@openlfcp/client 0.2.2 → 0.3.1

package/dist/identity/revocation.js

@@ -0,0 +1,403 @@
+import { bytesEqual, fromBase64url, fromHex, principalId, resourceId, secureRandom, toHex, } from "@openlfcp/core";
+import { activeDevice, signControlRecord, validateControlChain, } from "@openlfcp/wire";
+import { fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, runControlPhase, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
+import { mayManageDevices } from "./devices.js";
+import { principalRefOf } from "./document.js";
+import { newOperationId, OperationJournal, phaseOf } from "./journal.js";
+import { ChannelPool, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
+import { classifyRevoke } from "./phases.js";
+import { identityTarget } from "./resource.js";
+import { exposingRevocationsSince, resumeRotations, rotateAfter, rotatorTest, } from "./rotation.js";
+const toKeep = (state, root) => [...state.devices.entries()]
+    .filter(([, d]) => bytesEqual(d.root, root))
+    .map(([hex]) => principalId(fromHex(hex)))
+    .filter((p) => activeDevice(state, p) !== undefined);
+/** The DEVICE_REVOKE on the chain's head, if this installation may issue it there. */
+function revokeOn(chain, o, root, device, reason) {
+    const signed = signControlRecord({
+        resourceId: chain.state.resourceId,
+        controlSeq: chain.state.seq + 1n,
+        prevControlId: chain.state.head,
+    }, { type: "DEVICE_REVOKE", root, device, reason }, o.installation.signer);
+    const after = validateControlChain([...chain.records.map((r) => r.signed.bytes), signed.bytes]);
+    if (after.kind !== "linear")
+        return undefined;
+    // §8.1: the revoker must stay active in this Resource's post-state; a chain
+    // through the target is re-certified first, here, not only in I.
+    const me = o.installation.signer.descriptor.principalId;
+    if (!bytesEqual(me, device) &&
+        activeDevice(chain.state, me) !== undefined &&
+        activeDevice(after.state, me) === undefined)
+        return "self-dependent";
+    return { bytes: signed.bytes, after };
+}
+function previewOn(chain, o, root, device, reason) {
+    const R = chain.state.resourceId;
+    const empty = { suspended: [], exposing: false, rotator: false };
+    if (chain.state.revoked.has(`${toHex(root)}:${toHex(device)}`))
+        return { resource: R, status: "already-revoked", ...empty };
+    const sim = revokeOn(chain, o, root, device, reason);
+    if (sim === "self-dependent")
+        return { resource: R, status: "self-dependent", ...empty };
+    if (sim === undefined)
+        return { resource: R, status: "not-authorized", ...empty };
+    const before = new Set(toKeep(chain.state, root).map(toHex));
+    const after = new Set(toKeep(sim.after.state, root).map(toHex));
+    const suspended = [...before]
+        .filter((p) => !after.has(p) && p !== toHex(device))
+        .map((p) => principalId(fromHex(p)));
+    const exposing = exposingRevocationsSince(sim.after).some((e) => e.seq === sim.after.state.seq);
+    return {
+        resource: R,
+        status: "ok",
+        suspended,
+        exposing,
+        rotator: rotatorTest(sim.after.state, o.installation.signer.descriptor.principalId).rotator,
+    };
+}
+/** Roster targets of the Identity Resource (not archived), I excluded. */
+async function rosterTargets(o, channel, chain) {
+    const doc = o.document(chain.state.resourceId, genesisOwner(chain));
+    await loadIdentityDocument({
+        channel,
+        chain,
+        deks: await fetchDeks(o.storage, o.secrets, channel, chain, o.installation),
+        doc,
+    });
+    return [...doc.roster()]
+        .filter(([, e]) => e.archived !== true)
+        .map(([ref, e]) => ({ resource: resourceId(fromBase64url(ref)), url: e.coordinator }))
+        .filter((t) => !bytesEqual(t.resource, chain.state.resourceId));
+}
+/**
+ * §8.1: the post-state of revoking `device` in `I` and every reachable
+ * roster Resource: suspended devices, exposure, whether this installation
+ * stays active and who rotates.
