agent-comms 8.6.2 → 8.8.0

package/dist/core/account-join.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Joining a machine to an account (agent-comms#344): one deliberate act per new machine. A machine holding the account issues an account invite, an ordinary connection code (connection-code.ts) it also remembers as an invite; the person carries it to the new machine, which redeems it. Redeeming trusts the issuing device exactly as any connection code does, then asks that device, over the mesh's end-to-end authenticated request path (directly or relayed by the hub), for the account key, which comes back sealed under a key only the invite's holder can derive. The new machine then holds the account: its devices mint membership proofs as the account, so every machine already trusting the account's principal covers them with no per-pair step, and it replicates and can revoke from the account's grant ledger.
+ *
+ * The issuing device enforces the invite for real, not only the redeemer: it answers each invite once and never after its expiry, so a copied invite is worth nothing once used or stale, and it refuses to issue one that would stay valid for longer than an ordinary connection code (DEFAULT_CONNECTION_CODE_TTL_MS), which is already sized for a person relaying it by hand, since an invite is the account key to whoever redeems it first. Invites live only in the issuing store's memory, so a restart of that store before the invite is used cancels it.
+ *
+ * A join can carry a label for the joining machine. The issuing device validates it and keeps it as its own petname for the joiner's machine (naming.ts), so the machine the person just admitted is listed by the name they typed without a second step. The label and the machine id it names are the joiner's own assertion, which is acceptable only because whoever redeems an invite already receives the whole account; the petname is nothing but the issuing person's own view and is never gossiped.
+ *
+ * Neither half is an agent_comms tool action: an invite hands over the account key and a join replaces the machine's account, so both are `agent-comms account invite` and `agent-comms account join`, run by the person at the terminal (account-cli.ts), where nothing an agent is told can trigger them and the invite is never written into an agent's transcript.
+ */
+import type { IncomingManageRequest } from "wire-mesh-core/domain/mesh-session";
+import type { ManageOutcome } from "wire-mesh-core/domain/mesh-session";
+import { type ConnectionCodeLedger, type GenerateConnectionCodeOptions, type RedeemConnectionCodeOptions } from "./connection-code.js";
+import type { GatewayTrust } from "./gateway-trust.js";
+import type { MeshStoreIdentity } from "./mesh-store-shared.js";
+import type { MeshTransport } from "./transport.js";
+import type { ConnectionCode } from "./types.js";
+/** The request verb an invite's redeemer sends its issuer (params.verb), and the capability verb the manage-command carries only to satisfy manage-command.verb's grammar: the handler checks the invite itself, never a token. */
+export declare const ACCOUNT_JOIN_VERB = "account.join";
+/** What became of an invite: answered with the account key, or expired unanswered. */
+export type AccountInviteOutcome = "redeemed" | "expired";
+export interface AccountInvite {
+    code: ConnectionCode;
+    /** Settles once the invite has been answered or has expired, whichever comes first. */
+    settled: Promise<AccountInviteOutcome>;
+}
+export interface AccountJoinDeps {
+    requireIdentity: () => MeshStoreIdentity;
+    requireTransport: () => MeshTransport;
+    getPeerId: () => string;
+    connectionCodes: ConnectionCodeLedger;
+    gatewayTrust: GatewayTrust;
+    /** Re-evaluates whether the store should hold a hub session, after trust changes. */
+    reconsiderHub: () => void;
+    /** Redeems a connection code the ordinary way (freshness, single use, optional signature) and trusts the device it vouches for. */
+    redeemConnectionCode: (candidate: Readonly<ConnectionCode>, options: Readonly<RedeemConnectionCodeOptions>) => Promise<unknown>;
+    /** Labels deviceHex as name in the viewer's own petnames (Naming.setPetname). */
+    setPetname: (deviceHex: string, name: string) => string;
+    /** Re-attaches the store to the account it now holds, so its own proofs and ledger switch at once. */
+    setIdentity: (identity: MeshStoreIdentity) => void;
+}
+export interface AccountJoinOptions extends RedeemConnectionCodeOptions {
+    /** What the issuing person calls this machine: kept by the issuing device as its petname for it. Must satisfy the display-name rules. */
+    label?: string;
+}
+export interface AccountJoinResult {
+    /** The account's principal id (hex) this machine now holds. */
+    principal: string;
+    /** Where the account this machine held before was set aside, when it held a different one. */
+    replacedFile?: string;
+}
+export declare class AccountJoin {
+    private readonly deps;
+    /** Invites this store issued that are neither answered nor known to have expired, keyed by their nonce. */
+    private readonly invites;
+    constructor(deps: Readonly<AccountJoinDeps>);
+    /** Issues an account invite vouching for this store's own device, valid for options.ttlMs (at most DEFAULT_CONNECTION_CODE_TTL_MS, the default). Throws INVITE_TTL_TOO_LONG for a longer one. Also trusts the account's own principal, so this machine holds a hub session the joining machine can reach it through, and admits the joined machine's devices once their proofs name the account. */
+    invite(options?: Readonly<Omit<GenerateConnectionCodeOptions, "now">>): Promise<AccountInvite>;
+    /** Answers an account.join request: the account key and name sealed for the named invite, once, and only before the invite expires. Every other request, including a second use of the same invite, is refused without saying whether the invite ever existed. */
+    readonly handleJoinRequest: (request: Readonly<IncomingManageRequest>) => Promise<ManageOutcome>;
+    /** Drops every invite whose expiry has passed by this store's clock, settling each as expired. */
+    private pruneExpired;
+    /** Redeems an account invite and makes this machine hold the account it names. Throws INVALID_NAME for an unusable options.label before anything is redeemed, INVITE_REFUSED when the issuing device will not answer it (used, expired, cancelled by a restart, unreachable, or unwilling to take the label), and whatever redeeming the connection code itself throws before that. Redeeming trusts the issuing device so the key request can reach it; when the join then fails, that trust is withdrawn again unless the device was already trusted before, so a refused or unanswered invite leaves this machine trusting no one new. */
+    join(candidate: Readonly<ConnectionCode>, options?: Readonly<AccountJoinOptions>): Promise<AccountJoinResult>;
+    /** The half of join after the invite's issuer is trusted: fetch the account key from it and switch this machine to that account. */
+    private takeAccount;
+    /** Asks the invite's issuing device for the account key. Redeeming the invite has only just trusted that device, so the route to it (a hub session this store opens because it now trusts someone) may still be coming up: a request that found no route yet is retried until JOIN_ROUTE_WAIT_MS has passed, and any answer from the device itself is returned as it is. */
+    private requestAccountKey;
+    private trustOwnAccount;
+}
+//# sourceMappingURL=account-join.d.ts.map

