *   license refuses every time
  * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the standing
  *   credential's key-agreement key -- the recipient whose wrap survives the
  *   rotation, reading the fresh key back and unwrapping the generations for
@@ -316,7 +343,7 @@ export declare class RecordRemintFailedError extends Error {
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<LastEnrolledClientForgetResult>}
  */
-export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
+export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
     logStore: UnlockLogStore;
     clientLogStore: UnlockLogStore;
     pinStore?: ResourceLogPinStore;
@@ -325,18 +352,11 @@ export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pin
     forgottenKeyAgreementKeyMultibase: string;
     knownLatentHashes?: string[];
     expectedDid: string;
-    rosterStoreFor: (options: {
-        did: string;
-        log: DIDLog;
-    }) => EncryptionDescriptorStore;
+    rosterStore: SealableEncryptionDescriptorStore;
     credentialKeyAgreementKey: IKeyAgreementKey;
     userKey?: UserKey;
     pinnedEpochId?: string | null;
-    onUserKeyAdopted?: (adopted: {
-        userKey: UserKey;
-        latestEpochId: string;
-        descriptor: CollectionEncryption;
-    }) => Promise<void>;
+    onUserKeyAdopted?: UserKeyAdoptedHook;
     collections: CascadeCollections;
     annex: {
         storeFor: (options: {
@@ -356,4 +376,31 @@ export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pin
     }) => Promise<void>;
     now?: number;
 }): Promise<LastEnrolledClientForgetResult>;
+/**
+ * THE LAST-CLIENT REMOVAL ENTRY (stage 7, the transition's own removal): the
+ * plain forget's removal shape (`clientForgetEntryOnce`) with this ceremony's
+ * removability invariant injected instead of the plain forget's last-client
+ * refusal -- the forgotten client IS the last enrolled client, and the
+ * account stays invocable because the ladder VM the reinstall entry published
+ * remains in the document. Run only from {@link forgetLastEnrolledClient},
+ * which sequences the strike-and-reinstall pair, the rotation, and the
+ * revocations before it.
+ *
+ * @param options {object}   see `forgetWebvhClient` in `ladderAnchored.ts`
+ * @returns {Promise<{ did: string, doc: DIDDoc, log: DIDLog }>}
+ */
+export declare function forgetLastWebvhClient(options: {
+    store: UnlockLogStore;
+    projectionStore?: Pick<WebvhIdStore, 'getIdResourceRaw' | 'putIdResource'>;
+    ladderSeed: Uint8Array;
+    forgottenClient: RevokedClientKeys;
+    knownLatentHashes?: string[];
+    expectedDid?: string;
+    pinStore?: ResourceLogPinStore;
+    logId?: string;
+}): Promise<{
+    did: string;
+    doc: DIDDoc;
+    log: DIDLog;
+}>;
 //# sourceMappingURL=forgetLast.d.ts.map

package/dist/clientAnnex/forgetLast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2HG;AACH,OAAO,KAAK,EAAU,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAIxE,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAS1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAeD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,8BAA8B,CAAC,eAAe,CAAC,CAChD,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC5E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA+Q1C"}
+{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4IG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAM/E,OAAO,KAAK,EAAqB,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAE3E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,iCAAiC,EACtC,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAU1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAeD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,8BAA8B,CAAC,eAAe,CAAC,CAChD,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC5E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,iCAAiC,CAAA;IAC9C,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAiQ1C;AAkND;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrD"}