@keri-ts/verifier 0.0.0-stage → 2.0.1

package/esm/verifier/npm/src/src/webhook.js

@@ -0,0 +1,58 @@
+import { call } from "effection";
+import { TransportError } from "keri-ts/runtime";
+import { credentialSchema } from "./policy.js";
+/** Project an accepted credential and selected revocation state without changing protocol evidence. */
+export function webhookBody(creder, action, state) {
+    const actor = creder.issuer ?? "";
+    const data = action === "iss" ? presentationPayload(creder) : revocationPayload(creder, state);
+    return { action, actor, data };
+}
+/** Preserve the supported legacy attribute projection; this adds no authentication. */
+function presentationPayload(creder) {
+    const attrs = isRecord(creder.attrib) ? creder.attrib : {};
+    return {
+        schema: credentialSchema(creder),
+        issuer: creder.issuer,
+        issueTimestamp: typeof attrs.dt === "string" ? attrs.dt : undefined,
+        credential: creder.said,
+        recipient: typeof attrs.i === "string" ? attrs.i : undefined,
+        attributes: attrs,
+        edge: creder.edge ?? undefined,
+    };
+}
+/** Report the accepted TEL timestamp rather than the local delivery-attempt clock. */
+function revocationPayload(creder, state) {
+    return {
+        schema: credentialSchema(creder),
+        credential: creder.said,
+        revocationTimestamp: state?.dt,
+    };
+}
+/** Return HTTP success only after response cleanup; no receipt or exactly-once delivery is inferred. */
+export function* postWebhook(http, now, hook, body) {
+    const raw = JSON.stringify(body);
+    try {
+        return yield* call(function* () {
+            const response = yield* http.open(hook, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    "sally-resource": String(body.data.schema ?? ""),
+                    "sally-timestamp": new Date(now()).toISOString(),
+                },
+                body: raw,
+            });
+            // Returning from this call scope closes the unread response before publishing success.
+            return response.ok;
+        });
+    }
+    catch (error) {
+        if (error instanceof TransportError)
+            return false;
+        throw error;
+    }
+}
+/** ACDC attributes are protocol/schema data; narrow the mapping before projecting webhook fields. */
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@keri-ts/verifier",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2.0.1",
+  "description": "Credential verifier application policy, workflow storage and webhooks",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kentbull/keri-ts.git",
+    "directory": "packages/verifier"
+  },
+  "license": "Apache-2.0",
+  "main": "./esm/verifier/npm/src/mod.js",
+  "module": "./esm/verifier/npm/src/mod.js",
+  "types": "./types/mod.d.ts",
+  "exports": {
+    ".": {
+      "types": "./types/mod.d.ts",
+      "import": "./esm/verifier/npm/src/mod.js"
+    }
+  },
+  "scripts": {
+    "test": "node --version"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "esm",
+    "types",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20.3"
+  },
+  "dependencies": {
+    "@keri-ts/registrar": "2.0.1",
+    "cesr-ts": "2.0.0",
+    "effection": "^3.6.0",
+    "keri-ts": "2.0.1",
+    "@deno/shim-deno": "~0.18.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.9.0"
+  },
+  "_generatedBy": "dnt@dev"
+}

package/types/mod.d.ts

@@ -0,0 +1,7 @@
+/** Verifier application package entrypoint. */
+export { type AcdcV2Observation, type AcdcV2Verification, AcdcV2Verifier, type AcdcV2VerifierOptions, type HistoricalInspection, } from "./src/acdc-v2.js";
+export { VerifierAgent, type VerifierAgentOptions, type VerifierAgentProcessResult } from "./src/agent.js";
+export { createVerifierCueBaser, VerifierCueBaser, type VerifierCueBaserOptions, type VerifierCueCounts, } from "./src/cue-store.js";
+export { validatorsFromVerifierConfig, type VerifierBusinessValidator, type VerifierBusinessValidatorContext, } from "./src/policy.js";
+export type { VerifierWebhookBody } from "./src/webhook.js";
+//# sourceMappingURL=mod.d.ts.map

package/types/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,KAAK,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC3G,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,4BAA4B,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,GACtC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/types/src/acdc-v2.d.ts

