@openlfcp/client 0.3.1 → 0.5.0

package/dist/identity/context.d.ts

@@ -4,7 +4,7 @@ import { type LfcpStorage, type SecretStore } from "@openlfcp/storage";
 import { type DataUnitPayload, type Parsed, type PrincipalDescriptor, type Signer } from "@openlfcp/wire";
 import { type IdentityDocumentPort, type IdentityIntent } from "./document.js";
 import { type JournalPhase, type OperationJournal, type PackageLedger } from "./journal.js";
-import type { IdentityChannel } from "./network.js";
+import { type IdentityChannel } from "./network.js";
 import type { LinearChain, PhaseState } from "./phases.js";
 /** The storage the identity flows use. */
 export type IdentityStorage = Pick<LfcpStorage, "control" | "commit" | "localMarks" | "actorSequences">;
@@ -61,6 +61,13 @@ export interface PhaseOutcome {
  * with the same ACK, W §47), a record rebuilt on a new head otherwise.
  */
 export declare function runControlPhase(storage: IdentityStorage, channel: IdentityChannel, journal: OperationJournal, operation: string, spec: ControlPhaseSpec): Promise<PhaseOutcome>;
+/**
+ * The client-local refusal code of a device record or same-root Key Package
+ * this client does not send to a server whose READY lacks `identity-01`
+ * (LFCP-WIRE-01 §37): the Resource is hosted on a server without identity
+ * support (IDENTITY-PROFILE-01 §6). No wire code.
+ */
+export declare const IDENTITY_UNSUPPORTED = "IDENTITY_UNSUPPORTED";
 /** The DEKs this client holds for `chain`'s epochs, each checked against its commitment. */
 export declare function heldDeks(secrets: SecretStore, chain: LinearChain): Promise<Map<string, ResourceDEK>>;
 /** Stores the DEK of `epoch` (secret first) and links the epoch rows to it (LFCP-034). */
@@ -72,6 +79,16 @@ export declare function storeDek(storage: IdentityStorage, secrets: SecretStore,
 export declare function fetchDeks(storage: IdentityStorage, secrets: SecretStore, channel: IdentityChannel, chain: LinearChain, recipient: Installation): Promise<Map<string, ResourceDEK>>;
 /** Every Principal with `holds(P, 1)` at the head (W §19, §25.2): the reader set, by ID. */
 export declare function readersAt(state: LinearChain["state"]): readonly PrincipalDescriptor[];
+/**
+ * IDENTITY-PROFILE-01 §7.1 step 1: whether `principal`, a reader of the
+ * target state, is a device that the Identity Resource `identity` has
+ * revoked, or whose current chain in the target passes through such a
+ * device. Until the pair is propagated the target still counts the device
+ * as active (an unpropagated pair), but the installations of `identity`'s
+ * root treat it as revoked there and seal nothing to it, in a rotation as
+ * in step 3.
+ */
+export declare function revokedByIdentity(identity: LinearChain, target: LinearChain["state"], principal: PrincipalId): boolean;
 export interface KeyDelivery {
     /** Packages sealed and acknowledged now, as (epoch, recipient hex). */
     readonly sent: readonly {
@@ -136,6 +153,14 @@ export interface IdentityDocumentLoad {
 }
 /** The Genesis owner of a chain: the root of an Identity Resource (§2.3). */
 export declare function genesisOwner(chain: LinearChain): PrincipalId;
+/**
+ * Whether the retired entry `devices[key]` needs its flag (§7.1 step 4):
+ * some value of its `revoked` is not `true`, or the field is absent. A port
+ * without `retirement` shows one value. False when there is no valid entry.
+ */
+export declare function retiredFlagMissing(entries: ReadonlyMap<string, {
+    readonly revoked?: boolean;
+}>, key: string, revokedValues?: (key: string) => readonly unknown[]): boolean;
 /**
  * A new unit of `signer` in the Identity Resource carrying `intents` as
  * one change: the next actor sequence from the storage's reservation
@@ -150,6 +175,13 @@ export declare function sealIdentityUnit(options: {
     readonly doc: IdentityDocumentPort;
     readonly latest: IdentityDocumentLoad["latest"];
     readonly intents: readonly IdentityIntent[];
+    /**
+     * Retired entries whose `revoked` flag the change sets (§7.1 step 4,
+     * §8.2): field by field when the port has `retirement`, else with
+     * `device.put` of the entry's display fields (its `missing_keys` hint is
+     * the device's own, §3 AI5).
+     */
+    readonly retire?: readonly string[];
     /** The sequence to use instead of a reservation (a pairing device shared by installations, §5.3). */
     readonly seq?: bigint;
 }): Promise<Uint8Array>;

