@openlfcp/client 0.3.1 → 0.5.0

package/dist/identity/reconcile.js

@@ -1,45 +1,92 @@
 import { bytesEqual, fromBase64url, fromHex, principalId, resourceId, secureRandom, toHex, } from "@openlfcp/core";
-import { activeDevice, actsFor, DEVICE_KIND, deviceFingerprint, revocationOf, signControlRecord, } from "@openlfcp/wire";
-import { deliverKeys, fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, readersAt, runControlPhase, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
+import { activeDevice, actsFor, DEVICE_KIND, deviceFingerprint, isBound, revocationOf, signControlRecord, } from "@openlfcp/wire";
+import { deliverKeys, fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, readersAt, retiredFlagMissing, revokedByIdentity, runControlPhase, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
 import { mayManageDevices } from "./devices.js";
-import { principalRefOf, resourceRef } from "./document.js";
+import { principalRefOf, resourceRef, } from "./document.js";
 import { newOperationId, OperationJournal, PackageLedger } from "./journal.js";
 import { ChannelPool, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
 import { classifyRegister, classifyRevoke } from "./phases.js";
 import { identityTarget } from "./resource.js";
 import { rotateIfExposed } from "./revocation.js";
-import { resumeRotations } from "./rotation.js";
+import { checkFlowProfiles, resumeRotations } from "./rotation.js";
 /**
- * §7.1 steps 1 and 2 for one target, in their normative order. For the
- * target `I` itself both steps are vacuous. Registrations are planned on
- * the target's state as the revocations leave it (a device whose issuer
- * `I` revoked is never registered before the cascade reaches the target).
+ * §7.1 step 1: whether the revocation of `device` in `I` is relevant in the
+ * target `X`. It is when the device is bound in `X` (as a leaf or an
+ * intermediate, W §17.4 rule 9), or when it could become registered in `X`
+ * or issue a chain there: bound in `I` with kind 0, or with kind 1 and `X`
+ * in its scope, or not bound in `I` at all (its kind is unknown). A pairing
+ * device, or a service device whose scope does not list `X`, that is not
+ * bound in `X` can never act there (W §7.3 c3, c6; N8): its revocation
+ * would protect nothing and would take one of the 64 unbound pairs of the
+ * root that W §17.5 rule 5 allows in `X` and never frees.
+ *
+ * `binding` is the device's binding in `I` (undefined when unbound there).
  */
-export function planReconciliation(identity, target) {
+export function revocationRelevant(binding, target, device) {
+    if (isBound(target, device))
+        return true;
+    if (binding === undefined || binding.kind === DEVICE_KIND.PERSONAL)
+        return true;
+    return (binding.kind === DEVICE_KIND.SERVICE &&
+        binding.scope.some((s) => bytesEqual(s, target.resourceId)));
+}
+/**
+ * §7.1 step 1 for one target: the revocations of `I` to propose on `X`
+ * (the pairs of `I`'s `revoked` not in `X`'s that are relevant there, those
+ * whose device is bound in `X` first, each group in `I`'s chain order), and
+ * the devices whose revocation is not relevant in `X` and is not
+ * propagated. Empty for the target `I` itself.
+ */
+export function planRevocations(identity, target) {
     if (bytesEqual(identity.state.resourceId, target.state.resourceId))
-        return [];
+        return { propose: [], notRelevant: [] };
     const R = genesisOwner(identity);
     const I = identity.state;
     const X = target.state;
-    const steps = [];
-    // Step 1: every revoked pair of I not revoked in X, in I's chain order.