+ */
+export async function previewRevocation(o) {
+    const target = await identityTarget(o);
+    const pool = new ChannelPool(o.network);
+    const me = o.installation.signer.descriptor.principalId;
+    const reason = o.reason ?? 1n;
+    try {
+        const channel = await pool.get(o.installation.signer, target.url);
+        const I = await syncChain(o.storage, channel, target.resource);
+        const R = genesisOwner(I);
+        const mine = activeDevice(I.state, me);
+        const selfDependent = !bytesEqual(me, o.device) &&
+            mine !== undefined &&
+            mine.issuers.some((e) => bytesEqual(e, o.device));
+        const resources = [previewOn(I, o, R, o.device, reason)];
+        for (const t of await rosterTargets(o, channel, I)) {
+            const empty = { suspended: [], exposing: false, rotator: false };
+            try {
+                const c = await pool.get(o.installation.signer, t.url);
+                if (!c.extensions.includes(IDENTITY_EXTENSION)) {
+                    resources.push({ resource: t.resource, status: "unsupported", ...empty });
+                    continue;
+                }
+                resources.push(previewOn(await syncChain(o.storage, c, t.resource), o, R, o.device, reason));
+            }
+            catch (e) {
+                if (e instanceof IdentityUnavailable || e instanceof IdentityRefused)
+                    resources.push({ resource: t.resource, status: "unreachable", ...empty });
+                else if (e instanceof IdentityConflict)
+                    resources.push({ resource: t.resource, status: "conflict", ...empty });
+                else
+                    throw e;
+            }
+        }
+        return {
+            device: o.device,
+            selfDependent: selfDependent || resources.some((r) => r.status === "self-dependent"),
+            resources,
+        };
+    }
+    finally {
+        pool.closeAll();
+    }
+}
+class NotAuthorized extends Error {
+}
+class SelfDependent extends Error {
+}
+/**
+ * §8.2–§8.5: `DEVICE_REVOKE {R, D, r}` in `I`, then in every roster
+ * Resource where this installation may act, each followed by the rotation
+ * when the revocation is exposing there and this installation is the
+ * rotator (else `awaiting-rotation`). A self-retiring device (`D` is this
+ * installation, reason 0) commits the revocations only. Every phase is
+ * journaled and classified by §9.2: a revocation by another hand with
+ * another reason is `complete` and the rotation test still runs.
+ */
+export async function revokeDevice(o) {
+    const target = await identityTarget(o);
+    const me = o.installation.signer.descriptor.principalId;
+    const selfRetire = bytesEqual(me, o.device);
+    const journal = new OperationJournal(o.storage);
+    const pool = new ChannelPool(o.network);
+    const operation = o.operation ?? newOperationId("revoke-device", secureRandom(8));
+    try {
+        // Rotations an earlier operation committed but did not adopt are finished first (§9.1).
+        if (!selfRetire)
+            await resumeRotations({ ...o, pool });
+        const channel = await pool.get(o.installation.signer, target.url);
+        const known = await journal.get(operation);
+        let I;
+        try {
+            I = await syncChain(o.storage, channel, target.resource);
+        }
+        catch (e) {
+            // A resumed self-retirement no longer reads I: its targets come from the journal.
+            if (!(e instanceof IdentityRefused) || !selfRetire || known === undefined)
+                throw e;
+            return retireElsewhere(o, pool, journal, known);
+        }
+        const R = genesisOwner(I);
+        if (!selfRetire && !mayManageDevices(I.state, me, R))
+            return { kind: "not-authorized" };
+        const mine = activeDevice(I.state, me);
+        if (!selfRetire && mine !== undefined && mine.issuers.some((e) => bytesEqual(e, o.device)))
+            return { kind: "self-dependent" };
+        // The targets are journaled before the first record: a self-retiring device
+        // cannot read I's roster once I has revoked it (§9.1).
