@openlfcp/client 0.2.2 → 0.3.1

package/dist/identity/rotation.d.ts

@@ -0,0 +1,131 @@
+import { type ControlRecordId, type DataEpoch, type PrincipalId, type ResourceId } from "@openlfcp/core";
+import { type ResourceDEK } from "@openlfcp/crypto";
+import { type ControlState, type DataProfileCodec, type HaveVector, type PrincipalDescriptor } from "@openlfcp/wire";
+import { type KeyDelivery } from "./context.js";
+import type { FlowOptions } from "./devices.js";
+import { type ChannelPool, type IdentityChannel } from "./network.js";
+import { type LinearChain } from "./phases.js";
+/**
+ * Key rotation after device revocations (IDENTITY-PROFILE-01 §8.1–§8.4,
+ * §9.2–§9.4): who may rotate, which revocations call for it, the final
+ * frontier from the verified accepted set, and the durable KEY_EPOCH
+ * phase with its packages.
+ */
+/** §8.1: the rotator test of `candidate` on a state (usually the post-state). */
+export interface RotatorTest {
+    readonly holds6: boolean;
+    readonly holds7: boolean;
+    /** Every reader of the head acts for the candidate's root (W §25.2 same-root delivery). */
+    readonly everyReaderOfOwnRoot: boolean;
+    readonly rotator: boolean;
+    readonly readers: readonly PrincipalDescriptor[];
+}
+/**
+ * `A` is the rotator of a Resource only when `holds(A, 7)` and it can seal
+ * the new DEK to every reader of the head: `holds(A, 6)`, or every reader
+ * is of `A`'s root.
+ */
+export declare function rotatorTest(state: ControlState, candidate: PrincipalId): RotatorTest;
+/** An exposing DEVICE_REVOKE on a chain (W §17.5). */
+export interface ExposingRevocation {
+    readonly recordId: ControlRecordId;
+    readonly seq: bigint;
+}
+/**
+ * §8.4: the exposing revocations committed after the current epoch's
+ * KEY_EPOCH (or Genesis). One rotation covers all of them; a revocation
+ * that is not exposing never calls for one.
+ */
+export declare function exposingRevocationsSince(chain: LinearChain): readonly ExposingRevocation[];
+/**
+ * §8.3: the final frontier of the closing epoch from this installation's
+ * locally verified accepted set, after a Data synchronisation: a server's
+ * Have Vector is a fetch hint; a sequence that cannot be fetched and
+ * verified, or that fails authorization, stays outside. With `data`, a unit
+ * counts only when recipients accept it as data (W §26.3 rules 6 and 7: it
+ * decrypts under the epoch's DEK and the Data Profile accepts it), so a unit
+ * no recipient can merge never pushes an honest later unit of its actor
+ * beyond the cutoff; rotateAfter always passes it. Without `data` only
+ * signature, authorization and the actor chain are checked (0.3.0).
+ */
+export declare function verifiedFrontier(channel: IdentityChannel, chain: LinearChain, local?: LocalAccepted, data?: FrontierData): Promise<HaveVector>;
+/** This installation's stored units of a Resource and its verified Snapshots' coverage. */
+export interface LocalAccepted {
+    /** Every signature-valid unit the storage holds for the Resource (exact bytes). */
+    readonly units: readonly Uint8Array[];
+    /** The sequences verified Snapshots cover (W §29.3). */
+    readonly snapshot: HaveVector;
+    /**
+     * Unit IDs (hex) whose bytes this installation proved bad as data: a failed
+     * AEAD or a Data Profile decode refusal. A missing or mismatching DEK is
+     * not such a proof: those units are verified again here.
+     */
+    readonly refused?: ReadonlySet<string>;
+    /**
+     * Unit IDs (hex) this installation accepted on the wire (its actor chain
+     * links through them), including units its profile later refused to
+     * merge: recipients link through them the same way.
+     */
+    readonly accepted?: ReadonlySet<string>;
+}
+/** What the rotating client needs to judge a unit as data (W §26.3 rules 6 and 7). */
+export interface FrontierData {
+    /** The DEKs held for the Resource's epochs, by epoch number. */
+    readonly deks: ReadonlyMap<string, ResourceDEK>;
+    /**
+     * The Resource's Data Profile codec, when the application gives it: its
+     * `decode` is the profile's acceptance. Without it only decryption is
+     * checked here, and a profile refusal this installation recorded still
+     * counts (LocalAccepted.refused).
+     */
+    readonly profile?: DataProfileCodec<unknown>;
+}
+export type RotationStatus = 
+/** This installation committed the KEY_EPOCH and sealed the new DEK to every reader. */
+"rotated"
+/** Another writer closed the epoch after the revocation (§9.3). */
+ | "complete"
+/** The rotator test fails here: the root or an owner-acting device rotates (§8.1). */
+ | "awaiting-rotation"
+/** The new epoch's DEK is not held here: readers wait for its holder (§9.2). */
+ | "awaiting-key-holder"
+/** No exposing revocation since the current epoch opened (§8.4). */
+ | "not-needed"
+/** The coordinator stopped answering during the rotation: resume the operation (§9.1). */
+ | "unreachable" | "refused";
+export interface RotationOutcome {
+    readonly resource: ResourceId;
+    readonly status: RotationStatus;
+    readonly epoch?: DataEpoch;
+    readonly keys?: KeyDelivery;
+    readonly code?: string;
+}
+/**
+ * The Rotate phase after a revocation at control sequence `revokedAt`
+ * (§8.2, §8.4, §9.2–§9.4), journaled in `operation`. The KEY_EPOCH is
+ * always rebuilt on the current head with the current epoch number, the
+ * verified frontier and a DEK persisted before the record is sent; a DEK
+ * is never sealed before its record is accepted, so a rebuilt record may
+ * reuse it (§9.4). After the ACK the DEK goes to every reader of the new
+ * head, each package recorded in the ledger; the revoked device, a
+ * consumed or cancelled pairing device and suspended devices are not
+ * readers and receive nothing.
+ */
+export declare function rotateAfter(o: FlowOptions & {
+    readonly channel: IdentityChannel;
+    readonly operation: string;
+    readonly resource: ResourceId;
+    readonly revokedAt: bigint;
+}): Promise<RotationOutcome>;
+/**
+ * Resumes every rotation a journaled operation started and did not adopt:
+ * a KEY_EPOCH whose ACK was lost leaves its DEK in the operation's pending
+ * slot, whatever operation (revocation, reconciliation, pairing) started
+ * it (§9.1, §9.2). Run before planning new work on a Resource.
+ */
+export declare function resumeRotations(o: FlowOptions & {
+    readonly pool: ChannelPool;
+}): Promise<readonly RotationOutcome[]>;
+/** The control sequence of a record ID (hex) on a chain. */
+export declare const seqOf: (chain: LinearChain, recordIdHex: string) => bigint | undefined;
+//# sourceMappingURL=rotation.d.ts.map

