@interop/wallet-core 0.66.0 → 0.68.0

package/dist/clientAnnex/forgetLast.d.ts

@@ -38,11 +38,11 @@
  *    the ENROLLED client's root authority, and not through the credential's
  *    bridge delegation. The bridge is often signed by the very VM the strike
  *    removes -- the readiness stage's renewal mints it as the ladder, and
- *    stage 6 re-signs it as the ladder again -- so a bridge-invoked reinstall
+ *    stage 5 re-signs it as the ladder again -- so a bridge-invoked reinstall
  *    would be authorized against the post-strike document under the
  *    current-key-set rule and refused, leaving the account VM-less with every
  *    ladder-signed delegation rotted and a re-run failing identically. The
- *    client stands until stage 7 and holds root authority on the Space, so
+ *    client stands until stage 6 and holds root authority on the Space, so
  *    its store is the one that carries the pair. Only the HTTP invocation
  *    changes: both entries stay ladder-SIGNED.
  * 2. **The roster rotation**, ladder-signed, anchored at the reinstall entry,
@@ -73,39 +73,18 @@
  *    is what keeps a torn run from stranding the generation delegation-less.
  *    A delegation a surviving sibling credential's ladder signed is left
  *    standing, since the revocation loop never reaches it either.
- * 5. **The other unlock methods' record re-mint** (`unlockMethods`): every
- *    other standing credential's and recovery code's bridge (and
- *    `delegatedClients` sibling, where the record carries one) is re-signed
- *    by the ladder VM and its record re-sealed through the entry's
- *    management zcap -- the revocation cascade's re-mint pass
- *    (`remintRecoveryDelegations`), run with the ladder VM as the delegating
- *    and record-signing key and the forgotten client named as retiring, so
- *    every delegation it signed counts as rotted ahead of the removal entry.
- *    Delegations the removed client had signed rot at that entry, and on a
- *    client-less account no remembered login's refresh block will ever run
- *    again to heal them, so this is the one pass that reaches them. The
- *    HTTP side still invokes under the still-standing client (the
- *    management zcaps are granted to the account DID, which only an enrolled
- *    client can invoke) -- which is why the stage must run before the
- *    removal entry. The pass walks every entry and reports each one's fate,
- *    but the ceremony does not carry an unsettled entry past this point: a
- *    `failed` or `pending-entry` outcome refuses the removal entry
- *    ({@link RecordRemintFailedError}, naming the records the pass left
- *    unreached), since after the removal nothing could ever re-sign that
- *    record's bridge. The client stays
- *    enrolled, and a re-run reaches the entry again.
- * 6. **The record re-bind seam** (`onBeforeRemoval`, required): the caller
+ * 5. **The record re-bind seam** (`onBeforeRemoval`, required): the caller
  *    re-signs the LOGIN credential's bridge and `delegatedClients` sibling
  *    with the ladder VM and re-seals its unlock record with the credential
- *    in hand (a full re-wrap, proof verified rather than settled). Stage 5
- *    deliberately skips that credential (its record is re-sealed with the
- *    credential in hand rather than through a management zcap), so the
- *    seam is the only thing that ever re-signs the login credential's own
- *    bridge with the ladder VM. Without it the removal entry would leave
- *    every bridge signed by the struck key on an account with no enrolled
- *    client -- an account nothing can write to -- which is why a call that
- *    omits the seam is refused before any read.
- * 7. **The removal entry** ({@link forgetLastWebvhClient}): the client's
+ *    in hand (a full re-wrap, proof verified rather than settled). It is the
+ *    only unlock record this ceremony writes. Every OTHER credential's
+ *    record is signed by its own credential's ladder VM, which this ceremony
+ *    does not strike, so this transition rots no sibling record and re-seals
+ *    none (`decisions/0019`). Without the seam the removal entry would leave
+ *    the login credential's own bridge signed by the struck client's key on
+ *    an account with no enrolled client -- an account nothing can write to --
+ *    which is why a call that omits the seam is refused before any read.
+ * 6. **The removal entry** ({@link forgetLastWebvhClient}): the client's
  *    whole document inventory out while the reinstalled ladder VM keeps the
  *    account anchored. The post-removal `did:web` projection is PUT through
  *    `clientLogStore` immediately BEFORE that entry, since the entry itself
@@ -133,9 +112,7 @@
  * the generation stage re-asks the same staleness policy (a prior run's own
  * fresh delegation reads as retiring, so a re-run churns one delegation and
  * strands nothing, while a sibling-signed one churns none), and the record
- * re-mint re-checks staleness per entry (a record
- * already ladder-signed reads as current, one whose re-mint failed is still
- * rotted and is re-minted). Torn after the removal entry is the
+ * re-bind seam is idempotent. Torn after the removal entry is the
  * finish-the-wipe state the app's next login maps.