+        if (known === undefined)
+            await journal.begin({
+                id: operation,
+                kind: "revoke-device",
+                createdAt: o.now(),
+                intent: {
+                    identity: toHex(target.resource),
+                    device: toHex(o.device),
+                    root: toHex(R),
+                    reason: String(o.reason),
+                    targets: (await rosterTargets(o, channel, I)).map((t) => ({
+                        resource: toHex(t.resource),
+                        url: t.url,
+                    })),
+                },
+            });
+        const roster = targetsOf(await journal.load(operation));
+        const results = [];
+        const one = async (c, X) => {
+            let outcome;
+            try {
+                outcome = await runControlPhase(o.storage, c, journal, operation, {
+                    id: `revoke:${toHex(X)}`,
+                    kind: "revoke",
+                    resource: X,
+                    classify: (chain) => classifyRevoke(chain.state, R, o.device),
+                    build: (chain) => {
+                        const sim = revokeOn(chain, o, R, o.device, o.reason);
+                        if (sim === "self-dependent")
+                            throw new SelfDependent();
+                        if (sim === undefined)
+                            throw new NotAuthorized();
+                        return sim.bytes;
+                    },
+                });
+            }
+            catch (e) {
+                if (e instanceof NotAuthorized)
+                    return { resource: X, revoke: "not-authorized" };
+                if (e instanceof SelfDependent)
+                    return { resource: X, revoke: "self-dependent" };
+                throw e;
+            }
+            if (outcome.state === "superseded")
+                return { resource: X, revoke: "superseded" };
+            if (outcome.state === "refused")
+                return { resource: X, revoke: "refused" };
+            const revoke = outcome.state === "committed-own" ? "revoked" : "complete";
+            if (selfRetire && o.reason === 0n)
+                return { resource: X, revoke };
+            let rotation;
+            try {
+                rotation = await rotateIfExposed({ ...o, channel: c, operation, resource: X });
+            }
+            catch (e) {
+                // The revocation stands; the rotation resumes from the journal (§9.1).
+                if (!(e instanceof IdentityUnavailable))
+                    throw e;
+                rotation = { resource: X, status: "unreachable" };
+            }
+            return { resource: X, revoke, rotation };
+        };
+        const first = await one(channel, target.resource);
+        results.push(first);
+        if (first.revoke === "superseded") {
+            await journal.setStatus(operation, "superseded");
+            return { kind: "superseded", operation };
+        }
+        // §8.2: display only.
+        const document = !selfRetire && (first.revoke === "revoked" || first.revoke === "complete")
+            ? await markRevoked(o, channel, journal, operation, target.resource, o.device)
+            : { state: "none" };
+        for (const t of roster) {
+            try {
+                const c = await pool.get(o.installation.signer, t.url);
+                if (!c.extensions.includes(IDENTITY_EXTENSION)) {
+                    results.push({ resource: t.resource, revoke: "unsupported" });
+                    continue;
+                }
+                results.push(await one(c, t.resource));
+            }
+            catch (e) {
+                if (e instanceof IdentityUnavailable || e instanceof IdentityRefused)
+                    results.push({ resource: t.resource, revoke: "unreachable" });
+                else if (e instanceof IdentityConflict)
+                    results.push({ resource: t.resource, revoke: "conflict" });
+                else
+                    throw e;
+            }
+        }
+        const open = document.state === "refused" ||
+            document.state === "unreachable" ||
+            results.some((r) => r.revoke === "unreachable" ||
+                r.revoke === "conflict" ||
+                r.rotation?.status === "awaiting-key-holder" ||
+                r.rotation?.status === "unreachable");
