@openlfcp/client 0.4.0 → 0.5.0

package/dist/identity/context.d.ts

@@ -4,7 +4,7 @@ import { type LfcpStorage, type SecretStore } from "@openlfcp/storage";
 import { type DataUnitPayload, type Parsed, type PrincipalDescriptor, type Signer } from "@openlfcp/wire";
 import { type IdentityDocumentPort, type IdentityIntent } from "./document.js";
 import { type JournalPhase, type OperationJournal, type PackageLedger } from "./journal.js";
-import type { IdentityChannel } from "./network.js";
+import { type IdentityChannel } from "./network.js";
 import type { LinearChain, PhaseState } from "./phases.js";
 /** The storage the identity flows use. */
 export type IdentityStorage = Pick<LfcpStorage, "control" | "commit" | "localMarks" | "actorSequences">;
@@ -61,6 +61,13 @@ export interface PhaseOutcome {
  * with the same ACK, W §47), a record rebuilt on a new head otherwise.
  */
 export declare function runControlPhase(storage: IdentityStorage, channel: IdentityChannel, journal: OperationJournal, operation: string, spec: ControlPhaseSpec): Promise<PhaseOutcome>;
+/**
+ * The client-local refusal code of a device record or same-root Key Package
+ * this client does not send to a server whose READY lacks `identity-01`
+ * (LFCP-WIRE-01 §37): the Resource is hosted on a server without identity
+ * support (IDENTITY-PROFILE-01 §6). No wire code.
+ */
+export declare const IDENTITY_UNSUPPORTED = "IDENTITY_UNSUPPORTED";
 /** The DEKs this client holds for `chain`'s epochs, each checked against its commitment. */
 export declare function heldDeks(secrets: SecretStore, chain: LinearChain): Promise<Map<string, ResourceDEK>>;
 /** Stores the DEK of `epoch` (secret first) and links the epoch rows to it (LFCP-034). */
@@ -72,6 +79,16 @@ export declare function storeDek(storage: IdentityStorage, secrets: SecretStore,
 export declare function fetchDeks(storage: IdentityStorage, secrets: SecretStore, channel: IdentityChannel, chain: LinearChain, recipient: Installation): Promise<Map<string, ResourceDEK>>;
 /** Every Principal with `holds(P, 1)` at the head (W §19, §25.2): the reader set, by ID. */
 export declare function readersAt(state: LinearChain["state"]): readonly PrincipalDescriptor[];
+/**
+ * IDENTITY-PROFILE-01 §7.1 step 1: whether `principal`, a reader of the
+ * target state, is a device that the Identity Resource `identity` has
+ * revoked, or whose current chain in the target passes through such a
+ * device. Until the pair is propagated the target still counts the device
+ * as active (an unpropagated pair), but the installations of `identity`'s
+ * root treat it as revoked there and seal nothing to it, in a rotation as
+ * in step 3.
+ */
+export declare function revokedByIdentity(identity: LinearChain, target: LinearChain["state"], principal: PrincipalId): boolean;
 export interface KeyDelivery {
     /** Packages sealed and acknowledged now, as (epoch, recipient hex). */
     readonly sent: readonly {
@@ -136,6 +153,14 @@ export interface IdentityDocumentLoad {
 }
 /** The Genesis owner of a chain: the root of an Identity Resource (§2.3). */
 export declare function genesisOwner(chain: LinearChain): PrincipalId;
+/**
+ * Whether the retired entry `devices[key]` needs its flag (§7.1 step 4):
+ * some value of its `revoked` is not `true`, or the field is absent. A port
+ * without `retirement` shows one value. False when there is no valid entry.
+ */
+export declare function retiredFlagMissing(entries: ReadonlyMap<string, {
+    readonly revoked?: boolean;
+}>, key: string, revokedValues?: (key: string) => readonly unknown[]): boolean;
 /**
  * A new unit of `signer` in the Identity Resource carrying `intents` as
  * one change: the next actor sequence from the storage's reservation
@@ -150,6 +175,13 @@ export declare function sealIdentityUnit(options: {
     readonly doc: IdentityDocumentPort;
     readonly latest: IdentityDocumentLoad["latest"];
     readonly intents: readonly IdentityIntent[];
+    /**
+     * Retired entries whose `revoked` flag the change sets (§7.1 step 4,
+     * §8.2): field by field when the port has `retirement`, else with
+     * `device.put` of the entry's display fields (its `missing_keys` hint is
+     * the device's own, §3 AI5).
+     */
+    readonly retire?: readonly string[];
     /** The sequence to use instead of a reservation (a pairing device shared by installations, §5.3). */
     readonly seq?: bigint;
 }): Promise<Uint8Array>;