  *
  * The honest limitation is the cascade's, as everywhere: ciphertext this
@@ -143,16 +120,12 @@
  * and old epochs stay open to keys it already held.
  */
 import type { DIDDoc, DIDLog } from '@interop/did-method-webvh';
-import type { IKeyAgreementKey, IZcap } from '@interop/data-integrity-core';
-import type { ZcapClient } from '@interop/ezcap';
+import type { IKeyAgreementKey } from '@interop/data-integrity-core';
 import type { CollectionEncryption, IDelegatedZcap } from '@interop/was-client';
 import type { WebvhIdStore } from '../webvh/didWebvh.js';
 import { type RevokedClientKeys } from '../webvh/revokeClient.js';
-import type { ResourceLogPinStore } from '@interop/vh-resource-log';
 import { type CascadeCollections, type SealableEncryptionDescriptorStore, type UserKey, type UserKeyAdoptedHook, type UserKeyCascadeResult } from '../keys/index.js';
 import type { UnlockLogStore } from '../unlock/standingWebvh.js';
-import type { AccountPointer } from '../keyring/record.js';
-import { type RecordRemintOutcome, type RecoveryDelegationEntry } from '../recovery/recoveryDelegation.js';
 import { type ClientAnnexWriteStore } from './log.js';
 /**
  * What the ceremony's generation stage did: the revoked delegation ids, and
@@ -173,76 +146,26 @@ export interface GenerationDelegationRetirement {
     replaced: boolean;
     skipped?: 'no-pointer' | 'log-unreadable' | 'rung-uncommitted' | 'already-removed';
 }
-/**
- * The other unlock methods' reach for the record re-mint stage: the registry
- * entries to walk (the OTHER methods' -- the login credential's own record is
- * the `onBeforeRemoval` seam's, re-wrapped with the credential in hand; an
- * entry for it here is harmless but redundant), the unlock Spaces' storage
- * server, the management-zcap client factory (invoking as the still-standing
- * client), and the registry record-back seam. The shape is the revocation
- * cascade's re-mint seams verbatim, so an app binds both from one place.
- */
-export interface UnlockMethodsRemintReach<Entry extends RecoveryDelegationEntry = RecoveryDelegationEntry> {
-    entries: Entry[];
-    pointer: AccountPointer;
-    storageServerUrl: string;
-    managementZcapClient: (options: {
-        capability: IZcap;
-    }) => ZcapClient;
-    recordEntry: (options: {
-        entry: Entry;
-    }) => Promise<void>;
-}
 /**
  * What a completed last-client forget reports: whether the reinstall half of
  * the strike-and-reinstall pair ran on this call (`false` on a resumed run
  * that owed no rotation, so neither entry was published), whether the
  * roster's wrap for the
  * forgotten client was retired on this run, the per-collection fan-out
- * result, the generation stage's report, the other unlock methods' record
- * re-mint report (present when the caller supplied the reach: the counts and
- * every entry's fate; a completed ceremony never carries a `failed` outcome,
- * since that refuses the removal entry instead), the document as the removal
- * entry left it, and -- when the account has a roster -- the rotated key with
- * the roster descriptor it was read from.
+ * result, the generation stage's report, the document as the removal entry
+ * left it, and -- when the account has a roster -- the rotated key with the
+ * roster descriptor it was read from.
  */
 export interface LastEnrolledClientForgetResult {
     reinstalled: boolean;
     rotated: boolean;
     collections: UserKeyCascadeResult;
     generation: GenerationDelegationRetirement;
-    unlockMethods?: {
-        reminted: number;
-        skipped: number;
-        outcomes: RecordRemintOutcome[];
-    };
     did: string;
     document: object;
     userKey?: UserKey;
     rosterDescriptor?: CollectionEncryption;
 }
-/**
- * The record re-mint stage could not settle every other unlock method's
- * record, so the removal entry was refused: `failed` names the entries the
- * pass left unreached -- those whose re-mint threw (each carrying its cause)
- * and those it skipped as pending-shaped (the entry's identity members name
- * a credential other than the one its record is sealed to) -- and
- * `unlockMethods` is the whole stage report. A pending-shaped entry blocks
- * for the same reason a failed one does: its bridge is left signed by the
- * key the removal entry strikes, and on a client-less account no login will
- * ever heal it. The mender is a remembered login, which is exactly what the
- * removal would end. The forgotten client is still enrolled and every stage
- * before this one has landed, so a re-run resumes at the re-mint. Matched
- * on `name` (the errors cross app-injected seams that may resolve to another
- * copy of this package).