+        await journal.setStatus(operation, open ? "open" : "done");
+        return { kind: "revoked", operation, results: Object.freeze(results), document };
+    }
+    catch (e) {
+        if (e instanceof IdentityUnavailable)
+            return { kind: "unavailable", operation, reason: e.message };
+        if (e instanceof IdentityConflict)
+            return { kind: "conflict" };
+        throw e;
+    }
+    finally {
+        pool.closeAll();
+    }
+}
+const targetsOf = (op) => (op.intent.targets ?? []).map((t) => ({
+    resource: resourceId(fromHex(t.resource)),
+    url: t.url,
+}));
+/** A resumed self-retirement whose I revocation already holds: the journaled roster targets. */
+async function retireElsewhere(o, pool, journal, op) {
+    const R = principalId(fromHex(op.intent.root));
+    const results = [
+        { resource: resourceId(fromHex(op.intent.identity)), revoke: "complete" },
+    ];
+    for (const t of targetsOf(op)) {
+        try {
+            const c = await pool.get(o.installation.signer, t.url);
+            const outcome = await runControlPhase(o.storage, c, journal, op.id, {
+                id: `revoke:${toHex(t.resource)}`,
+                kind: "revoke",
+                resource: t.resource,
+                classify: (chain) => classifyRevoke(chain.state, R, o.device),
+                build: (chain) => {
+                    const sim = revokeOn(chain, o, R, o.device, o.reason);
+                    if (sim === undefined || sim === "self-dependent")
+                        throw new NotAuthorized();
+                    return sim.bytes;
+                },
+            });
+            results.push({
+                resource: t.resource,
+                revoke: outcome.state === "committed-own"
+                    ? "revoked"
+                    : outcome.state === "refused"
+                        ? "refused"
+                        : outcome.state === "superseded"
+                            ? "superseded"
+                            : "complete",
+            });
+        }
+        catch (e) {
+            if (e instanceof NotAuthorized)
+                results.push({ resource: t.resource, revoke: "not-authorized" });
+            else if (e instanceof IdentityUnavailable || e instanceof IdentityRefused)
+                results.push({ resource: t.resource, revoke: "unreachable" });
+            else
+                throw e;
+        }
+    }
+    const open = results.some((r) => r.revoke === "unreachable");
+    await journal.setStatus(op.id, open ? "open" : "done");
+    // A self-retirement writes no display flag (§8.2).
+    return {
+        kind: "revoked",
+        operation: op.id,
+        results: Object.freeze(results),
+        document: { state: "none" },
+    };
+}
+async function markRevoked(o, channel, journal, operation, I, device) {
+    const key = principalRefOf(device);
+    /** I's current state, and the device's entry as a flag to write, if any. */
+    const current = async () => {
+        const chain = await syncChain(o.storage, channel, I);
+        const doc = o.document(I, genesisOwner(chain));
+        const deks = await fetchDeks(o.storage, o.secrets, channel, chain, o.installation);
+        const load = await loadIdentityDocument({ channel, chain, deks, doc });
+        const entry = doc.devices().get(key);
+        return { chain, doc, deks, load, entry };
+    };
+    try {
+        const { entry } = await current();
+        if (entry === undefined)
+            return { state: "none" };
+        // Built on the current state of I (a rotation after the revocation makes an
+        // earlier unit stale, W §19.1); a resumed operation writes a refused flag again.
+        // Another writer may delete the entry or set the flag meanwhile: nothing is sent.
+        let gone = false;
+        const unit = await runUnitPhase(channel, journal, operation, {
+            id: "display",
+            resource: I,
+            rebuildOn: ["STALE_DATA_EPOCH"],
+            rebuildRefused: true,
+            build: async () => {
+                const now = await current();
+                gone = now.entry === undefined;
+                if (now.entry === undefined || now.entry.revoked === true)
+                    return null;
+                // The device's missing_keys hint is written only by the device (§3 AI5).
