@keri-ts/verifier 0.0.0-stage → 2.0.1

package/esm/verifier/npm/src/src/agent.js

@@ -0,0 +1,515 @@
+/**
+ * Sally-like verifier agent pipeline.
+ *
+ * Source of truth:
+ * - accepted `/ipex/grant` EXNs in `Baser.exns`
+ * - embedded credential/TEL/KEL artifacts in `Baser.epath`
+ * - saved credentials and TEL state in `Reger`
+ * - TEL revocation cues from the shared runtime cue deck
+ *
+ * `Notifier` rows are intentionally not consumed here; they remain operator
+ * visibility, matching the roadmap contract.
+ */
+import { Dater, Ilks, Prefixer, Vrsn_1_0 } from "cesr-ts";
+import { credentialSaidFromGrant, IPEX_GRANT_ROUTE, makeNowIso8601, processCredentialPresentationArtifacts, storedGrantArtifacts, ValidationError, } from "keri-ts/runtime";
+import { validateCredential } from "./policy.js";
+import { postWebhook, webhookBody } from "./webhook.js";
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
+/** Sally-like verifier processor for one `Habery`/`Reger` runtime. */
+export class VerifierAgent {
+    /**
+     * Borrow the configured stores, protocol owner and webhook policy; open no runtime or background worker.
+     *
+     * @param hby Borrowed local identities and accepted-state stores.
+     * @param reger Borrowed credential/TEL evidence store.
+     * @param cdb Borrowed durable pending/ready/acknowledged webhook store.
+     * @param protocol Borrowed shared processor for grant prerequisites and scheduled escrow advancement.
+     * @param cues Application cue Deck; only matching revocation cues are consumed.
+     * @param http Borrowed HTTP implementation selected by composition.
+     * @param now Required epoch-millisecond function, bound to its clock; used for local admission, webhook headers and expiry.
+     * @param validators Schema-SAID-to-business-validator table, shallow-copied at construction.
+     * @param options Webhook URL, child genus, expiry window (default ten minutes), and known-schema policy.
+     */
+    constructor(hby, reger, cdb, protocol, cues, http, now, validators, options) {
+        /** Borrowed identities and accepted exchange/KEL state. */
+        Object.defineProperty(this, "hby", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Borrowed credential and TEL evidence store used to establish current credential state. */
+        Object.defineProperty(this, "reger", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Verifier workflow store for pending, ready and acknowledged webhook records. */
+        Object.defineProperty(this, "cdb", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Borrowed protocol dispatch and escrow owner; artifact intake owns its own parser and Kevery. */
+        Object.defineProperty(this, "protocol", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Application cue flow; this owner consumes revocation cues and preserves unrelated records. */
+        Object.defineProperty(this, "cues", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Borrowed scoped HTTP client used for webhook attempts. */
+        Object.defineProperty(this, "http", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Borrowed epoch-millisecond source used for webhook timestamps and expiry. */
+        Object.defineProperty(this, "now", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Configured webhook destination, independent of protocol peer routing. */
+        Object.defineProperty(this, "hook", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Attachment genus used when settling accepted grant artifacts. */
+        Object.defineProperty(this, "gvrsn", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Existing workflow expiry window; elapsed time is measured by the injected clock. */
+        Object.defineProperty(this, "timeoutMs", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Schema-specific business checks copied from configuration at construction. */
+        Object.defineProperty(this, "validators", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Reject credentials without a configured schema validator when explicitly enabled. */
+        Object.defineProperty(this, "requireKnownSchemas", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "acdcV2", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.hby = hby;
+        this.reger = reger;
+        this.cdb = cdb;
+        this.protocol = protocol;
+        this.cues = cues;
+        this.http = http;
+        this.now = now;
+        this.hook = options.hook;
+        this.gvrsn = options.gvrsn ?? Vrsn_1_0;
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.validators = { ...validators };
+        this.requireKnownSchemas = options.requireKnownSchemas ?? false;
+        this.acdcV2 = options.acdcV2;
+    }
+    /**
+     * Settle verified artifacts and deliver queued webhooks within the caller's operation.
