core-3nweb-client-lib 0.49.6 → 0.49.8

package/build/core/keyring/index.js

@@ -1,6 +1,6 @@
 "use strict";
 /*
- Copyright (C) 2015 - 2018, 2022, 2025 3NSoft Inc.
+ Copyright (C) 2015 - 2018, 2022, 2025 - 2026 3NSoft Inc.
  
  This program is free software: you can redistribute it and/or modify it under
  the terms of the GNU General Public License as published by the Free Software
@@ -16,124 +16,53 @@
  this program. If not, see <http://www.gnu.org/licenses/>.
 */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Keyrings = exports.KEY_USE = void 0;
-const correspondent_keys_1 = require("./correspondent-keys");
-const id_to_email_map_1 = require("./id-to-email-map");
+exports.KEY_USE = void 0;
+exports.makeKeyrings = makeKeyrings;
+const peer_keys_1 = require("./peer-keys");
 const common_1 = require("./common");
 const async_cryptor_wrap_1 = require("../../lib-common/async-cryptor-wrap");
 const xsp_files_1 = require("xsp-files");
-const buffer_utils_1 = require("../../lib-common/buffer-utils");
 const canonical_address_1 = require("../../lib-common/canonical-address");
-const common_2 = require("../asmail/delivery/common");
-const keyring_storage_1 = require("./keyring-storage");
 const cryptor_work_labels_1 = require("../../lib-client/cryptor-work-labels");
-const published_intro_key_1 = require("./published-intro-key");
-var common_3 = require("./common");
-Object.defineProperty(exports, "KEY_USE", { enumerable: true, get: function () { return common_3.KEY_USE; } });
-const FILE_FOR_INTRO_KEY_ON_SERVER = 'introductory-keys/published-on-server.json';
-// XXX Keyring is just a storage and crypto functionality around keys
-class Keyrings {
-    constructor(cryptor, random, logger) {
-        this.cryptor = cryptor;
-        this.random = random;
-        this.logger = logger;
-        /**
-         * This is a map from correspondents' canonical addresses to key objects.
-         */
-        this.corrKeys = new Map();
-        this.pairIdToEmailMap = new id_to_email_map_1.IdToEmailMap();
-        this.workLabel = cryptor_work_labels_1.cryptoWorkLabels.makeRandom('asmail');
-        this.storage = undefined;
-        this.publishedKeys = undefined;
-        this.asKeyPairsStorage = {
-            pairIdToEmailMap: this.pairIdToEmailMap,
-            saveChanges: this.saveChanges.bind(this)
-        };
-        Object.seal(this);
-    }
-    addCorrespondent(address, serialForm) {
-        const ck = (serialForm ?
-            new correspondent_keys_1.CorrespondentKeys(this.asKeyPairsStorage, this.random, undefined, serialForm) :
-            new correspondent_keys_1.CorrespondentKeys(this.asKeyPairsStorage, this.random, address));
-        if (this.corrKeys.has(ck.correspondent)) {
-            throw new Error(`Correspondent with address ${ck.correspondent} is already present.`);
-        }
-        this.corrKeys.set(ck.correspondent, ck);
-        if (serialForm) {
-            ck.mapAllKeysIntoRing();
-        }
-        return ck;
-    }
-    async init(fs, getSigner, pkeyOnServer) {
-        this.publishedKeys = await published_intro_key_1.PublishedIntroKey.makeAndInit(await fs.writableFile(FILE_FOR_INTRO_KEY_ON_SERVER), getSigner, this.random, pkeyOnServer);
-        this.storage = (0, keyring_storage_1.makeKeyringStorage)(fs);
-        await this.storage.start();
-        const serialForm = await this.storage.load();
-        if (serialForm) {
-            const json = JSON.parse(serialForm);
-            // TODO check json's fields
-            // init data
-            json.corrKeys.forEach((info) => {
-                this.addCorrespondent(undefined, info);
-            });
-        }
-        else {
-            // save initial file, as there was none initially
-            this.saveChanges();
-        }
-    }
-    forASMail() {
-        return {
-            close: this.close.bind(this),
-            decrypt: this.decrypt.bind(this),
