keri-ts 0.10.0 → 0.10.2

package/esm/keri/npm/src/app/cli/multisig.js

@@ -0,0 +1,474 @@
+/**
+ * `tufa multisig ...` command implementation.
+ *
+ * The command surface follows KLI's group lifecycle model:
+ * - `incept`, `rotate`, and `interact` propose a group KEL event and publish a
+ *   `/multisig/*` EXN to the other members
+ * - `join` polls mailbox notifications, signs the embedded event with local
+ *   member keys, and republishes the approval EXN
+ */
+import * as dntShim from "../../_dnt.shims.js";
+import { ValidationError } from "../../core/errors.js";
+import { Roles } from "../../core/roles.js";
+import { groupSigningMembers, localGroupMember, proposeGroupEndpointRole, } from "../endpoint-roleing.js";
+import { uniqueMembers } from "../group-members.js";
+import { MULTISIG_ICP_ROUTE, MULTISIG_IXN_ROUTE, MULTISIG_ROT_ROUTE, } from "../grouping.js";
+import { completeDelegationIfNeeded, publishProposal, waitForGroupAcceptance, waitForLocalGroupCompletion, waitForOneApproval, waitForReplyAcceptance, } from "../multisig-workflows.js";
+import { Receiptor, WitnessReceiptor } from "../witnessing.js";
+import { withAgentRuntime } from "./common/context.js";
+import { loadRotateFileOptions, parseDataItems, parseThresholdOption, } from "./common/parsing.js";
+import { resolveWitnessAuths } from "./common/witness-auth.js";
+const MULTISIG_TOPIC = "multisig";
+function requireText(value, label) {
+    if (!value) {
+        throw new ValidationError(`${label} is required and cannot be empty`);
+    }
+    return value;
+}
+function loadMultisigInceptFile(path) {
+    const loaded = JSON.parse(dntShim.Deno.readTextFileSync(path));
+    return {
+        ...loaded,
+        aids: Array.isArray(loaded.aids) ? loaded.aids.filter(isString) : loaded.aids,
+        rmids: Array.isArray(loaded.rmids) ? loaded.rmids.filter(isString) : loaded.rmids,
+        isith: parseThresholdOption(loaded.isith),
+        nsith: parseThresholdOption(loaded.nsith),
+        wits: Array.isArray(loaded.wits) ? loaded.wits.filter(isString) : loaded.wits,
+    };
+}
+function isString(value) {
+    return typeof value === "string";
+}
+/** Create or begin a distributed group identifier from a KLI-style file. */
+export function* multisigInceptCommand(args) {
+    const commandArgs = {
+        name: args.name,
+        base: args.base,
+        headDirPath: args.headDirPath,
+        passcode: args.passcode,
+        alias: args.alias,
+        group: args.group,
+        compat: args.compat,
+        endpoint: args.endpoint,
+        authenticate: args.authenticate,
+        code: args.code,
+        codeTime: args.codeTime,
+        file: args.file,
+        approvalTimeoutSeconds: nonNegativeNumber(args.approvalTimeoutSeconds, 10, "approval timeout seconds"),
+        proxy: args.proxy,
+    };
+    const name = requireText(commandArgs.name, "Name");
+    const alias = requireText(commandArgs.alias, "Alias");
+    const group = requireText(commandArgs.group, "Group");
+    const file = requireText(commandArgs.file, "Config file");
+    const options = loadMultisigInceptFile(file);
+    const smids = options.aids ?? [];
+    const rmids = options.rmids ?? smids;
+    if (smids.length === 0) {
+        throw new ValidationError("Multisig inception config must include non-empty aids.");
+    }
+    yield* withMultisigRuntime(commandArgs, name, function* ({ hby, runtime }) {
+        const member = requireHabByAlias(hby, alias);
+        const created = hby.makeGroupHab(group, member, smids, rmids, undefined, {
+            isith: options.isith,
+            nsith: options.nsith,
+            toad: options.toad,
+            wits: options.wits ?? [],
+            delpre: options.delpre,
+            data: options.data ?? [],