@@ -0,0 +1,58 @@
+/** Exact retained IPEX views and current configured-source policy; no credential-view enrichment. */
+import type { Registrar } from "@keri-ts/registrar";
+import { type SerderACDC } from "cesr-ts";
+import { type Operation } from "effection";
+import { type ExchangeRegistryStateShape } from "keri-ts/db";
+import { type Exchanger, type Hab, type Habery, type HttpClient } from "keri-ts/runtime";
+/** Recent observation of an exact locally authenticated head from one configured TLS endpoint. */
+export interface AcdcV2Observation {
+    registry: string;
+    source: string;
+    head: string;
+    observedAt: string;
+}
+/** Historical proof validity carries no current-standing, business-policy or delivery claim. */
+export interface HistoricalInspection {
+    purpose: "historical-evidence";
+    proofValidity: "valid";
+    currentStanding: "not-evaluated";
+    grant: string;
+    credential: SerderACDC | null;
+    views: {
+        credential: string;
+        view: string;
+    }[];
+    /** Last authenticated per-node observation; optional omissions can retain earlier facts. Never current authority. */
+    recordedRegistryStates: (ExchangeRegistryStateShape & {
+        node: string;
+    })[];
+}
+/** Unavailable evidence remains separate from a known policy refusal or public revocation. */
+export interface AcdcV2Verification {
+    kind: "issued" | "revoked" | "missing" | "refused";
+    credential: SerderACDC | null;
+    observations: AcdcV2Observation[];
+}
+export interface AcdcV2VerifierOptions {
+    source: string;
+    maximumAgeMs: number;
+    requestTimeoutMs: number;
+    now: () => number;
+}
+/** Borrow accepted exchange/public evidence owners; acquire no stores, parser or background worker. */
+export declare class AcdcV2Verifier {
+    readonly hby: Habery;
+    readonly hab: Hab;
+    readonly exc: Exchanger;
+    readonly evidence: Registrar;
+    readonly http: HttpClient;
+    readonly options: AcdcV2VerifierOptions;
+    constructor(hby: Habery, hab: Hab, exc: Exchanger, evidence: Registrar, http: HttpClient, options: AcdcV2VerifierOptions);
+    /** Inspect the immutable retained nested material without querying, reporting or applying graph policy. */
+    inspectHistorical(grant: string): HistoricalInspection;
+    /** Authenticate one complete source response and its exact accepted head, never infer global latest state. */
+    private observe;
+    /** Require shared graph approval and full current standing over the exact retained credential views. */
+    verifyCurrent(grant: string): Operation<AcdcV2Verification>;
+}
+//# sourceMappingURL=acdc-v2.d.ts.map

package/types/src/acdc-v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acdc-v2.d.ts","sourceRoot":"","sources":["../../src/src/acdc-v2.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAmE,KAAK,UAAU,EAAY,MAAM,SAAS,CAAC;AACrH,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,KAAK,0BAA0B,EAAa,MAAM,YAAY,CAAC;AACxE,OAAO,EAML,KAAK,SAAS,EACd,KAAK,GAAG,EACR,KAAK,MAAM,EACX,KAAK,UAAU,EAWhB,MAAM,iBAAiB,CAAC;AAEzB,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AACD,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE,eAAe,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9C,qHAAqH;IACrH,sBAAsB,EAAE,CAAC,0BAA0B,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;CAC3E;AACD,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACnD,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,iBAAiB,EAAE,CAAC;CACnC;AACD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,uGAAuG;AACvG,qBAAa,cAAc;IAEvB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,GAAG,EAAE,GAAG;IACjB,QAAQ,CAAC,GAAG,EAAE,SAAS;IACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,qBAAqB;gBAL9B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,SAAS,EACnB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,qBAAqB;IAczC,2GAA2G;IAC3G,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB;IA4BtD,8GAA8G;IAC9G,OAAO,CAAE,OAAO;IAqChB,wGAAwG;IACvG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC,kBAAkB,CAAC;CA4G7D"}