package/dist/identity/context.js

@@ -1,11 +1,11 @@
 import { actorSequence, bytesEqual, controlRecordId, dataEpoch, fromHex, hash32, LfcpError, toHex, } from "@openlfcp/core";
 import { dekCommitment, exportSecretKeyBytes, importResourceDEK, sha256, } from "@openlfcp/crypto";
 import { dekSecretRef } from "@openlfcp/storage";
-import { ABILITY, hasAbility, InMemorySeenUnits, parseDataUnit, parseKeyPackage, receiveDataUnit, receiveKeyPackage, sealDataUnit, sealKeyPackage, validateControlChain, verifyKeyPackage, verifySignedObject, } from "@openlfcp/wire";
+import { ABILITY, decodeControlRecord, hasAbility, InMemorySeenUnits, parseDataUnit, parseKeyPackage, receiveDataUnit, receiveKeyPackage, revocationOf, sealDataUnit, sealKeyPackage, validateControlChain, verifyKeyPackage, verifySignedObject, } from "@openlfcp/wire";
 import { adoptStoredDeks, checkWriteBarrier, loadControlChain, saveControlChain, saveControlConflict, } from "../storage.js";
 import { identityPlaintextCodec, identityWriterClass, } from "./document.js";
 import { phaseOf, } from "./journal.js";
-import { IdentityUnavailable } from "./network.js";
+import { IDENTITY_EXTENSION, IdentityUnavailable } from "./network.js";
 /** The Resource or the Identity Resource is forked (§9.7): approval, reconciliation and rotation are suspended. */
 export class IdentityConflict extends Error {
     resource;
@@ -104,11 +104,22 @@ export async function runControlPhase(storage, channel, journal, operation, spec
         if (attempt >= MAX_HEAD_RETRIES)
             throw new IdentityUnavailable(`the head kept moving while proposing ${spec.id}`);
         const head = toHex(chain.state.head);
-        let bytes;
-        if (spec.resend !== false && before?.bytes !== undefined && before.expectedHead === head)
-            bytes = fromHex(before.bytes);
-        else {
-            bytes = await spec.build(chain);
+        const journaled = spec.resend !== false && before?.bytes !== undefined && before.expectedHead === head;
+        const bytes = journaled ? fromHex(before.bytes) : await spec.build(chain);
+        if (!channel.extensions.includes(IDENTITY_EXTENSION) && isDeviceRecord(bytes)) {
+            // W §37: no record of type 9 or 10 to a server whose READY lacks identity-01,
+            // journaled bytes included (a resumed operation checks the current READY).
+            await journal.putPhase(operation, {
+                ...(before ?? {}),
+                id: spec.id,
+                kind: spec.kind,
+                resource: toHex(R),
+                state: "refused",
+                code: IDENTITY_UNSUPPORTED,
+            });
+            return Object.freeze({ state: "refused", chain, code: IDENTITY_UNSUPPORTED });
+        }
+        if (!journaled) {
             const id = toHex(validateRecordId(bytes));
             await journal.putPhase(operation, {
                 id: spec.id,
@@ -136,6 +147,18 @@ export async function runControlPhase(storage, channel, journal, operation, spec
         return Object.freeze({ state: "refused", chain, code: answer.code });
     }
 }
+/**
+ * The client-local refusal code of a device record or same-root Key Package
+ * this client does not send to a server whose READY lacks `identity-01`
+ * (LFCP-WIRE-01 §37): the Resource is hosted on a server without identity
+ * support (IDENTITY-PROFILE-01 §6). No wire code.
+ */
+export const IDENTITY_UNSUPPORTED = "IDENTITY_UNSUPPORTED";
+/** A DEVICE_GRANT (type 9) or DEVICE_REVOKE (type 10). */
+function isDeviceRecord(bytes) {
+    const type = decodeControlRecord(bytes).body.type;
+    return type === "DEVICE_GRANT" || type === "DEVICE_REVOKE";
+}
 /** A Control Record's ID: SHA-256 of its exact bytes (W §13). */
 const validateRecordId = (bytes) => controlRecordId(sha256(bytes));
 function ownRecordOn(chain, sent) {
@@ -219,6 +242,23 @@ export function readersAt(state) {
         .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
         .map(([, d]) => d));
 }
+/**
+ * IDENTITY-PROFILE-01 §7.1 step 1: whether `principal`, a reader of the
+ * target state, is a device that the Identity Resource `identity` has
+ * revoked, or whose current chain in the target passes through such a
+ * device. Until the pair is propagated the target still counts the device
+ * as active (an unpropagated pair), but the installations of `identity`'s
+ * root treat it as revoked there and seal nothing to it, in a rotation as
+ * in step 3.
+ */
+export function revokedByIdentity(identity, target, principal) {
+    const R = genesisOwner(identity);
+    const revoked = (d) => revocationOf(identity.state, R, d) !== undefined;
+    if (revoked(principal))
+        return true;
+    const binding = target.devices.get(toHex(principal));