package/dist/identity/rotation.js

@@ -0,0 +1,363 @@
+import { bytesEqual, controlRecordId, fromHex, resourceId, toHex, } from "@openlfcp/core";
+import { generateResourceDEK, sha256 } from "@openlfcp/crypto";
+import { ABILITY, actsFor, addSequence, checkDataUnit, hasAbility, hasSequence, InMemorySeenUnits, isExposingRevocation, KEY_EPOCH_REASON, parseDataUnit, receiveDataUnit, rotateEpoch, } from "@openlfcp/wire";
+import { snapshotFrontier } from "../outbound.js";
+import { loadControlChain } from "../storage.js";
+import { deliverKeys, fetchDeks, readersAt, runControlPhase, storeDek, withoutEquivocations, } from "./context.js";
+import { getPendingDek, OperationJournal, PackageLedger, pendingDekRef, phaseOf, putPendingDek, } from "./journal.js";
+import { IdentityUnavailable } from "./network.js";
+import { keyEpochAfter, recordSeq } from "./phases.js";
+/**
+ * `A` is the rotator of a Resource only when `holds(A, 7)` and it can seal
+ * the new DEK to every reader of the head: `holds(A, 6)`, or every reader
+ * is of `A`'s root.
+ */
+export function rotatorTest(state, candidate) {
+    const readers = readersAt(state);
+    const root = actsFor(state, candidate);
+    const holds6 = hasAbility(state, candidate, ABILITY.KEY_DISTRIBUTE);
+    const holds7 = hasAbility(state, candidate, ABILITY.KEY_ROTATE);
+    const everyReaderOfOwnRoot = readers.every((r) => bytesEqual(actsFor(state, r.principalId), root));
+    return Object.freeze({
+        holds6,
+        holds7,
+        everyReaderOfOwnRoot,
+        rotator: holds7 && (holds6 || everyReaderOfOwnRoot),
+        readers,
+    });
+}
+/**
+ * §8.4: the exposing revocations committed after the current epoch's
+ * KEY_EPOCH (or Genesis). One rotation covers all of them; a revocation
+ * that is not exposing never calls for one.
+ */
+export function exposingRevocationsSince(chain) {
+    const opened = chain.state.epochs.get(String(chain.state.epoch.epoch))?.openedBy;
+    const from = opened === undefined ? 0n : (recordSeq(chain, opened) ?? 0n);
+    const out = [];
+    for (let i = 1; i < chain.records.length; i++) {
+        const r = chain.records[i];
+        if (r === undefined || r.body.type !== "DEVICE_REVOKE" || r.payload.controlSeq <= from)
+            continue;
+        const before = chain.stateAt(chain.records[i - 1]?.signed.id);
+        const after = chain.stateAt(r.signed.id);
+        if (before !== undefined && after !== undefined && isExposingRevocation(before, after))
+            out.push({ recordId: controlRecordId(r.signed.id), seq: r.payload.controlSeq });
+    }
+    return Object.freeze(out);
+}
+/**
+ * §8.3: the final frontier of the closing epoch from this installation's
+ * locally verified accepted set, after a Data synchronisation: a server's
+ * Have Vector is a fetch hint; a sequence that cannot be fetched and
+ * verified, or that fails authorization, stays outside. With `data`, a unit
+ * counts only when recipients accept it as data (W §26.3 rules 6 and 7: it
+ * decrypts under the epoch's DEK and the Data Profile accepts it), so a unit
+ * no recipient can merge never pushes an honest later unit of its actor
+ * beyond the cutoff; rotateAfter always passes it. Without `data` only
+ * signature, authorization and the actor chain are checked (0.3.0).
+ */
+export async function verifiedFrontier(channel, chain, local = { units: [], snapshot: [] }, data) {
+    const R = chain.state.resourceId;
+    const opened = await channel.open(R);
+    const ranges = opened.kind === "nack"
+        ? []
+        : opened.haves.flatMap((h) => {
+            const out = h.contiguous > 0n ? [{ actor: h.principalId, start: 1n, end: h.contiguous }] : [];
+            for (const [start, end] of h.ranges ?? [])
+                out.push({ actor: h.principalId, start, end });
+            return out;
+        });
+    // The fetched and the locally stored units together: an equivocation between a
+    // stored unit and a fetched one excludes both, like one within the fetch (W §26.2).
+    const all = new Map();
+    for (const bytes of [...local.units, ...(await channel.dataUnits(R, ranges))])
+        all.set(toHex(sha256(bytes)), bytes);
+    const parsedAll = [...all.values()].map((bytes) => ({ bytes, parsed: parseDataUnit(bytes) }));
+    // Every unit ID this installation knows of, whatever became of the unit (accepted,
+    // excluded as equivocation, or later in this pass): a previous naming one of them
