@interop/wallet-core 0.65.0 → 0.67.0

package/dist/clientAnnex/forget.d.ts

@@ -71,7 +71,7 @@ import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import type { RevokedClientKeys } from '../webvh/revokeClient.js';
-import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
+import { type CascadeCollections, type UserKey, type UserKeyAdoptedHook, type UserKeyCascadeResult } from '../keys/index.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
 /**
  * What a completed forget reports: whether the roster's wrap for the
@@ -154,11 +154,7 @@ export declare function forgetEnrolledClient({ logStore, clientLogStore, pinStor
     credentialKeyAgreementKey: IKeyAgreementKey;
     userKey?: UserKey;
     pinnedEpochId?: string | null;
-    onUserKeyAdopted?: (adopted: {
-        userKey: UserKey;
-        latestEpochId: string;
-        descriptor: CollectionEncryption;
-    }) => Promise<void>;
+    onUserKeyAdopted?: UserKeyAdoptedHook;
     collections: CascadeCollections;
 }): Promise<EnrolledClientForgetResult>;
 //# sourceMappingURL=forget.d.ts.map

package/dist/clientAnnex/forget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAGxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IACxE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,yBAAyB,CAAA;IACtC,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAqGtC"}
+{"version":3,"file":"forget.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAExE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAMzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEhE;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IACxE,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,yBAAyB,CAAA;IACtC,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;CAChC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAmEtC"}

package/dist/clientAnnex/forget.js

@@ -1,7 +1,6 @@
-import { relationIds } from '../resourceLog/document.js';
 import { readPublishedLogOrThrow } from '../webvh/didWebvh.js';
-import { cascadeCollectionsToUserKey, readUserKeyRoster, rosterRecipientKid, rotateUserKeyRoster } from '../keys/index.js';
-import { forgetWebvhClient, LastEnrolledClientForgetError } from './ladderAnchored.js';
+import { retireRosterRecipientAndCascade, rosterRecipientKid } from '../keys/index.js';
+import { forgetWebvhClient, isSoleEnrolledClient, LastEnrolledClientForgetError } from './ladderAnchored.js';
 /**
  * Forgets one enrolled client -- this browser's own -- from its
  * account. See the module doc for the stage order (rotation and fan-out
@@ -65,65 +64,36 @@ export async function forgetEnrolledClient({ logStore, clientLogStore, pinStore,
         ...(logId !== undefined ? { logId } : {}),
         missingMessage: 'did:webvh: did.jsonl is missing; nothing to forget from.'
     });
-    const signingVmId = `${published.did}#${forgottenClient.signingKeyMultibase}`;
-    const invocationIds = relationIds(published.doc.capabilityInvocation);
-    if (invocationIds.includes(signingVmId) &&
-        invocationIds.every(id => id === signingVmId)) {
+    if (isSoleEnrolledClient({
+        doc: published.doc,
+        vmId: `${published.did}#${forgottenClient.signingKeyMultibase}`
+    })) {
         throw new LastEnrolledClientForgetError();
     }
     // Stages 1 and 2: the roster rotation off this client's wrap and the
-    // collection fan-out, both under this client's still-standing authority.
-    let rotated = false;
-    let read;
-    let cascade = { outcomes: {}, failed: [] };
-    const current = await rosterStore.read();
-    if (current !== null) {
-        const forgottenKid = rosterRecipientKid({
+    // collection fan-out, both under this client's still-standing authority
+    // -- the shared recipient-retiring tail, anchored at the pre-edit head
+    // this read verified (the orchestrator sets the roster store's minimum
+    // controller version there, so a store wired over a stale cached view
+    // still appends under a view that carries every recipient the rotation
+    // resolves). The wrap is retired by its roster kid explicitly, since the
+    // document still lists this client, and the fresh key comes back through
+    // the credential's standing wrap.