+    return binding !== undefined && bytesEqual(binding.root, R) && binding.issuers.some(revoked);
+}
 /**
  * Seals every DEK of `deks` to each recipient at the chain's head and
  * records each acknowledged package (§9.5). A package the ledger records is
@@ -233,6 +273,21 @@ export async function deliverKeys(options) {
     const skipped = [];
     let complete = 0;
     const epochs = [...options.deks.keys()].sort((a, b) => (BigInt(a) < BigInt(b) ? -1 : 1));
+    // W §37: without identity-01 the server applies no same-root rule (W §25.2); a sender
+    // without key/distribute is authorized only by it, and sends nothing there.
+    const identity = options.channel.extensions.includes(IDENTITY_EXTENSION);
+    const sameRootOnly = !identity && !hasAbility(chain.state, sender.descriptor.principalId, ABILITY.KEY_DISTRIBUTE);
+    // The same for a pending package, at its own referenced head: a later key/distribute does
+    // not authorize it there (W §25.2), so it is re-sealed at the current head instead.
+    const resendable = (bytes) => {
+        const parsed = parseKeyPackage(bytes);
+        if (verifyKeyPackage(chain, parsed).kind !== "authorized")
+            return false;
+        if (identity)
+            return true;
+        const atHead = chain.stateAt(parsed.payload.controlHead);
+        return (atHead !== undefined && hasAbility(atHead, parsed.payload.sender, ABILITY.KEY_DISTRIBUTE));
+    };
     for (const recipient of options.recipients) {
         const rid = recipient.principalId;
         const hex = toHex(rid);
@@ -242,6 +297,10 @@ export async function deliverKeys(options) {
             skipped.push({ recipient: hex, reason: "not a reader at the head" });
             continue;
         }
+        if (sameRootOnly) {
+            skipped.push({ recipient: hex, reason: IDENTITY_UNSUPPORTED });
+            continue;
+        }
         for (const e of epochs) {
             const epoch = dataEpoch(BigInt(e));
             if ((await ledger.has(R, epoch, rid)) && !(options.resend?.get(hex)?.has(e) ?? false)) {
@@ -250,8 +309,7 @@ export async function deliverKeys(options) {
             }
             // §9.1: a package sent before is sent again as the same bytes, while it is still authorized.
             let bytes = await ledger.pending(R, epoch, rid);
-            if (bytes !== undefined &&
-                verifyKeyPackage(chain, parseKeyPackage(bytes)).kind !== "authorized")
+            if (bytes !== undefined && !resendable(bytes))
                 bytes = undefined;
             if (bytes === undefined) {
                 const sealed = await sealKeyPackage({
@@ -368,6 +426,28 @@ export function genesisOwner(chain) {
     const g = chain.records[0];
     return g?.body.type === "GENESIS" ? g.body.owner.principalId : chain.state.owner.principalId;
 }
+/** 0.4's flag write on a port without `retirement`: the entry's display fields and the flag. */
+function retiredPut(doc, key) {
+    const entry = doc.devices().get(key);
+    if (entry === undefined)
+        return [];
+    const { missing_keys: _hint, ...display } = entry;
+    return [{ intent: "device.put", key, entry: { ...display, revoked: true } }];
+}
+/**
+ * Whether the retired entry `devices[key]` needs its flag (§7.1 step 4):
+ * some value of its `revoked` is not `true`, or the field is absent. A port
+ * without `retirement` shows one value. False when there is no valid entry.
+ */
+export function retiredFlagMissing(entries, key, revokedValues) {
+    const entry = entries.get(key);
+    if (entry === undefined)
+        return false;
+    if (revokedValues === undefined)
+        return entry.revoked !== true;
+    const values = revokedValues(key);
+    return values.length === 0 || values.some((v) => v !== true);
+}
 /**
  * A new unit of `signer` in the Identity Resource carrying `intents` as
  * one change: the next actor sequence from the storage's reservation
@@ -390,11 +470,18 @@ export async function sealIdentityUnit(options) {
         while (previous !== undefined && seq <= previous.seq)
             seq = await options.storage.actorSequences.reserveNext(R, me);
     }
-    const plaintext = options.doc.write({
+    const author = {
         signer: me,
         actorSeq: seq,
         writerClass: identityWriterClass(chain.state, genesisOwner(chain), me),
-    }, options.intents);
+    };
+    const retire = options.retire ?? [];
+    const { doc } = options;
+    const plaintext = retire.length === 0
+        ? doc.write(author, options.intents)
+        : doc.retirement !== undefined
+            ? doc.retirement.write(author, options.intents, retire)
+            : doc.write(author, [...options.intents, ...retire.flatMap((key) => retiredPut(doc, key))]);
     return sealDataUnit({
         resourceId: R,
         dataEpoch: epoch,