- */
-export declare class RecordRemintFailedError extends Error {
-    readonly failed: RecordRemintOutcome[];
-    readonly unlockMethods: NonNullable<LastEnrolledClientForgetResult['unlockMethods']>;
-    constructor({ unlockMethods }: {
-        unlockMethods: NonNullable<LastEnrolledClientForgetResult['unlockMethods']>;
-    });
-}
 /**
  * Forgets the account's LAST enrolled client -- this browser's own
  * -- transitioning the account to the client-less, ladder-anchored state.
@@ -254,7 +177,13 @@ export declare class RecordRemintFailedError extends Error {
  *
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
- *   `did.jsonl` bridge store; also serves the ceremony's public reads
+ *   `did.jsonl` bridge store; also serves the ceremony's public reads. Every
+ *   account-log read the ceremony makes -- the opening read, and the strike,
+ *   reinstall, and removal entries' own reads inside their conflict-retry
+ *   loops -- is checked against the chain-head pin its store carries, so a
+ *   served truncated prefix is refused (`ResourceLogContinuityError`,
+ *   `rollback`) before any roster append or log publish, and each entry
+ *   advances the pin to the head it publishes
  * @param options.clientLogStore {UnlockLogStore}   the account-log store
  *   invoked under the STILL-STANDING enrolled client's root authority (an
  *   app's `wasWebvhIdStore` satisfies the narrower shape). The
@@ -262,17 +191,9 @@ export declare class RecordRemintFailedError extends Error {
  *   `logStore` is often signed by the ladder VM the strike removes and the
  *   reinstall would then be refused under the current-key-set rule. Both
  *   entries stay ladder-signed; only the HTTP invocation differs. It also
- *   carries the removal entry's pre-entry `did:web` projection PUT (stage 7),
+ *   carries the removal entry's pre-entry `did:web` projection PUT (stage 6),
  *   the one write the bridge store cannot make. Required: a call without it
  *   throws a `TypeError` before any read
- * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
- *   pins, the account log's slot derived from `annex.accountSpaceId`. Every
- *   account-log read the ceremony makes -- the opening read, and the strike,
- *   reinstall, and removal entries' own reads inside their conflict-retry
- *   loops -- is checked against the pinned head, so a served truncated
- *   prefix is refused (`ResourceLogContinuityError`, `rollback`) before any
- *   roster append or log publish, and each entry advances the pin to the
- *   head it publishes. Without it the ceremony checks `expectedDid` only
  * @param options.ladderSeed {Uint8Array}   the login credential's ladder seed
  * @param options.forgottenClient {RevokedClientKeys}   this client's public
  *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
@@ -320,33 +241,20 @@ export declare class RecordRemintFailedError extends Error {
  *   server (the fresh generation delegation's target host)
  * @param options.annex.accountSpaceId {string}   the ACCOUNT Space's id (the
  *   fresh delegation's target subtree)
- * @param [options.annex.pinStore] {ResourceLogPinStore}   chain-head pins
- *   for the pointed generation's read
- * @param [options.unlockMethods] {UnlockMethodsRemintReach}   the other
- *   unlock methods' record re-mint reach (stage 5): the registry entries
- *   whose bridge (and sibling) the ladder VM re-signs and whose records it
- *   re-seals through their management zcaps, invoked as the still-standing
- *   client. Omitted, the stage is skipped and the result carries no
- *   `unlockMethods` report -- the residue decision 0004's amendment stated.