+    const tail = await retireRosterRecipientAndCascade({
+        rosterStore,
+        did: published.did,
+        doc: published.doc,
+        log: published.log,
+        retireRecipientId: rosterRecipientKid({
             signingKeyMultibase: forgottenClient.signingKeyMultibase,
             keyAgreementKeyMultibase: forgottenKeyAgreementKeyMultibase
-        });
-        let descriptor = current.descriptor;
-        const currentEpoch = (descriptor.epochs ?? []).find(epoch => epoch.id === descriptor.currentEpoch);
-        const wrapped = currentEpoch?.recipients.some(entry => entry.header.kid === forgottenKid);
-        if (wrapped) {
-            descriptor = await rotateUserKeyRoster({
-                store: rosterStore,
-                document: published.doc,
-                retireRecipientId: forgottenKid
-            });
-            rotated = true;
-        }
-        // The fresh key comes back through the credential's standing wrap -- this
-        // client's own is gone from the current epoch -- with the continuity and
-        // possession checks still running on the threaded descriptor.
-        const adopted = await readUserKeyRoster({
-            store: rosterStore,
-            descriptor,
-            ...(userKey ? { userKey } : {}),
-            clientKeyAgreementKey: credentialKeyAgreementKey,
-            pinnedEpochId
-        });
-        if (adopted.rotated) {
-            await onUserKeyAdopted?.({
-                userKey: adopted.userKey,
-                latestEpochId: adopted.latestEpochId,
-                descriptor: adopted.descriptor
-            });
-        }
-        read = { userKey: adopted.userKey, descriptor: adopted.descriptor };
-        cascade = await cascadeCollectionsToUserKey({
-            collectionIds: typeof collections.collectionIds === 'function'
-                ? await collections.collectionIds()
-                : collections.collectionIds,
-            storeFor: collections.storeFor,
-            ...(collections.isEncrypted
-                ? { isEncrypted: collections.isEncrypted }
-                : {}),
-            rosterDescriptor: adopted.descriptor,
-            clientKeyAgreementKey: credentialKeyAgreementKey,
-            userKey: adopted.userKey
-        });
-    }
+        }),
+        ...(userKey ? { userKey } : {}),
+        readBackKeyAgreementKey: credentialKeyAgreementKey,
+        pinnedEpochId,
+        ...(onUserKeyAdopted ? { onUserKeyAdopted } : {}),
+        collections
+    });
     // Stage 3: the atomic ladder-signed removal entry, through the bridge.
     const removed = await forgetWebvhClient({
         store: logStore,
@@ -136,12 +106,12 @@ export async function forgetEnrolledClient({ logStore, clientLogStore, pinStore,
         ...(logId !== undefined ? { logId } : {})
     });
     return {
-        rotated,
-        collections: cascade,
+        rotated: tail.rotated,
+        collections: tail.collections,
         did: removed.did,
         document: removed.doc,
-        ...(read
-            ? { userKey: read.userKey, rosterDescriptor: read.descriptor }
+        ...(tail.userKey && tail.rosterDescriptor
+            ? { userKey: tail.userKey, rosterDescriptor: tail.rosterDescriptor }
             : {})
     };
 }

package/dist/clientAnnex/forget.js.map

@@ -1 +1 @@
-{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAsEA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAI9D,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EAIpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EAqBZ;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC;QAC9C,OAAO,EAAE,QAAQ;QACjB,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,cAAc,EAAE,0DAA0D;KAC3E,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAA;IAC7E,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IACrE,IACE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,6BAA6B,EAAE,CAAA;IAC3C,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,IAAwE,CAAA;IAC5E,IAAI,OAAO,GAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC,CAAA;QACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACnC,MAAM,YAAY,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,YAAY,CAC9C,CAAA;QACD,MAAM,OAAO,GAAG,YAAY,EAAE,UAAU,CAAC,IAAI,CAC3C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,YAAY,CAC3C,CAAA;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,GAAG,