-    const revokedInX = (d) => revocationOf(X, R, d) !== undefined;
-    const revokedNow = new Set();
+    const bound = [];
+    const unbound = [];
+    const notRelevant = [];
+    const seen = new Set();
     for (const r of identity.records) {
         if (r.body.type !== "DEVICE_REVOKE" || !bytesEqual(r.body.root, R))
             continue;
         const d = r.body.device;
-        if (revokedInX(d) || revokedNow.has(toHex(d)))
+        if (revocationOf(X, R, d) !== undefined || seen.has(toHex(d)))
             continue;
-        revokedNow.add(toHex(d));
-        steps.push({
+        seen.add(toHex(d));
+        if (!revocationRelevant(I.devices.get(toHex(d)), X, d)) {
+            notRelevant.push(d);
+            continue;
+        }
+        (isBound(X, d) ? bound : unbound).push({
             kind: "revoke",
             root: R,
             device: d,
             reason: r.body.reason === 3n ? 0n : r.body.reason,
         });
     }
-    const revokedAfter = (d) => revokedInX(d) || revokedNow.has(toHex(d));
+    return Object.freeze({
+        propose: Object.freeze([...bound, ...unbound]),
+        notRelevant: Object.freeze(notRelevant),
+    });
+}
+/**
+ * §7.1 steps 1 and 2 for one target, in their normative order. For the
+ * target `I` itself both steps are vacuous. Registrations are planned on
+ * the target's state as the revocations leave it, and every pair of `I`'s
+ * `revoked` counts as revoked in `X` whether its propagation succeeds or
+ * not (an unpropagated pair, refused by W §17.5 rule 5, or a pair that is
+ * not relevant): no device whose issuer `I` has revoked is ever registered.
+ */
+export function planReconciliation(identity, target) {
+    if (bytesEqual(identity.state.resourceId, target.state.resourceId))
+        return [];
+    const R = genesisOwner(identity);
+    const I = identity.state;
+    const X = target.state;
+    // Step 1: the relevant revocations of I, bound in X first.
+    const steps = [...planRevocations(identity, target).propose];
+    const revokedAfter = (d) => revocationOf(X, R, d) !== undefined || revocationOf(I, R, d) !== undefined;
     // Step 2: registrations, in I's binding order.
     for (const [hex, d] of I.devices) {
         if (!bytesEqual(d.root, R) || d.chain === null || d.leafId === null)
@@ -98,6 +145,7 @@ export function reconcileRecord(target, step, signer) {
  * opened and this installation is the rotator, it rotates (§8.4).
  */
 export async function reconcileDevices(o) {
+    checkFlowProfiles(o);
     const target = await identityTarget(o);
     const me = o.installation.signer;
     const journal = new OperationJournal(o.storage);
@@ -114,10 +162,11 @@ export async function reconcileDevices(o) {
     let document = { state: "none" };
     let open = false;
     try {
-        // A rotation an earlier run committed but did not adopt is finished first (§9.1).
-        await resumeRotations({ ...o, pool });
         const channel = await pool.get(me, target.url);
         const I = await syncChain(o.storage, channel, target.resource);
+        // A rotation an earlier run committed but did not adopt is finished first (§9.1). It
+        // seals nothing to a device I has revoked (§7.1 step 1).
+        await resumeRotations({ ...o, pool, identityChain: I });
         const R = genesisOwner(I);
         if (!mayManageDevices(I.state, me.descriptor.principalId, R))
             return {
@@ -164,8 +213,9 @@ export async function reconcileDevices(o) {
                     throw e;
             }
         }
-        // Step 4: display data for devices in I's chain without a valid entry (labels default to the fingerprint).
-        if (displayIntents(I, doc, R).length > 0 && doc.initialized()) {
+        // Step 4: display data for the leaf-bound personal and service devices of I without a valid
+        // entry (labels default to the fingerprint), and the flag of a retired entry.
+        if (!nothingToWrite(displayPlan(I, doc, R)) && doc.initialized()) {
             // Built on the current state of I: a rotation of I by this run, or by
             // anyone, makes an earlier unit stale (W §19.1), and it is written again.
             document = await runUnitPhase(channel, journal, operation, {
@@ -178,8 +228,8 @@ export async function reconcileDevices(o) {
                     const fresh = o.document(target.resource, R);
                     const loaded = await loadIdentityDocument({ channel, chain: now, deks, doc: fresh });
                     // Another manager may have written the entries since the first read (§7.1).