package/dist/identity/devices.d.ts

@@ -1,6 +1,7 @@
 import { type PrincipalId, type ResourceId } from "@openlfcp/core";
 import type { SecretStore } from "@openlfcp/storage";
-import { type CertificateChain, type ControlState, type DataProfileCodec, type DeviceCertificate, type DeviceCertificatePayload, type DeviceKind, type PrincipalDescriptor, type Signer } from "@openlfcp/wire";
+import { type CertificateChain, type ControlState, type DeviceCertificate, type DeviceCertificatePayload, type DeviceKind, type PrincipalDescriptor, type Signer } from "@openlfcp/wire";
+import type { DataProfileHandler } from "../apply.js";
 import { type IdentityStorage, type Installation, type KeyDelivery } from "./context.js";
 import { type IdentityNetwork } from "./network.js";
 import { type LinearChain } from "./phases.js";
@@ -32,12 +33,24 @@ export interface FlowOptions {
     readonly network: IdentityNetwork;
     readonly now: () => number;
     /**
-     * The application's Data Profile codecs. A rotation uses the Resource's
-     * codec to judge which units recipients accept as data (W §26.3 rule 7);
-     * without one, only decryption and recorded refusals are checked.
+     * The application's Data Profiles, each as its receiver checks one unit:
+     * `codecFor({resourceId, actor})`, the codec bound to the unit's Resource
+     * and signer (the DataProfileHandler hook; e.g. shared-objects'
+     * sharedObjectsUnitProfile, sectionsUnitProfile, identityUnitProfile). A
+     * rotation judges each unit with its Resource's profile, as recipients do
+     * (W §26.3 rules 6 and 7, including the change's actor); without one, only
+     * decryption and recorded refusals are checked. Replaces 0.3.1's
+     * `dataProfiles` (bare codecs, which cannot bind the actor): a flow given
+     * `dataProfiles` throws instead of checking less.
      */
-    readonly dataProfiles?: readonly DataProfileCodec<unknown>[];
+    readonly profiles?: readonly UnitProfile[];
 }
+/**
+ * One Data Profile's per-unit check (the receiver's DataProfileHandler
+ * `dataProfile` and `codecFor`): `decode` of the codec it returns throws to
+ * reject the unit's plaintext.
+ */
+export type UnitProfile = Pick<DataProfileHandler<unknown>, "dataProfile" | "codecFor">;
 /**
  * The certificates above a leaf that `issuer` signs for `root` in the
  * state: none when the issuer is the root, else the issuer's own current

package/dist/identity/document.d.ts

@@ -95,6 +95,29 @@ export interface IdentityDocumentPort {
         readonly hash: string;
         readonly signer: PrincipalId;
     }[];
+    /**
+     * Optional (0.5.0): a device entry's `revoked` flag field by field, for
+     * a retired entry (§7.1 step 4, §8.2). With it, reconciliation sees every
+     * concurrent value of the flag and sets it without writing the entry's
+     * other fields, so it never resolves a conflict on them (a concurrent
+     * rename). A port without it shows one value per field (`devices()`), and
+     * the flag is written with `device.put` of the entry's display fields, as
+     * in 0.4. IdentityReplica provides both (`fieldValues`, `write`'s
+     * `retire` option).
+     */
+    readonly retirement?: IdentityRetirementPort;
+}
+/** IdentityDocumentPort.retirement. */
+export interface IdentityRetirementPort {
+    /** Every value `devices[key].revoked` holds now: several under concurrent writes, none when absent. */
+    revokedValues(key: string): readonly unknown[];
+    /**
+     * Like IdentityDocumentPort.write, the plaintext of one change by
+     * `author`: `intents` in order (possibly none), then `revoked = true` in
+     * each existing entry `devices[key]` of `retire`, no other field of those
+     * entries written.
+     */
+    write(author: IdentityAuthor, intents: readonly IdentityIntent[], retire: readonly string[]): Uint8Array;
 }
 /** A passthrough Data Unit codec: the port produces and consumes the plaintext. */
 export declare const identityPlaintextCodec: DataProfileCodec<Uint8Array>;