- *   Supplied, an entry the pass could not re-mint -- or skipped as
- *   pending-shaped -- refuses the removal entry
- *   (`RecordRemintFailedError`)
  * @param options.onBeforeRemoval {Function}
  *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
- *   after the record re-mint stage, immediately before the removal entry,
- *   with the post-reinstall published state. The caller re-signs the login
- *   credential's bridge and `delegatedClients` sibling with the ladder VM
- *   and re-seals its unlock record here -- the only stage that reaches the
- *   login credential's record, which the `unlockMethods` pass skips. Must
- *   be idempotent (a resumed run invokes it again). Required: a call
- *   without it throws a `TypeError` before any read
+ *   immediately before the removal entry, with the post-reinstall published
+ *   state. The caller re-signs the login credential's bridge and
+ *   `delegatedClients` sibling with the ladder VM and re-seals its unlock
+ *   record here -- the only unlock record this ceremony writes. Must be
+ *   idempotent (a resumed run invokes it again). Required: a call without it
+ *   throws a `TypeError` before any read
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<LastEnrolledClientForgetResult>}
  */
-export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now }: {
+export declare function forgetLastEnrolledClient({ logStore, clientLogStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, onBeforeRemoval, now }: {
     logStore: UnlockLogStore;
     clientLogStore: UnlockLogStore;
-    pinStore?: ResourceLogPinStore;
     ladderSeed: Uint8Array;
     forgottenClient: RevokedClientKeys;
     forgottenKeyAgreementKeyMultibase: string;
@@ -366,9 +274,7 @@ export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pin
         revoke: (delegation: IDelegatedZcap) => Promise<void>;
         wasServerUrl: string;
         accountSpaceId: string;
-        pinStore?: ResourceLogPinStore;
     };
-    unlockMethods?: UnlockMethodsRemintReach;
     onBeforeRemoval: (published: {
         did: string;
         doc: object;
@@ -377,7 +283,7 @@ export declare function forgetLastEnrolledClient({ logStore, clientLogStore, pin
     now?: number;
 }): Promise<LastEnrolledClientForgetResult>;
 /**
- * THE LAST-CLIENT REMOVAL ENTRY (stage 7, the transition's own removal): the
+ * THE LAST-CLIENT REMOVAL ENTRY (stage 6, the transition's own removal): the
  * plain forget's removal shape (`clientForgetEntryOnce`) with this ceremony's
  * removability invariant injected instead of the plain forget's last-client
  * refusal -- the forgotten client IS the last enrolled client, and the
@@ -396,8 +302,6 @@ export declare function forgetLastWebvhClient(options: {
     forgottenClient: RevokedClientKeys;
     knownLatentHashes?: string[];
     expectedDid?: string;
-    pinStore?: ResourceLogPinStore;
-    logId?: string;
 }): Promise<{
     did: string;
     doc: DIDDoc;

package/dist/clientAnnex/forgetLast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4IG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAM/E,OAAO,KAAK,EAAqB,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAE3E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEnE,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,iCAAiC,EACtC,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAA;AAU1C,OAAO,EASL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,uBAAuB,GAAG,uBAAuB;IAE/D,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,oBAAoB,EAAE,CAAC,OAAO,EAAE;QAAE,UAAU,EAAE,KAAK,CAAA;KAAE,KAAK,UAAU,CAAA;IACpE,WAAW,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,aAAa,CAAC,EAAE;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,mBAAmB,EAAE,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAeD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CACjC,8BAA8B,CAAC,eAAe,CAAC,CAChD,CAAA;gBAEW,EACV,aAAa,EACd,EAAE;QACD,aAAa,EAAE,WAAW,CAAC,8BAA8B,CAAC,eAAe,CAAC,CAAC,CAAA;KAC5E;CAeF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,QAAQ,EACR,cAAc,EACd,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,aAAa,EACb,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,iCAAiC,CAAA;IAC9C,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;KAC/B,CAAA;IACD,aAAa,CAAC,EAAE,wBAAwB,CAAA;IACxC,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAiQ1C;AAkND;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrD"}