MAAM,mBAAmB,CAAC;gBACrC,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,SAAS,CAAC,GAAG;gBACvB,iBAAiB,EAAE,YAAY;aAChC,CAAC,CAAA;YACF,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,qBAAqB,EAAE,yBAAyB;YAChD,aAAa;SACd,CAAC,CAAA;QACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,gBAAgB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;QACnE,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAC1C,aAAa,EACX,OAAO,WAAW,CAAC,aAAa,KAAK,UAAU;gBAC7C,CAAC,CAAC,MAAM,WAAW,CAAC,aAAa,EAAE;gBACnC,CAAC,CAAC,WAAW,CAAC,aAAa;YAC/B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,GAAG,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO,CAAC,UAAU;YACpC,qBAAqB,EAAE,yBAAyB;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,KAAK,EAAE,QAAQ;QACf,eAAe,EAAE,cAAc;QAC/B,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IAEF,OAAO;QACL,OAAO;QACP,WAAW,EAAE,OAAO;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,UAAU,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}
+{"version":3,"file":"forget.js","sourceRoot":"","sources":["../../src/clientAnnex/forget.ts"],"names":[],"mappings":"AAsEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAI9D,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAKnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAoB5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,KAAK,EACL,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EAiBZ;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC;QAC9C,OAAO,EAAE,QAAQ;QACjB,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,cAAc,EAAE,0DAA0D;KAC3E,CAAC,CAAA;IACF,IACE,oBAAoB,CAAC;QACnB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,IAAI,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,eAAe,CAAC,mBAAmB,EAAE;KAChE,CAAC,EACF,CAAC;QACD,MAAM,IAAI,6BAA6B,EAAE,CAAA;IAC3C,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,+BAA+B,CAAC;QACjD,WAAW;QACX,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,iBAAiB,EAAE,kBAAkB,CAAC;YACpC,mBAAmB,EAAE,eAAe,CAAC,mBAAmB;YACxD,wBAAwB,EAAE,iCAAiC;SAC5D,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,uBAAuB,EAAE,yBAAyB;QAClD,aAAa;QACb,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW;KACZ,CAAC,CAAA;IAEF,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACtC,KAAK,EAAE,QAAQ;QACf,eAAe,EAAE,cAAc;QAC/B,UAAU;QACV,eAAe;QACf,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,gBAAgB;YACvC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;AACH,CAAC"}

package/dist/clientAnnex/forgetLast.d.ts

@@ -38,17 +38,22 @@
  *    the ENROLLED client's root authority, and not through the credential's
  *    bridge delegation. The bridge is often signed by the very VM the strike
  *    removes -- the readiness stage's renewal mints it as the ladder, and
- *    stage 6 re-signs it as the ladder again -- so a bridge-invoked reinstall
+ *    stage 5 re-signs it as the ladder again -- so a bridge-invoked reinstall
  *    would be authorized against the post-strike document under the
  *    current-key-set rule and refused, leaving the account VM-less with every
  *    ladder-signed delegation rotted and a re-run failing identically. The
- *    client stands until stage 7 and holds root authority on the Space, so
+ *    client stands until stage 6 and holds root authority on the Space, so
  *    its store is the one that carries the pair. Only the HTTP invocation
  *    changes: both entries stay ladder-SIGNED.
  * 2. **The roster rotation**, ladder-signed, anchored at the reinstall entry,
  *    HTTP-invoked under the still-standing client: the user key rotates off
  *    this client's wrap in ONE append (the license's one-shot shape), read
- *    back through the credential's standing wrap. Because the append's
+ *    back through the credential's standing wrap. The anchoring is this
+ *    ceremony's guarantee rather than the app's wiring: the shared
+ *    recipient-retiring tail (`retireRosterRecipientAndCascade`) sets the
+ *    roster store's minimum controller version from the post-reinstall log,
+ *    so a store resolving its controller from a cached pre-transition view
+ *    still lands the append at the reinstall version. Because the append's
  *    signer is the ladder VM -- a key the post-removal document still lists
  *    -- the roster log needs no seal repair afterwards, which matters on
  *    an account where no enrolled client's login sweep will ever run again.
