@openlfcp/client 0.1.5 → 0.2.0-beta.10

package/dist/receipts.js

@@ -0,0 +1,118 @@
+import { dataUnitId, fromHex, toHex } from "@openlfcp/core";
+import { sha256 } from "@openlfcp/crypto";
+import { cborMap, encode } from "@openlfcp/wire/cbor";
+import { releaseWrites } from "./batch-status.js";
+/** §3.3: an operation ID that already has a receipt for different intents. A local SDK error. */
+export class OperationIdReusedError extends Error {
+    operationId;
+    code = "OPERATION_ID_REUSED";
+    constructor(operationId) {
+        super(`operation ${operationId} already committed different intents (§3.3)`);
+        this.operationId = operationId;
+        this.name = "OperationIdReusedError";
+    }
+}
+const PREFIX = "receipt:";
+const markKey = (resource, operationId) => `${PREFIX}${toHex(resource)}:${operationId}`;
+const RELEASED = "released-batch:";
+const releasedKey = (resource, operationId) => `${RELEASED}${toHex(resource)}:${operationId}`;
+/** A plain value as the CBOR data model: objects become maps, absent fields are left out. */
+function cbor(value, depth = 0) {
+    if (depth > 64)
+        throw new Error("an intent nests too deep to hash");
+    if (value === null || typeof value === "boolean" || typeof value === "string")
+        return value;
+    if (typeof value === "number") {
+        if (!Number.isSafeInteger(value))
+            throw new Error(`an intent holds a non-integer number: ${value}`);
+        return value;
+    }
+    if (typeof value === "bigint" || value instanceof Uint8Array)
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => cbor(v, depth + 1));
+    if (typeof value === "object")
+        return cborMap(Object.entries(value)
+            .filter(([, v]) => v !== undefined)
+            .map(([k, v]) => [k, cbor(v, depth + 1)]));
+    throw new Error(`an intent holds a ${typeof value}, which has no canonical form`);
+}
+/**
+ * §3.3: SHA-256 (hex) of the deterministic CBOR (RFC 8949 §4.2.1) of the
+ * list of intents in order, each a map from its field names to their
+ * values, Text as given, nothing normalized.
+ */
+export function intentsHash(intents) {
+    return toHex(sha256(encode(cbor(intents))));
+}
+/** The receipt as stored in a local mark. */
+function storedReceipt(receipt) {
+    const stored = {
+        operationId: receipt.operationId,
+        unitIds: receipt.unitIds.map((u) => toHex(u)),
+        affectedNodeIds: [...receipt.affectedNodeIds],
+        modelRevision: receipt.modelRevision,
+        intentsHash: receipt.intentsHash,
+    };
+    return JSON.stringify(stored);
+}
+/** The local-mark write that stores `receipt` (for the commit's transaction). */
+export function receiptWrite(resource, receipt) {
+    return {
+        op: "put-local-mark",
+        key: markKey(resource, receipt.operationId),
+        value: storedReceipt(receipt),
+    };
+}
+const parse = (raw) => {
+    const s = JSON.parse(raw);
+    return Object.freeze({
+        operationId: s.operationId,
+        unitIds: Object.freeze(s.unitIds.map((u) => dataUnitId(fromHex(u)))),
+        affectedNodeIds: Object.freeze([...s.affectedNodeIds]),
+        modelRevision: s.modelRevision,
+        intentsHash: s.intentsHash,
+        durable: true,
+    });
+};
+/** §3.4: the receipt of an operation, definitive across restarts; undefined when nothing was committed. */
+export async function receiptOf(storage, resource, operationId) {
+    const raw = await storage.localMarks.get(markKey(resource, operationId));
+    return raw === undefined ? undefined : parse(raw);
+}
+/** The receipt of a released batch that is not final yet; undefined otherwise. */
+export async function releasedReceiptOf(storage, resource, operationId) {
+    const raw = await storage.localMarks.get(releasedKey(resource, operationId));
+    return raw === undefined ? undefined : parse(raw);
+}
+/** The receipts of a Resource's released batches that are not final yet. */
+export async function releasedReceiptsOf(storage, resource) {
+    return (await storage.localMarks.list(`${RELEASED}${toHex(resource)}:`)).map((m) => parse(m.value));
+}
+/** Keeps a released receipt for its batch's status (or, with null, forgets it). */
+export function releasedWrite(resource, operationId, receipt) {
+    return {
+        op: "put-local-mark",
+        key: releasedKey(resource, operationId),
+        value: receipt === null ? null : storedReceipt(receipt),
+    };
+}
+/** Every receipt of a Resource that is not released yet. */
+export async function receiptsOf(storage, resource) {
+    return (await storage.localMarks.list(`${PREFIX}${toHex(resource)}:`)).map((m) => parse(m.value));
+}
+/**
+ * §3.5: forgets a receipt the caller has finished with. Its batch status
+ * goes with it when the batch is final (accepted or rejected); otherwise
+ * the batch is still reported until it is final.