package/dist/core/account-join.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-join.d.ts","sourceRoot":"","sources":["../../src/core/account-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAOxE,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAIhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIjD,mOAAmO;AACnO,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAehD,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,cAAc,CAAC;IACrB,uFAAuF;IACvF,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACxC;AAOD,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,iBAAiB,CAAC;IACzC,gBAAgB,EAAE,MAAM,aAAa,CAAC;IACtC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,eAAe,EAAE,oBAAoB,CAAC;IACtC,YAAY,EAAE,YAAY,CAAC;IAC3B,qFAAqF;IACrF,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,mIAAmI;IACnI,oBAAoB,EAAE,CACpB,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,EACnC,OAAO,EAAE,QAAQ,CAAC,2BAA2B,CAAC,KAC3C,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,iFAAiF;IACjF,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACxD,sGAAsG;IACtG,WAAW,EAAE,CAAC,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,kBAAmB,SAAQ,2BAA2B;IACrE,yIAAyI;IACzI,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoBD,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,2GAA2G;IAC3G,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;gBAE/B,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC;IAE5D,oYAAoY;IAC9X,MAAM,CACV,OAAO,GAAE,QAAQ,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAM,GACjE,OAAO,CAAC,aAAa,CAAC;IAgCzB,kQAAkQ;IAClQ,QAAQ,CAAC,iBAAiB,GACxB,SAAS,QAAQ,CAAC,qBAAqB,CAAC,KACvC,OAAO,CAAC,aAAa,CAAC,CAyBvB;IAEF,kGAAkG;IAClG,OAAO,CAAC,YAAY;IASpB,6mBAA6mB;IACvmB,IAAI,CACR,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,EACnC,OAAO,GAAE,QAAQ,CAAC,kBAAkB,CAAM,GACzC,OAAO,CAAC,iBAAiB,CAAC;IAmB7B,oIAAoI;YACtH,WAAW;IAmCzB,4WAA4W;YAC9V,iBAAiB;IA4B/B,OAAO,CAAC,eAAe;CAKxB"}