@@ -68,39 +73,18 @@
  *    is what keeps a torn run from stranding the generation delegation-less.
  *    A delegation a surviving sibling credential's ladder signed is left
  *    standing, since the revocation loop never reaches it either.
- * 5. **The other unlock methods' record re-mint** (`unlockMethods`): every
- *    other standing credential's and recovery code's bridge (and
- *    `delegatedClients` sibling, where the record carries one) is re-signed
- *    by the ladder VM and its record re-sealed through the entry's
- *    management zcap -- the revocation cascade's re-mint pass
- *    (`remintRecoveryDelegations`), run with the ladder VM as the delegating
- *    and record-signing key and the forgotten client named as retiring, so
- *    every delegation it signed counts as rotted ahead of the removal entry.
- *    Delegations the removed client had signed rot at that entry, and on a
- *    client-less account no remembered login's refresh block will ever run
- *    again to heal them, so this is the one pass that reaches them. The
- *    HTTP side still invokes under the still-standing client (the
- *    management zcaps are granted to the account DID, which only an enrolled
- *    client can invoke) -- which is why the stage must run before the
- *    removal entry. The pass walks every entry and reports each one's fate,
- *    but the ceremony does not carry an unsettled entry past this point: a
- *    `failed` or `pending-entry` outcome refuses the removal entry
- *    ({@link RecordRemintFailedError}, naming the records the pass left
- *    unreached), since after the removal nothing could ever re-sign that
- *    record's bridge. The client stays
- *    enrolled, and a re-run reaches the entry again.
- * 6. **The record re-bind seam** (`onBeforeRemoval`, required): the caller
+ * 5. **The record re-bind seam** (`onBeforeRemoval`, required): the caller
  *    re-signs the LOGIN credential's bridge and `delegatedClients` sibling
  *    with the ladder VM and re-seals its unlock record with the credential
- *    in hand (a full re-wrap, proof verified rather than settled). Stage 5
- *    deliberately skips that credential (its record is re-sealed with the
- *    credential in hand rather than through a management zcap), so the
- *    seam is the only thing that ever re-signs the login credential's own
- *    bridge with the ladder VM. Without it the removal entry would leave
- *    every bridge signed by the struck key on an account with no enrolled
- *    client -- an account nothing can write to -- which is why a call that
- *    omits the seam is refused before any read.
- * 7. **The removal entry** ({@link forgetLastWebvhClient}): the client's
+ *    in hand (a full re-wrap, proof verified rather than settled). It is the
+ *    only unlock record this ceremony writes. Every OTHER credential's
+ *    record is signed by its own credential's ladder VM, which this ceremony
+ *    does not strike, so this transition rots no sibling record and re-seals
+ *    none (`decisions/0019`). Without the seam the removal entry would leave
+ *    the login credential's own bridge signed by the struck client's key on
+ *    an account with no enrolled client -- an account nothing can write to --
+ *    which is why a call that omits the seam is refused before any read.
+ * 6. **The removal entry** ({@link forgetLastWebvhClient}): the client's
  *    whole document inventory out while the reinstalled ladder VM keeps the
  *    account anchored. The post-removal `did:web` projection is PUT through
  *    `clientLogStore` immediately BEFORE that entry, since the entry itself
@@ -128,9 +112,7 @@
  * the generation stage re-asks the same staleness policy (a prior run's own
  * fresh delegation reads as retiring, so a re-run churns one delegation and
  * strands nothing, while a sibling-signed one churns none), and the record
- * re-mint re-checks staleness per entry (a record
- * already ladder-signed reads as current, one whose re-mint failed is still
- * rotted and is re-minted). Torn after the removal entry is the
+ * re-bind seam is idempotent. Torn after the removal entry is the
  * finish-the-wipe state the app's next login maps.