-                    const intents = displayIntents(now, fresh, R);
-                    if (intents.length === 0)
+                    const plan = displayPlan(now, fresh, R);
+                    if (nothingToWrite(plan))
                         return null;
                     return sealIdentityUnit({
                         storage: o.storage,
@@ -188,7 +238,8 @@ export async function reconcileDevices(o) {
                         signer: me,
                         doc: fresh,
                         latest: loaded.latest,
-                        intents,
+                        intents: plan.intents,
+                        retire: plan.retire,
                     });
                 },
             });
@@ -214,25 +265,76 @@ export async function reconcileDevices(o) {
     }
     return { operation, targets: Object.freeze(out), document };
 }
-/** §7.1 step 4: a device entry for each device of R in I's chain without one. */
-function displayIntents(I, doc, R) {
+/**
+ * §7.1 step 4: the display data reconciliation writes in `I`'s document,
+ * from `I`'s Control state and the valid device entries (§4). For every
+ * device of `R` of kind 0 or 1 bound in `I` as the leaf of an accepted
+ * chain (an intermediate-only binding issues and does not act in `I`):
+ * when it is not revoked in `I` and has no valid entry, an entry labelled
+ * with its fingerprint (§5.2); when it is revoked in `I` and some value of
+ * its entry's `revoked` (a retired entry) is not `true`, or the field is
+ * absent, that flag alone. `revokedValues` gives every concurrent value
+ * of the flag (IdentityDocumentPort.retirement); without it the entry's
+ * one shown value is read. No entry is created for a revoked device,
+ * nothing is written for a pairing device, nothing is relabelled or
+ * deleted, and a second run on the same states plans nothing.
+ */
+export function planDisplayData(identity, entries, root, revokedValues) {
     const intents = [];
-    for (const [hex, d] of I.state.devices) {
-        if (!bytesEqual(d.root, R) || d.chain === null || d.kind === DEVICE_KIND.PAIRING)
+    const retire = [];
+    for (const [hex, d] of identity.devices) {
+        if (!bytesEqual(d.root, root) || d.chain === null)
             continue;
-        const key = principalRefOf(principalId(fromHex(hex)));
-        if (doc.devices().has(key))
+        if (d.kind !== DEVICE_KIND.PERSONAL && d.kind !== DEVICE_KIND.SERVICE)
+            continue;
+        const D = principalId(fromHex(hex));
+        const key = principalRefOf(D);
+        if (revocationOf(identity, root, D) !== undefined) {
+            if (retiredFlagMissing(entries, key, revokedValues))
+                retire.push(key);
+            continue;
+        }
+        if (entries.has(key))
             continue;
         intents.push({
             intent: "device.put",
             key,
             entry: {
-                label: deviceFingerprint(principalId(fromHex(hex))),
+                label: deviceFingerprint(D),
                 kind: d.kind === DEVICE_KIND.SERVICE ? 1 : 0,
             },
         });
     }
-    return intents;
+    return Object.freeze({ intents: Object.freeze(intents), retire: Object.freeze(retire) });
+}
+const displayPlan = (I, doc, R) => planDisplayData(I.state, doc.devices(), R, doc.retirement === undefined ? undefined : (key) => doc.retirement?.revokedValues(key) ?? []);
+const nothingToWrite = (p) => p.intents.length === 0 && p.retire.length === 0;
+/**
+ * §7.1 step 3: the devices of `R` reconciliation seals the target's keys
+ * to: every reader of the target whose root is `R` (pairing devices of `I`
+ * included, in `I`), except a device revoked in `I` and a device whose
+ * current chain in the target passes through a device revoked in `I` (an
+ * unpropagated pair of step 1, which the target still counts as active).
+ */
+export function keyRecipients(identity, target) {
+    const R = genesisOwner(identity);
+    return Object.freeze(readersAt(target.state).filter((r) => bytesEqual(actsFor(target.state, r.principalId), R) &&
+        !revokedByIdentity(identity, target.state, r.principalId)));
+}
+/**
+ * The revocations of `I` that `X` refused in an earlier reconciliation of
+ * this installation, as `<phase ID>@<head of X they were proposed on>`,
+ * with the refusal code (§7.1 step 1). A head names one state of `X`.
+ */
+async function refusedRevocations(journal, operation, X) {
+    const out = new Map();
+    const prefix = `revoke:${toHex(X)}:`;
+    for (const op of await journal.list({ kind: "reconcile" }))
+        if (op.id !== operation)
+            for (const p of op.phases)
+                if (p.id.startsWith(prefix) && p.state === "refused" && p.expectedHead !== undefined)
+                    out.set(`${p.id}@${p.expectedHead}`, p.code ?? "refused");
+    return out;
 }
 async function reconcileTarget(o, channel, journal, ledger, operation, I, X, resend) {
     const me = o.installation.signer;
@@ -240,9 +342,29 @@ async function reconcileTarget(o, channel, journal, ledger, operation, I, X, res
     let chain = await syncChain(o.storage, channel, X);
     const steps = [];
     const manages = mayManageDevices(chain.state, me.descriptor.principalId, R);
+    const refused = manages
+        ? await refusedRevocations(journal, operation, X)
+        : new Map();
     if (manages)
         for (const step of planReconciliation(I, chain)) {
             const id = `${step.kind}:${toHex(X)}:${toHex(step.device)}`;
+            // §7.1 step 1: a refused propagation is not repeated as such. It is proposed again once
+            // X's state changed since the refusal (its head moved; binding the device moves it too,
+            // and a bound device's revocation is never limited), not on every run.