package/dist/identity/context.js

@@ -1,11 +1,11 @@
 import { actorSequence, bytesEqual, controlRecordId, dataEpoch, fromHex, hash32, LfcpError, toHex, } from "@openlfcp/core";
 import { dekCommitment, exportSecretKeyBytes, importResourceDEK, sha256, } from "@openlfcp/crypto";
 import { dekSecretRef } from "@openlfcp/storage";
-import { ABILITY, hasAbility, InMemorySeenUnits, parseDataUnit, parseKeyPackage, receiveDataUnit, receiveKeyPackage, sealDataUnit, sealKeyPackage, validateControlChain, verifyKeyPackage, verifySignedObject, } from "@openlfcp/wire";
+import { ABILITY, decodeControlRecord, hasAbility, InMemorySeenUnits, parseDataUnit, parseKeyPackage, receiveDataUnit, receiveKeyPackage, revocationOf, sealDataUnit, sealKeyPackage, validateControlChain, verifyKeyPackage, verifySignedObject, } from "@openlfcp/wire";
 import { adoptStoredDeks, checkWriteBarrier, loadControlChain, saveControlChain, saveControlConflict, } from "../storage.js";
 import { identityPlaintextCodec, identityWriterClass, } from "./document.js";
 import { phaseOf, } from "./journal.js";
-import { IdentityUnavailable } from "./network.js";
+import { IDENTITY_EXTENSION, IdentityUnavailable } from "./network.js";
 /** The Resource or the Identity Resource is forked (§9.7): approval, reconciliation and rotation are suspended. */
 export class IdentityConflict extends Error {
     resource;
@@ -104,11 +104,22 @@ export async function runControlPhase(storage, channel, journal, operation, spec
         if (attempt >= MAX_HEAD_RETRIES)
             throw new IdentityUnavailable(`the head kept moving while proposing ${spec.id}`);
         const head = toHex(chain.state.head);
-        let bytes;
-        if (spec.resend !== false && before?.bytes !== undefined && before.expectedHead === head)
-            bytes = fromHex(before.bytes);
-        else {
-            bytes = await spec.build(chain);
+        const journaled = spec.resend !== false && before?.bytes !== undefined && before.expectedHead === head;
+        const bytes = journaled ? fromHex(before.bytes) : await spec.build(chain);
+        if (!channel.extensions.includes(IDENTITY_EXTENSION) && isDeviceRecord(bytes)) {
+            // W §37: no record of type 9 or 10 to a server whose READY lacks identity-01,
+            // journaled bytes included (a resumed operation checks the current READY).
+            await journal.putPhase(operation, {
+                ...(before ?? {}),
+                id: spec.id,
+                kind: spec.kind,
+                resource: toHex(R),
+                state: "refused",
+                code: IDENTITY_UNSUPPORTED,
+            });
+            return Object.freeze({ state: "refused", chain, code: IDENTITY_UNSUPPORTED });
+        }
+        if (!journaled) {
             const id = toHex(validateRecordId(bytes));
             await journal.putPhase(operation, {
                 id: spec.id,
@@ -136,6 +147,18 @@ export async function runControlPhase(storage, channel, journal, operation, spec
         return Object.freeze({ state: "refused", chain, code: answer.code });
     }
 }
+/**
+ * The client-local refusal code of a device record or same-root Key Package
+ * this client does not send to a server whose READY lacks `identity-01`
+ * (LFCP-WIRE-01 §37): the Resource is hosted on a server without identity
+ * support (IDENTITY-PROFILE-01 §6). No wire code.
+ */
+export const IDENTITY_UNSUPPORTED = "IDENTITY_UNSUPPORTED";
+/** A DEVICE_GRANT (type 9) or DEVICE_REVOKE (type 10). */
+function isDeviceRecord(bytes) {
+    const type = decodeControlRecord(bytes).body.type;
+    return type === "DEVICE_GRANT" || type === "DEVICE_REVOKE";
+}
 /** A Control Record's ID: SHA-256 of its exact bytes (W §13). */
 const validateRecordId = (bytes) => controlRecordId(sha256(bytes));
 function ownRecordOn(chain, sent) {
@@ -219,6 +242,23 @@ export function readersAt(state) {
         .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
         .map(([, d]) => d));
 }
+/**
+ * IDENTITY-PROFILE-01 §7.1 step 1: whether `principal`, a reader of the
+ * target state, is a device that the Identity Resource `identity` has
+ * revoked, or whose current chain in the target passes through such a
+ * device. Until the pair is propagated the target still counts the device
+ * as active (an unpropagated pair), but the installations of `identity`'s
+ * root treat it as revoked there and seal nothing to it, in a rotation as
+ * in step 3.
+ */
+export function revokedByIdentity(identity, target, principal) {
+    const R = genesisOwner(identity);
+    const revoked = (d) => revocationOf(identity.state, R, d) !== undefined;
+    if (revoked(principal))
+        return true;
+    const binding = target.devices.get(toHex(principal));
+    return binding !== undefined && bytesEqual(binding.root, R) && binding.issuers.some(revoked);
+}
 /**
  * Seals every DEK of `deks` to each recipient at the chain's head and
  * records each acknowledged package (§9.5). A package the ledger records is
@@ -233,6 +273,21 @@ export async function deliverKeys(options) {
     const skipped = [];
     let complete = 0;
     const epochs = [...options.deks.keys()].sort((a, b) => (BigInt(a) < BigInt(b) ? -1 : 1));
+    // W §37: without identity-01 the server applies no same-root rule (W §25.2); a sender
+    // without key/distribute is authorized only by it, and sends nothing there.
+    const identity = options.channel.extensions.includes(IDENTITY_EXTENSION);
+    const sameRootOnly = !identity && !hasAbility(chain.state, sender.descriptor.principalId, ABILITY.KEY_DISTRIBUTE);
+    // The same for a pending package, at its own referenced head: a later key/distribute does
+    // not authorize it there (W §25.2), so it is re-sealed at the current head instead.
+    const resendable = (bytes) => {
+        const parsed = parseKeyPackage(bytes);
+        if (verifyKeyPackage(chain, parsed).kind !== "authorized")
+            return false;
+        if (identity)
+            return true;
+        const atHead = chain.stateAt(parsed.payload.controlHead);
+        return (atHead !== undefined && hasAbility(atHead, parsed.payload.sender, ABILITY.KEY_DISTRIBUTE));
+    };
     for (const recipient of options.recipients) {
         const rid = recipient.principalId;
         const hex = toHex(rid);
@@ -242,6 +297,10 @@ export async function deliverKeys(options) {
             skipped.push({ recipient: hex, reason: "not a reader at the head" });
             continue;
         }
+        if (sameRootOnly) {
+            skipped.push({ recipient: hex, reason: IDENTITY_UNSUPPORTED });
+            continue;
+        }
         for (const e of epochs) {
             const epoch = dataEpoch(BigInt(e));
             if ((await ledger.has(R, epoch, rid)) && !(options.resend?.get(hex)?.has(e) ?? false)) {
@@ -250,8 +309,7 @@ export async function deliverKeys(options) {
             }
             // §9.1: a package sent before is sent again as the same bytes, while it is still authorized.
             let bytes = await ledger.pending(R, epoch, rid);
-            if (bytes !== undefined &&
-                verifyKeyPackage(chain, parseKeyPackage(bytes)).kind !== "authorized")
+            if (bytes !== undefined && !resendable(bytes))
                 bytes = undefined;
             if (bytes === undefined) {
                 const sealed = await sealKeyPackage({
@@ -368,6 +426,28 @@ export function genesisOwner(chain) {
     const g = chain.records[0];
     return g?.body.type === "GENESIS" ? g.body.owner.principalId : chain.state.owner.principalId;
 }
+/** 0.4's flag write on a port without `retirement`: the entry's display fields and the flag. */
+function retiredPut(doc, key) {
+    const entry = doc.devices().get(key);
+    if (entry === undefined)
+        return [];
+    const { missing_keys: _hint, ...display } = entry;
+    return [{ intent: "device.put", key, entry: { ...display, revoked: true } }];
+}
+/**
+ * Whether the retired entry `devices[key]` needs its flag (§7.1 step 4):
+ * some value of its `revoked` is not `true`, or the field is absent. A port
+ * without `retirement` shows one value. False when there is no valid entry.
+ */
+export function retiredFlagMissing(entries, key, revokedValues) {
+    const entry = entries.get(key);
+    if (entry === undefined)
+        return false;
+    if (revokedValues === undefined)
+        return entry.revoked !== true;
+    const values = revokedValues(key);
+    return values.length === 0 || values.some((v) => v !== true);
+}
 /**
  * A new unit of `signer` in the Identity Resource carrying `intents` as
  * one change: the next actor sequence from the storage's reservation
@@ -390,11 +470,18 @@ export async function sealIdentityUnit(options) {
         while (previous !== undefined && seq <= previous.seq)
             seq = await options.storage.actorSequences.reserveNext(R, me);
     }
-    const plaintext = options.doc.write({
+    const author = {
         signer: me,
         actorSeq: seq,
         writerClass: identityWriterClass(chain.state, genesisOwner(chain), me),
-    }, options.intents);
+    };
+    const retire = options.retire ?? [];
+    const { doc } = options;
+    const plaintext = retire.length === 0
+        ? doc.write(author, options.intents)
+        : doc.retirement !== undefined
+            ? doc.retirement.write(author, options.intents, retire)
+            : doc.write(author, [...options.intents, ...retire.flatMap((key) => retiredPut(doc, key))]);
     return sealDataUnit({
         resourceId: R,
         dataEpoch: epoch,

package/dist/identity/document.d.ts

@@ -95,6 +95,29 @@ export interface IdentityDocumentPort {
         readonly hash: string;
         readonly signer: PrincipalId;
     }[];
+    /**
+     * Optional (0.5.0): a device entry's `revoked` flag field by field, for
+     * a retired entry (§7.1 step 4, §8.2). With it, reconciliation sees every
+     * concurrent value of the flag and sets it without writing the entry's
+     * other fields, so it never resolves a conflict on them (a concurrent
+     * rename). A port without it shows one value per field (`devices()`), and
+     * the flag is written with `device.put` of the entry's display fields, as
+     * in 0.4. IdentityReplica provides both (`fieldValues`, `write`'s
+     * `retire` option).
+     */
+    readonly retirement?: IdentityRetirementPort;
+}
+/** IdentityDocumentPort.retirement. */
+export interface IdentityRetirementPort {
+    /** Every value `devices[key].revoked` holds now: several under concurrent writes, none when absent. */
+    revokedValues(key: string): readonly unknown[];
+    /**
+     * Like IdentityDocumentPort.write, the plaintext of one change by
+     * `author`: `intents` in order (possibly none), then `revoked = true` in
+     * each existing entry `devices[key]` of `retire`, no other field of those
+     * entries written.
+     */
+    write(author: IdentityAuthor, intents: readonly IdentityIntent[], retire: readonly string[]): Uint8Array;
 }
 /** A passthrough Data Unit codec: the port produces and consumes the plaintext. */
 export declare const identityPlaintextCodec: DataProfileCodec<Uint8Array>;