+ */
+export async function releaseReceipt(storage, resource, operationId) {
+    const receipt = await receiptOf(storage, resource, operationId);
+    const r = await storage.commit([
+        { op: "put-local-mark", key: markKey(resource, operationId), value: null },
+        ...(receipt === undefined ? [] : await releaseWrites(storage, resource, receipt)),
+    ]);
+    if (!r.ok)
+        throw new Error(`the receipt was not released: ${r.reason}`);
+}
+//# sourceMappingURL=receipts.js.map

package/dist/repropose.d.ts

@@ -0,0 +1,81 @@
+import { type ControlRecordId, type Hash32, type ResourceId } from "@openlfcp/core";
+import { type LfcpStorage, type SecretStore } from "@openlfcp/storage";
+import { type Signer } from "@openlfcp/wire";
+import type { OutboundQueue } from "./outbound.js";
+/**
+ * Re-proposing this client's own Control Records that the coordinator
+ * refused with CONTROL_HEAD_MISMATCH (LFCP-WIRE-01 §21, §47; the LFCP-036
+ * design). A record proposed on a head that another writer moved is blocked
+ * "repropose" by the OutboundQueue; without this it — and every object that
+ * depends on it, such as a grant's invitation Key Package — would wait
+ * forever. Here each blocked record is re-authored on the current local
+ * head, keeping its intent, re-signed with a new record ID, and its
+ * dependent Key Packages are re-sealed to the new head; a record that is no
+ * longer authorized or meaningful is dropped with a typed outcome instead.
+ *
+ * Only the GRANT and REVOKE intents are re-authored: a revocation/rotation
+ * is serialized at the author (SyncClient.revokeAccess refuses while a
+ * Control Record is pending), so a KEY_EPOCH never reaches re-proposal; one
+ * that somehow does is dropped (its epoch number, DEK commitment and final
+ * frontier are bound to the head it was built on) and surfaced, so the
+ * application re-runs the high-level operation.
+ *
+ * Re-authoring is idempotent (a grant already on the chain with the same
+ * subject and abilities is treated as superseded, not duplicated) and
+ * bounded (an item re-proposed `maxAttempts` times without landing is
+ * dropped), so a head that keeps moving cannot loop.