  *
  * The honest limitation is the cascade's, as everywhere: ciphertext this
@@ -138,17 +120,13 @@
  * and old epochs stay open to keys it already held.
  */
 import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
-import type { IKeyAgreementKey, IZcap } from '@interop/data-integrity-core';
-import type { ZcapClient } from '@interop/ezcap';
+import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption, IDelegatedZcap } from '@interop/was-client';
-import type { EncryptionDescriptorStore } from '@interop/was-client/edv';
 import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import { type RevokedClientKeys } from '../webvh/revokeClient.js';
 import type { ResourceLogPinStore } from '@interop/vh-resource-log';
-import { type CascadeCollections, type UserKey, type UserKeyCascadeResult } from '../keys/index.js';
+import { type CascadeCollections, type SealableEncryptionDescriptorStore, type UserKey, type UserKeyAdoptedHook, type UserKeyCascadeResult } from '../keys/index.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
-import type { AccountPointer } from '../keyring/record.js';
-import { type RecordRemintOutcome, type RecoveryDelegationEntry } from '../recovery/recoveryDelegation.js';
 import { type ClientAnnexWriteStore } from './log.js';
 /**
  * What the ceremony's generation stage did: the revoked delegation ids, and
@@ -169,76 +147,26 @@ export interface GenerationDelegationRetirement {
     replaced: boolean;
     skipped?: 'no-pointer' | 'log-unreadable' | 'rung-uncommitted' | 'already-removed';
 }
-/**
- * The other unlock methods' reach for the record re-mint stage: the registry
- * entries to walk (the OTHER methods' -- the login credential's own record is
- * the `onBeforeRemoval` seam's, re-wrapped with the credential in hand; an
- * entry for it here is harmless but redundant), the unlock Spaces' storage
- * server, the management-zcap client factory (invoking as the still-standing
- * client), and the registry record-back seam. The shape is the revocation
- * cascade's re-mint seams verbatim, so an app binds both from one place.
- */
-export interface UnlockMethodsRemintReach<Entry extends RecoveryDelegationEntry = RecoveryDelegationEntry> {
-    entries: Entry[];
-    pointer: AccountPointer;
-    storageServerUrl: string;
-    managementZcapClient: (options: {
-        capability: IZcap;
-    }) => ZcapClient;
-    recordEntry: (options: {
-        entry: Entry;
-    }) => Promise<void>;
-}
 /**
  * What a completed last-client forget reports: whether the reinstall half of
  * the strike-and-reinstall pair ran on this call (`false` on a resumed run
  * that owed no rotation, so neither entry was published), whether the
  * roster's wrap for the
  * forgotten client was retired on this run, the per-collection fan-out
- * result, the generation stage's report, the other unlock methods' record
- * re-mint report (present when the caller supplied the reach: the counts and
- * every entry's fate; a completed ceremony never carries a `failed` outcome,
- * since that refuses the removal entry instead), the document as the removal
- * entry left it, and -- when the account has a roster -- the rotated key with
- * the roster descriptor it was read from.
+ * result, the generation stage's report, the document as the removal entry
+ * left it, and -- when the account has a roster -- the rotated key with the
+ * roster descriptor it was read from.
  */
 export interface LastEnrolledClientForgetResult {
     reinstalled: boolean;
     rotated: boolean;
     collections: UserKeyCascadeResult;
     generation: GenerationDelegationRetirement;
-    unlockMethods?: {
-        reminted: number;
-        skipped: number;
-        outcomes: RecordRemintOutcome[];
-    };
     did: string;
     document: object;
     userKey?: UserKey;
     rosterDescriptor?: CollectionEncryption;
 }
-/**
- * The record re-mint stage could not settle every other unlock method's
- * record, so the removal entry was refused: `failed` names the entries the
- * pass left unreached -- those whose re-mint threw (each carrying its cause)
- * and those it skipped as pending-shaped (the entry's identity members name
- * a credential other than the one its record is sealed to) -- and
- * `unlockMethods` is the whole stage report. A pending-shaped entry blocks
- * for the same reason a failed one does: its bridge is left signed by the
- * key the removal entry strikes, and on a client-less account no login will
- * ever heal it. The mender is a remembered login, which is exactly what the
- * removal would end. The forgotten client is still enrolled and every stage
- * before this one has landed, so a re-run resumes at the re-mint. Matched
- * on `name` (the errors cross app-injected seams that may resolve to another
- * copy of this package).