package/dist/identity/index.d.ts

@@ -2,14 +2,14 @@
 export { acceptInvitationAsDevice, claimForRootRecord, createResourceAsDevice, type DeviceAcceptResult, type DeviceCreateResult, type DeviceResourceResult, type IncompleteDeviceResource, selfRegistrationRecord, } from "./accept.js";
 export { type DocumentWrite, deliverKeys, extendChain, fetchDeks, genesisOwner, heldDeks, IdentityConflict, type IdentityDocumentLoad, type IdentityStorage, type Installation, type KeyDelivery, loadIdentityDocument, type PhaseOutcome, readersAt, runControlPhase, runUnitPhase, sealIdentityUnit, storeDek, syncChain, } from "./context.js";
 export { checkIssuance, type Feasibility, type FlowOptions, issuerCertificates, leafPayload, MASK_PRESETS, type MaskPreset, mayManageDevices, type RegisterTarget, type RegistrationResult, type RegistrationStatus, registerDevice, signChain, type UnitProfile, } from "./devices.js";
-export { type DeviceEntryValue, IDENTITY_PROFILE, type IdentityAuthor, type IdentityDocumentPort, type IdentityIntent, type IdentityWriterClass, identityPlaintextCodec, identityWriterClass, type PairingRequestValue, principalOfRef, principalRefOf, type RosterEntryValue, resourceRef, } from "./document.js";
+export { type DeviceEntryValue, IDENTITY_PROFILE, type IdentityAuthor, type IdentityDocumentPort, type IdentityIntent, type IdentityRetirementPort, type IdentityWriterClass, identityPlaintextCodec, identityWriterClass, type PairingRequestValue, principalOfRef, principalRefOf, type RosterEntryValue, resourceRef, } from "./document.js";
 export { type JournalOperation, type JournalPhase, type LedgerEntry, OperationJournal, type OperationKind, type OperationStatus, PackageLedger, pairingSecretRef, pendingDekRef, } from "./journal.js";
 export { ChannelPool, type ConnectionNetworkOptions, connectionNetwork, IDENTITY_EXTENSION, type IdentityAnswer, type IdentityChannel, type IdentityNetwork, IdentityRefused, IdentityUnavailable, type OpenAnswer, } from "./network.js";
 export { type ApprovalResult, approvedGrantRecord, approvePairing, type CancelResult, cancelPairing, cancelRecord, consumeRecord, createPairingSession, openPairingSessions, PairingLinkText, type PairingReview, type PairingSessionResult, pairingRequests, resumeApproval, resumePairingSession, } from "./pairing.js";
-export { type CandidateEvidence, type CandidateResult, type CandidateStatus, candidateEvidence, completePairing, type PairingOutcome, type RequestPairingOptions, type RequestPairingResult, requestPairing, } from "./pairing-request.js";
+export { type CandidateEvidence, type CandidateResult, type CandidateStatus, candidateEvidence, completePairing, type PairingOutcome, pairingLinkRejection, type RequestPairingOptions, type RequestPairingResult, requestPairing, } from "./pairing-request.js";
 export { certificateInScope, classifyCancel, classifyConsume, classifyPackage, classifyRegister, classifyRevoke, classifyRotate, keyEpochAfter, type LinearChain, type PhaseState, type RegisterPhase, recordSeq, } from "./phases.js";
 export { type RevocationStatus, revocationStatus } from "./proof.js";
-export { planReconciliation, type ReconcileStep, reconcileDevices, reconcileRecord, type TargetReconciliation, } from "./reconcile.js";
+export { type DisplayPlan, keyRecipients, planDisplayData, planReconciliation, planRevocations, type ReconcileStep, reconcileDevices, reconcileRecord, revocationRelevant, type TargetReconciliation, } from "./reconcile.js";
 export { type CreatedIdentityResource, type CreateIdentityResourceOptions, createIdentityResource, type IdentityDocumentFactory, type IdentityFlowOptions, identityTarget, localIdentityResource, resumeIdentityCreation, setLocalIdentityResource, } from "./resource.js";
 export { previewRevocation, type ResourcePreview, type RevocationPreview, type RevocationResult, type RevokeDeviceResult, revokeDevice, rotateIfExposed, } from "./revocation.js";
 export { type AddToRosterOptions, type AddToRosterResult, addToRoster, type RosterWrite, writeRosterEntry, } from "./roster.js";

package/dist/identity/index.js

@@ -6,10 +6,10 @@ export { IDENTITY_PROFILE, identityPlaintextCodec, identityWriterClass, principa
 export { OperationJournal, PackageLedger, pairingSecretRef, pendingDekRef, } from "./journal.js";
 export { ChannelPool, connectionNetwork, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
 export { approvedGrantRecord, approvePairing, cancelPairing, cancelRecord, consumeRecord, createPairingSession, openPairingSessions, PairingLinkText, pairingRequests, resumeApproval, resumePairingSession, } from "./pairing.js";
-export { candidateEvidence, completePairing, requestPairing, } from "./pairing-request.js";
+export { candidateEvidence, completePairing, pairingLinkRejection, requestPairing, } from "./pairing-request.js";
 export { certificateInScope, classifyCancel, classifyConsume, classifyPackage, classifyRegister, classifyRevoke, classifyRotate, keyEpochAfter, recordSeq, } from "./phases.js";
 export { revocationStatus } from "./proof.js";
-export { planReconciliation, reconcileDevices, reconcileRecord, } from "./reconcile.js";
+export { keyRecipients, planDisplayData, planReconciliation, planRevocations, reconcileDevices, reconcileRecord, revocationRelevant, } from "./reconcile.js";
 export { createIdentityResource, identityTarget, localIdentityResource, resumeIdentityCreation, setLocalIdentityResource, } from "./resource.js";
 export { previewRevocation, revokeDevice, rotateIfExposed, } from "./revocation.js";
 export { addToRoster, writeRosterEntry, } from "./roster.js";

package/dist/identity/pairing-request.d.ts

@@ -81,6 +81,18 @@ export type RequestPairingResult = {
     readonly operation?: string;
     readonly reason: string;
 };
+/**
+ * §5.2, the checks after the link parses and its secret is its device's
+ * (`parsePairingUri`, `pairingDeviceSigner`), on what opening `I` as `J`
+ * gave: the session as `J` is refused (W §41), `I`'s Genesis profile is not
+ * `org.openlfcp.identity.v1`, or `J` is not a registered, active kind-2
+ * device of `I`'s owner in `I`'s chain. Returns why the link is rejected
+ * (a client-local outcome, the corpora's PAIRING_LINK_REJECTED), or
+ * undefined when it passes; a rejected link is not used any further.
+ */
+export declare function pairingLinkRejection(J: PrincipalId, opened: LinearChain | {
+    readonly refused: string;
+}): string | undefined;
 /** §5.3 steps 2–3. */
 export declare function requestPairing(o: RequestPairingOptions): Promise<RequestPairingResult>;
 /** §6: the status of one Resource for the new device, from its own observations only. */

package/dist/identity/pairing-request.js

@@ -5,6 +5,32 @@ import { IDENTITY_PROFILE, principalRefOf, resourceRef, } from "./document.js";
 import { newOperationId, OperationJournal, pairingSecretRef, phaseOf } from "./journal.js";
 import { ChannelPool, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
 import { setLocalIdentityResource } from "./resource.js";
+/**
+ * §5.2, the checks after the link parses and its secret is its device's
+ * (`parsePairingUri`, `pairingDeviceSigner`), on what opening `I` as `J`
+ * gave: the session as `J` is refused (W §41), `I`'s Genesis profile is not
+ * `org.openlfcp.identity.v1`, or `J` is not a registered, active kind-2
+ * device of `I`'s owner in `I`'s chain. Returns why the link is rejected
+ * (a client-local outcome, the corpora's PAIRING_LINK_REJECTED), or
+ * undefined when it passes; a rejected link is not used any further.
+ */
+export function pairingLinkRejection(J, opened) {
+    if ("refused" in opened)
+        return `the session as the link's device is refused (${opened.refused})`;
+    const state = opened.state;
+    if (state.dataProfile !== IDENTITY_PROFILE)
+        return `the Resource is not an Identity Resource (its Genesis profile is ${state.dataProfile})`;
+    const R = genesisOwner(opened);
+    const binding = state.devices.get(toHex(J));
+    const j = activeDevice(state, J);
+    if (binding === undefined ||
+        !binding.registered ||
+        j === undefined ||
+        j.kind !== DEVICE_KIND.PAIRING ||
+        !bytesEqual(j.root, R))
+        return "the link's device is not a registered, active pairing device of the owner";
+    return undefined;
+}
 /** §5.3 steps 2–3. */
 export async function requestPairing(o) {
     let link;
@@ -39,16 +65,21 @@ export async function requestPairing(o) {
             };
         }
         const channel = await pool.get(J, url);
-        const chain = await syncChain(o.storage, channel, I);
+        let chain;
+        try {
+            chain = await syncChain(o.storage, channel, I);
+        }
+        catch (e) {
+            // §5.2 check 2: the coordinator refuses the session as J (W §41).
+            if (!(e instanceof IdentityRefused))
+                throw e;
+            const reason = pairingLinkRejection(J.descriptor.principalId, { refused: e.code });
+            return { kind: "not-a-session", reason: reason ?? e.message };
+        }
         const R = genesisOwner(chain);
-        if (chain.state.dataProfile !== IDENTITY_PROFILE)
-            return { kind: "not-a-session", reason: "the Resource is not an Identity Resource" };
-        const j = activeDevice(chain.state, J.descriptor.principalId);
-        if (j === undefined || j.kind !== DEVICE_KIND.PAIRING || !bytesEqual(j.root, R))
-            return {
-                kind: "not-a-session",
-                reason: "the link's device is not an active pairing device of the owner",
-            };
+        const rejected = pairingLinkRejection(J.descriptor.principalId, chain);
+        if (rejected !== undefined)
+            return { kind: "not-a-session", reason: rejected };
         const pairing = { signer: J, agreement: link.secret.agreementKey };
         const deks = await fetchDeks(o.storage, o.secrets, channel, chain, pairing);
         const doc = o.document(I, R);