+            const head = toHex(chain.state.head);
+            const code = step.kind === "revoke" ? refused.get(`${id}@${head}`) : undefined;
+            if (code !== undefined && !isBound(chain.state, step.device)) {
+                await journal.putPhase(operation, {
+                    id,
+                    kind: "revoke",
+                    resource: toHex(X),
+                    state: "refused",
+                    expectedHead: head,
+                    code,
+                });
+                steps.push({ step, state: "refused" });
+                continue;
+            }
             const outcome = await runControlPhase(o.storage, channel, journal, operation, {
                 id,
                 kind: step.kind,
@@ -255,17 +377,24 @@ async function reconcileTarget(o, channel, journal, ledger, operation, I, X, res
             steps.push({ step, state: outcome.state });
             chain = outcome.chain;
         }
-    // Step 3: every reader of the target whose root is R (pairing devices of I included), by the ledger.
+    // §7.1 step 1: a refused revocation is reported and stays unpropagated.
+    const unpropagated = steps
+        .filter((s) => s.step.kind === "revoke" && s.state === "refused")
+        .map((s) => s.step.device);
+    // Step 3: every reader of the target whose root is R (pairing devices of I included), by the
+    // ledger, except the devices I has revoked and those whose chain passes through one.
     const deks = await fetchDeks(o.storage, o.secrets, channel, chain, o.installation);
-    const recipients = readersAt(chain.state).filter((r) => bytesEqual(actsFor(chain.state, r.principalId), R));
+    const recipients = keyRecipients(I, chain);
     const keys = await deliverKeys({ channel, ledger, chain, sender: me, recipients, deks, resend });
     const rotation = o.rotate === false
         ? undefined
-        : await rotateIfExposed({ ...o, channel, operation, resource: X });
+        : // §7.1 step 1: the new epoch is sealed to no device I has revoked, nor through one.
+            await rotateIfExposed({ ...o, channel, operation, resource: X, identityChain: I });
     return {
         resource: X,
         status: manages ? "done" : "not-authorized",
         steps: Object.freeze(steps),
+        ...(unpropagated.length === 0 ? {} : { unpropagated: Object.freeze(unpropagated) }),
         keys,
         ...(rotation === undefined ? {} : { rotation }),
     };

package/dist/identity/revocation.d.ts

@@ -2,6 +2,7 @@ import { type PrincipalId, type ResourceId } from "@openlfcp/core";
 import { type DocumentWrite } from "./context.js";
 import { type FlowOptions } from "./devices.js";
 import { type IdentityChannel } from "./network.js";
+import { type LinearChain } from "./phases.js";
 import { type IdentityFlowOptions } from "./resource.js";
 import { type RotationOutcome } from "./rotation.js";
 /**
@@ -39,7 +40,14 @@ export interface RevocationResult {
     readonly resource: ResourceId;
     readonly revoke: "revoked" | "complete" | "superseded" | "not-authorized"
     /** The revoker's own chain passes through the device here: re-certify it here first (§8.1). */
-     | "self-dependent" | "refused" | "unreachable" | "unsupported" | "conflict";
+     | "self-dependent" | "refused"
+    /**
+     * §8.4, §7.1 step 1: a roster Resource where the device is not bound and
+     * can never act (a pairing device, or a service device whose scope does
+     * not list it): no revocation is proposed there, so that it does not take
+     * one of the root's 64 unbound pairs (W §17.5 rule 5).