+    // is a known fact about the link, never an unknown unit at a Snapshot position.
+    const knownIds = new Set(parsedAll.map((u) => toHex(u.parsed.signed.id)));
+    const units = withoutEquivocations(chain, parsedAll).sort((a, b) => {
+        const x = toHex(a.parsed.payload.actor);
+        const y = toHex(b.parsed.payload.actor);
+        if (x !== y)
+            return x < y ? -1 : 1;
+        return a.parsed.payload.actorSeq < b.parsed.payload.actorSeq ? -1 : 1;
+    });
+    const seen = new InMemorySeenUnits();
+    // Per actor: the latest accepted unit held as bytes.
+    const latest = new Map();
+    // Sequences covered by a verified Snapshot count as accepted (W §29.3).
+    let frontier = local.snapshot;
+    for (const { bytes, parsed } of units) {
+        const p = parsed.payload;
+        const check = await checkDataUnit(chain, bytes, seen);
+        if (check.kind !== "valid")
+            continue;
+        const covered = hasSequence(local.snapshot, p.actor, p.actorSeq);
+        // W §26.3 rules 6 and 7: a unit recipients cannot decrypt, or whose plaintext
+        // the Data Profile refuses, is not accepted data. It is not counted and does
+        // not become the actor's latest unit, so the honest unit after it, which names
+        // the actor's last good unit (W §26.2), still links. Units a verified Snapshot
+        // covers are attested by it (W §29.3).
+        if (!covered &&
+            data !== undefined &&
+            !(await acceptedAsData(chain, bytes, toHex(check.unitId), local, data)))
+            continue;
+        const actor = toHex(p.actor);
+        const last = latest.get(actor);
+        let links;
+        if (covered)
+            links = true;
+        else {
+            // The actor's last accepted position: its latest held unit or the highest
+            // sequence a verified Snapshot covers, whichever is later. A unit at or below
+            // an accepted position is not a link of the actor's chain (W §26.2).
+            const covered = coveredTop(local.snapshot, p.actor);
+            const position = (last?.seq ?? 0n) > covered ? (last?.seq ?? 0n) : covered;
+            const prev = p.prevDataUnitId === null ? null : toHex(p.prevDataUnitId);
+            // W §26.2: the unit names the actor's latest accepted unit (gaps allowed),
+            // or none before the actor's first. When that unit is covered by a
+            // Snapshot without its bytes here, its ID cannot be compared: the link is
+            // taken only when it names no unit known here at all (not an accepted older
+            // one, not an excluded twin, not a later unit of this pass).
+            if (position >= p.actorSeq)
+                links = false;
+            else if (position === 0n)
+                links = prev === null;
+            else if (prev === null)
+                links = false;
+            else if (last !== undefined && last.seq === position)
+                links = last.id === prev;
+            else
+                links = !knownIds.has(prev);
+        }
+        if (!links)
+            continue;
+        if (last === undefined || last.seq < p.actorSeq)
+            latest.set(actor, { id: toHex(check.unitId), seq: p.actorSeq });
+        frontier = addSequence(frontier, p.actor, p.actorSeq);
+    }
+    return frontier;
+}
+/** The highest sequence of `actor` that `vector` covers, or 0. */
+function coveredTop(vector, actor) {
+    const h = vector.find((x) => bytesEqual(x.principalId, actor));
+    if (h === undefined)
+        return 0n;
+    let best = h.contiguous;
+    for (const [, end] of h.extras)
+        if (end > best)
+            best = end;
+    return best;
+}
+const opaque = (dataProfile) => ({
+    dataProfile,
+    encode: (v) => v,
+    decode: (v) => v,
+});
+/**
+ * Whether recipients accept the unit as data: its DEK is held and matches
+ * the epoch's commitment, it decrypts, and the profile accepts the plaintext
+ * (receiveDataUnit's own steps, on a fresh accepted set: "held" for a link
+ * not decided here means those steps passed). A unit this client cannot
+ * decrypt cannot be verified and stays outside the frontier (W §19).
+ */
+async function acceptedAsData(chain, bytes, unitId, local, data) {
+    if (local.accepted?.has(unitId) === true)
+        return true;
+    if (local.refused?.has(unitId) === true)
+        return false;