package/dist/identity/pairing.d.ts

@@ -43,6 +43,17 @@ export type PairingSessionResult = {
  | {
     readonly kind: "not-authorized";
     readonly reason: string;
+}
+/**
+ * `I`'s coordinator does not list `identity-01` in READY: it is hosted on
+ * a server without identity support (IDENTITY-PROFILE-01 §6). Nothing is
+ * proposed or uploaded there: no DEVICE_GRANT, no same-root Key Package
+ * (LFCP-WIRE-01 §37).
+ */
+ | {
+    readonly kind: "unsupported";
+    readonly session?: string;
+    readonly reason: string;
 } | {
     readonly kind: "refused";
     readonly code: string;

package/dist/identity/pairing.js

@@ -5,7 +5,7 @@ import { deliverKeys, fetchDeks, genesisOwner, IdentityConflict, loadIdentityDoc
 import { checkIssuance, leafPayload, MASK_PRESETS, mayManageDevices, registerDevice, signChain, } from "./devices.js";
 import { identityPlaintextCodec, principalOfRef, principalRefOf, } from "./document.js";
 import { newOperationId, OperationJournal, PackageLedger, pairingSecretRef, phaseOf, } from "./journal.js";
-import { ChannelPool, IdentityUnavailable } from "./network.js";
+import { ChannelPool, IDENTITY_EXTENSION, IdentityUnavailable, } from "./network.js";
 import { classifyCancel, classifyConsume, classifyRegister } from "./phases.js";
 import { identityTarget } from "./resource.js";
 import { rotateIfExposed } from "./revocation.js";
@@ -40,6 +40,8 @@ export class PairingLinkText {
         return "[redacted]";
     }
 }
+/** W §37: the reason of an `unsupported` result. */
+const NO_IDENTITY_SUPPORT = "the Identity Resource is hosted on a server without identity support (its READY does not list identity-01)";
 const PAIRING_MASK = [1n, 2n];
 /** Wraps a flow body: transport failures and forks become results, the journal stays. */
 async function guarded(pool, body, unavailable, conflict) {
@@ -70,6 +72,8 @@ export async function createPairingSession(o) {
     const me = o.installation.signer;
     return guarded(pool, async () => {
         const channel = await pool.get(me, target.url);
+        if (!channel.extensions.includes(IDENTITY_EXTENSION))
+            return { kind: "unsupported", reason: NO_IDENTITY_SUPPORT };
         const chain = await syncChain(o.storage, channel, target.resource);
         const R = genesisOwner(chain);
         if (!mayManageDevices(chain.state, me.descriptor.principalId, R))
@@ -143,7 +147,14 @@ async function missingMaterial(o, channel, chain) {
             dek: (epoch) => deks.get(String(epoch)),
             profile: identityPlaintextCodec,
         });
-    if (opened?.kind !== "accepted")
+    // A unit held whose only failure is the missing DEK of a real epoch of I (every other
+    // check passed, and that DEK is listed above) is not missing itself. A unit naming an
+    // epoch I does not have, or failing any other check, is missing (§5.3 step 1).
+    const onlyDekMissing = opened?.kind === "local-failure" &&
+        opened.reason === "NO_DEK" &&
+        unit !== undefined &&
+        chain.state.epochs.has(String(parseDataUnit(unit).payload.dataEpoch));
+    if (opened?.kind !== "accepted" && !onlyDekMissing)
         missing.push("the root's Data Unit with actor sequence 1");
     return missing;
 }
@@ -156,6 +167,9 @@ async function finishSession(o, pool, session) {
     const chainJ = certificateChain(op.intent.certificates.map((c) => parseDeviceCertificate(fromHex(c))), R);
     const me = o.installation.signer;
     const channel = await pool.get(me, op.intent.url);
+    // A resumed session may meet a server that no longer lists identity-01 (W §37).
+    if (!channel.extensions.includes(IDENTITY_EXTENSION))
+        return { kind: "unsupported", session, reason: NO_IDENTITY_SUPPORT };
     const grant = await runControlPhase(o.storage, channel, journal, session, {
         id: "grant",
         kind: "register",