-            generateKeysToSend: this.generateKeysToSend.bind(this),
-            needIntroKeyFor: this.needIntroKeyFor.bind(this),
-            nextCrypto: this.nextCrypto.bind(this),
-        };
-    }
-    saveChanges() {
-        // pack bytes that need to be encrypted and saved
-        const dataToSave = {
-            corrKeys: []
+const published_intro_key_1 = require("./introductory-keys/published-intro-key");
+const fs_sync_utils_1 = require("../../lib-client/fs-utils/fs-sync-utils");
+const ecma_nacl_1 = require("ecma-nacl");
+const buffer_utils_1 = require("../../lib-common/buffer-utils");
+var common_2 = require("./common");
+Object.defineProperty(exports, "KEY_USE", { enumerable: true, get: function () { return common_2.KEY_USE; } });
+const INTRO_KEYS_FOLDER = 'introductory-keys';
+async function makeKeyrings(cryptor, random, logger, fs, localFS, getSigner, pkeyOnServer) {
+    const workLabel = cryptor_work_labels_1.cryptoWorkLabels.makeRandom('asmail');
+    const introKeysFS = await (0, fs_sync_utils_1.getOrMakeSyncedDirOnInit)(fs, INTRO_KEYS_FOLDER);
+    const publishedKeys = await (0, published_intro_key_1.makeHolderOfPublishedIntroKey)(introKeysFS, getSigner, random, pkeyOnServer);
+    const peerKeys = await (0, peer_keys_1.makePeersKeyring)(fs, localFS, random, logger);
+    async function generateIntroKeysToSendMsg(address, introPKeyFromServer) {
+        if (introPKeyFromServer.alg !== ecma_nacl_1.box.JWK_ALG_NAME) {
+            // XXX make some standard runtime exception, for unknown alg
+            throw new Error(`Unknown alg in introductory key: ${introPKeyFromServer.alg}`);
+        }
+        const oneTime = await (0, common_1.generateKeyPair)(random);
+        const currentPair = {
+            recipientKid: introPKeyFromServer.kid,
+            senderPKey: oneTime.pkey
         };
-        for (const corrKeys of this.corrKeys.values()) {
-            dataToSave.corrKeys.push(corrKeys.serialForm());
-        }
-        // trigger saving utility
-        this.storage.save(JSON.stringify(dataToSave));
-    }
-    needIntroKeyFor(address) {
-        address = (0, canonical_address_1.toCanonicalAddress)(address);
-        return !this.corrKeys.has(address);
+        const msgMasterKey = ecma_nacl_1.box.calc_dhshared_key(buffer_utils_1.base64.open(introPKeyFromServer.k), buffer_utils_1.base64.open(oneTime.skey.k));
+        const nextNonce = await random(xsp_files_1.NONCE_LENGTH);
+        const encryptor = (0, async_cryptor_wrap_1.makeEncryptor)(cryptor, workLabel, msgMasterKey, nextNonce);
+        msgMasterKey.fill(0);
+        const nextMsgCrypto = await peerKeys.suggestPairForPeerIntroKey(address, introPKeyFromServer);
+        return { encryptor, currentPair, msgCount: 1, nextMsgCrypto };
     }
-    ;
-    async generateKeysToSend(address, introPKeyFromServer) {
-        address = (0, canonical_address_1.toCanonicalAddress)(address);
-        let ck = this.corrKeys.get(address);
-        if (!ck) {
-            if (!introPKeyFromServer) {
-                throw new Error(`There are no known keys for given address ${address} and a key from a mail server is not given either.`);
-            }
-            ck = this.addCorrespondent(address);
-        }
-        const { msgMasterKey, currentPair, msgCount } = await ck.getSendingPair(introPKeyFromServer);
+    async function getEstablishedKeysToSendMsg(address) {
+        const { msgMasterKey, currentPair, msgCount, nextMsgCrypto } = await peerKeys.getSendingCryptoWithinEstablishedPair((0, canonical_address_1.toCanonicalAddress)(address));
         // prepare message encryptor
-        const nextNonce = await this.random(xsp_files_1.NONCE_LENGTH);
-        const encryptor = (0, async_cryptor_wrap_1.makeEncryptor)(this.cryptor, this.workLabel, msgMasterKey, nextNonce);
+        const nextNonce = await random(xsp_files_1.NONCE_LENGTH);