+ */
+export type ReproposeDropReason = 
+/** The blocked record was not authored by this client, so it cannot be re-signed. */
+"not-author"
+/** An equivalent grant is already on the chain: this one was re-proposed before. */
+ | "superseded"
+/** The intent is no longer authorized on the moved head. */
+ | "unauthorized"
+/** A revocation whose target grant is already inactive on the moved head. */
+ | "already-revoked"
+/** A dependent Key Package's DEK is not held, so it cannot be re-sealed. */
+ | "no-dek"
+/** A dependent Key Package no longer verifies on the moved head. */
+ | "key-unauthorized"
+/** A KEY_EPOCH or other intent that is not re-authored here. */
+ | "unsupported-intent"
+/** Re-proposed too many times without landing (the head kept moving). */
+ | "attempts-exhausted";
+export type ReproposeOutcome = {
+    readonly kind: "reproposed";
+    readonly oldId: ControlRecordId;
+    readonly newId: ControlRecordId;
+    /** The dependent Key Packages re-sealed to the new head, old ID → new ID. */
+    readonly keyPackages: readonly {
+        readonly oldId: Hash32;
+        readonly newId: Hash32;
+    }[];
+} | {
+    readonly kind: "dropped";
+    readonly oldId: ControlRecordId;
+    readonly reason: ReproposeDropReason;
+};
+export interface ReproposeResult {
+    readonly outcomes: readonly ReproposeOutcome[];
+}
+export interface ReproposeOptions {
+    readonly storage: Pick<LfcpStorage, "control" | "outbound" | "commit">;
+    readonly secrets: SecretStore;
+    readonly signer: Signer;
+    readonly resource: ResourceId;
+    /** For dropping in-memory tracking of the items a re-proposal replaces. */
+    readonly queue: OutboundQueue;
+    /** Re-proposal attempts per blocked record (by item ID hex), owned by the caller. */
+    readonly attempts: Map<string, number>;
+    /** The cap after which an item is dropped "attempts-exhausted" (default 8). */
+    readonly maxAttempts?: number;
+}
+/**
+ * Re-proposes every blocked "repropose" Control Record of `resource`, in
+ * record order, each on the local head left by the ones before it. Returns
+ * one outcome per blocked record. Call it under the same serial lock as the
+ * queue, so no other record is authored meanwhile.
+ */
+export declare function reproposeControlRecords(options: ReproposeOptions): Promise<ReproposeResult>;
+//# sourceMappingURL=repropose.d.ts.map

package/dist/repropose.js

@@ -0,0 +1,221 @@
+import { bytesEqual, controlRecordId, hash32, toHex, } from "@openlfcp/core";
+import { importResourceDEK } from "@openlfcp/crypto";
+import { dekSecretRef, } from "@openlfcp/storage";
+import { controlRecordSigner, decodeControlRecord, isGrantActive, parseKeyPackage, sealKeyPackage, signControlRecord, validateControlChain, verifyKeyPackage, } from "@openlfcp/wire";
+import { controlRecordWrites, keyPackageWrites } from "./queue.js";
+import { localControlChain } from "./storage.js";
+/** The descriptor of `principal` from the validated chain (its principals, owner or a grant subject). */
+function descriptorOf(state, principal) {
+    const known = state.principals.get(toHex(principal));
+    if (known !== undefined)
+        return known;
+    if (bytesEqual(state.owner.principalId, principal))
+        return state.owner;
+    return undefined;
+}
+/** An active grant on `state` with the same subject and ability set (a prior re-proposal of this grant). */
+function equivalentGrant(state, subject, abilities) {
+    const want = [...abilities].map(String).sort().join(",");
+    for (const g of state.grants.values())
+        if (bytesEqual(g.subject, subject) &&
+            isGrantActive(state, g.id) &&
+            [...g.abilities].map(String).sort().join(",") === want)
+            return true;
+    return false;
+}
+/** Re-signs a record on the local head and checks it extends the chain linearly; undefined when it does not. */
+function reauthor(local, sign) {
+    const signed = sign({