package/types/src/agent.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Sally-like verifier agent pipeline.
+ *
+ * Source of truth:
+ * - accepted `/ipex/grant` EXNs in `Baser.exns`
+ * - embedded credential/TEL/KEL artifacts in `Baser.epath`
+ * - saved credentials and TEL state in `Reger`
+ * - TEL revocation cues from the shared runtime cue deck
+ *
+ * `Notifier` rows are intentionally not consumed here; they remain operator
+ * visibility, matching the roadmap contract.
+ */
+import { type Versionage } from "cesr-ts";
+import type { Reger } from "keri-ts/db";
+import { type AgentCue, Deck, type Habery, type HttpClient, type ProtocolProcessor } from "keri-ts/runtime";
+import { type Operation } from "effection";
+import type { AcdcV2Verifier } from "./acdc-v2.js";
+import type { VerifierCueBaser } from "./cue-store.js";
+import { type VerifierBusinessValidator } from "./policy.js";
+export interface VerifierAgentProcessResult {
+    grantsQueued: number;
+    revocationsQueued: number;
+    presentationsReady: number;
+    revocationsReady: number;
+    webhooksSent: number;
+    webhooksFailed: number;
+    /** Business-policy refusals in this pass; accepted protocol evidence remains valid and saved. */
+    rejected: number;
+}
+/**
+ * Verifier business/webhook settings; stores, intake, HTTP, time and validators are explicit dependencies.
+ */
+export interface VerifierAgentOptions {
+    /** Webhook destination selected by the verifier operator. */
+    hook: string;
+    /** Attachment genus of grant children, independent of legacy EXN framing. */
+    gvrsn?: Versionage;
+    /** Local workflow expiry window in milliseconds. */
+    timeoutMs?: number;
+    /** Require a schema-specific validator before admitting a credential. */
+    requireKnownSchemas?: boolean;
+    /** Concrete ACDC v2 evidence/current-source owner; omitted keeps the legacy workflow. */
+    acdcV2?: AcdcV2Verifier;
+}
+/** Sally-like verifier processor for one `Habery`/`Reger` runtime. */
+export declare class VerifierAgent {
+    /** Borrowed identities and accepted exchange/KEL state. */
+    readonly hby: Habery;
+    /** Borrowed credential and TEL evidence store used to establish current credential state. */
+    readonly reger: Reger;
+    /** Verifier workflow store for pending, ready and acknowledged webhook records. */
+    readonly cdb: VerifierCueBaser;
+    /** Borrowed protocol dispatch and escrow owner; artifact intake owns its own parser and Kevery. */
+    readonly protocol: ProtocolProcessor;
+    /** Application cue flow; this owner consumes revocation cues and preserves unrelated records. */
+    readonly cues: Deck<AgentCue>;
+    /** Borrowed scoped HTTP client used for webhook attempts. */
+    readonly http: HttpClient;
+    /** Borrowed epoch-millisecond source used for webhook timestamps and expiry. */
+    readonly now: () => number;
+    /** Configured webhook destination, independent of protocol peer routing. */
+    readonly hook: string;
+    /** Attachment genus used when settling accepted grant artifacts. */
+    readonly gvrsn: Versionage;
+    /** Existing workflow expiry window; elapsed time is measured by the injected clock. */
+    readonly timeoutMs: number;
+    /** Schema-specific business checks copied from configuration at construction. */
+    readonly validators: Record<string, VerifierBusinessValidator>;
+    /** Reject credentials without a configured schema validator when explicitly enabled. */
+    readonly requireKnownSchemas: boolean;
+    readonly acdcV2?: AcdcV2Verifier;
+    /**
+     * Borrow the configured stores, protocol owner and webhook policy; open no runtime or background worker.
+     *
+     * @param hby Borrowed local identities and accepted-state stores.
+     * @param reger Borrowed credential/TEL evidence store.
+     * @param cdb Borrowed durable pending/ready/acknowledged webhook store.
+     * @param protocol Borrowed shared processor for grant prerequisites and scheduled escrow advancement.
+     * @param cues Application cue Deck; only matching revocation cues are consumed.
+     * @param http Borrowed HTTP implementation selected by composition.
+     * @param now Required epoch-millisecond function, bound to its clock; used for local admission, webhook headers and expiry.
+     * @param validators Schema-SAID-to-business-validator table, shallow-copied at construction.
+     * @param options Webhook URL, child genus, expiry window (default ten minutes), and known-schema policy.
+     */
+    constructor(hby: Habery, reger: Reger, cdb: VerifierCueBaser, protocol: ProtocolProcessor, cues: Deck<AgentCue>, http: HttpClient, now: () => number, validators: Record<string, VerifierBusinessValidator>, options: VerifierAgentOptions);
+    /**
+     * Settle verified artifacts and deliver queued webhooks within the caller's operation.
+     *
+     * @returns Per-pass admission, readiness, webhook and rejection counts; no worker is started.
+     */
+    processOnce(): Operation<VerifierAgentProcessResult>;
+    /**
+     * Settle grant artifacts before queuing their verified credentials for webhook delivery.
+     *
+     * @returns Number of newly queued presentations after artifact intake and verification.
+     */
+    private scanAcceptedGrants;
+    /** ACDC v2 work is keyed by exact Grant, preserving distinct retained partial/full views in the existing tables. */
+    private processAcdcV2Grants;
+    /** Consume a finite revocation-cue pass, restoring unrelated and failed records in their original order. */
+    private processRevokedCues;
+    /**
+     * Publish existing durable revocation work synchronously; caller retains source ownership through failure.
+     *
+     * @param cue Accepted credential revocation observation; uses injected local time for workflow admission.
+     * @returns One for newly queued work, otherwise zero.
+     */
+    private queueRevocation;
+    /**
+     * Recover revocation work from saved credentials backed by an accepted IPEX grant.
+     *
+     * @returns Number of revocations recovered from accepted persisted evidence.
+     */
+    private scanPersistedRevocations;
+    /** Move accepted, unexpired and business-valid credentials into the ready presentation store. */
+    private processPresentations;
+    /** Move confirmed revocations into the ready revocation store, retaining unresolved evidence. */
+    private processRevocations;
+    /** Deliver each ready webhook before recording success or applying its expiry policy. */
+    private processReady;
+    /** Avoid duplicate presentation work already pending, ready or acknowledged. */
+    private hasQueuedOrSent;
+    /** Avoid duplicate revocation work already pending, ready or acknowledged. */
+    private hasRevocationQueuedOrSent;
+    /** Require an accepted grant for this credential before recovering its revocation notification. */
+    private hasAcceptedGrantForCredential;
+    /** Look up existing ready work by credential without consuming another delivery record. */
+    private hasReady;
+    /**
+     * Compare workflow age against the injected epoch clock.
+     * Ready work is attempted before expiry is checked after refusal. Expiry removes
+     * that ready row; it is not a permanent tombstone preventing later rediscovery.
+     *
+     * @param dater Persisted local workflow admission time encoded as a CESR Dater.
+     * @returns True only when elapsed injected wall time is strictly greater than timeoutMs.
+     */
+    private expired;
+}
+//# sourceMappingURL=agent.d.ts.map