+        const encryptor = (0, async_cryptor_wrap_1.makeEncryptor)(cryptor, workLabel, msgMasterKey, nextNonce);
         msgMasterKey.fill(0);
-        return { encryptor, currentPair, msgCount };
+        return { encryptor, currentPair, msgCount, nextMsgCrypto };
     }
-    async nextCrypto(address) {
-        address = (0, canonical_address_1.toCanonicalAddress)(address);
-        let ck = this.corrKeys.get(address);
-        if (!ck) {
-            throw new Error(`No correspondent keys found for ${address}`);
-        }
-        const suggestPair = await ck.suggestPair();
-        return suggestPair;
-    }
-    async decryptMsgKeyWithIntroPair(recipientKid, senderPKey, getMainObjHeader) {
-        const recipKey = this.publishedKeys.find(recipientKid);
+    async function decryptMsgKeyWithIntroPair(recipientKid, senderPKey, getMainObjHeader) {
+        const recipKey = publishedKeys.find(recipientKid);
         if (!recipKey) {
             return;
         }
@@ -142,16 +71,17 @@ class Keyrings {
         if (h.length < msgKeyPackLen) {
             return;
         }
-        const masterDecr = (0, correspondent_keys_1.msgMasterDecryptor)(this.cryptor, recipKey.pair.skey, { kid: '', k: senderPKey });
+        const msgMasterKey = ecma_nacl_1.box.calc_dhshared_key(buffer_utils_1.base64.open(senderPKey), buffer_utils_1.base64.open(recipKey.pair.skey.k));
+        const masterDecr = (0, async_cryptor_wrap_1.makeDecryptor)(cryptor, workLabel, msgMasterKey);
         try {
             const mainObjFileKey = await masterDecr.open(h.subarray(0, msgKeyPackLen));
-            const info = {
+            const decrInfo = {
                 correspondent: undefined,
                 keyStatus: recipKey.role,
                 key: mainObjFileKey,
                 msgKeyPackLen
             };
-            return info;
+            return { decrInfo, introKey: recipKey.pair };
         }
         catch (err) {
             if (!err.failedCipherVerification) {
@@ -162,60 +92,35 @@ class Keyrings {
             masterDecr.destroy();
         }
     }
-    findEstablishedReceptionPairs(pid) {
-        const emails = this.pairIdToEmailMap.getEmails(pid);
-        if (!emails) {
-            return;
-        }
-        const decryptors = [];
-        for (const email of emails) {
-            const ck = this.corrKeys.get(email);
-            if (!ck) {
-                return;
-            }
-            const rp = ck.getReceivingPair(pid);
-            if (!rp) {
-                return;
-            }
-            decryptors.push({
-                correspondent: email,
-                role: rp.role,
-                pair: rp.pair
-            });
-        }
-        return decryptors;
-    }
-    async decryptMsgKeyWithEstablishedPair(pid, getMainObjHeader) {
-        const pairs = this.findEstablishedReceptionPairs(pid);
+    async function decryptMsgKeyWithEstablishedPair(pid, getMainObjHeader) {
+        const pairs = peerKeys.findEstablishedReceptionPairs(pid);
         if (!pairs) {
             return;
         }
         // try to open main object's file key from a header
         const h = await getMainObjHeader();
-        for (const { correspondent, pair, role } of pairs) {
-            const masterKey = buffer_utils_1.base64.open(pair.msgMasterKey);
-            const masterDecr = (0, async_cryptor_wrap_1.makeDecryptor)(this.cryptor, this.workLabel, masterKey);
-            masterKey.fill(0);
+        for (const { msgMasterKey, pairAlg, peerCAddr, ratchetStage, peerKId, recipientKId } of pairs) {
+            const masterDecr = (0, async_cryptor_wrap_1.makeDecryptor)(cryptor, workLabel, msgMasterKey);
+            msgMasterKey.fill(0);
             try {
-                const msgKeyPackLen = msgKeyPackLenForPair(pair);
+                const msgKeyPackLen = (0, common_1.msgKeyPackSizeFor)(pairAlg);
                 if (h.length < msgKeyPackLen) {
                     continue;