+        resourceId: local.state.resourceId,
+        controlSeq: local.state.seq + 1n,
+        prevControlId: local.state.head,
+    });
+    const next = validateControlChain([...local.records.map((r) => r.signed.bytes), signed.bytes]);
+    if (next.kind !== "linear")
+        return undefined;
+    return { bytes: signed.bytes, newId: signed.recordId, next };
+}
+/** Re-seals every queued Key Package that depended on `oldHead` to the re-proposed `newHead`/`next`. */
+async function resealDependents(options, next, oldHead, newHead) {
+    const removed = [];
+    const added = [];
+    const mapping = [];
+    for (const item of await options.storage.outbound.list(options.resource)) {
+        if (item.kind !== "key-package")
+            continue;
+        let controlHead;
+        let recipientId;
+        let epoch;
+        try {
+            const p = parseKeyPackage(item.bytes).payload;
+            controlHead = p.controlHead;
+            recipientId = p.recipient;
+            epoch = p.dataEpoch;
+        }
+        catch {
+            continue;
+        }
+        if (!bytesEqual(controlHead, oldHead))
+            continue;
+        const recipient = descriptorOf(next.state, recipientId);
+        const bytes = await options.secrets.get(dekSecretRef(options.resource, epoch));
+        if (recipient === undefined || bytes === undefined)
+            return { ok: false, reason: "no-dek" };
+        const sealed = await sealKeyPackage({
+            resourceId: options.resource,
+            epoch,
+            controlHead: newHead,
+            recipient,
+            dek: importResourceDEK(bytes),
+            signer: options.signer,
+        });
+        if (verifyKeyPackage(next, parseKeyPackage(sealed.bytes)).kind !== "authorized")
+            return { ok: false, reason: "key-unauthorized" };
+        removed.push(item.itemId);
+        added.push(sealed.bytes);
+        mapping.push({ oldId: item.itemId, newId: hash32(parseKeyPackage(sealed.bytes).signed.id) });
+    }
+    return Object.freeze({ ok: true, removed, added, mapping });
+}
+/** The queued Key Packages of `resource` whose control head is `controlHead`. */
+async function dependentKeyPackages(storage, resource, controlHead) {
+    const out = [];
+    for (const item of await storage.outbound.list(resource)) {
+        if (item.kind !== "key-package")
+            continue;
+        try {
+            if (bytesEqual(parseKeyPackage(item.bytes).payload.controlHead, controlHead))
+                out.push(item.itemId);
+        }
+        catch {
+            // not a parsable Key Package: never a dependent of this head.
+        }
+    }
+    return out;
+}
+/** Enqueues the re-authored record and its re-sealed Key Packages and dequeues the old ones, in one transaction. */
+async function swap(storage, queue, change) {
+    const writes = [
+        { op: "dequeue", itemId: change.removeControl },
+        ...change.removeKeyPackages.map((itemId) => ({ op: "dequeue", itemId })),
+        ...controlRecordWrites(change.addControl),
+        ...change.addKeyPackages.flatMap(keyPackageWrites),
+    ];
+    const r = await storage.commit(writes);
+    if (!r.ok)
+        throw new Error(`the re-proposal was not committed: ${r.reason}`);
+    queue.release([change.removeControl, ...change.removeKeyPackages]);
+}
+/** Dequeues a blocked record and its dependents and drops the queue's in-memory tracking of them. */
+async function dropItem(storage, queue, ids) {
+    const r = await storage.commit(ids.map((itemId) => ({ op: "dequeue", itemId })));
+    if (!r.ok)
+        throw new Error(`a re-proposal drop was not committed: ${r.reason}`);
+    queue.release(ids);
+}
+/**
+ * Re-proposes every blocked "repropose" Control Record of `resource`, in
+ * record order, each on the local head left by the ones before it. Returns
+ * one outcome per blocked record. Call it under the same serial lock as the
+ * queue, so no other record is authored meanwhile.