+     *
+     * @returns Per-pass admission, readiness, webhook and rejection counts; no worker is started.
+     */
+    *processOnce() {
+        const result = {
+            grantsQueued: 0,
+            revocationsQueued: 0,
+            presentationsReady: 0,
+            revocationsReady: 0,
+            webhooksSent: 0,
+            webhooksFailed: 0,
+            rejected: 0,
+        };
+        // Settle grant evidence and capture revocations before advancing shared protocol dependencies.
+        result.grantsQueued += yield* this.scanAcceptedGrants();
+        yield* this.processAcdcV2Grants(result);
+        result.revocationsQueued += this.processRevokedCues();
+        yield* this.protocol.processEscrowsOnce();
+        result.revocationsQueued += this.scanPersistedRevocations();
+        // Project accepted evidence into ready work, then observe real webhook delivery outcomes.
+        const presentations = this.processPresentations();
+        result.presentationsReady += presentations.ready;
+        result.rejected += presentations.rejected;
+        result.revocationsReady += this.processRevocations();
+        result.webhooksSent += yield* this.processReady(this.cdb.recv, "iss", result);
+        result.webhooksSent += yield* this.processReady(this.cdb.revk, "rev", result);
+        return result;
+    }
+    /**
+     * Settle grant artifacts before queuing their verified credentials for webhook delivery.
+     *
+     * @returns Number of newly queued presentations after artifact intake and verification.
+     */
+    *scanAcceptedGrants() {
+        let queued = 0;
+        for (const [, grant] of this.hby.db.exns.getTopItemIter()) {
+            if (grant.route !== IPEX_GRANT_ROUTE || !grant.said || grant.pvrsn.major === 2) {
+                continue;
+            }
+            const credentialSaid = credentialSaidFromGrant(grant);
+            if (!credentialSaid || this.hasQueuedOrSent(credentialSaid)) {
+                continue;
+            }
+            const artifacts = storedGrantArtifacts(this.hby, grant, this.gvrsn);
+            yield* processCredentialPresentationArtifacts(this.protocol, artifacts);
+            const creder = this.reger.creds.get([credentialSaid]);
+            if (!creder) {
+                throw new ValidationError(`Credential ${credentialSaid} was not saved after grant artifact processing.`);
+            }
+            const issuer = requireString(creder.issuer, "credential issuer");
+            this.cdb.snd.pin([credentialSaid], new Prefixer({ qb64: issuer }));
+            this.cdb.iss.pin([credentialSaid], nowDater(this.now()));
+            queued += 1;
+        }
+        return queued;
+    }
+    /** ACDC v2 work is keyed by exact Grant, preserving distinct retained partial/full views in the existing tables. */
+    *processAcdcV2Grants(result) {
+        if (!this.acdcV2)
+            return;
+        for (const [, grant] of this.hby.db.exns.getTopItemIter()) {
+            if (grant.route !== IPEX_GRANT_ROUTE || grant.pvrsn.major !== 2 || !grant.said)
+                continue;
+            const said = grant.said;
+            if (this.cdb.rack.get([said]))
+                continue;
+            if (!this.hasQueuedOrSent(said)) {
+                this.cdb.iss.pin([said], nowDater(this.now()));
+                result.grantsQueued++;
+            }
+            const verification = yield* this.acdcV2.verifyCurrent(said), creder = verification.credential;
+            if (verification.kind === "missing")
+                continue;
+            if (verification.kind === "refused" || !creder) {
+                this.cdb.iss.rem([said]);
+                this.cdb.recv.trim([said]);
+                result.rejected++;
+                continue;
+            }
+            const action = verification.kind === "revoked" ? "rev" : "iss";