- */
-export declare class RecordRemintFailedError extends Error {
-    readonly failed: RecordRemintOutcome[];
-    readonly unlockMethods: NonNullable<LastEnrolledClientForgetResult['unlockMethods']>;
-    constructor({ unlockMethods }: {
-        unlockMethods: NonNullable<LastEnrolledClientForgetResult['unlockMethods']>;
-    });
-}
 /**
  * Forgets the account's LAST enrolled client -- this browser's own
  * -- transitioning the account to the client-less, ladder-anchored state.
@@ -258,7 +186,7 @@ export declare class RecordRemintFailedError extends Error {
  *   `logStore` is often signed by the ladder VM the strike removes and the
  *   reinstall would then be refused under the current-key-set rule. Both
  *   entries stay ladder-signed; only the HTTP invocation differs. It also
- *   carries the removal entry's pre-entry `did:web` projection PUT (stage 7),
+ *   carries the removal entry's pre-entry `did:web` projection PUT (stage 6),
  *   the one write the bridge store cannot make. Required: a call without it
  *   throws a `TypeError` before any read
  * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
@@ -280,13 +208,19 @@ export declare class RecordRemintFailedError extends Error {
  *   excluded from the staged-hash attribution
  * @param options.expectedDid {string}   the account DID from the caller's
  *   stored account pointer
- * @param options.rosterStoreFor {Function}   `({ did, log }) => store` --
- *   builds the `key-map/user-key.jsonl` roster store whose appends are
- *   SIGNED BY THE LADDER VM and whose controller view resolves from the
- *   supplied log -- the pre-transition head for the opening read, the
- *   post-reinstall head for the rotation (the inventory-changing anchor the
- *   ceremony-tail license admits), while its HTTP requests invoke under the still-standing
- *   client
+ * @param options.rosterStore {SealableEncryptionDescriptorStore}   the
+ *   log-governed `key-map/user-key.jsonl` roster store whose appends are
+ *   SIGNED BY THE LADDER VM while its HTTP requests invoke under the
+ *   still-standing client. Its controller view is the ceremony's to anchor,
+ *   not the app's: the orchestrator sets the minimum controller version at
+ *   the pre-transition head for the opening read and at the post-reinstall
+ *   head for the rotation (the inventory-changing anchor the ceremony-tail
+ *   license admits), so a store wired over a cached pre-transition view
+ *   still anchors the one ladder-signed append past the reinstall entry.
+ *   Required to be anchorable: a store without `setMinimumControllerVersion`
+ *   is refused with a `TypeError` before any read, since the pair would
+ *   otherwise publish two entries per attempt ahead of a rotation the
+ *   license refuses every time
  * @param options.credentialKeyAgreementKey {IKeyAgreementKey}   the standing
  *   credential's key-agreement key -- the recipient whose wrap survives the
  *   rotation, reading the fresh key back and unwrapping the generations for
@@ -312,28 +246,18 @@ export declare class RecordRemintFailedError extends Error {
  *   fresh delegation's target subtree)
  * @param [options.annex.pinStore] {ResourceLogPinStore}   chain-head pins
  *   for the pointed generation's read
- * @param [options.unlockMethods] {UnlockMethodsRemintReach}   the other
- *   unlock methods' record re-mint reach (stage 5): the registry entries
- *   whose bridge (and sibling) the ladder VM re-signs and whose records it
- *   re-seals through their management zcaps, invoked as the still-standing
- *   client. Omitted, the stage is skipped and the result carries no
- *   `unlockMethods` report -- the residue decision 0004's amendment stated.