package/dist/identity/index.d.ts

@@ -1,15 +1,15 @@
 /** Identity flows (IDENTITY-PROFILE-01 §§5–9, LFCP-04-410). */
 export { acceptInvitationAsDevice, claimForRootRecord, createResourceAsDevice, type DeviceAcceptResult, type DeviceCreateResult, type DeviceResourceResult, type IncompleteDeviceResource, selfRegistrationRecord, } from "./accept.js";
 export { type DocumentWrite, deliverKeys, extendChain, fetchDeks, genesisOwner, heldDeks, IdentityConflict, type IdentityDocumentLoad, type IdentityStorage, type Installation, type KeyDelivery, loadIdentityDocument, type PhaseOutcome, readersAt, runControlPhase, runUnitPhase, sealIdentityUnit, storeDek, syncChain, } from "./context.js";
-export { checkIssuance, type Feasibility, type FlowOptions, issuerCertificates, leafPayload, MASK_PRESETS, type MaskPreset, mayManageDevices, type RegisterTarget, type RegistrationResult, type RegistrationStatus, registerDevice, signChain, } from "./devices.js";
-export { type DeviceEntryValue, IDENTITY_PROFILE, type IdentityAuthor, type IdentityDocumentPort, type IdentityIntent, type IdentityWriterClass, identityPlaintextCodec, identityWriterClass, type PairingRequestValue, principalOfRef, principalRefOf, type RosterEntryValue, resourceRef, } from "./document.js";
+export { checkIssuance, type Feasibility, type FlowOptions, issuerCertificates, leafPayload, MASK_PRESETS, type MaskPreset, mayManageDevices, type RegisterTarget, type RegistrationResult, type RegistrationStatus, registerDevice, signChain, type UnitProfile, } from "./devices.js";
+export { type DeviceEntryValue, IDENTITY_PROFILE, type IdentityAuthor, type IdentityDocumentPort, type IdentityIntent, type IdentityRetirementPort, type IdentityWriterClass, identityPlaintextCodec, identityWriterClass, type PairingRequestValue, principalOfRef, principalRefOf, type RosterEntryValue, resourceRef, } from "./document.js";
 export { type JournalOperation, type JournalPhase, type LedgerEntry, OperationJournal, type OperationKind, type OperationStatus, PackageLedger, pairingSecretRef, pendingDekRef, } from "./journal.js";
 export { ChannelPool, type ConnectionNetworkOptions, connectionNetwork, IDENTITY_EXTENSION, type IdentityAnswer, type IdentityChannel, type IdentityNetwork, IdentityRefused, IdentityUnavailable, type OpenAnswer, } from "./network.js";
 export { type ApprovalResult, approvedGrantRecord, approvePairing, type CancelResult, cancelPairing, cancelRecord, consumeRecord, createPairingSession, openPairingSessions, PairingLinkText, type PairingReview, type PairingSessionResult, pairingRequests, resumeApproval, resumePairingSession, } from "./pairing.js";
-export { type CandidateEvidence, type CandidateResult, type CandidateStatus, candidateEvidence, completePairing, type PairingOutcome, type RequestPairingOptions, type RequestPairingResult, requestPairing, } from "./pairing-request.js";
+export { type CandidateEvidence, type CandidateResult, type CandidateStatus, candidateEvidence, completePairing, type PairingOutcome, pairingLinkRejection, type RequestPairingOptions, type RequestPairingResult, requestPairing, } from "./pairing-request.js";
 export { certificateInScope, classifyCancel, classifyConsume, classifyPackage, classifyRegister, classifyRevoke, classifyRotate, keyEpochAfter, type LinearChain, type PhaseState, type RegisterPhase, recordSeq, } from "./phases.js";
 export { type RevocationStatus, revocationStatus } from "./proof.js";
-export { planReconciliation, type ReconcileStep, reconcileDevices, reconcileRecord, type TargetReconciliation, } from "./reconcile.js";
+export { type DisplayPlan, keyRecipients, planDisplayData, planReconciliation, planRevocations, type ReconcileStep, reconcileDevices, reconcileRecord, revocationRelevant, type TargetReconciliation, } from "./reconcile.js";
 export { type CreatedIdentityResource, type CreateIdentityResourceOptions, createIdentityResource, type IdentityDocumentFactory, type IdentityFlowOptions, identityTarget, localIdentityResource, resumeIdentityCreation, setLocalIdentityResource, } from "./resource.js";
 export { previewRevocation, type ResourcePreview, type RevocationPreview, type RevocationResult, type RevokeDeviceResult, revokeDevice, rotateIfExposed, } from "./revocation.js";
 export { type AddToRosterOptions, type AddToRosterResult, addToRoster, type RosterWrite, writeRosterEntry, } from "./roster.js";

package/dist/identity/index.js

@@ -6,10 +6,10 @@ export { IDENTITY_PROFILE, identityPlaintextCodec, identityWriterClass, principa
 export { OperationJournal, PackageLedger, pairingSecretRef, pendingDekRef, } from "./journal.js";
 export { ChannelPool, connectionNetwork, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
 export { approvedGrantRecord, approvePairing, cancelPairing, cancelRecord, consumeRecord, createPairingSession, openPairingSessions, PairingLinkText, pairingRequests, resumeApproval, resumePairingSession, } from "./pairing.js";
-export { candidateEvidence, completePairing, requestPairing, } from "./pairing-request.js";
+export { candidateEvidence, completePairing, pairingLinkRejection, requestPairing, } from "./pairing-request.js";
 export { certificateInScope, classifyCancel, classifyConsume, classifyPackage, classifyRegister, classifyRevoke, classifyRotate, keyEpochAfter, recordSeq, } from "./phases.js";
 export { revocationStatus } from "./proof.js";
-export { planReconciliation, reconcileDevices, reconcileRecord, } from "./reconcile.js";
+export { keyRecipients, planDisplayData, planReconciliation, planRevocations, reconcileDevices, reconcileRecord, revocationRelevant, } from "./reconcile.js";
 export { createIdentityResource, identityTarget, localIdentityResource, resumeIdentityCreation, setLocalIdentityResource, } from "./resource.js";
 export { previewRevocation, revokeDevice, rotateIfExposed, } from "./revocation.js";
 export { addToRoster, writeRosterEntry, } from "./roster.js";

package/dist/identity/pairing-request.d.ts

@@ -81,6 +81,18 @@ export type RequestPairingResult = {
     readonly operation?: string;
     readonly reason: string;
 };
+/**
+ * §5.2, the checks after the link parses and its secret is its device's
+ * (`parsePairingUri`, `pairingDeviceSigner`), on what opening `I` as `J`
+ * gave: the session as `J` is refused (W §41), `I`'s Genesis profile is not
+ * `org.openlfcp.identity.v1`, or `J` is not a registered, active kind-2
+ * device of `I`'s owner in `I`'s chain. Returns why the link is rejected
+ * (a client-local outcome, the corpora's PAIRING_LINK_REJECTED), or
+ * undefined when it passes; a rejected link is not used any further.
+ */
+export declare function pairingLinkRejection(J: PrincipalId, opened: LinearChain | {
+    readonly refused: string;
+}): string | undefined;
 /** §5.3 steps 2–3. */
 export declare function requestPairing(o: RequestPairingOptions): Promise<RequestPairingResult>;
 /** §6: the status of one Resource for the new device, from its own observations only. */