+            if (action === "rev" && !this.cdb.ack.get([said])) {
+                this.cdb.iss.rem([said]);
+                this.cdb.recv.trim([said]);
+                result.rejected++;
+                continue;
+            }
+            if (action === "iss" && this.cdb.ack.get([said]))
+                continue;
+            if (action === "iss"
+                && validateCredential(creder, this.validators, { hby: this.hby, reger: this.reger }, this.requireKnownSchemas)) {
+                this.cdb.iss.rem([said]);
+                result.rejected++;
+                continue;
+            }
+            const ready = action === "iss" ? this.cdb.recv : this.cdb.revk;
+            const waiting = [...ready.getTopItemIter([said, ""])][0];
+            const dater = this.cdb.iss.get([said]) ?? (waiting ? new Dater({ qb64: waiting[0][1] }) : nowDater(this.now()));
+            if (this.expired(dater)) {
+                this.cdb.iss.rem([said]);
+                ready.trim([said]);
+                continue;
+            }
+            ready.pin([said, dater.qb64], creder);
+            this.cdb.snd.pin([said], new Prefixer({ qb64: creder.issuer }));
+            this.cdb.iss.rem([said]);
+            if (action === "iss")
+                result.presentationsReady++;
+            else
+                result.revocationsReady++;
+            const payload = webhookBody(creder, action, null);
+            payload.data.grant = said;
+            payload.data.presenter = grant.pre;
+            payload.data.verifier = this.acdcV2.hab.pre;
+            payload.data.observations = verification.observations;
+            if (yield* postWebhook(this.http, this.now, this.hook, payload)) {
+                ready.rem([said, dater.qb64]);
+                (action === "iss" ? this.cdb.ack : this.cdb.rack).pin([said], creder);
+                result.webhooksSent++;
+            }
+            else
+                result.webhooksFailed++;
+        }
+    }
+    /** Consume a finite revocation-cue pass, restoring unrelated and failed records in their original order. */
+    processRevokedCues() {
+        const retained = [];
+        const count = this.cues.length;
+        let queued = 0;
+        try {
+            for (let index = 0; index < count; index++) {
+                const cue = this.cues.pull();
+                if (!cue)
+                    break;
+                if (cue.kin !== "revoked")
+                    retained.push(cue);
+                else {
+                    try {
+                        queued += this.queueRevocation(cue);
+                    }
+                    catch (error) {
+                        retained.push(cue);
+                        throw error;
+                    }
+                }
+            }
+        }
+        finally {
+            for (const cue of retained.reverse())
+                this.cues.prepend(cue);
+        }
+        return queued;
+    }
+    /**
+     * Publish existing durable revocation work synchronously; caller retains source ownership through failure.
+     *
+     * @param cue Accepted credential revocation observation; uses injected local time for workflow admission.
+     * @returns One for newly queued work, otherwise zero.
+     */
+    queueRevocation(cue) {
+        const said = cue.serder.pre;
+        if (!said || this.hasRevocationQueuedOrSent(said))
+            return 0;
+        const creder = this.reger.creds.get([said]);
+        if (creder?.issuer)
+            this.cdb.snd.pin([said], new Prefixer({ qb64: creder.issuer }));
+        this.cdb.rev.pin([said], nowDater(this.now()));
+        return 1;
+    }
+    /**
+     * Recover revocation work from saved credentials backed by an accepted IPEX grant.
+     *
+     * @returns Number of revocations recovered from accepted persisted evidence.