+ */
+export async function reproposeControlRecords(options) {
+    const { storage, signer, resource, queue } = options;
+    const maxAttempts = options.maxAttempts ?? 8;
+    const blocked = (await storage.outbound.list(resource))
+        .filter((i) => i.kind === "control-record" && i.blocked?.reason === "repropose")
+        .map((i) => ({ itemId: i.itemId, record: decodeControlRecord(i.bytes) }))
+        .sort((a, b) => (a.record.payload.controlSeq < b.record.payload.controlSeq ? -1 : 1));
+    const outcomes = [];
+    const mine = signer.descriptor.principalId;
+    for (const { itemId, record } of blocked) {
+        const oldId = controlRecordId(record.signed.id);
+        const drop = async (reason) => {
+            options.attempts.delete(toHex(itemId));
+            await dropItem(storage, queue, [
+                itemId,
+                ...(await dependentKeyPackages(storage, resource, oldId)),
+            ]);
+            outcomes.push(Object.freeze({ kind: "dropped", oldId, reason }));
+        };
+        if (!bytesEqual(controlRecordSigner(record), mine)) {
+            await drop("not-author");
+            continue;
+        }
+        const attempt = (options.attempts.get(toHex(itemId)) ?? 0) + 1;
+        if (attempt > maxAttempts) {
+            await drop("attempts-exhausted");
+            continue;
+        }
+        options.attempts.set(toHex(itemId), attempt);
+        const local = await localControlChain(storage, resource);
+        if (local === undefined || local.kind !== "linear") {
+            await drop("unauthorized");
+            continue;
+        }
+        const body = record.body;
+        if (body.type === "CAPABILITY_GRANT") {
+            if (equivalentGrant(local.state, body.subject.principalId, body.abilities)) {
+                await drop("superseded");
+                continue;
+            }
+            const reauthored = reauthor(local, (header) => signControlRecord(header, {
+                type: "CAPABILITY_GRANT",
+                subject: body.subject,
+                abilities: body.abilities,
+                delegable: body.delegable,
+                ...(body.claimLimit === undefined ? {} : { claimLimit: body.claimLimit }),
+            }, signer));
+            if (reauthored === undefined) {
+                await drop("unauthorized");
+                continue;
+            }
+            const resealed = await resealDependents(options, reauthored.next, oldId, reauthored.newId);
+            if (!resealed.ok) {
+                await drop(resealed.reason);
+                continue;
+            }
+            await swap(storage, queue, {
+                removeControl: itemId,
+                removeKeyPackages: resealed.removed,
+                addControl: reauthored.bytes,
+                addKeyPackages: resealed.added,
+            });
+            // Carry the attempt count onto the re-authored record, so a head that
+            // keeps moving is still bounded (the count is cleared on its ACK).
+            options.attempts.delete(toHex(itemId));
+            options.attempts.set(toHex(reauthored.newId), attempt);
+            outcomes.push(Object.freeze({
+                kind: "reproposed",
+                oldId,
+                newId: reauthored.newId,
+                keyPackages: resealed.mapping,
+            }));
+            continue;
+        }
+        if (body.type === "CAPABILITY_REVOKE") {
+            if (!isGrantActive(local.state, body.grantId)) {
+                await drop("already-revoked");
+                continue;
+            }
+            const reauthored = reauthor(local, (header) => signControlRecord(header, { type: "CAPABILITY_REVOKE", grantId: body.grantId }, signer));
+            if (reauthored === undefined) {
+                await drop("unauthorized");
+                continue;
+            }
+            await swap(storage, queue, {
+                removeControl: itemId,
+                removeKeyPackages: [],
+                addControl: reauthored.bytes,
+                addKeyPackages: [],
+            });
+            options.attempts.delete(toHex(itemId));
+            options.attempts.set(toHex(reauthored.newId), attempt);
+            outcomes.push(Object.freeze({ kind: "reproposed", oldId, newId: reauthored.newId, keyPackages: [] }));
+            continue;
+        }
+        await drop("unsupported-intent");
+    }
+    return Object.freeze({ outcomes: Object.freeze(outcomes) });
+}
+//# sourceMappingURL=repropose.js.map

package/dist/revoke.d.ts

@@ -0,0 +1,71 @@
+import { type ControlRecordId, type DataEpoch, type PrincipalId } from "@openlfcp/core";
+import type { ResourceDEK } from "@openlfcp/crypto";
+import { type ChainResult, type HaveVector, type Signer } from "@openlfcp/wire";
+/**
+ * Removing a member's access (LFCP-02-060, LFCP-WIRE-01 §17.3, §19, §25):
+ * every active grant naming the member that the revoker may revoke is
+ * revoked, which also deactivates the grants delegated from it (§17.2);
+ * then, when the member has no read access left, the Data Epoch is rotated
+ * with a fresh DEK (§19, reason "member revoked"), and the new DEK goes in
+ * Key Packages to every remaining reader, so the member cannot read new
+ * data. Every record is built on the validated head and checked by
+ * extending the chain before anything is queued.