package/dist/identity/pairing-request.js

@@ -5,6 +5,32 @@ import { IDENTITY_PROFILE, principalRefOf, resourceRef, } from "./document.js";
 import { newOperationId, OperationJournal, pairingSecretRef, phaseOf } from "./journal.js";
 import { ChannelPool, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
 import { setLocalIdentityResource } from "./resource.js";
+/**
+ * §5.2, the checks after the link parses and its secret is its device's
+ * (`parsePairingUri`, `pairingDeviceSigner`), on what opening `I` as `J`
+ * gave: the session as `J` is refused (W §41), `I`'s Genesis profile is not
+ * `org.openlfcp.identity.v1`, or `J` is not a registered, active kind-2
+ * device of `I`'s owner in `I`'s chain. Returns why the link is rejected
+ * (a client-local outcome, the corpora's PAIRING_LINK_REJECTED), or
+ * undefined when it passes; a rejected link is not used any further.
+ */
+export function pairingLinkRejection(J, opened) {
+    if ("refused" in opened)
+        return `the session as the link's device is refused (${opened.refused})`;
+    const state = opened.state;
+    if (state.dataProfile !== IDENTITY_PROFILE)
+        return `the Resource is not an Identity Resource (its Genesis profile is ${state.dataProfile})`;
+    const R = genesisOwner(opened);
+    const binding = state.devices.get(toHex(J));
+    const j = activeDevice(state, J);
+    if (binding === undefined ||
+        !binding.registered ||
+        j === undefined ||
+        j.kind !== DEVICE_KIND.PAIRING ||
+        !bytesEqual(j.root, R))
+        return "the link's device is not a registered, active pairing device of the owner";
+    return undefined;
+}
 /** §5.3 steps 2–3. */
 export async function requestPairing(o) {
     let link;
@@ -39,16 +65,21 @@ export async function requestPairing(o) {
             };
         }
         const channel = await pool.get(J, url);
-        const chain = await syncChain(o.storage, channel, I);
+        let chain;
+        try {
+            chain = await syncChain(o.storage, channel, I);
+        }
+        catch (e) {
+            // §5.2 check 2: the coordinator refuses the session as J (W §41).
+            if (!(e instanceof IdentityRefused))
+                throw e;
+            const reason = pairingLinkRejection(J.descriptor.principalId, { refused: e.code });
+            return { kind: "not-a-session", reason: reason ?? e.message };
+        }
         const R = genesisOwner(chain);
-        if (chain.state.dataProfile !== IDENTITY_PROFILE)
-            return { kind: "not-a-session", reason: "the Resource is not an Identity Resource" };
-        const j = activeDevice(chain.state, J.descriptor.principalId);
-        if (j === undefined || j.kind !== DEVICE_KIND.PAIRING || !bytesEqual(j.root, R))
-            return {
-                kind: "not-a-session",
-                reason: "the link's device is not an active pairing device of the owner",
-            };
+        const rejected = pairingLinkRejection(J.descriptor.principalId, chain);
+        if (rejected !== undefined)
+            return { kind: "not-a-session", reason: rejected };
         const pairing = { signer: J, agreement: link.secret.agreementKey };
         const deks = await fetchDeks(o.storage, o.secrets, channel, chain, pairing);
         const doc = o.document(I, R);

package/dist/identity/pairing.d.ts

@@ -43,6 +43,17 @@ export type PairingSessionResult = {
  | {
     readonly kind: "not-authorized";
     readonly reason: string;
+}
+/**
+ * `I`'s coordinator does not list `identity-01` in READY: it is hosted on
+ * a server without identity support (IDENTITY-PROFILE-01 §6). Nothing is
+ * proposed or uploaded there: no DEVICE_GRANT, no same-root Key Package
+ * (LFCP-WIRE-01 §37).
+ */
+ | {
+    readonly kind: "unsupported";
+    readonly session?: string;
+    readonly reason: string;
 } | {
     readonly kind: "refused";
     readonly code: string;