package/types/src/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/src/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAqC,KAAK,UAAU,EAAY,MAAM,SAAS,CAAC;AACvF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EACL,KAAK,QAAQ,EAGb,IAAI,EACJ,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,iBAAiB,EAIvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAsB,KAAK,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAIjF,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,iGAAiG;IACjG,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yFAAyF;IACzF,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,sEAAsE;AACtE,qBAAa,aAAa;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,mFAAmF;IACnF,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,iGAAiG;IACjG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IAC/D,wFAAwF;IACxF,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IAEjC;;;;;;;;;;;;OAYG;gBAED,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,EACpB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,EACrD,OAAO,EAAE,oBAAoB;IAiB/B;;;;OAIG;IACF,WAAW,IAAI,SAAS,CAAC,0BAA0B,CAAC;IA2BrD;;;;OAIG;IACH,OAAO,CAAE,kBAAkB;IAyB3B,oHAAoH;IACpH,OAAO,CAAE,mBAAmB;IA4D5B,4GAA4G;IAC5G,OAAO,CAAC,kBAAkB;IAwB1B;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IASvB;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAwBhC,iGAAiG;IACjG,OAAO,CAAC,oBAAoB;IA6C5B,iGAAiG;IACjG,OAAO,CAAC,kBAAkB;IA+B1B,yFAAyF;IACzF,OAAO,CAAE,YAAY;IAqCrB,gFAAgF;IAChF,OAAO,CAAC,eAAe;IAMvB,8EAA8E;IAC9E,OAAO,CAAC,yBAAyB;IAMjC,mGAAmG;IACnG,OAAO,CAAC,6BAA6B;IASrC,2FAA2F;IAC3F,OAAO,CAAC,QAAQ;IAYhB;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;CAGhB"}