+{"version":3,"file":"forgetLast.d.ts","sourceRoot":"","sources":["../../src/clientAnnex/forgetLast.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqHG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAK/E,OAAO,KAAK,EAAqB,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,iCAAiC,EACtC,KAAK,OAAO,EACZ,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAUhE,OAAO,EAQL,KAAK,qBAAqB,EAC3B,MAAM,UAAU,CAAA;AAEjB;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EACN,YAAY,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,iBAAiB,CAAA;CAC3E;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,oBAAoB,CAAA;IACjC,UAAU,EAAE,8BAA8B,CAAA;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,QAAQ,EACR,cAAc,EACd,UAAU,EACV,eAAe,EACf,iCAAiC,EACjC,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,yBAAyB,EACzB,OAAO,EACP,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,eAAe,EACf,GAAgB,EACjB,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,cAAc,EAAE,cAAc,CAAA;IAC9B,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iCAAiC,EAAE,MAAM,CAAA;IACzC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,iCAAiC,CAAA;IAC9C,yBAAyB,EAAE,gBAAgB,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;IACrC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,OAAO,EAAE;YAClB,OAAO,EAAE,MAAM,CAAA;YACf,YAAY,EAAE,MAAM,CAAA;SACrB,KAAK,qBAAqB,CAAA;QAC3B,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACrD,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,eAAe,EAAE,CAAC,SAAS,EAAE;QAC3B,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;QACX,GAAG,EAAE,MAAM,CAAA;KACZ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA2N1C;AAyJD;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,cAAc,CAAA;IACrB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,iBAAiB,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrD"}

package/dist/clientAnnex/forgetLast.js

@@ -1,58 +1,13 @@
-import { readPublishedLog, readPublishedLogOrThrow, withLogConflictRetry } from '../webvh/didWebvh.js';
-import { accountLogPinId } from '../webvh/verifyLog.js';
+import { readPublishedLogOrThrow, withLogConflictRetry } from '../webvh/didWebvh.js';
 import { clientRemovalTarget } from '../webvh/revokeClient.js';
 import { delegationProofKeyId } from '../webvh/standingZcap.js';
 import { vmFragmentOf } from '@interop/vh-resource-log';
 import { anchorRosterStoreAt, isSealableDescriptorStore, retireRosterRecipientAndCascade, rosterRecipientKid, rosterWrapsRecipient } from '../keys/index.js';
-import { recordSignerFromAgent } from '../keyring/record.js';
-import { remintRecoveryDelegations } from '../recovery/recoveryDelegation.js';
 import { ladderVmKeyMultibase } from './ladder.js';
 import { ladderVmIds, relationIds } from '../resourceLog/document.js';
-import { ladderVmAgent, ladderVmZcapClient } from './zcap.js';
+import { ladderVmZcapClient } from './zcap.js';
 import { clientForgetEntryOnce, installLadderVmWebvh, strikeLadderVmWebvh } from './ladderAnchored.js';
-import { clientAnnexDidParts, clientAnnexLogPinId, delegatedClientsDelegationMinter, delegatedClientsPointer, ensureGenerationDelegationCurrent, generationDelegationHistory, mintGenerationDelegation, revokeTreatingAlreadyRevokedAsSuccess } from './log.js';
-/**
- * The re-mint outcomes that withhold the removal entry: a record the pass
- * could not reach, and a pending-shaped entry it deliberately did not write
- * (re-minting one would seal a half-retired credential a fresh bridge into
- * the standing credential's record). Both leave a bridge the removal entry
- * would rot for good on an account that will never see a remembered login
- * again.
- */
-const REMINT_BLOCKING_OUTCOMES = [
-    'failed',
-    'pending-entry'
-];
-/**
- * The record re-mint stage could not settle every other unlock method's
- * record, so the removal entry was refused: `failed` names the entries the
- * pass left unreached -- those whose re-mint threw (each carrying its cause)
- * and those it skipped as pending-shaped (the entry's identity members name
- * a credential other than the one its record is sealed to) -- and
- * `unlockMethods` is the whole stage report. A pending-shaped entry blocks
- * for the same reason a failed one does: its bridge is left signed by the
- * key the removal entry strikes, and on a client-less account no login will
- * ever heal it. The mender is a remembered login, which is exactly what the
- * removal would end. The forgotten client is still enrolled and every stage
- * before this one has landed, so a re-run resumes at the re-mint. Matched
- * on `name` (the errors cross app-injected seams that may resolve to another
- * copy of this package).
- */
-export class RecordRemintFailedError extends Error {
-    failed;
-    unlockMethods;
-    constructor({ unlockMethods }) {
-        const failed = unlockMethods.outcomes.filter(outcome => REMINT_BLOCKING_OUTCOMES.includes(outcome.outcome));
-        super('did:webvh: the last-client forget could not settle the record of ' +
-            `${failed.length} other unlock method(s) (` +
-            failed.map(outcome => `"${outcome.label}"`).join(', ') +
-            '); the removal entry was not published. The client stays enrolled; ' +
-            'run the forget again.');
-        this.name = 'RecordRemintFailedError';
-        this.failed = failed;
-        this.unlockMethods = unlockMethods;
-    }
-}
+import { clientAnnexDidParts, delegatedClientsPointer, ensureGenerationDelegationCurrent, generationDelegationHistory, mintGenerationDelegation, readClientAnnexLogOrAbsent, revokeTreatingAlreadyRevokedAsSuccess } from './log.js';
 /**
  * Forgets the account's LAST enrolled client -- this browser's own
  * -- transitioning the account to the client-less, ladder-anchored state.