+                const { missing_keys: _hint, ...display } = now.entry;
+                return sealIdentityUnit({
+                    storage: o.storage,
+                    chain: now.chain,
+                    deks: now.deks,
+                    signer: o.installation.signer,
+                    doc: now.doc,
+                    latest: now.load.latest,
+                    intents: [{ intent: "device.put", key, entry: { ...display, revoked: true } }],
+                });
+            },
+        });
+        if (unit.state === "refused")
+            return { state: "refused", code: unit.code ?? "refused" };
+        return { state: gone ? "none" : unit.state };
+    }
+    catch (e) {
+        // The revocation stands without its display flag; anything else is an error.
+        if (e instanceof IdentityUnavailable)
+            return { state: "unreachable" };
+        throw e;
+    }
+}
+/**
+ * §8.4 rotation policy: when the Resource holds an exposing revocation
+ * committed after its current epoch opened and this installation is the
+ * rotator, rotate once (covering every such revocation) and seal the new
+ * DEK to every reader; otherwise `awaiting-rotation`, or `not-needed` when
+ * nothing exposing happened since the last rotation.
+ */
+export async function rotateIfExposed(o) {
+    // A rotation this operation already started resumes from its journaled phase: its
+    // KEY_EPOCH may be committed while its DEK still waits in the pending slot (§9.1).
+    const started = phaseOf(await new OperationJournal(o.storage).load(o.operation), `rotate:${toHex(o.resource)}`);
+    const at = started?.facts?.revokedAt;
+    if (at !== undefined && started?.state !== "awaiting-rotation")
+        return rotateAfter({ ...o, revokedAt: BigInt(at) });
+    const chain = await syncChain(o.storage, o.channel, o.resource);
+    const exposing = exposingRevocationsSince(chain);
+    const last = exposing.at(-1);
+    if (last === undefined)
+        return { resource: o.resource, status: "not-needed" };
+    return rotateAfter({ ...o, revokedAt: last.seq });
+}
+//# sourceMappingURL=revocation.js.map

package/dist/identity/roster.d.ts

@@ -0,0 +1,89 @@
+import { type ResourceId } from "@openlfcp/core";
+import { type RosterEntryValue } from "./document.js";
+import { OperationJournal } from "./journal.js";
+import { type IdentityChannel } from "./network.js";
+import { type IdentityFlowOptions } from "./resource.js";
+/**
+ * The roster of the Identity Resource (IDENTITY-PROFILE-01 §2.1): how the
+ * human's other installations learn a Resource (§6). An entry is written as
+ * its own durable phase of an operation (§9.1): a unit refused as stale
+ * after a rotation of `I` is written again in the current epoch (W §19.1),
+ * and an entry already present, by this installation or another writer,
+ * is not written again.
+ */
+export type RosterWrite = 
+/** This installation's unit carrying the entry was accepted. */
+{
+    readonly state: "written";
+}
+/** The roster already held an entry for the Resource. */
+ | {
+    readonly state: "present";
+}
+/** The coordinator refused the unit for another reason; the phase stays open. */
+ | {
+    readonly state: "refused";
+    readonly code: string;
+};
+/** Writes `roster[ref(resource)] = entry` in `I` as the phase `roster` of `operation`. */
+export declare function writeRosterEntry(o: IdentityFlowOptions, channel: IdentityChannel, journal: OperationJournal, operation: string, identity: ResourceId, resource: ResourceId, entry: RosterEntryValue): Promise<RosterWrite>;
+export interface AddToRosterOptions extends IdentityFlowOptions {
+    /** The Resource to list (a Resource of the human: created or joined here). */
+    readonly resource: ResourceId;
+    /** A display name for the roster entry. */
+    readonly name?: string;
+    /**
+     * The entry's fields; by default taken from the Resource's Control Chain:
+     * its Data Profile, route endpoints and coordinator (stored here, or read
+     * from `url`).