package/dist/core/account-join.js

@@ -0,0 +1,183 @@
+/**
+ * Joining a machine to an account (agent-comms#344): one deliberate act per new machine. A machine holding the account issues an account invite, an ordinary connection code (connection-code.ts) it also remembers as an invite; the person carries it to the new machine, which redeems it. Redeeming trusts the issuing device exactly as any connection code does, then asks that device, over the mesh's end-to-end authenticated request path (directly or relayed by the hub), for the account key, which comes back sealed under a key only the invite's holder can derive. The new machine then holds the account: its devices mint membership proofs as the account, so every machine already trusting the account's principal covers them with no per-pair step, and it replicates and can revoke from the account's grant ledger.
+ *
+ * The issuing device enforces the invite for real, not only the redeemer: it answers each invite once and never after its expiry, so a copied invite is worth nothing once used or stale, and it refuses to issue one that would stay valid for longer than an ordinary connection code (DEFAULT_CONNECTION_CODE_TTL_MS), which is already sized for a person relaying it by hand, since an invite is the account key to whoever redeems it first. Invites live only in the issuing store's memory, so a restart of that store before the invite is used cancels it.
+ *
+ * A join can carry a label for the joining machine. The issuing device validates it and keeps it as its own petname for the joiner's machine (naming.ts), so the machine the person just admitted is listed by the name they typed without a second step. The label and the machine id it names are the joiner's own assertion, which is acceptable only because whoever redeems an invite already receives the whole account; the petname is nothing but the issuing person's own view and is never gossiped.
+ *
+ * Neither half is an agent_comms tool action: an invite hands over the account key and a join replaces the machine's account, so both are `agent-comms account invite` and `agent-comms account join`, run by the person at the terminal (account-cli.ts), where nothing an agent is told can trigger them and the invite is never written into an agent's transcript.
+ */
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { openAccountKeyFromInvite, sealAccountKeyForInvite, } from "./account-bundle.js";
+import { openAccountLedger } from "./account-ledger-store.js";
+import { DEFAULT_CONNECTION_CODE_TTL_MS, } from "./connection-code.js";
+import { parseDisplayName } from "./display-name.js";
+import { isDeviceIdHex } from "./room-path.js";
+import { CommsError, requireDisplayName } from "./store.js";
+import { importAccountKey, readAccountContents } from "./user-identity.js";
+import { toIdentityPort } from "./wire-mesh-identity.js";
+/** The request verb an invite's redeemer sends its issuer (params.verb), and the capability verb the manage-command carries only to satisfy manage-command.verb's grammar: the handler checks the invite itself, never a token. */
+export const ACCOUNT_JOIN_VERB = "account.join";
+const ACCOUNT_JOIN_CAPABILITY_VERB = "account:join";
+/** The outcomes sendRoomRequest gives when this side has no route to the device yet, as opposed to an answer from the device. */
+const NO_ROUTE_CODES = new Set([
+    "no_route",
+    "not_connected",
+]);
+const MS_PER_SECOND = 1000;
+/** How long a join waits for a route to the issuing device to come up: a hub dial and its first directory exchange take seconds, so this is generous without leaving a person waiting on an unreachable issuer for long. */
+const JOIN_ROUTE_WAIT_SECONDS = 30;
+const JOIN_ROUTE_WAIT_MS = JOIN_ROUTE_WAIT_SECONDS * MS_PER_SECOND;
+/** Between attempts to reach the issuing device: short against the wait, long enough not to spin. */
+const JOIN_ROUTE_RETRY_MS = 250;
+/** The label a join request asks the issuer to keep for the joiner's machine: undefined when it asks for none, "invalid" when it asks for one that is not a usable label for a full machine id (a label with no machine id included). */
+function joinerPetname(params) {
+    const label = "label" in params ? params.label : undefined;
+    const machine = "machine" in params ? params.machine : undefined;
+    if (label === undefined && machine === undefined)
+        return undefined;
+    if (typeof label !== "string" ||
+        typeof machine !== "string" ||
+        !isDeviceIdHex(machine.toLowerCase()) ||
+        parseDisplayName(label) !== label) {
+        return "invalid";
+    }
+    return { machine, label };
+}
+export class AccountJoin {
+    deps;
+    /** Invites this store issued that are neither answered nor known to have expired, keyed by their nonce. */
+    invites = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Issues an account invite vouching for this store's own device, valid for options.ttlMs (at most DEFAULT_CONNECTION_CODE_TTL_MS, the default). Throws INVITE_TTL_TOO_LONG for a longer one. Also trusts the account's own principal, so this machine holds a hub session the joining machine can reach it through, and admits the joined machine's devices once their proofs name the account. */
+    async invite(options = {}) {
+        const ttlMs = options.ttlMs ?? DEFAULT_CONNECTION_CODE_TTL_MS;
+        if (ttlMs > DEFAULT_CONNECTION_CODE_TTL_MS) {
+            throw new CommsError(`An account invite can stay valid for at most ${String(DEFAULT_CONNECTION_CODE_TTL_MS)} ms, since whoever redeems it first takes the account key`, "INVITE_TTL_TOO_LONG");
+        }
+        const { clock } = this.deps.requireIdentity();
+        this.pruneExpired();
+        const code = await this.deps.connectionCodes.generate(this.deps.getPeerId(), { ...options, ttlMs, now: clock.now() });
+        const settled = new Promise((resolve) => {
+            this.invites.set(code.code, {
+                secret: {
+                    code: code.code,
+                    expiresAt: code.expiresAt,
+                    deviceId: code.deviceId,
+                },
+                settle: resolve,
+            });
+        });
+        // Settles `settled` on expiry even when nothing else calls in to prune; unref'd so a pending invite never keeps a process alive by itself.
+        setTimeout(() => {
+            this.pruneExpired();
+        }, ttlMs).unref();
+        this.trustOwnAccount();
+        return { code, settled };
+    }
+    /** Answers an account.join request: the account key and name sealed for the named invite, once, and only before the invite expires. Every other request, including a second use of the same invite, is refused without saying whether the invite ever existed. */
+    handleJoinRequest = async (request) => {
+        this.pruneExpired();
+        const { params } = request.command;
+        const code = "code" in params ? params.code : undefined;
+        const invite = typeof code === "string" ? this.invites.get(code) : undefined;
+        if (invite === undefined) {
+            return Promise.resolve({ result: "error", code: "invalid_invite" });
+        }
+        const petname = joinerPetname(params);
+        if (petname === "invalid") {
+            return Promise.resolve({ result: "error", code: "invalid_label" });
+        }
+        // Before the invite is spent, so a petname file that cannot be written fails the request with the invite still usable rather than losing the invite and the label together.
+        if (petname !== undefined) {
+            this.deps.setPetname(petname.machine, petname.label);
+        }
+        this.invites.delete(invite.secret.code);
+        const { userIdentityOptions } = this.deps.requireIdentity();
+        const sealed = sealAccountKeyForInvite(readAccountContents(userIdentityOptions), invite.secret);
+        invite.settle("redeemed");
+        return Promise.resolve({ result: "ok", sealed });
+    };
+    /** Drops every invite whose expiry has passed by this store's clock, settling each as expired. */
+    pruneExpired() {
+        const now = this.deps.requireIdentity().clock.now();
+        for (const [nonce, invite] of this.invites) {
+            if (Date.parse(invite.secret.expiresAt) > now)
+                continue;
+            this.invites.delete(nonce);
+            invite.settle("expired");
+        }
+    }
+    /** Redeems an account invite and makes this machine hold the account it names. Throws INVALID_NAME for an unusable options.label before anything is redeemed, INVITE_REFUSED when the issuing device will not answer it (used, expired, cancelled by a restart, unreachable, or unwilling to take the label), and whatever redeeming the connection code itself throws before that. Redeeming trusts the issuing device so the key request can reach it; when the join then fails, that trust is withdrawn again unless the device was already trusted before, so a refused or unanswered invite leaves this machine trusting no one new. */
+    async join(candidate, options = {}) {
+        const { label, ...redeemOptions } = options;
+        const named = label === undefined
+            ? undefined
+            : requireDisplayName(label, "A machine label");
+        const trustedBefore = this.deps.gatewayTrust.isTrusted(candidate.deviceId);
+        await this.deps.redeemConnectionCode(candidate, redeemOptions);
+        try {
+            return await this.takeAccount(candidate, named);
+        }
+        catch (error) {
+            if (!trustedBefore) {
+                this.deps.gatewayTrust.remove(candidate.deviceId);
+                this.deps.reconsiderHub();
+            }
+            throw error;
+        }
+    }
+    /** The half of join after the invite's issuer is trusted: fetch the account key from it and switch this machine to that account. */
+    async takeAccount(candidate, label) {
+        const outcome = await this.requestAccountKey(candidate, label);
+        const sealed = outcome.result === "ok" ? outcome.sealed : undefined;
+        if (typeof sealed !== "string") {
+            throw new CommsError(`The issuing device refused the account invite (${outcome.result === "error" ? (outcome.message ?? outcome.code) : "no key in its answer"})`, "INVITE_REFUSED");
+        }
+        const contents = openAccountKeyFromInvite(sealed, candidate);
+        const current = this.deps.requireIdentity();
+        const { identity, replacedFile } = importAccountKey(current.userIdentityOptions, contents);
+        this.deps.setIdentity({
+            ...current,
+            userIdentity: await toIdentityPort(identity),
+            accountLedger: await openAccountLedger({
+                userIdentityOptions: current.userIdentityOptions,
+                userIdentity: identity,
+                clock: current.clock,
+            }),
+        });
+        this.trustOwnAccount();
+        const principal = deviceIdToHex(Uint8Array.from(identity.deviceId));
+        return replacedFile === undefined
+            ? { principal }
+            : { principal, replacedFile };
+    }
+    /** Asks the invite's issuing device for the account key. Redeeming the invite has only just trusted that device, so the route to it (a hub session this store opens because it now trusts someone) may still be coming up: a request that found no route yet is retried until JOIN_ROUTE_WAIT_MS has passed, and any answer from the device itself is returned as it is. */
+    async requestAccountKey(invite, label) {
+        const { clock, machineIdentity } = this.deps.requireIdentity();
+        const labelling = label === undefined
+            ? {}
+            : { label, machine: deviceIdToHex(machineIdentity.deviceId) };
+        const deadline = clock.now() + JOIN_ROUTE_WAIT_MS;
+        for (;;) {
+            const outcome = await this.deps.requireTransport().sendRoomRequest(invite.deviceId, {
+                verb: ACCOUNT_JOIN_CAPABILITY_VERB,
+                params: { verb: ACCOUNT_JOIN_VERB, code: invite.code, ...labelling },
+            }, { kind: "node" });
+            const noRouteYet = outcome.result === "error" && NO_ROUTE_CODES.has(outcome.code);
+            if (!noRouteYet || clock.now() >= deadline)
+                return outcome;
+            await new Promise((resolve) => {
+                setTimeout(resolve, JOIN_ROUTE_RETRY_MS);
+            });
+        }
+    }
+    trustOwnAccount() {
+        const { userIdentity } = this.deps.requireIdentity();
+        this.deps.gatewayTrust.addPrincipal(deviceIdToHex(userIdentity.deviceId));
+        this.deps.reconsiderHub();
+    }
+}
+//# sourceMappingURL=account-join.js.map