+        });
+        const payload = {
+            gid: created.hab.pre,
+            smids,
+            rmids,
+            ...(options.delpre ? { delegator: options.delpre } : {}),
+        };
+        const deliveries = yield* publishProposal(runtime, member, uniqueMembers([...smids, ...rmids]), MULTISIG_ICP_ROUTE, "icp", payload, created.message);
+        const accepted = yield* waitForGroupAcceptance(hby, runtime, created.serder, multisigApprovalOptions(hby, {
+            ...commandArgs,
+            group,
+            auto: true,
+            pollTurns: approvalTimeoutTurns(commandArgs.approvalTimeoutSeconds),
+            pollBudgetMs: 1_000,
+        }));
+        let delegationPhase = null;
+        if (accepted) {
+            yield* receiptAcceptedEvent(hby, created.hab.pre, commandArgs);
+            delegationPhase = yield* completeDelegationIfNeeded(hby, runtime, created.hab.pre, commandArgs.proxy);
+        }
+        printIdentifier(hby, created.hab.pre, delegationPhase);
+        console.log(JSON.stringify({
+            route: MULTISIG_ICP_ROUTE,
+            group: created.hab.pre,
+            accepted,
+            deliveries,
+        }));
+    });
+}
+/** Poll for and approve one pending group multisig event. */
+export function* multisigJoinCommand(args) {
+    const commandArgs = {
+        name: args.name,
+        base: args.base,
+        headDirPath: args.headDirPath,
+        passcode: args.passcode,
+        alias: args.alias,
+        group: args.group,
+        compat: args.compat,
+        endpoint: args.endpoint,
+        authenticate: args.authenticate,
+        code: args.code,
+        codeTime: args.codeTime,
+        auto: args.auto,
+        registryName: args.registryName,
+        said: args.said,
+        pollTurns: args.pollTurns,
+        pollBudgetMs: args.pollBudgetMs,
+        proxy: args.proxy,
+    };
+    const pollTurns = positiveInteger(commandArgs.pollTurns, 32, "poll turns");
+    const pollBudgetMs = positiveInteger(commandArgs.pollBudgetMs, 2_000, "poll budget milliseconds");
+    const name = requireText(commandArgs.name, "Name");
+    yield* withMultisigRuntime(commandArgs, name, function* ({ hby, runtime }) {
+        const result = yield* waitForOneApproval(hby, runtime, {
+            ...multisigApprovalOptions(hby, { ...commandArgs, pollTurns, pollBudgetMs }),
+        });
+        if (!result) {
+            const local = yield* waitForLocalGroupCompletion(hby, runtime, {
+                ...multisigApprovalOptions(hby, { ...commandArgs, pollTurns, pollBudgetMs }),
+            });
+            if (!local) {
+                throw new ValidationError("No matching multisig notification was available to join.");
+            }
+            if (local.accepted) {
+                yield* receiptAcceptedEvent(hby, local.group, commandArgs);
+                if (local.route === MULTISIG_ICP_ROUTE || local.route === MULTISIG_ROT_ROUTE) {
+                    yield* completeDelegationIfNeeded(hby, runtime, local.group, commandArgs.proxy);
+                }
+            }
+            console.log(JSON.stringify(local));
+            return;
+        }
+        if (result.accepted) {
+            yield* receiptAcceptedEvent(hby, result.group, commandArgs);
+            if (result.route === MULTISIG_ICP_ROUTE
+                || result.route === MULTISIG_ROT_ROUTE) {
+                yield* completeDelegationIfNeeded(hby, runtime, result.group, commandArgs.proxy);
+            }
+        }
+        console.log(JSON.stringify(result));
+    });
+}
+/** Create or begin one group interaction event. */
+export function* multisigInteractCommand(args) {
+    const commandArgs = {
+        name: args.name,
+        base: args.base,