package/dist/identity/reconcile.d.ts

@@ -1,6 +1,7 @@
 import { type PrincipalId, type ResourceId } from "@openlfcp/core";
-import { type CertificateChain, type Signer } from "@openlfcp/wire";
+import { type CertificateChain, type ControlState, type DeviceBinding, type PrincipalDescriptor, type Signer } from "@openlfcp/wire";
 import { type DocumentWrite, type KeyDelivery } from "./context.js";
+import { type DeviceEntryValue, type IdentityIntent } from "./document.js";
 import { type LinearChain, type PhaseState } from "./phases.js";
 import { type IdentityFlowOptions } from "./resource.js";
 import { type RotationOutcome } from "./rotation.js";
@@ -26,11 +27,40 @@ export type ReconcileStep = {
     /** `I`'s chain for the device. */
     readonly chain: CertificateChain;
 };
+/**
+ * §7.1 step 1: whether the revocation of `device` in `I` is relevant in the
+ * target `X`. It is when the device is bound in `X` (as a leaf or an
+ * intermediate, W §17.4 rule 9), or when it could become registered in `X`
+ * or issue a chain there: bound in `I` with kind 0, or with kind 1 and `X`
+ * in its scope, or not bound in `I` at all (its kind is unknown). A pairing
+ * device, or a service device whose scope does not list `X`, that is not
+ * bound in `X` can never act there (W §7.3 c3, c6; N8): its revocation
+ * would protect nothing and would take one of the 64 unbound pairs of the
+ * root that W §17.5 rule 5 allows in `X` and never frees.
+ *
+ * `binding` is the device's binding in `I` (undefined when unbound there).
+ */
+export declare function revocationRelevant(binding: Pick<DeviceBinding, "kind" | "scope"> | undefined, target: ControlState, device: PrincipalId): boolean;
+/**
+ * §7.1 step 1 for one target: the revocations of `I` to propose on `X`
+ * (the pairs of `I`'s `revoked` not in `X`'s that are relevant there, those
+ * whose device is bound in `X` first, each group in `I`'s chain order), and
+ * the devices whose revocation is not relevant in `X` and is not
+ * propagated. Empty for the target `I` itself.
+ */
+export declare function planRevocations(identity: LinearChain, target: LinearChain): {
+    readonly propose: readonly Extract<ReconcileStep, {
+        kind: "revoke";
+    }>[];
+    readonly notRelevant: readonly PrincipalId[];
+};
 /**
  * §7.1 steps 1 and 2 for one target, in their normative order. For the
  * target `I` itself both steps are vacuous. Registrations are planned on
- * the target's state as the revocations leave it (a device whose issuer
- * `I` revoked is never registered before the cascade reaches the target).
+ * the target's state as the revocations leave it, and every pair of `I`'s
+ * `revoked` counts as revoked in `X` whether its propagation succeeds or
+ * not (an unpropagated pair, refused by W §17.5 rule 5, or a pair that is
+ * not relevant): no device whose issuer `I` has revoked is ever registered.
  */
 export declare function planReconciliation(identity: LinearChain, target: LinearChain): readonly ReconcileStep[];
 /** The record of a step on the target's head, signed by the reconciler. */
@@ -43,6 +73,17 @@ export interface TargetReconciliation {
         readonly step: ReconcileStep;
         readonly state: PhaseState | "refused";
     }[];
+    /**
+     * §7.1 step 1: devices whose revocation in `I` the target refused (the
+     * limit of W §17.5 rule 5, or the reconciler's authority there), to
+     * report to the human with the Resource. Each stays unpropagated: this
+     * run registered no device through it and sealed nothing to it. A later
+     * run proposes it again once the target's state changed since the
+     * refusal (its head moved, for one by the device's binding there); on the
+     * same state it reports the pair without sending anything. Empty when
+     * every relevant pair reached the target.
+     */
+    readonly unpropagated?: readonly PrincipalId[];
     readonly keys?: KeyDelivery;
     readonly rotation?: RotationOutcome;
 }
@@ -70,4 +111,33 @@ export declare function reconcileDevices(o: IdentityFlowOptions & {
      */
     readonly document: DocumentWrite;
 }>;
+/** §7.1 step 4's writes in `I`'s document: new entries, and the retired entries to flag. */
+export interface DisplayPlan {
+    readonly intents: readonly IdentityIntent[];
+    /** Retired entries (PrincipalRefs) whose `revoked` is set to `true`, and nothing else of them. */
+    readonly retire: readonly string[];
+}
+/**
+ * §7.1 step 4: the display data reconciliation writes in `I`'s document,
+ * from `I`'s Control state and the valid device entries (§4). For every
+ * device of `R` of kind 0 or 1 bound in `I` as the leaf of an accepted
+ * chain (an intermediate-only binding issues and does not act in `I`):
+ * when it is not revoked in `I` and has no valid entry, an entry labelled
+ * with its fingerprint (§5.2); when it is revoked in `I` and some value of
+ * its entry's `revoked` (a retired entry) is not `true`, or the field is
+ * absent, that flag alone. `revokedValues` gives every concurrent value
+ * of the flag (IdentityDocumentPort.retirement); without it the entry's
+ * one shown value is read. No entry is created for a revoked device,
+ * nothing is written for a pairing device, nothing is relabelled or
+ * deleted, and a second run on the same states plans nothing.
+ */
+export declare function planDisplayData(identity: ControlState, entries: ReadonlyMap<string, DeviceEntryValue>, root: PrincipalId, revokedValues?: (key: string) => readonly unknown[]): DisplayPlan;
+/**
+ * §7.1 step 3: the devices of `R` reconciliation seals the target's keys
+ * to: every reader of the target whose root is `R` (pairing devices of `I`
+ * included, in `I`), except a device revoked in `I` and a device whose
+ * current chain in the target passes through a device revoked in `I` (an
+ * unpropagated pair of step 1, which the target still counts as active).
+ */
+export declare function keyRecipients(identity: LinearChain, target: LinearChain): readonly PrincipalDescriptor[];
 //# sourceMappingURL=reconcile.d.ts.map