package/dist/core/account-join.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-join.js","sourceRoot":"","sources":["../../src/core/account-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,8BAA8B,GAI/B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,mOAAmO;AACnO,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAChD,MAAM,4BAA4B,GAAG,cAAc,CAAC;AAEpD,iIAAiI;AACjI,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,UAAU;IACV,eAAe;CAChB,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,4NAA4N;AAC5N,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,kBAAkB,GAAG,uBAAuB,GAAG,aAAa,CAAC;AACnE,qGAAqG;AACrG,MAAM,mBAAmB,GAAG,GAAG,CAAC;AA+ChC,yOAAyO;AACzO,SAAS,aAAa,CACpB,MAAyC;IAEzC,MAAM,KAAK,GAAY,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,OAAO,GAAY,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnE,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACrC,gBAAgB,CAAC,KAAK,CAAC,KAAK,KAAK,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,OAAO,WAAW;IAIO;IAH7B,2GAA2G;IAC1F,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE5D,YAA6B,IAA+B;QAA/B,SAAI,GAAJ,IAAI,CAA2B;IAAG,CAAC;IAEhE,oYAAoY;IACpY,KAAK,CAAC,MAAM,CACV,UAAgE,EAAE;QAElE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,8BAA8B,CAAC;QAC9D,IAAI,KAAK,GAAG,8BAA8B,EAAE,CAAC;YAC3C,MAAM,IAAI,UAAU,CAClB,gDAAgD,MAAM,CAAC,8BAA8B,CAAC,2DAA2D,EACjJ,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CACnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EACrB,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CACxC,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,EAAE;YAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE;gBAC1B,MAAM,EAAE;oBACN,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB;gBACD,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,2IAA2I;QAC3I,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,kQAAkQ;IACzP,iBAAiB,GAAG,KAAK,EAChC,OAAwC,EAChB,EAAE;QAC1B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACnC,MAAM,IAAI,GAAY,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,MAAM,GACV,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,4KAA4K;QAC5K,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,uBAAuB,CACpC,mBAAmB,CAAC,mBAAmB,CAAC,EACxC,MAAM,CAAC,MAAM,CACd,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,kGAAkG;IAC1F,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG;gBAAE,SAAS;YACxD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,6mBAA6mB;IAC7mB,KAAK,CAAC,IAAI,CACR,SAAmC,EACnC,UAAwC,EAAE;QAE1C,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;QAC5C,MAAM,KAAK,GACT,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,oIAAoI;IAC5H,KAAK,CAAC,WAAW,CACvB,SAAmC,EACnC,KAAyB;QAEzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,UAAU,CAClB,kDAAkD,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAsB,GAAG,EAC5I,gBAAgB,CACjB,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5C,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,gBAAgB,CACjD,OAAO,CAAC,mBAAmB,EAC3B,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YACpB,GAAG,OAAO;YACV,YAAY,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC;YAC5C,aAAa,EAAE,MAAM,iBAAiB,CAAC;gBACrC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,YAAY,EAAE,QAAQ;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpE,OAAO,YAAY,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE,SAAS,EAAE;YACf,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IAClC,CAAC;IAED,4WAA4W;IACpW,KAAK,CAAC,iBAAiB,CAC7B,MAAgC,EAChC,KAAyB;QAEzB,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/D,MAAM,SAAS,GACb,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;QAClD,SAAS,CAAC;YACR,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,eAAe,CAChE,MAAM,CAAC,QAAQ,EACf;gBACE,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,SAAS,EAAE;aACrE,EACD,EAAE,IAAI,EAAE,MAAM,EAAE,CACjB,CAAC;YACF,MAAM,UAAU,GACd,OAAO,CAAC,MAAM,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC3D,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;IAC5B,CAAC;CACF"}

package/dist/core/account-ledger-crypto.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The confidentiality layer of the account's replicated grant ledger (agent-comms#344). A `core/data` entry is opaque bytes to the transport and is replicated to whoever asks for it, so every ledger entry is sealed with a key only a holder of the account's private key can derive: AES-256-GCM under an HKDF-SHA256 key from the account key, with the log it belongs to and its sequence number bound in as associated data so a relayer can neither read an entry nor move one to another log or position. The same derivation gives each machine's writer log an id that any account holder recognises and nobody else can distinguish from a random device-id.
+ */
+import type { DeviceId } from "wire-mesh-core/generated/protocol";
+/** A data-domain log id is a device-id, which is a SHA-256 digest. */
+export declare const WRITER_LOG_ID_BYTES = 32;
+/** The random half of a writer log id; the other half authenticates it. */
+export declare const WRITER_NONCE_BYTES: number;
+/** The two keys every ledger operation needs, derived once from the account's private key. */
+export interface AccountLedgerKeys {
+    /** Seals and opens entries. */
+    entryKey: Buffer;
+    /** Derives and recognises writer log ids. */
+    writerKey: Buffer;
+}
+/** Derives the ledger's keys from the account's PEM private key. Every copy of the same account key derives the same keys, which is what lets every machine holding it read what any of them wrote. */
+export declare function deriveAccountLedgerKeys(accountPrivateKeyPem: string): AccountLedgerKeys;
+/** A fresh random writer nonce, generated once per machine. */
+export declare function generateWriterNonce(): Uint8Array<ArrayBuffer>;
+/** The log id a machine with this writer nonce appends the account's ledger entries under: the nonce followed by a truncated HMAC of it under the account's writer key. */
+export declare function writerLogId(keys: Readonly<AccountLedgerKeys>, nonce: Uint8Array): DeviceId;
+/** Whether a log id is one of this account's writer logs. Only a holder of the account key can tell; to anyone else it is indistinguishable from a device-id. */
+export declare function isWriterLogId(keys: Readonly<AccountLedgerKeys>, logId: Uint8Array): boolean;
+/** Seals one ledger entry's plaintext for position `seq` of log `logId`: version, IV, tag, then ciphertext. */
+export declare function sealLedgerEntry(keys: Readonly<AccountLedgerKeys>, logId: Uint8Array, seq: number, plaintext: Uint8Array): Uint8Array<ArrayBuffer>;
+/** Opens a sealed entry, or returns undefined if it was not sealed by a holder of this account key for exactly this log and position (tampered, moved, truncated, or someone else's). */
+export declare function openLedgerEntry(keys: Readonly<AccountLedgerKeys>, logId: Uint8Array, seq: number, sealed: Uint8Array): Uint8Array<ArrayBuffer> | undefined;
+//# sourceMappingURL=account-ledger-crypto.d.ts.map