package/types/src/cue-store.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Sally-like verifier communication cue database.
+ *
+ * These application records remain outside protocol Baser/Reger evidence.
+ * ack/rack mark local HTTP success, not business receipts or KERI acknowledgements.
+ * This is Sally-inspired workflow state, not a claim of exact Sally storage parity.
+ */
+import { Dater, Prefixer, SerderACDC } from "cesr-ts";
+import { CesrSuber, LMDBer, type LMDBerOptions, SerderSuber } from "keri-ts/db";
+import { type Operation } from "effection";
+/** Options for opening the verifier cue sidecar. */
+export interface VerifierCueBaserOptions extends LMDBerOptions {
+    compat?: boolean;
+}
+/** Counts of queued verifier communication work. */
+export interface VerifierCueCounts {
+    senders: number;
+    iss: number;
+    rev: number;
+    recv: number;
+    revk: number;
+    ack: number;
+    rack: number;
+}
+/** Durable local workflow records for pending, ready and delivered webhook work. */
+export declare class VerifierCueBaser extends LMDBer {
+    snd: CesrSuber<Prefixer>;
+    iss: CesrSuber<Dater>;
+    rev: CesrSuber<Dater>;
+    recv: SerderSuber<SerderACDC>;
+    revk: SerderSuber<SerderACDC>;
+    ack: SerderSuber<SerderACDC>;
+    rack: SerderSuber<SerderACDC>;
+    static readonly TailDirPath = "keri/verifier";
+    static readonly AltTailDirPath = ".tufa/verifier";
+    static readonly CompatAltTailDirPath = ".keri/verifier";
+    static readonly TempPrefix = "keri_verifier_";
+    constructor(options?: VerifierCueBaserOptions);
+    /** Open ordinary LMDB storage and bind this application's typed tables. */
+    reopen(options?: VerifierCueBaserOptions): Operation<boolean>;
+    /** Clear workflow records, including the existing local delivered markers. */
+    clearEscrows(): void;
+    /** Snapshot application row counts for command output, never protocol acceptance. */
+    getCounts(): VerifierCueCounts;
+}
+/** Open a verifier cue sidecar and return the ready-to-use databaser. */
+export declare function createVerifierCueBaser(options?: VerifierCueBaserOptions): Operation<VerifierCueBaser>;
+//# sourceMappingURL=cue-store.d.ts.map