                 }
                 const mainObjFileKey = await masterDecr.open(h.subarray(0, msgKeyPackLen));
                 const keyInfo = {
-                    correspondent: correspondent,
-                    keyStatus: role,
+                    correspondent: peerKeys.getPeerAddressForCanonical(peerCAddr) || peerCAddr,
+                    keyStatus: ratchetStage,
                     key: mainObjFileKey,
                     msgKeyPackLen
                 };
                 // set pair as in use
                 if (keyInfo.keyStatus === 'suggested') {
-                    const corrKeys = this.corrKeys.get(keyInfo.correspondent);
-                    corrKeys.markPairAsInUse(pair);
+                    await peerKeys.markPairAsInUse(peerCAddr, peerKId, recipientKId);
                 }
                 return {
                     keyInfo,
-                    incrMsgCount: msgCount => this.updateReceivedMsgCountIn(pair, msgCount)
+                    incrMsgCount: msgCount => peerKeys.updateReceivedMsgCountIn(peerCAddr, peerKId, recipientKId, msgCount, Date.now())
                 };
             }
             catch (err) {
@@ -228,58 +133,13 @@ class Keyrings {
             }
         }
     }
-    /**
-     * This method updates message counts and a timestamp in a given reception
-     * pair.
-     * @param rp is a sending pair, in which changes should be done. Note this
-     * must be a shared structure at this point, not a copy of a pair.
-     * @param msgCount is a message count that should be added to the pair.
-     */
-    updateReceivedMsgCountIn(rp, msgCount) {
-        const lastTS = Date.now();
-        if (!rp.receivedMsgs) {
-            rp.receivedMsgs = { counts: [], lastTS };
-        }
-        (0, common_2.addToNumberLineSegments)(rp.receivedMsgs.counts, msgCount);
-        rp.receivedMsgs.lastTS = lastTS;
-        this.saveChanges();
-    }
-    absorbSuggestedNextKeyPair(correspondent, pair) {
-        let ck = this.corrKeys.get(correspondent);
-        if (!ck) {
-            ck = this.addCorrespondent(correspondent);
-        }
-        if (pair.isSenderIntroKey) {
-            const usedIntro = this.publishedKeys.find(pair.senderKid);
-            if (!usedIntro) {
-                throw new Error(`Recently used published intro key is not found`);
-            }
-            ck.ratchetUpSendingPair(pair, usedIntro.pair);
-        }
-        else {
-            ck.ratchetUpSendingPair(pair);
-        }
-        // if (ck) {
-        // 	ck.ratchetUpSendingPair(pair);
-        // } else {
-        // 	if (!pair.isSenderIntroKey) {
-        // 		throw new Error(`Expected addition of correspondent to be done, when new `);
-        // 	}
-        // 	const usedIntro = this.publishedKeys.find(pair.senderKid);
-        // 	if (!usedIntro) {
-        // 		throw new Error(`Recently used published intro key is not found`);
-        // 	}
-        // 	ck = this.addCorrespondent(correspondent);
-        // 	ck.ratchetUpSendingPair(pair, usedIntro.pair);
-        // }
-        this.saveChanges();
-    }
-    async decrypt(msgMeta, getMainObjHeader, getOpenedMsg, checkMidKeyCerts) {
+    async function decrypt(msgMeta, getMainObjHeader, getOpenedMsg, checkMidKeyCerts) {
         let decrInfo;
+        let introKey = undefined;
         let incrMsgCount;
         let openedMsg;
         if (msgMeta.pid) {
-            const r = await this.decryptMsgKeyWithEstablishedPair(msgMeta.pid, getMainObjHeader);
+            const r = await decryptMsgKeyWithEstablishedPair(msgMeta.pid, getMainObjHeader);
             if (!r) {
                 return;
             }
@@ -288,10 +148,12 @@ class Keyrings {
             openedMsg = await getOpenedMsg(decrInfo.key, decrInfo.msgKeyPackLen);
         }
         else {
-            decrInfo = await this.decryptMsgKeyWithIntroPair(msgMeta.recipientKid, msgMeta.senderPKey, getMainObjHeader);