package/dist/core/account-ledger-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-ledger-crypto.d.ts","sourceRoot":"","sources":["../../src/core/account-ledger-crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAWlE,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,QAA0B,CAAC;AAQ1D,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,uMAAuM;AACvM,wBAAgB,uBAAuB,CACrC,oBAAoB,EAAE,MAAM,GAC3B,iBAAiB,CAWnB;AASD,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,UAAU,CAAC,WAAW,CAAC,CAE7D;AAED,2KAA2K;AAC3K,wBAAgB,WAAW,CACzB,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EACjC,KAAK,EAAE,UAAU,GAChB,QAAQ,CAUV;AAED,iKAAiK;AACjK,wBAAgB,aAAa,CAC3B,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EACjC,KAAK,EAAE,UAAU,GAChB,OAAO,CAOT;AAQD,+GAA+G;AAC/G,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EACjC,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,UAAU,GACpB,UAAU,CAAC,WAAW,CAAC,CAazB;AAED,yLAAyL;AACzL,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EACjC,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,GACjB,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAoBrC"}

package/dist/core/account-ledger-crypto.js

@@ -0,0 +1,101 @@
+/**
+ * The confidentiality layer of the account's replicated grant ledger (agent-comms#344). A `core/data` entry is opaque bytes to the transport and is replicated to whoever asks for it, so every ledger entry is sealed with a key only a holder of the account's private key can derive: AES-256-GCM under an HKDF-SHA256 key from the account key, with the log it belongs to and its sequence number bound in as associated data so a relayer can neither read an entry nor move one to another log or position. The same derivation gives each machine's writer log an id that any account holder recognises and nobody else can distinguish from a random device-id.
+ */
+import { createCipheriv, createDecipheriv, createHmac, createPrivateKey, hkdfSync, randomBytes, timingSafeEqual, } from "node:crypto";
+/** AES-256 takes a 256-bit key. */
+const KEY_BYTES = 32;
+/** The 96-bit IV GCM is specified for; any other length is hashed into one, which weakens its guarantees. */
+const IV_BYTES = 12;
+/** GCM's full-length authentication tag. */
+const TAG_BYTES = 16;
+/** The first byte of every sealed entry, so a later format can be told apart from this one. */
+const SEALED_ENTRY_VERSION = 1;
+const VERSION_BYTES = 1;
+/** A data-domain log id is a device-id, which is a SHA-256 digest. */
+export const WRITER_LOG_ID_BYTES = 32;
+/** The random half of a writer log id; the other half authenticates it. */
+export const WRITER_NONCE_BYTES = WRITER_LOG_ID_BYTES / 2;
+/** A sequence number is bound into the associated data as a 64-bit big-endian integer. */
+const SEQ_BYTES = 8;
+const ENTRY_KEY_INFO = "agent-comms/account-ledger/entry/v1";
+const WRITER_KEY_INFO = "agent-comms/account-ledger/writer/v1";
+const ASSOCIATED_DATA_LABEL = "agent-comms/account-ledger/v1";
+/** Derives the ledger's keys from the account's PEM private key. Every copy of the same account key derives the same keys, which is what lets every machine holding it read what any of them wrote. */
+export function deriveAccountLedgerKeys(accountPrivateKeyPem) {
+    const ikm = createPrivateKey(accountPrivateKeyPem).export({
+        format: "der",
+        type: "pkcs8",
+    });
+    const derive = (info) => Buffer.from(hkdfSync("sha256", ikm, Buffer.alloc(0), info, KEY_BYTES));
+    return {
+        entryKey: derive(ENTRY_KEY_INFO),
+        writerKey: derive(WRITER_KEY_INFO),
+    };
+}
+function writerTag(writerKey, nonce) {
+    return createHmac("sha256", writerKey)
+        .update(nonce)
+        .digest()
+        .subarray(0, WRITER_LOG_ID_BYTES - WRITER_NONCE_BYTES);
+}
+/** A fresh random writer nonce, generated once per machine. */
+export function generateWriterNonce() {
+    return Uint8Array.from(randomBytes(WRITER_NONCE_BYTES));
+}
+/** The log id a machine with this writer nonce appends the account's ledger entries under: the nonce followed by a truncated HMAC of it under the account's writer key. */
+export function writerLogId(keys, nonce) {
+    if (nonce.length !== WRITER_NONCE_BYTES) {
+        throw new Error(`a writer nonce is ${String(WRITER_NONCE_BYTES)} bytes, got ${String(nonce.length)}`);
+    }
+    const id = new Uint8Array(WRITER_LOG_ID_BYTES);
+    id.set(nonce, 0);
+    id.set(writerTag(keys.writerKey, nonce), WRITER_NONCE_BYTES);
+    return id;
+}
+/** Whether a log id is one of this account's writer logs. Only a holder of the account key can tell; to anyone else it is indistinguishable from a device-id. */
+export function isWriterLogId(keys, logId) {
+    if (logId.length !== WRITER_LOG_ID_BYTES)
+        return false;
+    const expected = writerTag(keys.writerKey, logId.subarray(0, WRITER_NONCE_BYTES));
+    return timingSafeEqual(expected, logId.subarray(WRITER_NONCE_BYTES));
+}
+function associatedData(logId, seq) {
+    const seqBytes = Buffer.alloc(SEQ_BYTES);
+    seqBytes.writeBigUInt64BE(BigInt(seq));
+    return Buffer.concat([Buffer.from(ASSOCIATED_DATA_LABEL), logId, seqBytes]);
+}
+/** Seals one ledger entry's plaintext for position `seq` of log `logId`: version, IV, tag, then ciphertext. */
+export function sealLedgerEntry(keys, logId, seq, plaintext) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", keys.entryKey, iv);
+    cipher.setAAD(associatedData(logId, seq));
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return Uint8Array.from(Buffer.concat([
+        Buffer.from([SEALED_ENTRY_VERSION]),
+        iv,
+        cipher.getAuthTag(),
+        ciphertext,
+    ]));
+}
+/** Opens a sealed entry, or returns undefined if it was not sealed by a holder of this account key for exactly this log and position (tampered, moved, truncated, or someone else's). */
+export function openLedgerEntry(keys, logId, seq, sealed) {
+    const headerBytes = VERSION_BYTES + IV_BYTES + TAG_BYTES;
+    if (sealed.length < headerBytes || sealed[0] !== SEALED_ENTRY_VERSION) {
+        return undefined;
+    }
+    const iv = sealed.subarray(VERSION_BYTES, VERSION_BYTES + IV_BYTES);
+    const tag = sealed.subarray(VERSION_BYTES + IV_BYTES, headerBytes);
+    const decipher = createDecipheriv("aes-256-gcm", keys.entryKey, iv);
+    decipher.setAAD(associatedData(logId, seq));
+    decipher.setAuthTag(tag);
+    try {
+        return Uint8Array.from(Buffer.concat([
+            decipher.update(sealed.subarray(headerBytes)),
+            decipher.final(),
+        ]));
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=account-ledger-crypto.js.map