+     */
+    readonly entry?: RosterEntryValue;
+    /** The Resource's coordinator, when its chain is not stored here. */
+    readonly url?: string;
+    /** Resume this operation. */
+    readonly operation?: string;
+}
+export type AddToRosterResult = 
+/** This installation wrote the entry. */
+{
+    readonly kind: "added";
+    readonly operation: string;
+    readonly resource: ResourceId;
+}
+/** The roster already lists the Resource (written earlier, or by another device). */
+ | {
+    readonly kind: "present";
+    readonly operation: string;
+    readonly resource: ResourceId;
+}
+/** This installation cannot write `I` (`holds(D, 2)` is false, e.g. a Read device, §7.2). */
+ | {
+    readonly kind: "needs-writer";
+}
+/** The coordinator refused the unit: the operation stays open; resume it with `operation`. */
+ | {
+    readonly kind: "document-incomplete";
+    readonly operation: string;
+    readonly resource: ResourceId;
+    readonly code: string;
+} | {
+    readonly kind: "conflict";
+} | {
+    readonly kind: "unavailable";
+    readonly operation?: string;
+    readonly reason: string;
+};
+/**
+ * Adds a Resource to the roster of the Identity Resource as one durable
+ * operation (IDENTITY-PROFILE-01 §2.1, §6, §9): the entry the human's other
+ * installations read to reach the Resource (pairing step 10, reconciliation
+ * §7.1). For a Resource created or joined after `I` was filled (§5.1), for
+ * example a section created later on any personal device. Idempotent: an
+ * entry already present is not written again; a unit refused as stale
+ * after a rotation of `I` is written again in the current epoch; any other
+ * refusal leaves the operation open. Only a writer of `I` (the root or a
+ * personal device holding data/write there) may add entries (§3 AI4: a
+ * pairing or service device never writes the roster).
+ */
+export declare function addToRoster(o: AddToRosterOptions): Promise<AddToRosterResult>;
+//# sourceMappingURL=roster.d.ts.map

package/dist/identity/roster.js

@@ -0,0 +1,130 @@
+import { fromHex, LfcpError, resourceId, secureRandom, toHex, } from "@openlfcp/core";
+import { ABILITY, hasAbility } from "@openlfcp/wire";
+import { loadControlChain } from "../storage.js";
+import { fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
+import { resourceRef } from "./document.js";
+import { newOperationId, OperationJournal } from "./journal.js";
+import { ChannelPool, IdentityRefused, IdentityUnavailable, } from "./network.js";
+import { identityTarget } from "./resource.js";
+/** Writes `roster[ref(resource)] = entry` in `I` as the phase `roster` of `operation`. */
+export async function writeRosterEntry(o, channel, journal, operation, identity, resource, entry) {
+    const me = o.installation.signer;
+    const openI = async () => {
+        const chain = await syncChain(o.storage, channel, identity);
+        const doc = o.document(identity, genesisOwner(chain));
+        const deks = await fetchDeks(o.storage, o.secrets, channel, chain, o.installation);
+        const load = await loadIdentityDocument({ channel, chain, deks, doc });
+        return { chain, doc, deks, load };
+    };
+    if ((await openI()).doc.roster().has(resourceRef(resource)))
+        return { state: "present" };
+    const r = await runUnitPhase(channel, journal, operation, {
+        id: "roster",
+        resource: identity,
+        // A unit refused after a rotation of I is written again in the new epoch (W §19.1).
+        rebuildOn: ["STALE_DATA_EPOCH"],
+        // A resumed operation whose unit was refused writes the entry again on the
+        // current document, previous unit and actor sequence: the refused bytes may
+        // name a previous unit this actor has since moved past (W §26.2). Exact
+        // bytes are re-sent only after an unknown outcome (§9.1).
+        rebuildRefused: true,
+        build: async () => {
+            const { chain, doc, deks, load } = await openI();
+            // Another writer may have listed the Resource since the last check (a stale
+            // retry, a resume): its entry stands and the phase is complete (§9.2).