+     */
+    scanPersistedRevocations() {
+        let queued = 0;
+        for (const [keys] of this.reger.saved.getTopItemIter()) {
+            const said = keys[0];
+            if (!said || this.hasRevocationQueuedOrSent(said)) {
+                continue;
+            }
+            const creder = this.reger.creds.get([said]);
+            if (!creder || !this.hasAcceptedGrantForCredential(said)) {
+                continue;
+            }
+            const state = credentialState(this.reger, creder);
+            if (!state || (state.et !== Ilks.rev && state.et !== Ilks.brv)) {
+                continue;
+            }
+            if (creder.issuer) {
+                this.cdb.snd.pin([said], new Prefixer({ qb64: creder.issuer }));
+            }
+            this.cdb.rev.pin([said], nowDater(this.now()));
+            queued += 1;
+        }
+        return queued;
+    }
+    /** Move accepted, unexpired and business-valid credentials into the ready presentation store. */
+    processPresentations() {
+        let ready = 0;
+        let rejected = 0;
+        for (const [keys, dater] of [...this.cdb.iss.getTopItemIter()]) {
+            const said = keys[0];
+            if (!said) {
+                continue;
+            }
+            if (this.expired(dater)) {
+                this.cdb.iss.rem([said]);
+                continue;
+            }
+            if (this.reger.saved.get([said]) === null) {
+                continue;
+            }
+            const creder = this.reger.creds.get([said]);
+            if (!creder) {
+                continue;
+            }
+            const state = credentialState(this.reger, creder);
+            if (!state) {
+                continue;
+            }
+            if (state.et === Ilks.rev || state.et === Ilks.brv) {
+                this.cdb.iss.rem([said]);
+                continue;
+            }
+            const rejection = validateCredential(creder, this.validators, { hby: this.hby, reger: this.reger }, this.requireKnownSchemas);
+            if (rejection) {
+                this.cdb.iss.rem([said]);
+                rejected += 1;
+                continue;
+            }
+            this.cdb.recv.pin([said, dater.qb64], creder);
+            this.cdb.iss.rem([said]);
+            ready += 1;
+        }
+        return { ready, rejected };
+    }
+    /** Move confirmed revocations into the ready revocation store, retaining unresolved evidence. */
+    processRevocations() {
+        let ready = 0;
+        for (const [keys, dater] of [...this.cdb.rev.getTopItemIter()]) {
+            const said = keys[0];
+            if (!said) {
+                continue;
+            }
+            if (this.expired(dater)) {
+                this.cdb.rev.rem([said]);
+                continue;
+            }
+            const creder = this.reger.creds.get([said]);
+            if (!creder) {
+                continue;
+            }
+            const state = credentialState(this.reger, creder);
+            if (!state || state.et === Ilks.iss || state.et === Ilks.bis) {
+                continue;
+            }
+            if (state.et === Ilks.rev || state.et === Ilks.brv) {
+                if (creder.issuer) {
+                    this.cdb.snd.pin([said], new Prefixer({ qb64: creder.issuer }));
+                }
+                this.cdb.rev.rem([said]);
+                this.cdb.revk.pin([said, dater.qb64], creder);
+                ready += 1;
+            }
+        }
+        return ready;
+    }
+    /** Deliver each ready webhook before recording success or applying its expiry policy. */
+    *processReady(db, action, result) {
+        let sent = 0;
+        for (const [keys, creder] of [...db.getTopItemIter()]) {
+            const [said, daterQb64] = keys;
+            if (said && this.hby.db.exns.get([said])?.pvrsn.major === 2)
+                continue;
+            if (!said || !daterQb64) {
+                continue;
+            }
+            let state = null;
+            if (action === "rev")
+                state = credentialState(this.reger, creder);
+            const payload = webhookBody(creder, action, state);
+            const accepted = yield* postWebhook(this.http, this.now, this.hook, payload);
+            if (accepted) {
+                db.rem([said, daterQb64]);
+                if (action === "iss") {
+                    this.cdb.ack.pin([said], creder);
+                }
+                else {
+                    this.cdb.rack.pin([said], creder);
+                }
+                sent += 1;
+                continue;
+            }
+            result.webhooksFailed += 1;
+            const dater = new Dater({ qb64: daterQb64 });
+            if (this.expired(dater)) {
+                db.rem([said, daterQb64]);
+            }
+        }
+        return sent;
+    }
+    /** Avoid duplicate presentation work already pending, ready or acknowledged. */
+    hasQueuedOrSent(said) {
+        return this.cdb.iss.get([said]) !== null
+            || this.cdb.ack.get([said]) !== null
+            || this.hasReady(this.cdb.recv, said);
+    }
+    /** Avoid duplicate revocation work already pending, ready or acknowledged. */
+    hasRevocationQueuedOrSent(said) {
+        return this.cdb.rev.get([said]) !== null
+            || this.cdb.rack.get([said]) !== null
+            || this.hasReady(this.cdb.revk, said);
+    }
+    /** Require an accepted grant for this credential before recovering its revocation notification. */
+    hasAcceptedGrantForCredential(said) {
+        for (const [, grant] of this.hby.db.exns.getTopItemIter()) {
+            if (grant.route === IPEX_GRANT_ROUTE && credentialSaidFromGrant(grant) === said) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /** Look up existing ready work by credential without consuming another delivery record. */
+    hasReady(db, said) {
+        for (const [keys] of db.getTopItemIter([said, ""])) {
+            if (keys[0] === said) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Compare workflow age against the injected epoch clock.