package/dist/core/account-ledger-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-ledger-crypto.js","sourceRoot":"","sources":["../../src/core/account-ledger-crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,mCAAmC;AACnC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,6GAA6G;AAC7G,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,4CAA4C;AAC5C,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,+FAA+F;AAC/F,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,CAAC,CAAC;AAC1D,0FAA0F;AAC1F,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAC7D,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAC/D,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAU9D,uMAAuM;AACvM,MAAM,UAAU,uBAAuB,CACrC,oBAA4B;IAE5B,MAAM,GAAG,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;QACxD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC;QAChC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB,EAAE,KAAiB;IACrD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;SACnC,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,EAAE;SACR,QAAQ,CAAC,CAAC,EAAE,mBAAmB,GAAG,kBAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB;IACjC,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,2KAA2K;AAC3K,MAAM,UAAU,WAAW,CACzB,IAAiC,EACjC,KAAiB;IAEjB,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,qBAAqB,MAAM,CAAC,kBAAkB,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC/C,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjB,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC7D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,iKAAiK;AACjK,MAAM,UAAU,aAAa,CAC3B,IAAiC,EACjC,KAAiB;IAEjB,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,QAAQ,GAAG,SAAS,CACxB,IAAI,CAAC,SAAS,EACd,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CACtC,CAAC;IACF,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB,EAAE,GAAW;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,eAAe,CAC7B,IAAiC,EACjC,KAAiB,EACjB,GAAW,EACX,SAAqB;IAErB,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,UAAU,CAAC,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC;QACnC,EAAE;QACF,MAAM,CAAC,UAAU,EAAE;QACnB,UAAU;KACX,CAAC,CACH,CAAC;AACJ,CAAC;AAED,yLAAyL;AACzL,MAAM,UAAU,eAAe,CAC7B,IAAiC,EACjC,KAAiB,EACjB,GAAW,EACX,MAAkB;IAElB,MAAM,WAAW,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,GAAG,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,QAAQ,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,GAAG,QAAQ,EAAE,WAAW,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CACpB,MAAM,CAAC,MAAM,CAAC;YACZ,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC7C,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/core/account-ledger-store.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Opens this machine's copy of the account's replicated grant ledger (account-ledger.ts): a filesystem store beside user-identity.json, shared by every bridge on the machine, and the one-time migration of a pre-ledger user-identity.json's own issued-grant maps into it.
+ */
+import type { Clock } from "wire-mesh-core/ports/clock";
+import { AccountLedger } from "./account-ledger.js";
+import type { PeerIdentity } from "./identity.js";
+import { type UserIdentityOptions } from "./user-identity.js";
+export interface OpenAccountLedgerOptions {
+    /** Where user-identity.json lives; the ledger is kept beside it. */
+    userIdentityOptions: Readonly<UserIdentityOptions>;
+    /** The account's identity as loadOrCreateUserIdentity returned it. */
+    userIdentity: Readonly<PeerIdentity>;
+    clock: Clock;
+}
+/** The directory an account's ledger is stored in on this machine. Named by the account's device-id, so a machine that imports a different account starts that account's ledger afresh instead of mixing two accounts' logs. */
+export declare function accountLedgerDir(userIdentityOptions: Readonly<UserIdentityOptions>, userIdentity: Readonly<PeerIdentity>): string;
+/**
+ * Opens the account ledger for this machine and migrates any grants a pre-ledger build recorded in user-identity.json into it, so an existing user-identity.json needs no manual step: every grant it knew about stays revocable, now from any machine holding the key. The legacy maps are removed only after their grants are in the ledger, so a crash between the two re-migrates them on the next start, which is harmless because the ledger folds a grant recorded twice into one.
+ */
+export declare function openAccountLedger(options: Readonly<OpenAccountLedgerOptions>): Promise<AccountLedger>;
+//# sourceMappingURL=account-ledger-store.d.ts.map

package/dist/core/account-ledger-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-ledger-store.d.ts","sourceRoot":"","sources":["../../src/core/account-ledger-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACnD,sEAAsE;IACtE,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrC,KAAK,EAAE,KAAK,CAAC;CACd;AAED,gOAAgO;AAChO,wBAAgB,gBAAgB,CAC9B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAClD,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,GACnC,MAAM,CAKR;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAC1C,OAAO,CAAC,aAAa,CAAC,CAqBxB"}