package/dist/identity/reconcile.js

@@ -1,8 +1,8 @@
 import { bytesEqual, fromBase64url, fromHex, principalId, resourceId, secureRandom, toHex, } from "@openlfcp/core";
-import { activeDevice, actsFor, DEVICE_KIND, deviceFingerprint, revocationOf, signControlRecord, } from "@openlfcp/wire";
-import { deliverKeys, fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, readersAt, runControlPhase, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
+import { activeDevice, actsFor, DEVICE_KIND, deviceFingerprint, isBound, revocationOf, signControlRecord, } from "@openlfcp/wire";
+import { deliverKeys, fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, readersAt, retiredFlagMissing, revokedByIdentity, runControlPhase, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
 import { mayManageDevices } from "./devices.js";
-import { principalRefOf, resourceRef } from "./document.js";
+import { principalRefOf, resourceRef, } from "./document.js";
 import { newOperationId, OperationJournal, PackageLedger } from "./journal.js";
 import { ChannelPool, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
 import { classifyRegister, classifyRevoke } from "./phases.js";
@@ -10,36 +10,83 @@ import { identityTarget } from "./resource.js";
 import { rotateIfExposed } from "./revocation.js";
 import { checkFlowProfiles, resumeRotations } from "./rotation.js";
 /**
- * §7.1 steps 1 and 2 for one target, in their normative order. For the
- * target `I` itself both steps are vacuous. Registrations are planned on
- * the target's state as the revocations leave it (a device whose issuer
- * `I` revoked is never registered before the cascade reaches the target).
+ * §7.1 step 1: whether the revocation of `device` in `I` is relevant in the
+ * target `X`. It is when the device is bound in `X` (as a leaf or an
+ * intermediate, W §17.4 rule 9), or when it could become registered in `X`
+ * or issue a chain there: bound in `I` with kind 0, or with kind 1 and `X`
+ * in its scope, or not bound in `I` at all (its kind is unknown). A pairing
+ * device, or a service device whose scope does not list `X`, that is not
+ * bound in `X` can never act there (W §7.3 c3, c6; N8): its revocation
+ * would protect nothing and would take one of the 64 unbound pairs of the
+ * root that W §17.5 rule 5 allows in `X` and never frees.
+ *
+ * `binding` is the device's binding in `I` (undefined when unbound there).
  */
-export function planReconciliation(identity, target) {
+export function revocationRelevant(binding, target, device) {
+    if (isBound(target, device))
+        return true;
+    if (binding === undefined || binding.kind === DEVICE_KIND.PERSONAL)
+        return true;
+    return (binding.kind === DEVICE_KIND.SERVICE &&
+        binding.scope.some((s) => bytesEqual(s, target.resourceId)));
+}
+/**
+ * §7.1 step 1 for one target: the revocations of `I` to propose on `X`
+ * (the pairs of `I`'s `revoked` not in `X`'s that are relevant there, those
+ * whose device is bound in `X` first, each group in `I`'s chain order), and
+ * the devices whose revocation is not relevant in `X` and is not
+ * propagated. Empty for the target `I` itself.
+ */
+export function planRevocations(identity, target) {
     if (bytesEqual(identity.state.resourceId, target.state.resourceId))
-        return [];
+        return { propose: [], notRelevant: [] };
     const R = genesisOwner(identity);
     const I = identity.state;
     const X = target.state;
-    const steps = [];
-    // Step 1: every revoked pair of I not revoked in X, in I's chain order.
-    const revokedInX = (d) => revocationOf(X, R, d) !== undefined;
-    const revokedNow = new Set();
+    const bound = [];
+    const unbound = [];
+    const notRelevant = [];
+    const seen = new Set();
     for (const r of identity.records) {
         if (r.body.type !== "DEVICE_REVOKE" || !bytesEqual(r.body.root, R))
             continue;
         const d = r.body.device;
-        if (revokedInX(d) || revokedNow.has(toHex(d)))
+        if (revocationOf(X, R, d) !== undefined || seen.has(toHex(d)))
             continue;
-        revokedNow.add(toHex(d));
-        steps.push({
+        seen.add(toHex(d));
+        if (!revocationRelevant(I.devices.get(toHex(d)), X, d)) {
+            notRelevant.push(d);
+            continue;
+        }
+        (isBound(X, d) ? bound : unbound).push({
             kind: "revoke",
             root: R,
             device: d,
             reason: r.body.reason === 3n ? 0n : r.body.reason,
         });
     }
-    const revokedAfter = (d) => revokedInX(d) || revokedNow.has(toHex(d));
+    return Object.freeze({
+        propose: Object.freeze([...bound, ...unbound]),
+        notRelevant: Object.freeze(notRelevant),
+    });
+}
+/**
+ * §7.1 steps 1 and 2 for one target, in their normative order. For the
+ * target `I` itself both steps are vacuous. Registrations are planned on
+ * the target's state as the revocations leave it, and every pair of `I`'s
+ * `revoked` counts as revoked in `X` whether its propagation succeeds or
+ * not (an unpropagated pair, refused by W §17.5 rule 5, or a pair that is
+ * not relevant): no device whose issuer `I` has revoked is ever registered.
+ */
+export function planReconciliation(identity, target) {
+    if (bytesEqual(identity.state.resourceId, target.state.resourceId))
+        return [];
+    const R = genesisOwner(identity);
+    const I = identity.state;
+    const X = target.state;
+    // Step 1: the relevant revocations of I, bound in X first.
+    const steps = [...planRevocations(identity, target).propose];
+    const revokedAfter = (d) => revocationOf(X, R, d) !== undefined || revocationOf(I, R, d) !== undefined;
     // Step 2: registrations, in I's binding order.
     for (const [hex, d] of I.devices) {
         if (!bytesEqual(d.root, R) || d.chain === null || d.leafId === null)
@@ -115,10 +162,11 @@ export async function reconcileDevices(o) {
     let document = { state: "none" };
     let open = false;
     try {
-        // A rotation an earlier run committed but did not adopt is finished first (§9.1).
-        await resumeRotations({ ...o, pool });
         const channel = await pool.get(me, target.url);
         const I = await syncChain(o.storage, channel, target.resource);
+        // A rotation an earlier run committed but did not adopt is finished first (§9.1). It
+        // seals nothing to a device I has revoked (§7.1 step 1).
+        await resumeRotations({ ...o, pool, identityChain: I });
         const R = genesisOwner(I);
         if (!mayManageDevices(I.state, me.descriptor.principalId, R))
             return {
@@ -165,8 +213,9 @@ export async function reconcileDevices(o) {
                     throw e;
             }
         }
-        // Step 4: display data for devices in I's chain without a valid entry (labels default to the fingerprint).
-        if (displayIntents(I, doc, R).length > 0 && doc.initialized()) {
+        // Step 4: display data for the leaf-bound personal and service devices of I without a valid
+        // entry (labels default to the fingerprint), and the flag of a retired entry.
+        if (!nothingToWrite(displayPlan(I, doc, R)) && doc.initialized()) {
             // Built on the current state of I: a rotation of I by this run, or by
             // anyone, makes an earlier unit stale (W §19.1), and it is written again.
             document = await runUnitPhase(channel, journal, operation, {
@@ -179,8 +228,8 @@ export async function reconcileDevices(o) {
                     const fresh = o.document(target.resource, R);
                     const loaded = await loadIdentityDocument({ channel, chain: now, deks, doc: fresh });
                     // Another manager may have written the entries since the first read (§7.1).
-                    const intents = displayIntents(now, fresh, R);
-                    if (intents.length === 0)
+                    const plan = displayPlan(now, fresh, R);
+                    if (nothingToWrite(plan))
                         return null;
                     return sealIdentityUnit({
                         storage: o.storage,
@@ -189,7 +238,8 @@ export async function reconcileDevices(o) {
                         signer: me,
                         doc: fresh,
                         latest: loaded.latest,
-                        intents,
+                        intents: plan.intents,
+                        retire: plan.retire,
                     });
                 },
             });
@@ -215,25 +265,76 @@ export async function reconcileDevices(o) {
     }
     return { operation, targets: Object.freeze(out), document };
 }
-/** §7.1 step 4: a device entry for each device of R in I's chain without one. */
-function displayIntents(I, doc, R) {
+/**
+ * §7.1 step 4: the display data reconciliation writes in `I`'s document,
+ * from `I`'s Control state and the valid device entries (§4). For every
+ * device of `R` of kind 0 or 1 bound in `I` as the leaf of an accepted
+ * chain (an intermediate-only binding issues and does not act in `I`):
+ * when it is not revoked in `I` and has no valid entry, an entry labelled
+ * with its fingerprint (§5.2); when it is revoked in `I` and some value of
+ * its entry's `revoked` (a retired entry) is not `true`, or the field is
+ * absent, that flag alone. `revokedValues` gives every concurrent value
+ * of the flag (IdentityDocumentPort.retirement); without it the entry's
+ * one shown value is read. No entry is created for a revoked device,
+ * nothing is written for a pairing device, nothing is relabelled or
+ * deleted, and a second run on the same states plans nothing.
+ */
+export function planDisplayData(identity, entries, root, revokedValues) {
     const intents = [];
-    for (const [hex, d] of I.state.devices) {
-        if (!bytesEqual(d.root, R) || d.chain === null || d.kind === DEVICE_KIND.PAIRING)
+    const retire = [];
+    for (const [hex, d] of identity.devices) {
+        if (!bytesEqual(d.root, root) || d.chain === null)
             continue;
-        const key = principalRefOf(principalId(fromHex(hex)));
-        if (doc.devices().has(key))
+        if (d.kind !== DEVICE_KIND.PERSONAL && d.kind !== DEVICE_KIND.SERVICE)
+            continue;
+        const D = principalId(fromHex(hex));
+        const key = principalRefOf(D);
+        if (revocationOf(identity, root, D) !== undefined) {
+            if (retiredFlagMissing(entries, key, revokedValues))
+                retire.push(key);
+            continue;
+        }
+        if (entries.has(key))
             continue;
         intents.push({
             intent: "device.put",
             key,
             entry: {
-                label: deviceFingerprint(principalId(fromHex(hex))),
+                label: deviceFingerprint(D),
                 kind: d.kind === DEVICE_KIND.SERVICE ? 1 : 0,
             },
         });
     }
-    return intents;
+    return Object.freeze({ intents: Object.freeze(intents), retire: Object.freeze(retire) });
+}
+const displayPlan = (I, doc, R) => planDisplayData(I.state, doc.devices(), R, doc.retirement === undefined ? undefined : (key) => doc.retirement?.revokedValues(key) ?? []);
+const nothingToWrite = (p) => p.intents.length === 0 && p.retire.length === 0;
+/**
+ * §7.1 step 3: the devices of `R` reconciliation seals the target's keys
+ * to: every reader of the target whose root is `R` (pairing devices of `I`
+ * included, in `I`), except a device revoked in `I` and a device whose
+ * current chain in the target passes through a device revoked in `I` (an
+ * unpropagated pair of step 1, which the target still counts as active).
+ */
+export function keyRecipients(identity, target) {
+    const R = genesisOwner(identity);
+    return Object.freeze(readersAt(target.state).filter((r) => bytesEqual(actsFor(target.state, r.principalId), R) &&
+        !revokedByIdentity(identity, target.state, r.principalId)));
+}
+/**
+ * The revocations of `I` that `X` refused in an earlier reconciliation of
+ * this installation, as `<phase ID>@<head of X they were proposed on>`,
+ * with the refusal code (§7.1 step 1). A head names one state of `X`.
+ */
+async function refusedRevocations(journal, operation, X) {
+    const out = new Map();
+    const prefix = `revoke:${toHex(X)}:`;
+    for (const op of await journal.list({ kind: "reconcile" }))
+        if (op.id !== operation)
+            for (const p of op.phases)
+                if (p.id.startsWith(prefix) && p.state === "refused" && p.expectedHead !== undefined)
+                    out.set(`${p.id}@${p.expectedHead}`, p.code ?? "refused");
+    return out;
 }
 async function reconcileTarget(o, channel, journal, ledger, operation, I, X, resend) {
     const me = o.installation.signer;
@@ -241,9 +342,29 @@ async function reconcileTarget(o, channel, journal, ledger, operation, I, X, res
     let chain = await syncChain(o.storage, channel, X);
     const steps = [];
     const manages = mayManageDevices(chain.state, me.descriptor.principalId, R);
+    const refused = manages
+        ? await refusedRevocations(journal, operation, X)
+        : new Map();
     if (manages)
         for (const step of planReconciliation(I, chain)) {
             const id = `${step.kind}:${toHex(X)}:${toHex(step.device)}`;
+            // §7.1 step 1: a refused propagation is not repeated as such. It is proposed again once
+            // X's state changed since the refusal (its head moved; binding the device moves it too,
+            // and a bound device's revocation is never limited), not on every run.
+            const head = toHex(chain.state.head);
+            const code = step.kind === "revoke" ? refused.get(`${id}@${head}`) : undefined;
+            if (code !== undefined && !isBound(chain.state, step.device)) {
+                await journal.putPhase(operation, {
+                    id,
+                    kind: "revoke",
+                    resource: toHex(X),
+                    state: "refused",
+                    expectedHead: head,
+                    code,
+                });
+                steps.push({ step, state: "refused" });
+                continue;
+            }
             const outcome = await runControlPhase(o.storage, channel, journal, operation, {
                 id,
                 kind: step.kind,
@@ -256,17 +377,24 @@ async function reconcileTarget(o, channel, journal, ledger, operation, I, X, res
             steps.push({ step, state: outcome.state });
             chain = outcome.chain;
         }
-    // Step 3: every reader of the target whose root is R (pairing devices of I included), by the ledger.
+    // §7.1 step 1: a refused revocation is reported and stays unpropagated.
+    const unpropagated = steps
+        .filter((s) => s.step.kind === "revoke" && s.state === "refused")
+        .map((s) => s.step.device);
+    // Step 3: every reader of the target whose root is R (pairing devices of I included), by the
+    // ledger, except the devices I has revoked and those whose chain passes through one.
     const deks = await fetchDeks(o.storage, o.secrets, channel, chain, o.installation);
-    const recipients = readersAt(chain.state).filter((r) => bytesEqual(actsFor(chain.state, r.principalId), R));
+    const recipients = keyRecipients(I, chain);
     const keys = await deliverKeys({ channel, ledger, chain, sender: me, recipients, deks, resend });
     const rotation = o.rotate === false
         ? undefined
-        : await rotateIfExposed({ ...o, channel, operation, resource: X });
+        : // §7.1 step 1: the new epoch is sealed to no device I has revoked, nor through one.
+            await rotateIfExposed({ ...o, channel, operation, resource: X, identityChain: I });
     return {
         resource: X,
         status: manages ? "done" : "not-authorized",
         steps: Object.freeze(steps),
+        ...(unpropagated.length === 0 ? {} : { unpropagated: Object.freeze(unpropagated) }),
         keys,
         ...(rotation === undefined ? {} : { rotation }),
     };