+    const profile = data.profile !== undefined && data.profile.dataProfile === chain.state.dataProfile
+        ? data.profile
+        : opaque(chain.state.dataProfile);
+    const r = await receiveDataUnit(chain, bytes, {
+        seen: new InMemorySeenUnits(),
+        dek: (epoch) => data.deks.get(String(epoch)),
+        profile,
+    });
+    return r.kind === "accepted" || r.kind === "held";
+}
+/**
+ * The Rotate phase after a revocation at control sequence `revokedAt`
+ * (§8.2, §8.4, §9.2–§9.4), journaled in `operation`. The KEY_EPOCH is
+ * always rebuilt on the current head with the current epoch number, the
+ * verified frontier and a DEK persisted before the record is sent; a DEK
+ * is never sealed before its record is accepted, so a rebuilt record may
+ * reuse it (§9.4). After the ACK the DEK goes to every reader of the new
+ * head, each package recorded in the ledger; the revoked device, a
+ * consumed or cancelled pairing device and suspended devices are not
+ * readers and receive nothing.
+ */
+export async function rotateAfter(o) {
+    const journal = new OperationJournal(o.storage);
+    const me = o.installation.signer;
+    const R = o.resource;
+    const id = `rotate:${toHex(R)}`;
+    // The epoch of this operation's own accepted KEY_EPOCH, found by its record ID.
+    let ownEpoch;
+    const outcome = await runControlPhase(o.storage, o.channel, journal, o.operation, {
+        id,
+        kind: "rotate",
+        resource: R,
+        facts: { revokedAt: String(o.revokedAt) },
+        // §9.3: rebuilt with the current accepted set on every attempt, even on the same head.
+        resend: false,
+        classify: (chain, isOwn) => {
+            const own = chain.records.find((r) => r.body.type === "KEY_EPOCH" &&
+                r.payload.controlSeq > o.revokedAt &&
+                isOwn(toHex(r.signed.id)));
+            if (own?.body.type === "KEY_EPOCH") {
+                ownEpoch = own.body.epoch;
+                return "committed-own";
+            }
+            if (keyEpochAfter(chain, o.revokedAt))
+                return "complete";
+            return rotatorTest(chain.state, me.descriptor.principalId).rotator
+                ? "pending"
+                : "awaiting-rotation";
+        },
+        build: async (chain) => {
+            const frontier = await verifiedFrontier(o.channel, chain, await localAccepted(o, chain), {
+                deks: await fetchDeks(o.storage, o.secrets, o.channel, chain, o.installation),
+                ...profileFor(o, chain),
+            });
+            const dek = (await getPendingDek(o.secrets, R, o.operation)) ?? generateResourceDEK();
+            // The DEK before the record that commits to it (§9.1).
+            await putPendingDek(o.secrets, R, o.operation, dek);
+            return rotateEpoch(chain.state, me, {
+                reason: KEY_EPOCH_REASON.COMPROMISE,
+                finalFrontier: frontier,
+                dek,
+            }).bytes;
+        },
+    });
+    if (outcome.state === "refused")
+        return { resource: R, status: "refused", code: outcome.code ?? "refused" };
+    if (outcome.state === "awaiting-rotation")
+        return { resource: R, status: "awaiting-rotation" };
+    const chain = outcome.chain;
+    if (outcome.state === "committed-own" && ownEpoch === undefined)
+        // The ACK of this installation's own record (runControlPhase extended the chain with it).
+        ownEpoch = chain.state.epoch.epoch;
+    if (outcome.state === "committed-own") {
+        // The pending DEK is the key of this operation's own epoch, not of the current one:
+        // another rotator may have closed it since (§9.2, §9.3).
+        const dek = await getPendingDek(o.secrets, R, o.operation);
+        if (dek !== undefined && ownEpoch !== undefined) {
+            await storeDek(o.storage, o.secrets, chain, ownEpoch, dek);
+            await o.secrets.delete(pendingDekRef(R, o.operation));
+        }
+    }
+    const epoch = ownEpoch ?? chain.state.epoch.epoch;
+    const deks = await fetchDeks(o.storage, o.secrets, o.channel, chain, o.installation);
+    if (!deks.has(String(epoch)))
+        return { resource: R, status: "awaiting-key-holder", epoch };
+    // Every epoch held from the rotated one on, to every reader of the head (§8.2); a takeover
+    // seals only what it holds (§9.6).
+    const send = new Map([...deks].filter(([e]) => BigInt(e) >= epoch));