package/dist/core/account-ledger-store.js

@@ -0,0 +1,34 @@
+/**
+ * Opens this machine's copy of the account's replicated grant ledger (account-ledger.ts): a filesystem store beside user-identity.json, shared by every bridge on the machine, and the one-time migration of a pre-ledger user-identity.json's own issued-grant maps into it.
+ */
+import * as path from "node:path";
+import { createNodeFsStorage } from "wire-mesh-core/adapters/node-fs-storage";
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { generateWriterNonce } from "./account-ledger-crypto.js";
+import { AccountLedger } from "./account-ledger.js";
+import { createFileLedgerLock } from "./ledger-lock.js";
+import { clearLegacyIssuedGrants, loadOrCreateLedgerWriterNonce, readLegacyIssuedGrants, userIdentityDir, } from "./user-identity.js";
+/** The directory an account's ledger is stored in on this machine. Named by the account's device-id, so a machine that imports a different account starts that account's ledger afresh instead of mixing two accounts' logs. */
+export function accountLedgerDir(userIdentityOptions, userIdentity) {
+    return path.join(userIdentityDir(userIdentityOptions), `account-ledger-${deviceIdToHex(Uint8Array.from(userIdentity.deviceId))}`);
+}
+/**
+ * Opens the account ledger for this machine and migrates any grants a pre-ledger build recorded in user-identity.json into it, so an existing user-identity.json needs no manual step: every grant it knew about stays revocable, now from any machine holding the key. The legacy maps are removed only after their grants are in the ledger, so a crash between the two re-migrates them on the next start, which is harmless because the ledger folds a grant recorded twice into one.
+ */
+export async function openAccountLedger(options) {
+    const dir = accountLedgerDir(options.userIdentityOptions, options.userIdentity);
+    const ledger = new AccountLedger({
+        accountPrivateKey: options.userIdentity.privateKey,
+        writerNonce: loadOrCreateLedgerWriterNonce(options.userIdentityOptions, generateWriterNonce),
+        storage: createNodeFsStorage({ dir }),
+        lock: createFileLedgerLock(`${dir}.lock`),
+        clock: options.clock,
+    });
+    const legacy = readLegacyIssuedGrants(options.userIdentityOptions);
+    if (legacy.length > 0) {
+        await ledger.recordGrants(legacy);
+        clearLegacyIssuedGrants(options.userIdentityOptions, legacy);
+    }
+    return ledger;
+}
+//# sourceMappingURL=account-ledger-store.js.map