@@ -64,7 +19,13 @@ export class RecordRemintFailedError extends Error {
  *
  * @param options {object}
  * @param options.logStore {UnlockLogStore}   the credential's delegated
- *   `did.jsonl` bridge store; also serves the ceremony's public reads
+ *   `did.jsonl` bridge store; also serves the ceremony's public reads. Every
+ *   account-log read the ceremony makes -- the opening read, and the strike,
+ *   reinstall, and removal entries' own reads inside their conflict-retry
+ *   loops -- is checked against the chain-head pin its store carries, so a
+ *   served truncated prefix is refused (`ResourceLogContinuityError`,
+ *   `rollback`) before any roster append or log publish, and each entry
+ *   advances the pin to the head it publishes
  * @param options.clientLogStore {UnlockLogStore}   the account-log store
  *   invoked under the STILL-STANDING enrolled client's root authority (an
  *   app's `wasWebvhIdStore` satisfies the narrower shape). The
@@ -72,17 +33,9 @@ export class RecordRemintFailedError extends Error {
  *   `logStore` is often signed by the ladder VM the strike removes and the
  *   reinstall would then be refused under the current-key-set rule. Both
  *   entries stay ladder-signed; only the HTTP invocation differs. It also
- *   carries the removal entry's pre-entry `did:web` projection PUT (stage 7),
+ *   carries the removal entry's pre-entry `did:web` projection PUT (stage 6),
  *   the one write the bridge store cannot make. Required: a call without it
  *   throws a `TypeError` before any read
- * @param [options.pinStore] {ResourceLogPinStore}   this client's chain-head
- *   pins, the account log's slot derived from `annex.accountSpaceId`. Every
- *   account-log read the ceremony makes -- the opening read, and the strike,
- *   reinstall, and removal entries' own reads inside their conflict-retry
- *   loops -- is checked against the pinned head, so a served truncated
- *   prefix is refused (`ResourceLogContinuityError`, `rollback`) before any
- *   roster append or log publish, and each entry advances the pin to the
- *   head it publishes. Without it the ceremony checks `expectedDid` only
  * @param options.ladderSeed {Uint8Array}   the login credential's ladder seed
  * @param options.forgottenClient {RevokedClientKeys}   this client's public
  *   halves; an `updateKeyMultibase` the log does not authorize (stale, or the
@@ -130,30 +83,18 @@ export class RecordRemintFailedError extends Error {
  *   server (the fresh generation delegation's target host)
  * @param options.annex.accountSpaceId {string}   the ACCOUNT Space's id (the
  *   fresh delegation's target subtree)
- * @param [options.annex.pinStore] {ResourceLogPinStore}   chain-head pins
- *   for the pointed generation's read
- * @param [options.unlockMethods] {UnlockMethodsRemintReach}   the other
- *   unlock methods' record re-mint reach (stage 5): the registry entries
- *   whose bridge (and sibling) the ladder VM re-signs and whose records it
- *   re-seals through their management zcaps, invoked as the still-standing
- *   client. Omitted, the stage is skipped and the result carries no
- *   `unlockMethods` report -- the residue decision 0004's amendment stated.
- *   Supplied, an entry the pass could not re-mint -- or skipped as
- *   pending-shaped -- refuses the removal entry
- *   (`RecordRemintFailedError`)
  * @param options.onBeforeRemoval {Function}
  *   `({ did, doc, log }) => Promise<void>` -- the record re-bind seam: runs
- *   after the record re-mint stage, immediately before the removal entry,
- *   with the post-reinstall published state. The caller re-signs the login
- *   credential's bridge and `delegatedClients` sibling with the ladder VM
- *   and re-seals its unlock record here -- the only stage that reaches the
- *   login credential's record, which the `unlockMethods` pass skips. Must
- *   be idempotent (a resumed run invokes it again). Required: a call
- *   without it throws a `TypeError` before any read
+ *   immediately before the removal entry, with the post-reinstall published
+ *   state. The caller re-signs the login credential's bridge and
+ *   `delegatedClients` sibling with the ladder VM and re-seals its unlock
+ *   record here -- the only unlock record this ceremony writes. Must be
+ *   idempotent (a resumed run invokes it again). Required: a call without it
+ *   throws a `TypeError` before any read
  * @param [options.now] {number}   epoch milliseconds, for tests
  * @returns {Promise<LastEnrolledClientForgetResult>}
  */
-export async function forgetLastEnrolledClient({ logStore, clientLogStore, pinStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, unlockMethods, onBeforeRemoval, now = Date.now() }) {
+export async function forgetLastEnrolledClient({ logStore, clientLogStore, ladderSeed, forgottenClient, forgottenKeyAgreementKeyMultibase, knownLatentHashes, expectedDid, rosterStore, credentialKeyAgreementKey, userKey, pinnedEpochId, onUserKeyAdopted, collections, annex, onBeforeRemoval, now = Date.now() }) {
     // The seam is the only stage that re-signs the login credential's bridge
     // with the ladder VM; a run without it would land the removal entry over
     // a record the struck key signed, on an account nothing could then write
@@ -186,14 +127,9 @@ export async function forgetLastEnrolledClient({ logStore, clientLogStore, pinSt
     // state the app's next login maps -- nothing here can still invoke), and
     // an account with another enrolled client belongs to the ordinary
     // forget ceremony.
-    // The account log's pin slot, shared by every read and entry below.