+ */
+type Linear = Extract<ChainResult, {
+    kind: "linear";
+}>;
+/** A grant naming the member that the revoker may not revoke: the member keeps access through it. */
+export interface RemainingPath {
+    readonly grantId: ControlRecordId;
+    readonly issuer: PrincipalId;
+    readonly abilities: readonly string[];
+}
+/** What a revocation writes, before it is queued. */
+export interface RevocationPlan {
+    /** The grants revoked, in record order. */
+    readonly revoked: readonly ControlRecordId[];
+    /** Grants delegated from them that the revocations deactivate (§17.2). */
+    readonly deactivated: readonly ControlRecordId[];
+    /** The signed Control Records in order: the revocations, then the Key Epoch if any. */
+    readonly records: readonly {
+        readonly recordId: ControlRecordId;
+        readonly bytes: Uint8Array;
+    }[];
+    /** The new epoch and its DEK, when the epoch is rotated. */
+    readonly rotation: {
+        readonly epoch: DataEpoch;
+        readonly dek: ResourceDEK;
+    } | null;
+    /** Sealed Key Packages of the new DEK, one per remaining reader. */
+    readonly keyPackages: readonly Uint8Array[];
+    /** The readers who receive them. */
+    readonly recipients: readonly PrincipalId[];
+    readonly remainingPaths: readonly RemainingPath[];
+}
+export type RevocationRefusal = 
+/** The member is the Resource's owner: ownership is transferred, never revoked. */
+"would-remove-owner"
+/** No active grant names the member. */
+ | "not-member"
+/** The revoker may revoke none of the member's grants, or may not rotate the epoch. */
+ | "not-authorized";
+export declare class RevocationRefused extends Error {
+    readonly reason: RevocationRefusal;
+    constructor(reason: RevocationRefusal, message: string);
+}
+/**
+ * Plans the removal of `subject` by `revoker` on the validated chain
+ * `view`. `frontier` is the closing epoch's accepted final frontier (the
+ * local Have). With `rotate: false`, or when the member keeps read access
+ * through a remaining path, the epoch is not rotated. Throws
+ * RevocationRefused.
+ */
+export declare function planRevocation(options: {
+    readonly view: Linear;
+    readonly revoker: Signer;
+    readonly subject: PrincipalId;
+    readonly frontier: HaveVector;
+    readonly rotate?: boolean;
+}): Promise<RevocationPlan>;
+export {};
+//# sourceMappingURL=revoke.d.ts.map

package/dist/revoke.js

@@ -0,0 +1,108 @@
+import { bytesEqual, controlRecordId, toHex, } from "@openlfcp/core";
+import { ABILITY, ABILITY_NAMES, hasAbility, isGrantActive, KEY_EPOCH_REASON, parseKeyPackage, rotateEpoch, sealKeyPackage, signControlRecord, validateControlChain, verifyKeyPackage, } from "@openlfcp/wire";
+export class RevocationRefused extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "RevocationRefused";
+    }
+}
+const name = (a) => ABILITY_NAMES.get(a) ?? `${a}`;
+/**
+ * Plans the removal of `subject` by `revoker` on the validated chain
+ * `view`. `frontier` is the closing epoch's accepted final frontier (the
+ * local Have). With `rotate: false`, or when the member keeps read access
+ * through a remaining path, the epoch is not rotated. Throws
+ * RevocationRefused.