- *   Supplied, an entry the pass could not re-mint -- or skipped as
- *   pending-shaped -- refuses the removal entry
- *   (`RecordRemintFailedError`)
  * @param options.onBeforeRemoval {Function}
  *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
- *   after the record re-mint stage, immediately before the removal entry,
- *   with the post-reinstall published state. The caller re-signs the login
- *   credential's bridge and `delegatedClients` sibling with the ladder VM
- *   and re-seals its unlock record here -- the only stage that reaches the
- *   login credential's record, which the `unlockMethods` pass skips. Must
- *   be idempotent (a resumed run invokes it again). Required: a call
- *   without it throws a `TypeError` before any read
+ *   immediately before the removal entry, with the post-reinstall published
+ *   state. The caller re-signs the login credential's bridge and
+ *   `delegatedClients` sibling with the ladder VM and re-seals its unlock
+ *   record here -- the only unlock record this ceremony writes. Must be
+ *   idempotent (a resumed run invokes it again). Required: a call without it
+ *   throws a `TypeError` before any read
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<LastEnrolledClientForgetResult>}
  */
-export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStoreFor, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
+export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, onBeforeRemoval, now }: {
     logStore: UnlockLogStore;
     clientLogStore: UnlockLogStore;
     pinStore?: ResourceLogPinStore;
@@ -342,18 +266,11 @@ export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pin
     forgottenKeyAgreementKeyMultibase: string;
     knownLatentHashes?: string[];
     expectedDid: string;
-    rosterStoreFor: (options: {
-        did: string;
-        log: DIDLog;
-    }) => EncryptionDescriptorStore;
+    rosterStore: SealableEncryptionDescriptorStore;
     credentialKeyAgreementKey: IKeyAgreementKey;
     userKey?: UserKey;
     pinnedEpochId?: string | null;
-    onUserKeyAdopted?: (adopted: {
-        userKey: UserKey;
-        latestEpochId: string;
-        descriptor: CollectionEncryption;
-    }) => Promise<void>;
+    onUserKeyAdopted?: UserKeyAdoptedHook;
     collections: CascadeCollections;
     annex: {
         storeFor: (options: {
@@ -365,7 +282,6 @@ export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pin
         accountSpaceId: string;
         pinStore?: ResourceLogPinStore;
     };
-    unlockMethods?: UnlockMethodsRemintReach;
     onBeforeRemoval: (published: {
         did: string;
         doc: object;
@@ -374,7 +290,7 @@ export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pin
     now?: number;
 }): Promise<LastEnrolledClientForgetResult>;
 /**
- * THE LAST-CLIENT REMOVAL ENTRY (stage 7, the transition's own removal): the
+ * THE LAST-CLIENT REMOVAL ENTRY (stage 6, the transition's own removal): the
  * plain forget's removal shape (`clientForgetEntryOnce`) with this ceremony's
  * removability invariant injected instead of the plain forget's last-client
  * refusal -- the forgotten client IS the last enrolled client, and the

package/dist/clientAnnex/forgetLast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuIG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AAMxE,OAAO,KAAK,EAAqB,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAE3E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,OAAO,EACZ,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAU1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAeD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,8BAA8B,CAAC,eAAe,CAAC,CAChD,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC5E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,CAAC,OAAO,EAAE;QACxB,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,yBAAyB,CAAA;IAC/B,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,OAAO,CAAA;QAChB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,oBAAoB,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAkR1C;AAkND;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrD"}
+{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqHG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAM/E,OAAO,KAAK,EAAqB,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAE3E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,iCAAiC,EACtC,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAUhE,OAAO,EAQL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,iCAAiC,CAAA;IAC9C,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAmO1C;AA4JD;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrD"}