package/dist/identity/pairing.js

@@ -5,10 +5,11 @@ import { deliverKeys, fetchDeks, genesisOwner, IdentityConflict, loadIdentityDoc
 import { checkIssuance, leafPayload, MASK_PRESETS, mayManageDevices, registerDevice, signChain, } from "./devices.js";
 import { identityPlaintextCodec, principalOfRef, principalRefOf, } from "./document.js";
 import { newOperationId, OperationJournal, PackageLedger, pairingSecretRef, phaseOf, } from "./journal.js";
-import { ChannelPool, IdentityUnavailable } from "./network.js";
+import { ChannelPool, IDENTITY_EXTENSION, IdentityUnavailable, } from "./network.js";
 import { classifyCancel, classifyConsume, classifyRegister } from "./phases.js";
 import { identityTarget } from "./resource.js";
 import { rotateIfExposed } from "./revocation.js";
+import { checkFlowProfiles } from "./rotation.js";
 /**
  * Pairing a new installation, the managing side `A` (IDENTITY-PROFILE-01
  * §5.3 steps 1, 4–7, 9 and 10): a pairing device `J` registered in the
@@ -39,6 +40,8 @@ export class PairingLinkText {
         return "[redacted]";
     }
 }
+/** W §37: the reason of an `unsupported` result. */
+const NO_IDENTITY_SUPPORT = "the Identity Resource is hosted on a server without identity support (its READY does not list identity-01)";
 const PAIRING_MASK = [1n, 2n];
 /** Wraps a flow body: transport failures and forks become results, the journal stays. */
 async function guarded(pool, body, unavailable, conflict) {
@@ -69,6 +72,8 @@ export async function createPairingSession(o) {
     const me = o.installation.signer;
     return guarded(pool, async () => {
         const channel = await pool.get(me, target.url);
+        if (!channel.extensions.includes(IDENTITY_EXTENSION))
+            return { kind: "unsupported", reason: NO_IDENTITY_SUPPORT };
         const chain = await syncChain(o.storage, channel, target.resource);
         const R = genesisOwner(chain);
         if (!mayManageDevices(chain.state, me.descriptor.principalId, R))
@@ -142,7 +147,14 @@ async function missingMaterial(o, channel, chain) {
             dek: (epoch) => deks.get(String(epoch)),
             profile: identityPlaintextCodec,
         });
-    if (opened?.kind !== "accepted")
+    // A unit held whose only failure is the missing DEK of a real epoch of I (every other
+    // check passed, and that DEK is listed above) is not missing itself. A unit naming an
+    // epoch I does not have, or failing any other check, is missing (§5.3 step 1).
+    const onlyDekMissing = opened?.kind === "local-failure" &&
+        opened.reason === "NO_DEK" &&
+        unit !== undefined &&
+        chain.state.epochs.has(String(parseDataUnit(unit).payload.dataEpoch));
+    if (opened?.kind !== "accepted" && !onlyDekMissing)
         missing.push("the root's Data Unit with actor sequence 1");
     return missing;
 }
@@ -155,6 +167,9 @@ async function finishSession(o, pool, session) {
     const chainJ = certificateChain(op.intent.certificates.map((c) => parseDeviceCertificate(fromHex(c))), R);
     const me = o.installation.signer;
     const channel = await pool.get(me, op.intent.url);
+    // A resumed session may meet a server that no longer lists identity-01 (W §37).
+    if (!channel.extensions.includes(IDENTITY_EXTENSION))
+        return { kind: "unsupported", session, reason: NO_IDENTITY_SUPPORT };
     const grant = await runControlPhase(o.storage, channel, journal, session, {
         id: "grant",
         kind: "register",
@@ -323,6 +338,7 @@ export async function pairingRequests(o) {
  * phase 1; phase 2 signs exactly that payload.
  */
 export async function approvePairing(o) {
+    checkFlowProfiles(o);
     const { I, R, J, url } = await readSession(o, o.review.session);
     const pool = new ChannelPool(o.network);
     const me = o.installation.signer;
@@ -413,6 +429,7 @@ export const approvedGrantRecord = (chain, signer, root, device, pairing) => sig
 export const cancelRecord = (chain, signer, root, pairing) => signControlRecord(next(chain), { type: "DEVICE_REVOKE", root, device: pairing, reason: 0n }, signer).bytes;
 /** Resumes a journaled approval from its next phase (§9.1: "If A crashes after step 5 …"). */
 export async function resumeApproval(o, operation) {
+    checkFlowProfiles(o);
     const journal = new OperationJournal(o.storage);
     const pool = new ChannelPool(o.network);
     const me = o.installation.signer;
@@ -565,6 +582,7 @@ export async function resumeApproval(o, operation) {
  * human does not confirm is rejected).
  */
 export async function cancelPairing(o) {
+    checkFlowProfiles(o);
     const { I, R, J, url } = await readSession(o, o.session);
     const journal = new OperationJournal(o.storage);
     const pool = new ChannelPool(o.network);