+    const keys = await deliverKeys({
+        channel: o.channel,
+        ledger: new PackageLedger(o.storage),
+        chain,
+        sender: me,
+        recipients: readersAt(chain.state),
+        deks: send,
+    });
+    const phase = phaseOf(await journal.load(o.operation), id);
+    return {
+        resource: R,
+        status: phase?.state === "committed-own" ? "rotated" : "complete",
+        epoch,
+        keys,
+    };
+}
+/**
+ * The accepted set this installation holds locally for the Resource (its
+ * stored accepted units and verified Snapshots, when the storage keeps them),
+ * merged into the verified frontier (§8.3).
+ */
+/** The codec the application gave for the Resource's Data Profile, if any. */
+const profileFor = (o, chain) => {
+    const profile = o.dataProfiles?.find((p) => p.dataProfile === chain.state.dataProfile);
+    return profile === undefined ? {} : { profile };
+};
+async function localAccepted(o, chain) {
+    const st = o.storage;
+    if (st.dataUnits === undefined || st.snapshots === undefined)
+        return { units: [], snapshot: [] };
+    const R = chain.state.resourceId;
+    // Every stored unit takes part: the storage keeps only signature-valid units,
+    // whatever became of their content, and equivocation evidence (both twins,
+    // stored as "equivocation") must reach the check (W §26.2).
+    const units = [];
+    for (const status of [
+        "seen",
+        "merged",
+        "profile-pending",
+        "held",
+        "quarantined",
+        "equivocation",
+        "local-failure",
+        "profile-held",
+        "profile-rejected",
+        "profile-unsupported",
+    ])
+        for (const u of await st.dataUnits.withStatus(R, status))
+            units.push(u.bytes);
+    // What this installation decided as a receiver. Proven bad bytes: AEAD and
+    // profile decode failures (a missing or wrong DEK is verified again). Accepted
+    // on the wire: the units its actor chain links through, a unit the profile
+    // refused when merging included (it keeps the accepted mark).
+    const refused = new Set();
+    for (const u of await st.dataUnits.withStatus(R, "local-failure"))
+        if (/^(AEAD|PROFILE_REJECTED):/.test(u.detail ?? ""))
+            refused.add(toHex(u.unitId));
+    const accepted = new Set();
+    for (const status of ["merged", "profile-pending", "profile-held", "profile-rejected"])
+        for (const u of await st.dataUnits.withStatus(R, status))
+            if (u.accepted)
+                accepted.add(toHex(u.unitId));
+    return { units, snapshot: await snapshotFrontier(st, R), refused, accepted };
+}
+/**
+ * Resumes every rotation a journaled operation started and did not adopt:
+ * a KEY_EPOCH whose ACK was lost leaves its DEK in the operation's pending
+ * slot, whatever operation (revocation, reconciliation, pairing) started
+ * it (§9.1, §9.2). Run before planning new work on a Resource.
+ */
+export async function resumeRotations(o) {
+    const journal = new OperationJournal(o.storage);
+    const out = [];
+    for (const op of await journal.list())
+        for (const phase of op.phases) {
+            if (phase.kind !== "rotate" || phase.facts?.revokedAt === undefined)
+                continue;
+            const R = resourceId(fromHex(phase.resource));
+            if ((await getPendingDek(o.secrets, R, op.id)) === undefined)
+                continue;
+            const stored = await loadControlChain(o.storage, R);
+            if (stored?.kind !== "linear")
+                continue;
+            try {
+                const channel = await o.pool.get(o.installation.signer, stored.state.route.coordinatorUrl);
+                out.push(await rotateAfter({
+                    ...o,
+                    channel,
+                    operation: op.id,
+                    resource: R,
+                    revokedAt: BigInt(phase.facts.revokedAt),
+                }));
+            }
+            catch (e) {
+                if (!(e instanceof IdentityUnavailable))
+                    throw e;
+                out.push({ resource: R, status: "unreachable" });
+            }
+        }
+    return Object.freeze(out);
+}
+/** The control sequence of a record ID (hex) on a chain. */
+export const seqOf = (chain, recordIdHex) => recordSeq(chain, fromHex(recordIdHex));
+//# sourceMappingURL=rotation.js.map