-    const pinned = pinStore
-        ? { pinStore, logId: accountLogPinId({ spaceId: annex.accountSpaceId }) }
-        : {};
     const before = await readPublishedLogOrThrow({
         idStore: logStore,
         expectedDid,
-        ...pinned,
         missingMessage: 'did:webvh: did.jsonl is missing; nothing to enroll into.'
     });
     const preTarget = await clientRemovalTarget({
@@ -280,14 +216,12 @@ export async function forgetLastEnrolledClient({ logStore, clientLogStore, pinSt
         await strikeLadderVmWebvh({
             store: clientLogStore,
             ladderSeed,
-            expectedDid,
-            ...pinned
+            expectedDid
         });
         const install = await installLadderVmWebvh({
             store: clientLogStore,
             ladderSeed,
-            expectedDid,
-            ...pinned
+            expectedDid
         });
         reinstalled = install.installed;
         anchor = { did: install.did, doc: install.doc, log: install.log };
@@ -327,32 +261,8 @@ export async function forgetLastEnrolledClient({ logStore, clientLogStore, pinSt
         annex,
         now
     });
-    // Stage 5: the other unlock methods' record re-mint, ladder-signed, with
-    // the forgotten client named as retiring -- the post-reinstall document
-    // still lists it, so without that axis every bridge it signed would read
-    // as standing and be left to rot at the removal entry.
-    let remint;
-    if (unlockMethods !== undefined) {
-        remint = await remintUnlockMethodRecordsAsLadder({
-            doc: anchor.doc,
-            accountDid: anchor.did,
-            ladderSeed,
-            retiringSigningKeyMultibase: forgottenClient.signingKeyMultibase,
-            reach: unlockMethods,
-            now
-        });
-        // The one pass that will ever reach these records on a client-less
-        // account: a record it could not re-seal -- or deliberately did not
-        // write, the pending-shaped entry -- would be left with a bridge the
-        // removal entry rots for good, so the removal is refused instead. The
-        // stages already landed are idempotent and the client still stands, so
-        // the re-run resumes here.
-        if (remint.outcomes.some(outcome => REMINT_BLOCKING_OUTCOMES.includes(outcome.outcome))) {
-            throw new RecordRemintFailedError({ unlockMethods: remint });
-        }
-    }
-    // Stage 6: the record re-bind seam -- the login credential's record, the
-    // one stage 5 skipped -- while the removal has not landed (a
+    // Stage 5: the record re-bind seam -- the login credential's record, the
+    // only one this ceremony writes -- while the removal has not landed (a
     // ladder-VM-signed bridge verifies from the reinstall entry on, and the old
     // client-signed one keeps verifying until the removal -- so a tear on
     // either side of this callback leaves a working login).
@@ -361,7 +271,7 @@ export async function forgetLastEnrolledClient({ logStore, clientLogStore, pinSt
         doc: anchor.doc,
         log: anchor.log
     });
-    // Stage 7: the removal entry -- the client's whole inventory out, the
+    // Stage 6: the removal entry -- the client's whole inventory out, the
     // installed ladder VM keeping the account anchored.
     const removed = await forgetLastWebvhClient({
         store: logStore,
@@ -369,15 +279,13 @@ export async function forgetLastEnrolledClient({ logStore, clientLogStore, pinSt
         ladderSeed,
         forgottenClient,
         ...(knownLatentHashes ? { knownLatentHashes } : {}),
-        expectedDid,
-        ...pinned
+        expectedDid
     });
     return {
         reinstalled,
         rotated: tail.rotated,
         collections: tail.collections,
         generation,
-        ...(remint ? { unlockMethods: remint } : {}),
         did: removed.did,
         document: removed.doc,
         ...(tail.userKey && tail.rosterDescriptor
@@ -399,7 +307,7 @@ export async function forgetLastEnrolledClient({ logStore, clientLogStore, pinSt
  * PROJECTED post-edit document, not by an unconditional force: this
  * credential's ladder VM is named as retiring (the revocations below end its
  * delegations, a state no client-side predicate can read) and so is the
- * forgotten client (the removal entry in stage 7 has yet to strike it). A
+ * forgotten client (the removal entry in stage 6 has yet to strike it). A
  * delegation signed by neither -- a sibling credential's ladder VM, which
  * survives the transition -- stands, and keeping it is the right answer: the
  * revocation loop below never reaches it.
@@ -421,11 +329,12 @@ async function retireLadderGenerationDelegations({ doc, accountDid, ladderSeed,
     }
     const parts = clientAnnexDidParts({ did: pointedDid });
     const store = annex.storeFor(parts);
-    const logId = clientAnnexLogPinId(parts);
-    const published = await readPublishedLog({
-        idStore: store,
-        expectedDid: pointedDid,
-        ...(annex.pinStore !== undefined ? { pinStore: annex.pinStore, logId } : {})
+    // Absence is read as absence even under a pin this client holds from an
+    // earlier read: a generation that is gone is the `log-unreadable` escape,
+    // and a refusal here would wedge the transition after the roster rotation.