package/types/src/cue-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cue-store.d.ts","sourceRoot":"","sources":["../../src/src/cue-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEhF,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,oDAAoD;AACpD,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,oFAAoF;AACpF,qBAAa,gBAAiB,SAAQ,MAAM;IAC1C,GAAG,EAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1B,GAAG,EAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACvB,GAAG,EAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACvB,IAAI,EAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,EAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC/B,GAAG,EAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC9B,IAAI,EAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAE/B,gBAAyB,WAAW,mBAAmB;IACvD,gBAAyB,cAAc,oBAAoB;IAC3D,MAAM,CAAC,QAAQ,CAAC,oBAAoB,oBAAoB;IACxD,gBAAyB,UAAU,oBAAoB;gBAE3C,OAAO,GAAE,uBAA4B;IAWjD,2EAA2E;IACjE,MAAM,CAAC,OAAO,GAAE,uBAA4B,GAAG,SAAS,CAAC,OAAO,CAAC;IAgB3E,8EAA8E;IAC9E,YAAY,IAAI,IAAI;IASpB,qFAAqF;IACrF,SAAS,IAAI,iBAAiB;CAW/B;AAED,yEAAyE;AACzE,wBAAiB,sBAAsB,CACrC,OAAO,GAAE,uBAA4B,GACpC,SAAS,CAAC,gBAAgB,CAAC,CAO7B"}

package/types/src/policy.d.ts

@@ -0,0 +1,16 @@
+/** Operator business acceptance, independent of protocol validity and evidence persistence. */
+import type { SerderACDC } from "cesr-ts";
+import type { Reger } from "keri-ts/db";
+import type { Habery } from "keri-ts/runtime";
+export interface VerifierBusinessValidatorContext {
+    hby: Habery;
+    reger: Reger;
+}
+export type VerifierBusinessValidator = (creder: SerderACDC, context: VerifierBusinessValidatorContext) => boolean | string | void;
+/** Return a business refusal reason without modifying accepted protocol evidence. */
+export declare function validateCredential(creder: SerderACDC, validators: Record<string, VerifierBusinessValidator>, context: VerifierBusinessValidatorContext, requireKnownSchemas: boolean): string | null;
+/** Build validators from a local JSON config object. */
+export declare function validatorsFromVerifierConfig(config: unknown): Record<string, VerifierBusinessValidator>;
+/** Match the application's supported schema-SAID projection for policy and webhook consumers. */
+export declare function credentialSchema(creder: SerderACDC): string;
+//# sourceMappingURL=policy.d.ts.map

package/types/src/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/src/policy.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,KAAK,CAAC;CACd;AAED,MAAM,MAAM,yBAAyB,GAAG,CACtC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,gCAAgC,KACtC,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;AAE7B,qFAAqF;AACrF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,EACrD,OAAO,EAAE,gCAAgC,EACzC,mBAAmB,EAAE,OAAO,GAC3B,MAAM,GAAG,IAAI,CAcf;AAED,wDAAwD;AACxD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAkB3C;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAG3D"}

package/types/src/webhook.d.ts

@@ -0,0 +1,14 @@
+/** Business notification JSON and one scoped status-only HTTP attempt. */
+import type { SerderACDC } from "cesr-ts";
+import { type Operation } from "effection";
+import { type HttpClient, type VcStateRecordShape } from "keri-ts/runtime";
+export interface VerifierWebhookBody {
+    action: "iss" | "rev";
+    actor: string;
+    data: Record<string, unknown>;
+}
+/** Project an accepted credential and selected revocation state without changing protocol evidence. */
+export declare function webhookBody(creder: SerderACDC, action: "iss" | "rev", state: VcStateRecordShape | null): VerifierWebhookBody;
+/** Return HTTP success only after response cleanup; no receipt or exactly-once delivery is inferred. */
+export declare function postWebhook(http: HttpClient, now: () => number, hook: string, body: VerifierWebhookBody): Operation<boolean>;
+//# sourceMappingURL=webhook.d.ts.map

package/types/src/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/src/webhook.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,KAAK,UAAU,EAAkB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG3F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,KAAK,GAAG,KAAK,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,uGAAuG;AACvG,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,KAAK,GAAG,KAAK,EACrB,KAAK,EAAE,kBAAkB,GAAG,IAAI,GAC/B,mBAAmB,CAIrB;AAyBD,wGAAwG;AACxG,wBAAiB,WAAW,CAC1B,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,MAAM,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,mBAAmB,GACxB,SAAS,CAAC,OAAO,CAAC,CAoBpB"}