+ */
+export async function planRevocation(options) {
+    const { view, revoker, subject } = options;
+    const state0 = view.state;
+    const R = state0.resourceId;
+    if (bytesEqual(state0.owner.principalId, subject))
+        throw new RevocationRefused("would-remove-owner", "the owner's access is not revoked (§17.3)");
+    const grants = [...state0.grants.values()].filter((g) => bytesEqual(g.subject, subject) && isGrantActive(state0, g.id));
+    if (grants.length === 0)
+        throw new RevocationRefused("not-member", "no active grant names this Principal");
+    let bytes = view.records.map((r) => r.signed.bytes);
+    let running = view;
+    const records = [];
+    const revoked = [];
+    const remainingPaths = [];
+    for (const g of grants) {
+        // Already inactive through an earlier revocation of its ancestor (§17.2).
+        if (!isGrantActive(running.state, g.id))
+            continue;
+        const signed = signControlRecord({ resourceId: R, controlSeq: running.state.seq + 1n, prevControlId: running.state.head }, { type: "CAPABILITY_REVOKE", grantId: g.id }, revoker);
+        const next = validateControlChain([...bytes, signed.bytes]);
+        if (next.kind !== "linear") {
+            remainingPaths.push(Object.freeze({
+                grantId: g.id,
+                issuer: g.issuer,
+                abilities: Object.freeze(g.abilities.map(name)),
+            }));
+            continue;
+        }
+        bytes = [...bytes, signed.bytes];
+        running = next;
+        records.push({ recordId: signed.recordId, bytes: signed.bytes });
+        revoked.push(g.id);
+    }
+    if (revoked.length === 0)
+        throw new RevocationRefused("not-authorized", "the revoker may revoke none of this Principal's grants (§17.3)");
+    const revokedKeys = new Set(revoked.map((id) => toHex(id)));
+    const deactivated = [...state0.grants.values()]
+        .filter((g) => !revokedKeys.has(toHex(g.id)) &&
+        isGrantActive(state0, g.id) &&
+        !isGrantActive(running.state, g.id))
+        .map((g) => g.id);
+    let rotation = null;
+    const keyPackages = [];
+    const recipients = [];
+    const stillReads = hasAbility(running.state, subject, ABILITY.DATA_READ);
+    if (options.rotate !== false && !stillReads) {
+        const r = rotateEpoch(running.state, revoker, {
+            reason: KEY_EPOCH_REASON.MEMBER_REVOKED,
+            finalFrontier: options.frontier,
+        });
+        const next = validateControlChain([...bytes, r.bytes]);
+        if (next.kind !== "linear")
+            throw new RevocationRefused("not-authorized", "the revoker may not rotate the Data Epoch (key/rotate, §19)");
+        running = next;
+        records.push({ recordId: controlRecordId(r.recordId), bytes: r.bytes });
+        rotation = Object.freeze({ epoch: r.epoch, dek: r.dek });
+        // Every remaining reader but the revoker, who keeps the DEK it made.
+        const readers = [
+            running.state.owner,
+            ...[...running.state.principals.values()],
+        ].filter((d, i, all) => all.findIndex((x) => bytesEqual(x.principalId, d.principalId)) === i &&
+            !bytesEqual(d.principalId, revoker.descriptor.principalId) &&
+            hasAbility(running.state, d.principalId, ABILITY.DATA_READ));
+        for (const recipient of readers) {
+            const sealed = await sealKeyPackage({
+                resourceId: R,
+                epoch: r.epoch,
+                controlHead: r.recordId,
+                recipient,
+                dek: r.dek,
+                signer: revoker,
+            });
+            const check = verifyKeyPackage(running, parseKeyPackage(sealed.bytes));
+            if (check.kind !== "authorized")
+                throw new RevocationRefused("not-authorized", `the revoker may not distribute the new key: ${check.message}`);
+            keyPackages.push(sealed.bytes);
+            recipients.push(recipient.principalId);
+        }
+    }
+    return Object.freeze({
+        revoked: Object.freeze(revoked),
+        deactivated: Object.freeze(deactivated),
+        records: Object.freeze(records),
+        rotation,
+        keyPackages: Object.freeze(keyPackages),
+        recipients: Object.freeze(recipients),
+        remainingPaths: Object.freeze(remainingPaths),
+    });
+}
+//# sourceMappingURL=revoke.js.map