-            if (!decrInfo) {
+            const r = await decryptMsgKeyWithIntroPair(msgMeta.recipientKid, msgMeta.senderPKey, getMainObjHeader);
+            if (!r) {
                 return;
             }
+            decrInfo = r.decrInfo;
+            introKey = r.introKey;
             openedMsg = await getOpenedMsg(decrInfo.key, decrInfo.msgKeyPackLen);
             const certs = openedMsg.introCryptoCerts;
             const { address, pkey } = await checkMidKeyCerts(certs);
@@ -310,46 +172,50 @@ class Keyrings {
             incrMsgCount(openedMsg.msgCount);
         }
         // absorb next crypto
-        const pair = openedMsg.nextCrypto;
-        if (pair) {
+        const suggestedPair = openedMsg.nextCrypto;
+        if (suggestedPair) {
             try {
-                if (msgMeta.recipientKid) {
-                    if (!pair.isSenderIntroKey) {
-                        throw new Error(`Introductory message is not referencing used intro key in the next crypto`);
-                    }
-                    if (msgMeta.recipientKid !== pair.senderKid) {
+                if (introKey) {
+                    if (introKey.pkey.kid !== suggestedPair.senderKid) {
                         throw new Error(`Introductory message is referencing wrong key in the next crypto`);
                     }
+                    await peerKeys.absorbNextPairSuggestedByPeer(decrInfo.correspondent, suggestedPair, introKey);
+                }
+                else {
+                    await peerKeys.absorbNextPairSuggestedByPeer(decrInfo.correspondent, suggestedPair);
                 }
-                this.absorbSuggestedNextKeyPair(decrInfo.correspondent, pair);
             }
             catch (err) {
-                this.logger.logError(err, `Fail to absorb next suggested key for messaging`);
+                logger.logError(err, `Fail to absorb next suggested key for messaging`);
             }
         }
         return { decrInfo, openedMsg };
     }
     ;
-    async close() {
-        await this.publishedKeys.close();
-        await this.storage.close();
+    async function close() {
+        await publishedKeys.close();
+        await peerKeys.close();
     }
-    makeKeyringsCAP() {
+    function makeKeyringsCAP() {
         const w = {
-            introKeyOnASMailServer: this.publishedKeys.makeIntroKeyCAP(),
-            getCorrespondentKeys: async (addr) => {
-                var _a;
-                const cAddr = (0, canonical_address_1.toCanonicalAddress)(addr);
-                return (_a = this.corrKeys.get(cAddr)) === null || _a === void 0 ? void 0 : _a.toInfo();
-            }
+            introKeyOnASMailServer: publishedKeys.makeIntroKeyCAP(),
+            getCorrespondentKeys: async (peerAddr) => peerKeys.getPeerKeysInfo(peerAddr)
         };
         return Object.freeze(w);
     }
-}
-exports.Keyrings = Keyrings;
-Object.freeze(Keyrings.prototype);
-Object.freeze(Keyrings);
-function msgKeyPackLenForPair(p) {
-    return (0, common_1.msgKeyPackSizeFor)(p.recipientKey.skey.alg);
+    function forASMail() {
+        return {
+            close,
+            decrypt,
+            generateIntroKeysToSendMsg,
+            getEstablishedKeysToSendMsg,
+            needIntroKeyFor: peerKeys.needIntroKeyFor
+        };
+    }
+    return {
+        close,
+        makeKeyringsCAP,
+        forASMail
+    };
 }
 Object.freeze(exports);

package/build/core/keyring/introductory-keys/published-intro-key.d.ts

@@ -0,0 +1,17 @@
+import { ParamOnServer } from '../../../lib-client/asmail/service-config';
+import { AsyncRNG } from '../../../lib-common/rng-def';
+import { GetSigner } from '../../id-manager';
+import { JWKeyPair, MsgKeyRole } from '../common';
+type WritableFS = web3n.files.WritableFS;
+type IntroKeyCAP = web3n.keys.Keyrings['introKeyOnASMailServer'];