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { type ClaimJournal, pendingInvitationClaims } from "./claim-journal.js";
 export { type ConnectionEvents, ConnectionNotReady, type ConnectionOptions, LFCP_SUBPROTOCOL, LfcpConnection, platformWebSocket, type WebSocketFactory, type WebSocketLike, } from "./connection.js";
 export { type CreateDataUnitOptions, type CreatedDataUnit, createDataUnit } from "./data-unit.js";
 export { EngineGuard, type EngineItem, isEngineTrap, type Suspicion, snapshotItem, unitItem, } from "./engine-guard.js";
+export * from "./identity/index.js";
 export { type AcceptedInvitation, type AcceptInvitationOptions, type AcceptInvitationProgress, type AcceptInvitationStage, abandonInvitationClaim, acceptInvitation, type CreatedInvitation, type CreateInvitationOptions, createInvitation, DEFAULT_INVITATION_ABILITIES, InvitationLink, type ResumeInvitationClaimOptions, resumeInvitationClaim, } from "./invite.js";
 export { type AckedItem, type AckOutcome, type AckWrites, type BlockedItem, exponentialBackoff, type NackOutcome, type OutboundMessage, OutboundQueue, type OutboundQueueOptions, type ResourceSyncState, type RetryPolicy, type RetryReason, resourceSyncState, type StaleOutboundUnit, snapshotFrontier, } from "./outbound.js";
 export { controlRecordWrites, createQueuedSnapshot, keyPackageWrites, outboundItem, queueControlRecord, queueKeyEpoch, queueKeyPackage, queueSnapshot, } from "./queue.js";
@@ -16,7 +17,7 @@ export { type ResourcePhase, type ResourcePhaseEvent, resourcePhaseTransition, }
 export { planRevocation, type RemainingPath, type RevocationPlan, type RevocationRefusal, RevocationRefused, } from "./revoke.js";
 export { type CatchUp, type ReceivedFact, type ReceivedState, type ReofferReason, receivedState, type SectionState, type StatusEvent, type StatusSnapshot, } from "./section-status.js";
 export { type CreatedSnapshot, type CreateSnapshotOptions, createSnapshot } from "./snapshot.js";
-export { adoptStoredDeks, type CommitOperationOptions, commitOperation, createQueuedDataUnit, dataUnitRow, dekResolver, latestAcceptedOwnUnit, loadControlChain, localControlChain, StoredSeenUnits, saveControlChain, saveControlConflict, } from "./storage.js";
+export { adoptStoredDeks, type CommitOperationOptions, checkWriteBarrier, commitOperation, createQueuedDataUnit, dataUnitRow, dekResolver, latestAcceptedOwnUnit, loadControlChain, localControlChain, StoredSeenUnits, saveControlChain, saveControlConflict, setWriteBarrier, type WriteBarrier, writeBarrier, } from "./storage.js";
 export { type CommitBinding, CommitRefusedError, defaultReconnect, type ReconnectPolicy, type ResourceBinding, type ResourceRefusal, type RevokeAccessResult, type SnapshotBinding, type StagedOperation, SyncClient, type SyncClientOptions, type SyncEvent, startSyncDriver, TERMINAL_RESOURCE_CODES, } from "./sync-client.js";
 export { type Flushed, type Submitted, TypingCoalescer, type TypingCoalescerOptions, } from "./typing.js";
 export { type AccessContext, type AccessState, accessState, type GrantPath, type IssuedInvitation, NotWritableError, type PendingControl, type ServerRefusal, UNKNOWN_ACCESS, type WriteAccess, type WriteDeniedReason, writeAccess, } from "./write-access.js";