+            if (doc.roster().has(resourceRef(resource)))
+                return null;
+            return sealIdentityUnit({
+                storage: o.storage,
+                chain,
+                deks,
+                signer: me,
+                doc,
+                latest: load.latest,
+                intents: [{ intent: "roster.put", key: resourceRef(resource), entry }],
+            });
+        },
+    });
+    if (r.state === "committed-own")
+        return { state: "written" };
+    if (r.state === "complete")
+        return { state: "present" };
+    return { state: "refused", code: r.code ?? "refused" };
+}
+/**
+ * Adds a Resource to the roster of the Identity Resource as one durable
+ * operation (IDENTITY-PROFILE-01 §2.1, §6, §9): the entry the human's other
+ * installations read to reach the Resource (pairing step 10, reconciliation
+ * §7.1). For a Resource created or joined after `I` was filled (§5.1), for
+ * example a section created later on any personal device. Idempotent: an
+ * entry already present is not written again; a unit refused as stale
+ * after a rotation of `I` is written again in the current epoch; any other
+ * refusal leaves the operation open. Only a writer of `I` (the root or a
+ * personal device holding data/write there) may add entries (§3 AI4: a
+ * pairing or service device never writes the roster).
+ */
+export async function addToRoster(o) {
+    const target = await identityTarget(o);
+    const me = o.installation.signer;
+    const journal = new OperationJournal(o.storage);
+    const pool = new ChannelPool(o.network);
+    let operation = o.operation;
+    try {
+        const channel = await pool.get(me, target.url);
+        const I = await syncChain(o.storage, channel, target.resource);
+        if (!hasAbility(I.state, me.descriptor.principalId, ABILITY.DATA_WRITE))
+            return { kind: "needs-writer" };
+        if (operation === undefined || (await journal.get(operation)) === undefined) {
+            const entry = o.entry ?? (await entryOf(o, pool, o.resource));
+            operation = operation ?? newOperationId("add-to-roster", secureRandom(8));
+            await journal.begin({
+                id: operation,
+                kind: "add-to-roster",
+                createdAt: o.now(),
+                intent: {
+                    identity: toHex(target.resource),
+                    resource: toHex(o.resource),
+                    entry: { ...entry, ...(o.name === undefined ? {} : { name: o.name }) },
+                },
+            });
+        }
+        const op = await journal.load(operation);
+        const resource = resourceId(fromHex(op.intent.resource));
+        const written = await writeRosterEntry(o, channel, journal, op.id, target.resource, resource, op.intent.entry);
+        if (written.state === "refused")
+            return { kind: "document-incomplete", operation: op.id, resource, code: written.code };
+        await journal.setStatus(op.id, "done");
+        return { kind: written.state === "written" ? "added" : "present", operation: op.id, resource };
+    }
+    catch (e) {
+        if (e instanceof IdentityUnavailable || e instanceof IdentityRefused)
+            return {
+                kind: "unavailable",
+                ...(operation === undefined ? {} : { operation }),
+                reason: e.message,
+            };
+        if (e instanceof IdentityConflict)
+            return { kind: "conflict" };
+        throw e;
+    }
+    finally {
+        pool.closeAll();
+    }
+}
+/** The roster entry of a Resource from its Control Chain (W §15, §20): profile, routes, coordinator. */
+async function entryOf(o, pool, resource) {
+    const stored = await loadControlChain(o.storage, resource);
+    let chain;
+    if (stored?.kind === "linear")
+        chain = stored;
+    else if (o.url !== undefined)
+        chain = await syncChain(o.storage, await pool.get(o.installation.signer, o.url), resource);
+    else
+        throw new LfcpError("MISSING_DEPENDENCY", "the Resource's chain is not stored here: give its entry or its coordinator URL");
+    return {
+        profile: chain.state.dataProfile,
+        endpoints: chain.state.route.endpoints.map((e) => e.url),
+        coordinator: chain.state.route.coordinatorUrl,
+    };
+}
+//# sourceMappingURL=roster.js.map