package/dist/core/account-ledger-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-ledger-store.js","sourceRoot":"","sources":["../../src/core/account-ledger-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,eAAe,GAEhB,MAAM,oBAAoB,CAAC;AAU5B,gOAAgO;AAChO,MAAM,UAAU,gBAAgB,CAC9B,mBAAkD,EAClD,YAAoC;IAEpC,OAAO,IAAI,CAAC,IAAI,CACd,eAAe,CAAC,mBAAmB,CAAC,EACpC,kBAAkB,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAC1E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA2C;IAE3C,MAAM,GAAG,GAAG,gBAAgB,CAC1B,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC;QAC/B,iBAAiB,EAAE,OAAO,CAAC,YAAY,CAAC,UAAU;QAClD,WAAW,EAAE,6BAA6B,CACxC,OAAO,CAAC,mBAAmB,EAC3B,mBAAmB,CACpB;QACD,OAAO,EAAE,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,IAAI,EAAE,oBAAoB,CAAC,GAAG,GAAG,OAAO,CAAC;QACzC,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,uBAAuB,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/account-ledger.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The account's issued-grant ledger as a replicated object (agent-comms#344), following wire-mesh's replicated issuer grant ledger pattern (spec/PATTERNS.md). A token-id never appears on the wire except inside the grant it names, so the only record that a grant exists is what its issuer kept; with the ledger in one machine's user-identity.json, only that machine could revoke what it minted. Here every grant the account's user principal mints, and every revocation of one, is an entry in a `core/data` log, and the logs replicate by data-domain fan-out to every machine holding the account key, so any of them sees every admission and can revoke it.
+ *
+ * Each machine appends to a writer log of its own rather than all of them sharing one: a data-domain log is single-writer, and two machines appending to one log while apart would both write the same sequence number and fork it, silently losing one side's grants. A writer log's id is self-authenticating (account-ledger-crypto.ts), so any account holder recognises every writer log it is offered without a roster, and the ledger is the union of all of them.
+ *
+ * Holding a replica grants no authority: an entry is sealed under a key derived from the account key, so a replica held by anyone else is ciphertext they can neither read nor forge, and minting or revoking still needs the account's private key.
+ */
+import { type DataEntriesFrame, type DataHaveFrame, type DataRequestFrame, type DeviceId, type RevocationEntry } from "wire-mesh-core/generated/protocol";
+import type { RevocationView } from "wire-mesh-core/domain/revocation-view";
+import type { Clock } from "wire-mesh-core/ports/clock";
+import type { IdentityPort } from "wire-mesh-core/ports/identity";
+import type { KeyValueStorage } from "wire-mesh-core/ports/storage";
+import type { LedgerLock } from "./ledger-lock.js";
+/** Which of the principal's grant kinds an entry is about: a device's own group:member admission (device-membership.ts), or a dm:send grant (room-lifecycle.ts, dm-send-delegation.ts). Each kind is keyed by the grant's bearer, so the two never share a namespace. */
+export type IssuedGrantKind = "device" | "dm";
+/** One grant the ledger records as issued and not revoked. */
+export interface OutstandingGrant {
+    tokenId: Uint8Array<ArrayBuffer>;
+    /** When it was recorded (epoch ms, the recording machine's clock). */
+    at: number;
+}
+export interface AccountLedgerDeps {
+    /** The account's PEM private key: every ledger key is derived from it. */
+    accountPrivateKey: string;
+    /** This machine's writer nonce, persisted once per machine (user-identity.ts). */
+    writerNonce: Uint8Array;
+    /** Holds every account writer log this machine has, its own included. Shared by every bridge on the machine. */
+    storage: KeyValueStorage;
+    /** Serialises every read and write of `storage` across every bridge sharing it: appends to this machine's writer log, replicated entries stored for another machine's, and every read of either. The store's writes are not atomic (a file is truncated, then written), so a read racing another bridge's write could see an empty head and treat a log as empty. */
+    lock: LedgerLock;
+    clock: Clock;
+}
+/** Answers and stores the data-domain frames for the account's writer logs; what a transport needs of the ledger to replicate it. */
+export interface AccountLedgerReplica {
+    /** Whether `peer` names one of this account's writer logs. */
+    ownsLog: (peer: DeviceId) => boolean;
+    /** Answers a have or request for an account log, or stores entries for one after checking every entry was sealed for exactly that log and position. Returns the frame to send back, or null for none. */
+    handleDataFrame: (frame: Readonly<DataHaveFrame | DataRequestFrame | DataEntriesFrame>) => Promise<DataHaveFrame | DataRequestFrame | DataEntriesFrame | null>;
+    /** A data-have for every account log this machine holds, to offer peers. */
+    announcements: () => Promise<DataHaveFrame[]>;
+}
+export declare class AccountLedger implements AccountLedgerReplica {
+    private readonly deps;
+    /** This machine's own writer log. */
+    readonly writerLog: DeviceId;
+    private readonly keys;
+    private readonly revocationListeners;
+    constructor(deps: Readonly<AccountLedgerDeps>);
+    /** Records that the principal minted `tokenId` for `subjectHex`. */
+    recordGrant(kind: IssuedGrantKind, subjectHex: string, tokenId: Uint8Array<ArrayBuffer>): Promise<void>;
+    /** Records grants migrated from a pre-ledger user-identity.json in one append, so a restart part-way through leaves nothing half-recorded worth caring about: a grant recorded twice folds to one. */
+    recordGrants(grants: readonly Readonly<{
+        kind: IssuedGrantKind;
+        subject: string;
+        tokenId: Uint8Array<ArrayBuffer>;
+    }>[]): Promise<void>;
+    /** Records the revocation of `tokenId`, carrying the signed revocation entry itself so every replica can feed it into its own RevocationView. */
+    recordRevocation(kind: IssuedGrantKind, subjectHex: string, tokenId: Uint8Array<ArrayBuffer>, revocation: RevocationEntry): Promise<void>;
+    /** Every grant of `kind` for `subjectHex` that some machine of the account recorded and none has revoked, oldest first. */
+    outstandingGrants(kind: IssuedGrantKind, subjectHex: string): Promise<OutstandingGrant[]>;
+    /** Every revocation entry the ledger holds, from every machine, for a RevocationView to learn at start-up. */
+    revocations(): Promise<RevocationEntry[]>;
+    ownsLog(peer: DeviceId): boolean;
+    /** Calls `listener` with each revocation entry another machine's replicated log brings in, so a RevocationView learns it even if the gossiped revocation-announce never reached this node. Returns the unsubscribe. */
+    onReplicatedRevocation(listener: (entry: RevocationEntry) => void): () => void;
+    announcements(): Promise<DataHaveFrame[]>;
+    handleDataFrame(frame: Readonly<DataHaveFrame | DataRequestFrame | DataEntriesFrame>): Promise<DataHaveFrame | DataRequestFrame | DataEntriesFrame | null>;
+    private append;
+    /** Every account writer log in storage, this machine's own included once it has written anything. Called only under the lock. */
+    private heldLogs;
+    /** Every record in every held writer log. Throws on an entry that does not open: handleDataFrame and append never store one, so it means the storage was damaged outside the ledger, and carrying on would hide grants that can then never be revoked. */
+    private records;
+}
+/** Feeds every revocation the account ledger holds, and each one another machine's log brings in later, into a store's RevocationView, so a grant any machine of the account revoked is refused there even if the gossiped revocation-announce never reached it. A revocation that fails to verify, or a ledger that cannot be read, is reported rather than recorded. Returns the unsubscribe, for a store that replaces its ledger on joining another account. */
+export declare function followLedgerRevocations(identity: Readonly<{
+    accountLedger: AccountLedger;
+    revocation: RevocationView;
+    identity: IdentityPort;
+}>, onError: (error: Error) => void): () => void;
+//# sourceMappingURL=account-ledger.d.ts.map

package/dist/core/account-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-ledger.d.ts","sourceRoot":"","sources":["../../src/core/account-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmBH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAUpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,yQAAyQ;AACzQ,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,IAAI,CAAC;AAqC9C,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACjC,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,WAAW,EAAE,UAAU,CAAC;IACxB,gHAAgH;IAChH,OAAO,EAAE,eAAe,CAAC;IACzB,qWAAqW;IACrW,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;CACd;AAED,qIAAqI;AACrI,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,OAAO,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC;IACrC,yMAAyM;IACzM,eAAe,EAAE,CACf,KAAK,EAAE,QAAQ,CAAC,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,KACjE,OAAO,CAAC,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACzE,4EAA4E;IAC5E,aAAa,EAAE,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC/C;AAMD,qBAAa,aAAc,YAAW,oBAAoB;IAQ5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAEhC;gBAEyB,IAAI,EAAE,QAAQ,CAAC,iBAAiB,CAAC;IAK9D,oEAAoE;IAC9D,WAAW,CACf,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC;IAahB,sMAAsM;IAChM,YAAY,CAChB,MAAM,EAAE,SAAS,QAAQ,CAAC;QACxB,IAAI,EAAE,eAAe,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;KAClC,CAAC,EAAE,GACH,OAAO,CAAC,IAAI,CAAC;IAchB,iJAAiJ;IAC3I,gBAAgB,CACpB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,EAChC,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,IAAI,CAAC;IAchB,2HAA2H;IACrH,iBAAiB,CACrB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAqB9B,8GAA8G;IACxG,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAM/C,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;IAIhC,uNAAuN;IACvN,sBAAsB,CACpB,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GACzC,MAAM,IAAI;IAOP,aAAa,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAczC,eAAe,CACnB,KAAK,EAAE,QAAQ,CAAC,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,GACnE,OAAO,CAAC,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,IAAI,CAAC;YA+BxD,MAAM;IAoBpB,iIAAiI;YACnH,QAAQ;IAWtB,0PAA0P;YAC5O,OAAO;CAyBtB;AAUD,ocAAoc;AACpc,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,EAAE,YAAY,CAAC;CACxB,CAAC,EACF,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAC9B,MAAM,IAAI,CAsBZ"}