package/dist/identity/revocation.d.ts

@@ -2,6 +2,7 @@ import { type PrincipalId, type ResourceId } from "@openlfcp/core";
 import { type DocumentWrite } from "./context.js";
 import { type FlowOptions } from "./devices.js";
 import { type IdentityChannel } from "./network.js";
+import { type LinearChain } from "./phases.js";
 import { type IdentityFlowOptions } from "./resource.js";
 import { type RotationOutcome } from "./rotation.js";
 /**
@@ -39,7 +40,14 @@ export interface RevocationResult {
     readonly resource: ResourceId;
     readonly revoke: "revoked" | "complete" | "superseded" | "not-authorized"
     /** The revoker's own chain passes through the device here: re-certify it here first (§8.1). */
-     | "self-dependent" | "refused" | "unreachable" | "unsupported" | "conflict";
+     | "self-dependent" | "refused"
+    /**
+     * §8.4, §7.1 step 1: a roster Resource where the device is not bound and
+     * can never act (a pairing device, or a service device whose scope does
+     * not list it): no revocation is proposed there, so that it does not take
+     * one of the root's 64 unbound pairs (W §17.5 rule 5).
+     */
+     | "not-relevant" | "unreachable" | "unsupported" | "conflict";
     readonly rotation?: RotationOutcome;
 }
 export type RevokeDeviceResult = {
@@ -102,5 +110,7 @@ export declare function rotateIfExposed(o: FlowOptions & {
     readonly channel: IdentityChannel;
     readonly operation: string;
     readonly resource: ResourceId;
+    /** The Identity Resource of this installation's root: see rotateAfter. */
+    readonly identityChain?: LinearChain;
 }): Promise<RotationOutcome>;
 //# sourceMappingURL=revocation.d.ts.map

package/dist/identity/revocation.js

@@ -1,11 +1,12 @@
 import { bytesEqual, fromBase64url, fromHex, principalId, resourceId, secureRandom, toHex, } from "@openlfcp/core";
-import { activeDevice, signControlRecord, validateControlChain, } from "@openlfcp/wire";
-import { fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, runControlPhase, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
+import { activeDevice, revocationOf, signControlRecord, validateControlChain, } from "@openlfcp/wire";
+import { fetchDeks, genesisOwner, IdentityConflict, loadIdentityDocument, retiredFlagMissing, runControlPhase, runUnitPhase, sealIdentityUnit, syncChain, } from "./context.js";
 import { mayManageDevices } from "./devices.js";
 import { principalRefOf } from "./document.js";
 import { newOperationId, OperationJournal, phaseOf } from "./journal.js";
 import { ChannelPool, IDENTITY_EXTENSION, IdentityRefused, IdentityUnavailable, } from "./network.js";
 import { classifyRevoke } from "./phases.js";
+import { revocationRelevant } from "./reconcile.js";
 import { identityTarget } from "./resource.js";
 import { checkFlowProfiles, exposingRevocationsSince, resumeRotations, rotateAfter, rotatorTest, } from "./rotation.js";
 const toKeep = (state, root) => [...state.devices.entries()]
@@ -139,9 +140,6 @@ export async function revokeDevice(o) {
     const pool = new ChannelPool(o.network);
     const operation = o.operation ?? newOperationId("revoke-device", secureRandom(8));
     try {
-        // Rotations an earlier operation committed but did not adopt are finished first (§9.1).
-        if (!selfRetire)
-            await resumeRotations({ ...o, pool });
         const channel = await pool.get(o.installation.signer, target.url);
         const known = await journal.get(operation);
         let I;
@@ -154,6 +152,10 @@ export async function revokeDevice(o) {
                 throw e;
             return retireElsewhere(o, pool, journal, known);
         }
+        // Rotations an earlier operation committed but did not adopt are finished first (§9.1),
+        // sealing nothing to a device I has revoked (§7.1 step 1).
+        if (!selfRetire)
+            await resumeRotations({ ...o, pool, identityChain: I });
         const R = genesisOwner(I);
         if (!selfRetire && !mayManageDevices(I.state, me, R))
             return { kind: "not-authorized" };
@@ -172,6 +174,9 @@ export async function revokeDevice(o) {
                     device: toHex(o.device),
                     root: toHex(R),
                     reason: String(o.reason),
+                    // §8.4: the device's binding in I decides where its revocation is relevant,
+                    // also for a resumed self-retirement that can no longer read I.
+                    ...bindingIntent(I.state.devices.get(toHex(o.device))),
                     targets: (await rosterTargets(o, channel, I)).map((t) => ({
                         resource: toHex(t.resource),
                         url: t.url,
@@ -179,8 +184,13 @@ export async function revokeDevice(o) {
                 },
             });
         const roster = targetsOf(await journal.load(operation));
+        const binding = I.state.devices.get(toHex(o.device));
         const results = [];
-        const one = async (c, X) => {
+        // I as this operation leaves it: a rotation seals nothing to a device it has revoked.
+        let identityChain = I;
+        const one = async (c, X, inRoster = true) => {
+            if (inRoster && !(await relevantIn(o, c, X, R, binding)))
+                return { resource: X, revoke: "not-relevant" };
             let outcome;
             try {
                 outcome = await runControlPhase(o.storage, c, journal, operation, {
@@ -209,12 +219,20 @@ export async function revokeDevice(o) {
                 return { resource: X, revoke: "superseded" };
             if (outcome.state === "refused")
                 return { resource: X, revoke: "refused" };
+            if (!inRoster)
+                identityChain = outcome.chain;
             const revoke = outcome.state === "committed-own" ? "revoked" : "complete";
             if (selfRetire && o.reason === 0n)
                 return { resource: X, revoke };
             let rotation;
             try {
-                rotation = await rotateIfExposed({ ...o, channel: c, operation, resource: X });
+                rotation = await rotateIfExposed({
+                    ...o,
+                    channel: c,
+                    operation,
+                    resource: X,
+                    identityChain,
+                });
             }
             catch (e) {
                 // The revocation stands; the rotation resumes from the journal (§9.1).
@@ -224,7 +242,7 @@ export async function revokeDevice(o) {
             }
             return { resource: X, revoke, rotation };
         };
-        const first = await one(channel, target.resource);
+        const first = await one(channel, target.resource, false);
         results.push(first);
         if (first.revoke === "superseded") {
             await journal.setStatus(operation, "superseded");
@@ -272,6 +290,35 @@ export async function revokeDevice(o) {
         pool.closeAll();
     }
 }
+/** The device's kind and scope in I, journaled with a revocation (§8.4). */
+const bindingIntent = (b) => b === undefined ? {} : { binding: { kind: b.kind, scope: b.scope.map(toHex) } };
+/**
+ * The journaled binding; `null` when the operation predates it (0.4.0),
+ * which revokes in every roster Resource as before.
+ */
+function bindingOf(op) {
+    if (!Object.hasOwn(op.intent, "targets"))
+        return null;
+    const b = op.intent.binding;
+    if (b === undefined)
+        return Object.hasOwn(op.intent, "binding") ? undefined : null;
+    return {
+        kind: b.kind,
+        scope: b.scope.map((h) => resourceId(fromHex(h))),
+    };
+}
+/**
+ * §8.4: whether the revocation of the device is proposed on the roster
+ * Resource `X`: when it is already revoked there (the phase classifies it
+ * as complete), or when it is relevant there by §7.1 step 1.
+ */
+async function relevantIn(o, c, X, R, binding) {
+    if (binding === null)
+        return true;
+    const x = await syncChain(o.storage, c, X);
+    return (revocationOf(x.state, R, o.device) !== undefined ||
+        revocationRelevant(binding, x.state, o.device));
+}
 const targetsOf = (op) => (op.intent.targets ?? []).map((t) => ({
     resource: resourceId(fromHex(t.resource)),
     url: t.url,
@@ -282,9 +329,14 @@ async function retireElsewhere(o, pool, journal, op) {
     const results = [
         { resource: resourceId(fromHex(op.intent.identity)), revoke: "complete" },
     ];
+    const binding = bindingOf(op);
     for (const t of targetsOf(op)) {
         try {
             const c = await pool.get(o.installation.signer, t.url);
+            if (!(await relevantIn(o, c, t.resource, R, binding))) {
+                results.push({ resource: t.resource, revoke: "not-relevant" });
+                continue;
+            }
             const outcome = await runControlPhase(o.storage, c, journal, op.id, {
                 id: `revoke:${toHex(t.resource)}`,
                 kind: "revoke",
@@ -354,10 +406,11 @@ async function markRevoked(o, channel, journal, operation, I, device) {
             build: async () => {
                 const now = await current();
                 gone = now.entry === undefined;
-                if (now.entry === undefined || now.entry.revoked === true)
+                const retirement = now.doc.retirement;
+                const values = retirement === undefined ? undefined : (k) => retirement.revokedValues(k);
+                if (!retiredFlagMissing(now.doc.devices(), key, values))
                     return null;
-                // The device's missing_keys hint is written only by the device (§3 AI5).
-                const { missing_keys: _hint, ...display } = now.entry;
+                // The flag alone (§8.2); the device's missing_keys hint is its own (§3 AI5).
                 return sealIdentityUnit({
                     storage: o.storage,
                     chain: now.chain,
@@ -365,7 +418,8 @@ async function markRevoked(o, channel, journal, operation, I, device) {
                     signer: o.installation.signer,
                     doc: now.doc,
                     latest: now.load.latest,
-                    intents: [{ intent: "device.put", key, entry: { ...display, revoked: true } }],
+                    intents: [],
+                    retire: [key],
                 });
             },
         });