+     */
+     | "not-relevant" | "unreachable" | "unsupported" | "conflict";
     readonly rotation?: RotationOutcome;
 }
 export type RevokeDeviceResult = {
@@ -102,5 +110,7 @@ export declare function rotateIfExposed(o: FlowOptions & {
     readonly channel: IdentityChannel;
     readonly operation: string;
     readonly resource: ResourceId;
+    /** The Identity Resource of this installation's root: see rotateAfter. */
+    readonly identityChain?: LinearChain;
 }): Promise<RotationOutcome>;
 //# sourceMappingURL=revocation.d.ts.map

package/dist/identity/revocation.js

@@ -1,13 +1,14 @@
 import { bytesEqual, fromBase64url, fromHex, principalId, resourceId, secureRandom, toHex, } from "@openlfcp/core";
-import { activeDevice, signControlRecord, validateControlChain, } from "@openlfcp/wire";
-import { fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, runControlPhase, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
+import { activeDevice, revocationOf, signControlRecord, validateControlChain, } from "@openlfcp/wire";
+import { fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, retiredFlagMissing, runControlPhase, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
 import { mayManageDevices } from "./devices.js";
 import { principalRefOf } from "./document.js";
 import { newOperationId, OperationJournal, phaseOf } from "./journal.js";
 import { ChannelPool, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
 import { classifyRevoke } from "./phases.js";
+import { revocationRelevant } from "./reconcile.js";
 import { identityTarget } from "./resource.js";
-import { exposingRevocationsSince, resumeRotations, rotateAfter, rotatorTest, } from "./rotation.js";
+import { checkFlowProfiles, exposingRevocationsSince, resumeRotations, rotateAfter, rotatorTest, } from "./rotation.js";
 const toKeep = (state, root) => [...state.devices.entries()]
     .filter(([, d]) => bytesEqual(d.root, root))
     .map(([hex]) => principalId(fromHex(hex)))
@@ -131,6 +132,7 @@ class SelfDependent extends Error {
  * another reason is `complete` and the rotation test still runs.
  */
 export async function revokeDevice(o) {
+    checkFlowProfiles(o);
     const target = await identityTarget(o);
     const me = o.installation.signer.descriptor.principalId;
     const selfRetire = bytesEqual(me, o.device);
@@ -138,9 +140,6 @@ export async function revokeDevice(o) {
     const pool = new ChannelPool(o.network);
     const operation = o.operation ?? newOperationId("revoke-device", secureRandom(8));
     try {
-        // Rotations an earlier operation committed but did not adopt are finished first (§9.1).
-        if (!selfRetire)
-            await resumeRotations({ ...o, pool });
         const channel = await pool.get(o.installation.signer, target.url);
         const known = await journal.get(operation);
         let I;
@@ -153,6 +152,10 @@ export async function revokeDevice(o) {
                 throw e;
             return retireElsewhere(o, pool, journal, known);
         }
+        // Rotations an earlier operation committed but did not adopt are finished first (§9.1),
+        // sealing nothing to a device I has revoked (§7.1 step 1).
+        if (!selfRetire)
+            await resumeRotations({ ...o, pool, identityChain: I });
         const R = genesisOwner(I);
         if (!selfRetire && !mayManageDevices(I.state, me, R))
             return { kind: "not-authorized" };
@@ -171,6 +174,9 @@ export async function revokeDevice(o) {
                     device: toHex(o.device),
                     root: toHex(R),
                     reason: String(o.reason),
+                    // §8.4: the device's binding in I decides where its revocation is relevant,
+                    // also for a resumed self-retirement that can no longer read I.
+                    ...bindingIntent(I.state.devices.get(toHex(o.device))),
                     targets: (await rosterTargets(o, channel, I)).map((t) => ({
                         resource: toHex(t.resource),
                         url: t.url,
@@ -178,8 +184,13 @@ export async function revokeDevice(o) {
                 },
             });
         const roster = targetsOf(await journal.load(operation));
+        const binding = I.state.devices.get(toHex(o.device));
         const results = [];
-        const one = async (c, X) => {
+        // I as this operation leaves it: a rotation seals nothing to a device it has revoked.