package/dist/index.js

@@ -7,6 +7,7 @@ export { pendingInvitationClaims } from "./claim-journal.js";
 export { ConnectionNotReady, LFCP_SUBPROTOCOL, LfcpConnection, platformWebSocket, } from "./connection.js";
 export { createDataUnit } from "./data-unit.js";
 export { EngineGuard, isEngineTrap, snapshotItem, unitItem, } from "./engine-guard.js";
+export * from "./identity/index.js";
 export { abandonInvitationClaim, acceptInvitation, createInvitation, DEFAULT_INVITATION_ABILITIES, InvitationLink, resumeInvitationClaim, } from "./invite.js";
 export { exponentialBackoff, OutboundQueue, resourceSyncState, snapshotFrontier, } from "./outbound.js";
 export { controlRecordWrites, createQueuedSnapshot, keyPackageWrites, outboundItem, queueControlRecord, queueKeyEpoch, queueKeyPackage, queueSnapshot, } from "./queue.js";
@@ -16,7 +17,7 @@ export { resourcePhaseTransition, } from "./resource-state.js";
 export { planRevocation, RevocationRefused, } from "./revoke.js";
 export { receivedState, } from "./section-status.js";
 export { createSnapshot } from "./snapshot.js";
-export { adoptStoredDeks, commitOperation, createQueuedDataUnit, dataUnitRow, dekResolver, latestAcceptedOwnUnit, loadControlChain, localControlChain, StoredSeenUnits, saveControlChain, saveControlConflict, } from "./storage.js";
+export { adoptStoredDeks, checkWriteBarrier, commitOperation, createQueuedDataUnit, dataUnitRow, dekResolver, latestAcceptedOwnUnit, loadControlChain, localControlChain, StoredSeenUnits, saveControlChain, saveControlConflict, setWriteBarrier, writeBarrier, } from "./storage.js";
 export { CommitRefusedError, defaultReconnect, SyncClient, startSyncDriver, TERMINAL_RESOURCE_CODES, } from "./sync-client.js";
 export { TypingCoalescer, } from "./typing.js";
 export { accessState, NotWritableError, UNKNOWN_ACCESS, writeAccess, } from "./write-access.js";

package/dist/revoke.d.ts

@@ -41,6 +41,14 @@ export interface RevocationPlan {
     /** The readers who receive them. */
     readonly recipients: readonly PrincipalId[];
     readonly remainingPaths: readonly RemainingPath[];
+    /**
+     * The member lost read access but the revoker is not the rotator of
+     * IDENTITY-PROFILE-01 §8.1 on the post-state (it lacks key/rotate, or it
+     * cannot seal to every reader: no key/distribute and a reader of another
+     * root): no Key Epoch is planned and the Resource awaits rotation by its
+     * owner or an owner-acting device.
+     */
+    readonly awaitingRotation: boolean;
 }
 export type RevocationRefusal = 
 /** The member is the Resource's owner: ownership is transferred, never revoked. */

package/dist/revoke.js

@@ -1,5 +1,7 @@
 import { bytesEqual, controlRecordId, toHex, } from "@openlfcp/core";
 import { ABILITY, ABILITY_NAMES, hasAbility, isGrantActive, KEY_EPOCH_REASON, parseKeyPackage, rotateEpoch, sealKeyPackage, signControlRecord, validateControlChain, verifyKeyPackage, } from "@openlfcp/wire";
+import { readersAt } from "./identity/context.js";
+import { rotatorTest } from "./identity/rotation.js";
 export class RevocationRefused extends Error {
     reason;
     constructor(reason, message) {
@@ -61,7 +63,11 @@ export async function planRevocation(options) {
     const keyPackages = [];
     const recipients = [];
     const stillReads = hasAbility(running.state, subject, ABILITY.DATA_READ);
-    if (options.rotate !== false && !stillReads) {
+    // §8.1: rotate only as the rotator of the post-state; else the Resource awaits rotation.
+    const awaitingRotation = options.rotate !== false &&
+        !stillReads &&
+        !rotatorTest(running.state, revoker.descriptor.principalId).rotator;
+    if (options.rotate !== false && !stillReads && !awaitingRotation) {
         const r = rotateEpoch(running.state, revoker, {
             reason: KEY_EPOCH_REASON.MEMBER_REVOKED,
             finalFrontier: options.frontier,
@@ -72,13 +78,10 @@ export async function planRevocation(options) {
         running = next;
         records.push({ recordId: controlRecordId(r.recordId), bytes: r.bytes });
         rotation = Object.freeze({ epoch: r.epoch, dek: r.dek });
-        // Every remaining reader but the revoker, who keeps the DEK it made.
-        const readers = [
-            running.state.owner,
-            ...[...running.state.principals.values()],
-        ].filter((d, i, all) => all.findIndex((x) => bytesEqual(x.principalId, d.principalId)) === i &&
-            !bytesEqual(d.principalId, revoker.descriptor.principalId) &&
-            hasAbility(running.state, d.principalId, ABILITY.DATA_READ));
+        // Every Principal with holds(P, 1) at the new head (W §19, §25.2): members,
+        // the owner and every active device, revoked and suspended devices
+        // excluded; but the revoker, who keeps the DEK it made.
+        const readers = readersAt(running.state).filter((d) => !bytesEqual(d.principalId, revoker.descriptor.principalId));
         for (const recipient of readers) {
             const sealed = await sealKeyPackage({
                 resourceId: R,
@@ -103,6 +106,7 @@ export async function planRevocation(options) {
         keyPackages: Object.freeze(keyPackages),
         recipients: Object.freeze(recipients),
         remainingPaths: Object.freeze(remainingPaths),
+        awaitingRotation,
     });
 }
 //# sourceMappingURL=revoke.js.map