package/dist/identity/rotation.d.ts

@@ -112,13 +112,19 @@ export interface RotationOutcome {
  * reuse it (§9.4). After the ACK the DEK goes to every reader of the new
  * head, each package recorded in the ledger; the revoked device, a
  * consumed or cancelled pairing device and suspended devices are not
- * readers and receive nothing.
+ * readers and receive nothing. With `identityChain`, neither does a reader that
+ * the rotator's Identity Resource has revoked, or whose chain in the
+ * Resource passes through such a device: a pair not yet propagated there
+ * (IDENTITY-PROFILE-01 §7.1 step 1) is treated as revoked, and the rotation
+ * closes the epoch for it as for the device just revoked.
  */
 export declare function rotateAfter(o: FlowOptions & {
     readonly channel: IdentityChannel;
     readonly operation: string;
     readonly resource: ResourceId;
     readonly revokedAt: bigint;
+    /** The Identity Resource of the rotator's root (§7.1 step 1), when the flow knows it. */
+    readonly identityChain?: LinearChain;
 }): Promise<RotationOutcome>;
 /** The flow options of a rotation: 0.3.1's bare `dataProfiles` is refused, never checked less. */
 export declare function checkFlowProfiles(o: FlowOptions): void;
@@ -130,6 +136,8 @@ export declare function checkFlowProfiles(o: FlowOptions): void;
  */
 export declare function resumeRotations(o: FlowOptions & {
     readonly pool: ChannelPool;
+    /** The Identity Resource of this installation's root: see rotateAfter. */
+    readonly identityChain?: LinearChain;
 }): Promise<readonly RotationOutcome[]>;
 /** The control sequence of a record ID (hex) on a chain. */
 export declare const seqOf: (chain: LinearChain, recordIdHex: string) => bigint | undefined;

package/dist/identity/rotation.js

@@ -3,7 +3,7 @@ import { generateResourceDEK, sha256 } from "@openlfcp/crypto";
 import { ABILITY, actsFor, addSequence, checkDataUnit, hasAbility, hasSequence, InMemorySeenUnits, isExposingRevocation, KEY_EPOCH_REASON, parseDataUnit, receiveDataUnit, rotateEpoch, } from "@openlfcp/wire";
 import { snapshotFrontier } from "../outbound.js";
 import { loadControlChain } from "../storage.js";
-import { deliverKeys, fetchDeks, readersAt, runControlPhase, storeDek, withoutEquivocations, } from "./context.js";
+import { deliverKeys, fetchDeks, readersAt, revokedByIdentity, runControlPhase, storeDek, withoutEquivocations, } from "./context.js";
 import { getPendingDek, OperationJournal, PackageLedger, pendingDekRef, phaseOf, putPendingDek, } from "./journal.js";
 import { IdentityUnavailable } from "./network.js";
 import { keyEpochAfter, recordSeq } from "./phases.js";
@@ -191,7 +191,11 @@ async function acceptedAsData(chain, bytes, unitId, actor, local, data) {
  * reuse it (§9.4). After the ACK the DEK goes to every reader of the new
  * head, each package recorded in the ledger; the revoked device, a
  * consumed or cancelled pairing device and suspended devices are not
- * readers and receive nothing.
+ * readers and receive nothing. With `identityChain`, neither does a reader that
+ * the rotator's Identity Resource has revoked, or whose chain in the
+ * Resource passes through such a device: a pair not yet propagated there
+ * (IDENTITY-PROFILE-01 §7.1 step 1) is treated as revoked, and the rotation
+ * closes the epoch for it as for the device just revoked.
  */
 export async function rotateAfter(o) {
     checkFlowProfiles(o);
@@ -266,7 +270,8 @@ export async function rotateAfter(o) {
         ledger: new PackageLedger(o.storage),
         chain,
         sender: me,
-        recipients: readersAt(chain.state),
+        recipients: readersAt(chain.state).filter((r) => o.identityChain === undefined ||
+            !revokedByIdentity(o.identityChain, chain.state, r.principalId)),
         deks: send,
     });
     const phase = phaseOf(await journal.load(o.operation), id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlfcp/client",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "LFCP client: session, Control Plane and Data Plane synchronization.",
   "keywords": [
     "openlfcp",
@@ -42,9 +42,9 @@
     "tag": "latest"
   },
   "dependencies": {
-    "@openlfcp/core": "^0.4.0",
-    "@openlfcp/storage": "^0.4.0",
-    "@openlfcp/wire": "^0.4.0",
-    "@openlfcp/crypto": "^0.4.0"
+    "@openlfcp/core": "^0.5.0",
+    "@openlfcp/crypto": "^0.5.0",
+    "@openlfcp/storage": "^0.5.0",
+    "@openlfcp/wire": "^0.5.0"
   }
 }