+     * Ready work is attempted before expiry is checked after refusal. Expiry removes
+     * that ready row; it is not a permanent tombstone preventing later rediscovery.
+     *
+     * @param dater Persisted local workflow admission time encoded as a CESR Dater.
+     * @returns True only when elapsed injected wall time is strictly greater than timeoutMs.
+     */
+    expired(dater) {
+        return this.now() - new Date(dater.dts).getTime() > this.timeoutMs;
+    }
+}
+/** Read the existing legacy Reger observer state; this application does not interpret ACDC v2 registries. */
+function credentialState(reger, creder) {
+    const regk = creder.regid;
+    const said = creder.said;
+    if (!regk || !said) {
+        return null;
+    }
+    const tever = reger.tevers.get(regk);
+    if (!isRecord(tever) || typeof tever.vcState !== "function") {
+        return null;
+    }
+    return tever.vcState(said);
+}
+/**
+ * Encode a local workflow timestamp from the same epoch-millisecond source used for expiry.
+ *
+ * @param now Local epoch milliseconds from the injected verifier clock.
+ * @returns CESR Dater used for durable workflow admission, not the signed protocol timestamp.
+ */
+function nowDater(now) {
+    return new Dater({ dts: makeNowIso8601(new Date(now)) });
+}
+/** Refuse absent signed identifiers before writing workflow coordinates. */
+function requireString(value, label) {
+    if (!value) {
+        throw new ValidationError(`Missing ${label}.`);
+    }
+    return value;
+}
+/** Narrow structural provider/attribute data at the public protocol boundary. */
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/esm/verifier/npm/src/src/cue-store.js

@@ -0,0 +1,134 @@
+/**
+ * Sally-like verifier communication cue database.
+ *
+ * These application records remain outside protocol Baser/Reger evidence.
+ * ack/rack mark local HTTP success, not business receipts or KERI acknowledgements.
+ * This is Sally-inspired workflow state, not a claim of exact Sally storage parity.
+ */
+import { Dater, Prefixer, SerderACDC } from "cesr-ts";
+import { CesrSuber, LMDBer, SerderSuber } from "keri-ts/db";
+import { DatabaseNotOpenError } from "keri-ts/runtime";
+/** Durable local workflow records for pending, ready and delivered webhook work. */
+export class VerifierCueBaser extends LMDBer {
+    constructor(options = {}) {
+        const compat = options.compat ?? false;
+        super(options, {
+            tailDirPath: VerifierCueBaser.TailDirPath,
+            cleanTailDirPath: "keri/clean/verifier",
+            altTailDirPath: compat ? VerifierCueBaser.CompatAltTailDirPath : VerifierCueBaser.AltTailDirPath,
+            altCleanTailDirPath: compat ? ".keri/clean/verifier" : ".tufa/clean/verifier",
+            tempPrefix: VerifierCueBaser.TempPrefix,
+        });
+        Object.defineProperty(this, "snd", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "iss", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "rev", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "recv", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "revk", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "ack", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "rack", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+    }
+    /** Open ordinary LMDB storage and bind this application's typed tables. */
+    *reopen(options = {}) {
+        const opened = yield* super.reopen(options);
+        if (!opened) {
+            return false;
+        }
+        this.snd = new CesrSuber(this, { subkey: "snd.", ctor: Prefixer });
+        this.iss = new CesrSuber(this, { subkey: "iss.", ctor: Dater });
+        this.rev = new CesrSuber(this, { subkey: "rev.", ctor: Dater });
+        this.recv = new SerderSuber(this, { subkey: "recv", ctor: SerderACDC });