package/dist/identity/reconcile.d.ts

@@ -1,6 +1,7 @@
 import { type PrincipalId, type ResourceId } from "@openlfcp/core";
-import { type CertificateChain, type Signer } from "@openlfcp/wire";
+import { type CertificateChain, type ControlState, type DeviceBinding, type PrincipalDescriptor, type Signer } from "@openlfcp/wire";
 import { type DocumentWrite, type KeyDelivery } from "./context.js";
+import { type DeviceEntryValue, type IdentityIntent } from "./document.js";
 import { type LinearChain, type PhaseState } from "./phases.js";
 import { type IdentityFlowOptions } from "./resource.js";
 import { type RotationOutcome } from "./rotation.js";
@@ -26,11 +27,40 @@ export type ReconcileStep = {
     /** `I`'s chain for the device. */
     readonly chain: CertificateChain;
 };
+/**
+ * §7.1 step 1: whether the revocation of `device` in `I` is relevant in the
+ * target `X`. It is when the device is bound in `X` (as a leaf or an
+ * intermediate, W §17.4 rule 9), or when it could become registered in `X`
+ * or issue a chain there: bound in `I` with kind 0, or with kind 1 and `X`
+ * in its scope, or not bound in `I` at all (its kind is unknown). A pairing
+ * device, or a service device whose scope does not list `X`, that is not
+ * bound in `X` can never act there (W §7.3 c3, c6; N8): its revocation
+ * would protect nothing and would take one of the 64 unbound pairs of the
+ * root that W §17.5 rule 5 allows in `X` and never frees.
+ *
+ * `binding` is the device's binding in `I` (undefined when unbound there).
+ */
+export declare function revocationRelevant(binding: Pick<DeviceBinding, "kind" | "scope"> | undefined, target: ControlState, device: PrincipalId): boolean;
+/**
+ * §7.1 step 1 for one target: the revocations of `I` to propose on `X`
+ * (the pairs of `I`'s `revoked` not in `X`'s that are relevant there, those
+ * whose device is bound in `X` first, each group in `I`'s chain order), and
+ * the devices whose revocation is not relevant in `X` and is not
+ * propagated. Empty for the target `I` itself.
+ */
+export declare function planRevocations(identity: LinearChain, target: LinearChain): {
+    readonly propose: readonly Extract<ReconcileStep, {
+        kind: "revoke";
+    }>[];
+    readonly notRelevant: readonly PrincipalId[];
+};
 /**
  * §7.1 steps 1 and 2 for one target, in their normative order. For the
  * target `I` itself both steps are vacuous. Registrations are planned on
- * the target's state as the revocations leave it (a device whose issuer
- * `I` revoked is never registered before the cascade reaches the target).
+ * the target's state as the revocations leave it, and every pair of `I`'s
+ * `revoked` counts as revoked in `X` whether its propagation succeeds or
+ * not (an unpropagated pair, refused by W §17.5 rule 5, or a pair that is
+ * not relevant): no device whose issuer `I` has revoked is ever registered.
  */
 export declare function planReconciliation(identity: LinearChain, target: LinearChain): readonly ReconcileStep[];
 /** The record of a step on the target's head, signed by the reconciler. */
@@ -43,6 +73,17 @@ export interface TargetReconciliation {
         readonly step: ReconcileStep;
         readonly state: PhaseState | "refused";
     }[];
+    /**
+     * §7.1 step 1: devices whose revocation in `I` the target refused (the
+     * limit of W §17.5 rule 5, or the reconciler's authority there), to
+     * report to the human with the Resource. Each stays unpropagated: this
+     * run registered no device through it and sealed nothing to it. A later
+     * run proposes it again once the target's state changed since the
+     * refusal (its head moved, for one by the device's binding there); on the
+     * same state it reports the pair without sending anything. Empty when
+     * every relevant pair reached the target.
+     */
+    readonly unpropagated?: readonly PrincipalId[];
     readonly keys?: KeyDelivery;
     readonly rotation?: RotationOutcome;
 }
@@ -70,4 +111,33 @@ export declare function reconcileDevices(o: IdentityFlowOptions & {
      */
     readonly document: DocumentWrite;
 }>;
+/** §7.1 step 4's writes in `I`'s document: new entries, and the retired entries to flag. */
+export interface DisplayPlan {
+    readonly intents: readonly IdentityIntent[];
+    /** Retired entries (PrincipalRefs) whose `revoked` is set to `true`, and nothing else of them. */
+    readonly retire: readonly string[];
+}
+/**
+ * §7.1 step 4: the display data reconciliation writes in `I`'s document,
+ * from `I`'s Control state and the valid device entries (§4). For every
+ * device of `R` of kind 0 or 1 bound in `I` as the leaf of an accepted
+ * chain (an intermediate-only binding issues and does not act in `I`):
+ * when it is not revoked in `I` and has no valid entry, an entry labelled
+ * with its fingerprint (§5.2); when it is revoked in `I` and some value of
+ * its entry's `revoked` (a retired entry) is not `true`, or the field is
+ * absent, that flag alone. `revokedValues` gives every concurrent value
+ * of the flag (IdentityDocumentPort.retirement); without it the entry's
+ * one shown value is read. No entry is created for a revoked device,
+ * nothing is written for a pairing device, nothing is relabelled or
+ * deleted, and a second run on the same states plans nothing.
+ */
+export declare function planDisplayData(identity: ControlState, entries: ReadonlyMap<string, DeviceEntryValue>, root: PrincipalId, revokedValues?: (key: string) => readonly unknown[]): DisplayPlan;
+/**
+ * §7.1 step 3: the devices of `R` reconciliation seals the target's keys
+ * to: every reader of the target whose root is `R` (pairing devices of `I`
+ * included, in `I`), except a device revoked in `I` and a device whose
+ * current chain in the target passes through a device revoked in `I` (an
+ * unpropagated pair of step 1, which the target still counts as active).
+ */
+export declare function keyRecipients(identity: LinearChain, target: LinearChain): readonly PrincipalDescriptor[];
 //# sourceMappingURL=reconcile.d.ts.map