+export declare function makeHolderOfPublishedIntroKey(introKeysFS: WritableFS, getSigner: GetSigner, random: AsyncRNG, pkeyOnServer: ParamOnServer<'init-pub-key'>): Promise<{
+    startExpiryCheckProcess: () => void;
+    close: () => Promise<void>;
+    makeIntroKeyCAP: () => IntroKeyCAP;
+    find: (kid: string) => {
+        role: MsgKeyRole;
+        pair: JWKeyPair;
+        replacedAt?: number;
+    } | undefined;
+}>;
+export {};

package/build/core/keyring/introductory-keys/published-intro-key.js

@@ -0,0 +1,190 @@
+"use strict";
+/*
+ Copyright (C) 2015 - 2018, 2025 - 2026 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeHolderOfPublishedIntroKey = makeHolderOfPublishedIntroKey;
+const single_file_1 = require("../../../lib-common/dataset-sync/single-file");
+const jwkeys_1 = require("../../../lib-common/jwkeys");
+const common_1 = require("../common");
+const INTRO_KEY_VALIDITY = 31 * 24 * 60 * 60;
+const UPDATE_BEFORE_EXPIRY = 7 * 24 * 60 * 60;
+const MAX_NUM_OF_PREV = 3;
+const INTRO_KEY_ON_SERVER_FILE = `published-on-server.json`;
+async function makeHolderOfPublishedIntroKey(introKeysFS, getSigner, random, pkeyOnServer) {
+    var _a;
+    const keysFile = await (0, single_file_1.initSyncedFile)(introKeysFS, INTRO_KEY_ON_SERVER_FILE, newFile => newFile.writeJSON({ previous: [] }));
+    let keys;
+    async function setKeysFromFile() {
+        keys = await keysFile.readJSON();
+    }
+    await setKeysFromFile();
+    const { changeProc, stopFileWatching, triggerUpload } = (0, single_file_1.watchAndApplyChangesFromOtherDevices)(keysFile, () => changeProc.startOrChain(setKeysFromFile), doOnConflict);
+    if (keysFile.isNew) {
+        await update();
+    }
+    updateIfCurrentExpired();
+    let periodicExpiryCheck = setTimeout(updateIfCurrentExpired, UPDATE_BEFORE_EXPIRY * 1000 / 20);
+    (_a = periodicExpiryCheck.unref) === null || _a === void 0 ? void 0 : _a.call(periodicExpiryCheck);
+    async function makeNewIntroKey() {
+        const signer = await getSigner();
+        const pair = await (0, common_1.generateKeyPair)(random);
+        const certs = {
+            pkeyCert: signer.certifyPublicKey(pair.pkey, INTRO_KEY_VALIDITY),
+            userCert: signer.userCert,
+            provCert: signer.providerCert
+        };
+        pair.createdAt = Date.now();
+        return { pair, certs };
+    }
+    function update() {
+        return changeProc.startOrChain(async () => {
+            const { certs, pair: keyPair } = await makeNewIntroKey();
+            await pkeyOnServer.setOnServer(certs);
+            retireCurrent(keyPair.createdAt);
+            keys.current = { keyPair, certs };
+            await keysFile.writeJSON(keys);
+            triggerUpload();
+            return certs;
+        });
+    }
+    ;
+    function retireCurrent(retiredAt) {
+        if (!keys.current) {
+            return;
+        }
+        const current = keys.current;
+        current.keyPair.retiredAt = retiredAt;
+        keys.previous.push(current.keyPair);
+        if (keys.previous.length > MAX_NUM_OF_PREV) {
+            keys.previous.splice(0, keys.previous.length - MAX_NUM_OF_PREV);
+        }
+        keys.current = undefined;
+    }
+    function doOnConflict() {
+        return changeProc.startOrChain(async () => {
+            var _a, _b, _c, _d, _e, _f;
+            const { remote } = await keysFile.v.sync.status(false);
+            if (!remote) {
+                return;
+            }
+            const onRemote = (await keysFile.v.readJSON({ remoteVersion: remote.latest })).json;
+            if (((_a = onRemote.current) === null || _a === void 0 ? void 0 : _a.keyPair.pkey.kid) === ((_b = keys.current) === null || _b === void 0 ? void 0 : _b.keyPair.pkey.kid)) {
+                await keysFile.v.sync.adoptRemote();
+                return;
+            }
+            const certsOnServer = await pkeyOnServer.getFromServer();