+        this.revk = new SerderSuber(this, { subkey: "revk", ctor: SerderACDC });
+        this.ack = new SerderSuber(this, { subkey: "ack", ctor: SerderACDC });
+        this.rack = new SerderSuber(this, { subkey: "rack", ctor: SerderACDC });
+        return true;
+    }
+    /** Clear workflow records, including the existing local delivered markers. */
+    clearEscrows() {
+        this.iss.trim();
+        this.rev.trim();
+        this.recv.trim();
+        this.revk.trim();
+        this.ack.trim();
+        this.rack.trim();
+    }
+    /** Snapshot application row counts for command output, never protocol acceptance. */
+    getCounts() {
+        return {
+            senders: this.snd.cntAll(),
+            iss: this.iss.cntAll(),
+            rev: this.rev.cntAll(),
+            recv: this.recv.cntAll(),
+            revk: this.revk.cntAll(),
+            ack: this.ack.cntAll(),
+            rack: this.rack.cntAll(),
+        };
+    }
+}
+Object.defineProperty(VerifierCueBaser, "TailDirPath", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: "keri/verifier"
+});
+Object.defineProperty(VerifierCueBaser, "AltTailDirPath", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: ".tufa/verifier"
+});
+Object.defineProperty(VerifierCueBaser, "CompatAltTailDirPath", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: ".keri/verifier"
+});
+Object.defineProperty(VerifierCueBaser, "TempPrefix", {
+    enumerable: true,
+    configurable: true,
+    writable: true,
+    value: "keri_verifier_"
+});
+/** Open a verifier cue sidecar and return the ready-to-use databaser. */
+export function* createVerifierCueBaser(options = {}) {
+    const cdb = new VerifierCueBaser(options);
+    const opened = yield* cdb.reopen(options);
+    if (!opened) {
+        throw new DatabaseNotOpenError("Failed to open VerifierCueBaser");
+    }
+    return cdb;
+}

package/esm/verifier/npm/src/src/policy.js

@@ -0,0 +1,45 @@
+/** Return a business refusal reason without modifying accepted protocol evidence. */
+export function validateCredential(creder, validators, context, requireKnownSchemas) {
+    const schema = credentialSchema(creder);
+    if (!schema) {
+        return "missing credential schema";
+    }
+    const validator = validators[schema];
+    if (!validator) {
+        return requireKnownSchemas ? `unsupported credential schema ${schema}` : null;
+    }
+    const result = validator(creder, context);
+    if (typeof result === "string") {
+        return result;
+    }
+    return result === false ? `credential ${creder.said ?? "<unknown>"} failed business validation` : null;
+}
+/** Build validators from a local JSON config object. */
+export function validatorsFromVerifierConfig(config) {
+    if (!isRecord(config) || !isRecord(config.schemas)) {
+        return {};
+    }
+    const validators = {};
+    for (const [schema, policy] of Object.entries(config.schemas)) {
+        if (!isRecord(policy)) {
+            continue;
+        }
+        validators[schema] = (creder) => {
+            const issuer = typeof policy.issuer === "string" ? policy.issuer : "";
+            if (issuer && creder.issuer !== issuer) {
+                return `expected issuer ${issuer}, got ${creder.issuer ?? "<missing>"}`;
+            }
+            return true;
+        };
+    }
+    return validators;
+}
+/** Match the application's supported schema-SAID projection for policy and webhook consumers. */
+export function credentialSchema(creder) {
+    const schema = creder.schema;
+    return typeof schema === "string" ? schema : isRecord(schema) && typeof schema.$id === "string" ? schema.$id : "";
+}
+/** Narrow operator JSON mappings without imposing protocol or schema validation here. */
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}