+        let identityChain = I;
+        const one = async (c, X, inRoster = true) => {
+            if (inRoster && !(await relevantIn(o, c, X, R, binding)))
+                return { resource: X, revoke: "not-relevant" };
             let outcome;
             try {
                 outcome = await runControlPhase(o.storage, c, journal, operation, {
@@ -208,12 +219,20 @@ export async function revokeDevice(o) {
                 return { resource: X, revoke: "superseded" };
             if (outcome.state === "refused")
                 return { resource: X, revoke: "refused" };
+            if (!inRoster)
+                identityChain = outcome.chain;
             const revoke = outcome.state === "committed-own" ? "revoked" : "complete";
             if (selfRetire && o.reason === 0n)
                 return { resource: X, revoke };
             let rotation;
             try {
-                rotation = await rotateIfExposed({ ...o, channel: c, operation, resource: X });
+                rotation = await rotateIfExposed({
+                    ...o,
+                    channel: c,
+                    operation,
+                    resource: X,
+                    identityChain,
+                });
             }
             catch (e) {
                 // The revocation stands; the rotation resumes from the journal (§9.1).
@@ -223,7 +242,7 @@ export async function revokeDevice(o) {
             }
             return { resource: X, revoke, rotation };
         };
-        const first = await one(channel, target.resource);
+        const first = await one(channel, target.resource, false);
         results.push(first);
         if (first.revoke === "superseded") {
             await journal.setStatus(operation, "superseded");
@@ -271,6 +290,35 @@ export async function revokeDevice(o) {
         pool.closeAll();
     }
 }
+/** The device's kind and scope in I, journaled with a revocation (§8.4). */
+const bindingIntent = (b) => b === undefined ? {} : { binding: { kind: b.kind, scope: b.scope.map(toHex) } };
+/**
+ * The journaled binding; `null` when the operation predates it (0.4.0),
+ * which revokes in every roster Resource as before.
+ */
+function bindingOf(op) {
+    if (!Object.hasOwn(op.intent, "targets"))
+        return null;
+    const b = op.intent.binding;
+    if (b === undefined)
+        return Object.hasOwn(op.intent, "binding") ? undefined : null;
+    return {
+        kind: b.kind,
+        scope: b.scope.map((h) => resourceId(fromHex(h))),
+    };
+}
+/**
+ * §8.4: whether the revocation of the device is proposed on the roster
+ * Resource `X`: when it is already revoked there (the phase classifies it
+ * as complete), or when it is relevant there by §7.1 step 1.
+ */
+async function relevantIn(o, c, X, R, binding) {
+    if (binding === null)
+        return true;
+    const x = await syncChain(o.storage, c, X);
+    return (revocationOf(x.state, R, o.device) !== undefined ||
+        revocationRelevant(binding, x.state, o.device));
+}
 const targetsOf = (op) => (op.intent.targets ?? []).map((t) => ({
     resource: resourceId(fromHex(t.resource)),
     url: t.url,
@@ -281,9 +329,14 @@ async function retireElsewhere(o, pool, journal, op) {
     const results = [
         { resource: resourceId(fromHex(op.intent.identity)), revoke: "complete" },
     ];
+    const binding = bindingOf(op);
     for (const t of targetsOf(op)) {
         try {
             const c = await pool.get(o.installation.signer, t.url);
+            if (!(await relevantIn(o, c, t.resource, R, binding))) {
+                results.push({ resource: t.resource, revoke: "not-relevant" });
+                continue;
+            }
             const outcome = await runControlPhase(o.storage, c, journal, op.id, {
                 id: `revoke:${toHex(t.resource)}`,
                 kind: "revoke",
@@ -353,10 +406,11 @@ async function markRevoked(o, channel, journal, operation, I, device) {
             build: async () => {
                 const now = await current();
                 gone = now.entry === undefined;
-                if (now.entry === undefined || now.entry.revoked === true)
+                const retirement = now.doc.retirement;
+                const values = retirement === undefined ? undefined : (k) => retirement.revokedValues(k);
+                if (!retiredFlagMissing(now.doc.devices(), key, values))
                     return null;
-                // The device's missing_keys hint is written only by the device (§3 AI5).
-                const { missing_keys: _hint, ...display } = now.entry;
+                // The flag alone (§8.2); the device's missing_keys hint is its own (§3 AI5).
                 return sealIdentityUnit({
                     storage: o.storage,
                     chain: now.chain,
@@ -364,7 +418,8 @@ async function markRevoked(o, channel, journal, operation, I, device) {
                     signer: o.installation.signer,
                     doc: now.doc,
                     latest: now.load.latest,
-                    intents: [{ intent: "device.put", key, entry: { ...display, revoked: true } }],
+                    intents: [],
+                    retire: [key],
                 });
             },
         });
@@ -387,6 +442,7 @@ async function markRevoked(o, channel, journal, operation, I, device) {
  * nothing exposing happened since the last rotation.