+            const currentOnServer = (certsOnServer ? (0, jwkeys_1.getPubKey)(certsOnServer.pkeyCert) : undefined);
+            if ((currentOnServer === null || currentOnServer === void 0 ? void 0 : currentOnServer.kid) === ((_c = keys.current) === null || _c === void 0 ? void 0 : _c.keyPair.pkey.kid)) {
+                await keysFile.v.sync.upload({ uploadVersion: remote.latest + 1 });
+            }
+            else if ((currentOnServer === null || currentOnServer === void 0 ? void 0 : currentOnServer.kid) === ((_d = onRemote.current) === null || _d === void 0 ? void 0 : _d.keyPair.pkey.kid)) {
+                await keysFile.v.sync.adoptRemote({ remoteVersion: remote.latest });
+            }
+            else {
+                await pkeyOnServer.setOnServer((_f = (_e = keys.current) === null || _e === void 0 ? void 0 : _e.certs) !== null && _f !== void 0 ? _f : null);
+                await keysFile.v.sync.upload({ uploadVersion: remote.latest + 1 });
+            }
+        })
+            .catch((exc) => {
+            if (exc.type === 'connect') {
+                // XXX need to have watcher for connection to complete upload
+                //     Should this whole try-to-connect method be generic to reuse it?
+            }
+        });
+    }
+    /**
+     * This looks for a published key with a given key id. If it is found, an
+     * object is returned with following fields:
+     * - pair is JWK key pair;
+     * - role of a found key pair;
+     * - replacedAt field is present for a previously published key pair,
+     * telling, in milliseconds, when this key was superseded a newer one.
+     * Undefined is returned, when a key is not found.
+     * @param kid
+     * @return if key is found, object with following fields is returned:
+     */
+    function find(kid) {
+        // check current key
+        if (keys.current
+            && (keys.current.keyPair.skey.kid === kid)) {
+            return {
+                role: 'published_intro',
+                pair: keys.current.keyPair
+            };
+        }
+        // check previous key
+        const pair = keys.previous.find(({ skey }) => (skey.kid === kid));
+        if (pair) {
+            return {
+                role: 'prev_published_intro',
+                pair,
+                replacedAt: pair.retiredAt
+            };
+        }
+        // if nothing found, explicitly return undefined
+        return;
+    }
+    function makeIntroKeyCAP() {
+        const w = {
+            getCurrent,
+            makeAndPublishNew: update,
+            remove: removeCurrent
+        };
+        return Object.freeze(w);
+    }
+    async function getCurrent() {
+        var _a;
+        const certs = (_a = keys.current) === null || _a === void 0 ? void 0 : _a.certs;
+        return (certs ? certs : null);
+    }
+    async function removeCurrent() {
+        if (!keys.current) {
+            return;
+        }
+        return changeProc.startOrChain(async () => {
+            await pkeyOnServer.setOnServer(null);
+            retireCurrent(Math.floor(Date.now() / 1000));
+            await keysFile.writeJSON(keys);
+            triggerUpload();
+        });
+    }
+    function updateIfCurrentExpired() {
+        if (!keys.current) {
+            return;
+        }
+        const { pkeyCert } = keys.current.certs;
+        const expiryInSeconds = (0, jwkeys_1.getKeyCert)(pkeyCert).expiresAt;
+        const now = Math.floor(Date.now() / 1000);
+        if (expiryInSeconds < (now + UPDATE_BEFORE_EXPIRY)) {
+            update();
+        }
+    }
+    async function close() {
+        stopFileWatching();
+        if (periodicExpiryCheck) {
+            clearTimeout(periodicExpiryCheck);
+            periodicExpiryCheck = undefined;
+        }
+    }
+    return {
+        startExpiryCheckProcess: updateIfCurrentExpired,
+        close,
+        makeIntroKeyCAP,
+        find
+    };
+}
+Object.freeze(exports);