package/dist/storage.d.ts

@@ -111,6 +111,24 @@ export declare function createQueuedDataUnit<T>(storage: Pick<LfcpStorage, "acto
      */
     readonly onCreated?: (created: CreatedDataUnit, value: T) => void;
 }, also?: readonly StorageWrite[] | ((created: CreatedDataUnit) => readonly StorageWrite[])): Promise<CreatedDataUnit>;
+/**
+ * The write barrier of a Resource (IDENTITY-PROFILE-01 §8.6): set once this
+ * device has evidence that it lost access there ("access refused") or that
+ * it was revoked ("revocation proven"). While it is set, the device creates
+ * no Data Unit for that Resource; the local replica stays readable and
+ * unsent work stays exportable. Evidence that the device is active again
+ * clears it.
+ */
+export interface WriteBarrier {
+    readonly state: "access-refused" | "revocation-proven";
+    /** The revoking DEVICE_REVOKE (hex), when proven. */
+    readonly record?: string;
+    readonly reason?: string;
+}
+export declare function writeBarrier(storage: Pick<LfcpStorage, "localMarks">, resource: ResourceId): Promise<WriteBarrier | undefined>;
+export declare function setWriteBarrier(storage: Pick<LfcpStorage, "commit">, resource: ResourceId, barrier: WriteBarrier | null): Promise<void>;
+/** Refuses to create a Data Unit behind a write barrier (§8.6), when the storage keeps local marks. */
+export declare function checkWriteBarrier(storage: Partial<Pick<LfcpStorage, "localMarks">>, resource: ResourceId): Promise<void>;
 /**
  * SDK-SECTIONS-INTEGRATION-01 §3.1 (LFCP-02-025): commits one operation, a
  * batch of a profile's changes, as Data Units with their outbound entries,

package/dist/storage.js

@@ -281,8 +281,33 @@ export async function createQueuedDataUnit(storage, options, also = []) {
     const actor = options.actor.descriptor.principalId;
     return serialized(storage, `${toHex(resource)}:${toHex(actor)}`, () => createQueuedDataUnitNow(storage, options, also, resource, actor));
 }
+const BARRIER = "identity-write-barrier:";
+export async function writeBarrier(storage, resource) {
+    const v = await storage.localMarks.get(`${BARRIER}${toHex(resource)}`);
+    return v === undefined ? undefined : JSON.parse(v);
+}
+export async function setWriteBarrier(storage, resource, barrier) {
+    const r = await storage.commit([
+        {
+            op: "put-local-mark",
+            key: `${BARRIER}${toHex(resource)}`,
+            value: barrier === null ? null : JSON.stringify(barrier),
+        },
+    ]);
+    if (!r.ok)
+        throw new Error(`the write barrier was not stored: ${r.reason}`);
+}
+/** Refuses to create a Data Unit behind a write barrier (§8.6), when the storage keeps local marks. */
+export async function checkWriteBarrier(storage, resource) {
+    if (storage.localMarks === undefined)
+        return;
+    const b = await writeBarrier(storage, resource);
+    if (b !== undefined)
+        throw new LfcpError("AUTHORIZATION_FAILED", `this device must not write to the Resource: ${b.state} (IDENTITY-PROFILE-01 §8.6)`);
+}
 async function createQueuedDataUnitNow(storage, options, also, resource, actor) {
     const { onCreated, previousUnitId, ...create } = options;
+    await checkWriteBarrier(storage, resource);
     const latest = await latestAcceptedOwnUnit(storage, resource, actor);
     // §26.2: a null previous only when the writer holds no own unit as
     // accepted (before its first, or after a first that went stale); while it
@@ -336,6 +361,7 @@ export async function commitOperation(storage, options, also = []) {
             return { receipt: existing, committed: false };
         }
         const { onCreated, operationId, intents, values, affectedNodeIds, modelRevision, ...create } = options;
+        await checkWriteBarrier(storage, resource);
         void intents;
         const first = await latestAcceptedOwnUnit(storage, resource, actor);
         const created = [];