  */
 export async function rotateIfExposed(o) {
+    checkFlowProfiles(o);
     // A rotation this operation already started resumes from its journaled phase: its
     // KEY_EPOCH may be committed while its DEK still waits in the pending slot (§9.1).
     const started = phaseOf(await new OperationJournal(o.storage).load(o.operation), `rotate:${toHex(o.resource)}`);

package/dist/identity/rotation.d.ts

@@ -1,8 +1,8 @@
 import { type ControlRecordId, type DataEpoch, type PrincipalId, type ResourceId } from "@openlfcp/core";
 import { type ResourceDEK } from "@openlfcp/crypto";
-import { type ControlState, type DataProfileCodec, type HaveVector, type PrincipalDescriptor } from "@openlfcp/wire";
+import { type ControlState, type HaveVector, type PrincipalDescriptor } from "@openlfcp/wire";
 import { type KeyDelivery } from "./context.js";
-import type { FlowOptions } from "./devices.js";
+import type { FlowOptions, UnitProfile } from "./devices.js";
 import { type ChannelPool, type IdentityChannel } from "./network.js";
 import { type LinearChain } from "./phases.js";
 /**
@@ -73,12 +73,15 @@ export interface FrontierData {
     /** The DEKs held for the Resource's epochs, by epoch number. */
     readonly deks: ReadonlyMap<string, ResourceDEK>;
     /**
-     * The Resource's Data Profile codec, when the application gives it: its
-     * `decode` is the profile's acceptance. Without it only decryption is
+     * The Resource's Data Profile, when the application gives it, as its
+     * receiver checks one unit: `codecFor({resourceId, actor})` is bound to the
+     * unit's Resource and signer, and the codec's `decode` is the profile's
+     * acceptance (the change's actor included). Without it only decryption is
      * checked here, and a profile refusal this installation recorded still
-     * counts (LocalAccepted.refused).
+     * counts (LocalAccepted.refused). 0.3.1 took a bare codec, which cannot
+     * bind the actor: one without `codecFor` is refused (TypeError).
      */
-    readonly profile?: DataProfileCodec<unknown>;
+    readonly profile?: UnitProfile;
 }
 export type RotationStatus = 
 /** This installation committed the KEY_EPOCH and sealed the new DEK to every reader. */
@@ -109,14 +112,22 @@ export interface RotationOutcome {
  * reuse it (§9.4). After the ACK the DEK goes to every reader of the new
  * head, each package recorded in the ledger; the revoked device, a
  * consumed or cancelled pairing device and suspended devices are not
- * readers and receive nothing.
+ * readers and receive nothing. With `identityChain`, neither does a reader that
+ * the rotator's Identity Resource has revoked, or whose chain in the
+ * Resource passes through such a device: a pair not yet propagated there
+ * (IDENTITY-PROFILE-01 §7.1 step 1) is treated as revoked, and the rotation
+ * closes the epoch for it as for the device just revoked.
  */
 export declare function rotateAfter(o: FlowOptions & {
     readonly channel: IdentityChannel;
     readonly operation: string;
     readonly resource: ResourceId;
     readonly revokedAt: bigint;
+    /** The Identity Resource of the rotator's root (§7.1 step 1), when the flow knows it. */
+    readonly identityChain?: LinearChain;
 }): Promise<RotationOutcome>;
+/** The flow options of a rotation: 0.3.1's bare `dataProfiles` is refused, never checked less. */
+export declare function checkFlowProfiles(o: FlowOptions): void;
 /**
  * Resumes every rotation a journaled operation started and did not adopt:
  * a KEY_EPOCH whose ACK was lost leaves its DEK in the operation's pending
@@ -125,6 +136,8 @@ export declare function rotateAfter(o: FlowOptions & {
  */
 export declare function resumeRotations(o: FlowOptions & {
     readonly pool: ChannelPool;
+    /** The Identity Resource of this installation's root: see rotateAfter. */
+    readonly identityChain?: LinearChain;
 }): Promise<readonly RotationOutcome[]>;
 /** The control sequence of a record ID (hex) on a chain. */
 export declare const seqOf: (chain: LinearChain, recordIdHex: string) => bigint | undefined;