+    const published = await readClientAnnexLogOrAbsent({
+        store,
+        expectedDid: pointedDid
     });
     if (published === undefined) {
         return { revoked: [], replaced: false, skipped: 'log-unreadable' };
@@ -468,9 +377,6 @@ async function retireLadderGenerationDelegations({ doc, accountDid, ladderSeed,
             expectedDid: pointedDid,
             accountDoc: doc,
             retiringKeyMultibases: [ladderVmKey, retiringSigningKeyMultibase],
-            ...(annex.pinStore !== undefined
-                ? { pinStore: annex.pinStore, logId }
-                : {}),
             now
         });
         // `replaced` reports what the stage actually wrote. A delegation the
@@ -480,73 +386,28 @@ async function retireLadderGenerationDelegations({ doc, accountDid, ladderSeed,
         replaced = ensured.renewed;
     }
     catch (err) {
-        if (err.name !== 'ClientAnnexRungUncommittedError') {
+        if (err?.name !==
+            'ClientAnnexRungUncommittedError') {
             throw err;
         }
         rungUncommitted = true;
     }
     // The revocations, blind and resumable (400 already-revoked as success).
-    const revoked = [];
-    for (const delegation of doomed) {
-        await revokeTreatingAlreadyRevokedAsSuccess({
-            revoke: annex.revoke,
-            delegation
-        });
-        const id = delegation.id;
-        if (typeof id === 'string') {
-            revoked.push(id);
-        }
-    }
+    // They target independent delegations, so they run together; the reported
+    // ids keep the doomed list's order.
+    await Promise.all(doomed.map(delegation => revokeTreatingAlreadyRevokedAsSuccess({
+        revoke: annex.revoke,
+        delegation
+    })));
+    const revoked = doomed
+        .map(delegation => delegation.id)
+        .filter((id) => typeof id === 'string');
     return rungUncommitted
         ? { revoked, replaced, skipped: 'rung-uncommitted' }
         : { revoked, replaced };
 }
 /**
- * The record re-mint stage: the revocation cascade's re-mint pass over the
- * other unlock methods' registry entries, with the ladder VM as both the
- * delegating key (the fresh bridge and sibling) and the record-frame signer
- * (`ladderVmAgent`'s did:key form, whose multibase the post-reinstall document
- * lists, so a reader settling the mixed-signer proof against the account
- * document accepts it after the removal too -- `currentAccountRecordSigners`
- * is that allowlist), and the forgotten client named as retiring. The sibling
- * minter reads the annex pointer off the post-reinstall document. The HTTP
- * side rides the caller's management-zcap clients, still invocable here.
- *
- * @param options {object}
- * @param options.doc {DIDDoc}   the post-reinstall account document
- * @param options.accountDid {string}
- * @param options.ladderSeed {Uint8Array}
- * @param options.retiringSigningKeyMultibase {string}   the forgotten
- *   client's signing key
- * @param options.reach {UnlockMethodsRemintReach}
- * @param options.now {number}
- * @returns {Promise<object>}   the pass's counts and per-entry outcomes
- */
-async function remintUnlockMethodRecordsAsLadder({ doc, accountDid, ladderSeed, retiringSigningKeyMultibase, reach, now }) {
-    const ladderClient = await ladderVmZcapClient({ accountDid, ladderSeed });
-    const recordSigner = recordSignerFromAgent({
-        keyAgent: await ladderVmAgent({ ladderSeed })
-    });
-    return remintRecoveryDelegations({
-        doc,
-        entries: reach.entries,
-        pointer: reach.pointer,
-        storageServerUrl: reach.storageServerUrl,
-        zcapClient: ladderClient,
-        recordSigner,
-        managementZcapClient: reach.managementZcapClient,
-        recordEntry: reach.recordEntry,
-        mintDelegatedClientsDelegation: delegatedClientsDelegationMinter({
-            doc,
-            zcapClient: ladderClient,
-            wasServerUrl: reach.pointer.host
-        }),
-        retiringKeyMultibases: [retiringSigningKeyMultibase],
-        now
-    });
-}
-/**
- * THE LAST-CLIENT REMOVAL ENTRY (stage 7, the transition's own removal): the
+ * THE LAST-CLIENT REMOVAL ENTRY (stage 6, the transition's own removal): the
  * plain forget's removal shape (`clientForgetEntryOnce`) with this ceremony's
  * removability invariant injected instead of the plain forget's last-client
  * refusal -- the forgotten client IS the last enrolled client, and the