+        headDirPath: args.headDirPath,
+        passcode: args.passcode,
+        alias: args.alias,
+        group: args.group,
+        compat: args.compat,
+        endpoint: args.endpoint,
+        authenticate: args.authenticate,
+        code: args.code,
+        codeTime: args.codeTime,
+        data: args.data,
+        approvalTimeoutSeconds: nonNegativeNumber(args.approvalTimeoutSeconds, 10, "approval timeout seconds"),
+    };
+    const name = requireText(commandArgs.name, "Name");
+    const group = requireText(commandArgs.group ?? commandArgs.alias, "Group");
+    const data = parseDataItems(commandArgs.data);
+    yield* withMultisigRuntime(commandArgs, name, function* ({ hby, runtime }) {
+        const created = hby.interactGroupHab(group, undefined, { data });
+        const smids = groupSigningMembers(hby, created.hab.pre);
+        const payload = { gid: created.hab.pre, smids };
+        const deliveries = yield* publishProposal(runtime, localGroupMember(hby, created.hab.pre), smids, MULTISIG_IXN_ROUTE, "ixn", payload, created.message);
+        const accepted = yield* waitForGroupAcceptance(hby, runtime, created.serder, multisigApprovalOptions(hby, {
+            ...commandArgs,
+            group,
+            auto: true,
+            pollTurns: approvalTimeoutTurns(commandArgs.approvalTimeoutSeconds),
+            pollBudgetMs: 1_000,
+        }));
+        if (accepted) {
+            yield* receiptAcceptedEvent(hby, created.hab.pre, commandArgs);
+        }
+        printIdentifier(hby, created.hab.pre);
+        console.log(JSON.stringify({
+            route: MULTISIG_IXN_ROUTE,
+            group: created.hab.pre,
+            accepted,
+            deliveries,
+        }));
+    });
+}
+/** Rotate or begin rotation of one group identifier. */
+export function* multisigRotateCommand(args) {
+    const commandArgs = {
+        name: args.name,
+        base: args.base,
+        headDirPath: args.headDirPath,
+        passcode: args.passcode,
+        alias: args.alias,
+        group: args.group,
+        compat: args.compat,
+        endpoint: args.endpoint,
+        authenticate: args.authenticate,
+        code: args.code,
+        codeTime: args.codeTime,
+        file: args.file,
+        isith: args.isith,
+        nsith: args.nsith,
+        toad: args.toad,
+        witnesses: args.witnesses,
+        cuts: args.cuts,
+        witnessAdd: args.witnessAdd,
+        data: args.data,
+        smids: args.smids,
+        rmids: args.rmids,
+        proxy: args.proxy,
+        approvalTimeoutSeconds: nonNegativeNumber(args.approvalTimeoutSeconds, 10, "approval timeout seconds"),
+    };
+    const name = requireText(commandArgs.name, "Name");
+    const group = requireText(commandArgs.group ?? commandArgs.alias, "Group");
+    const options = mergeRotateOptions(commandArgs);
+    yield* withMultisigRuntime(commandArgs, name, function* ({ hby, runtime }) {
+        const rotated = hby.rotateGroupHab(group, commandArgs.smids, commandArgs.rmids, {
+            isith: options.isith,
+            nsith: options.nsith,
+            toad: options.toad,
+            cuts: options.witsCut,
+            adds: options.witsAdd,
+            data: options.data ?? [],
+        });
+        const smids = commandArgs.smids?.length ? commandArgs.smids : groupSigningMembers(hby, rotated.hab.pre);
+        const rmids = commandArgs.rmids?.length ? commandArgs.rmids : smids;
+        const payload = { gid: rotated.hab.pre, smids, rmids };
+        const deliveries = yield* publishProposal(runtime, localGroupMember(hby, rotated.hab.pre), uniqueMembers([...smids, ...rmids]), MULTISIG_ROT_ROUTE, "rot", payload, rotated.message);
+        const accepted = yield* waitForGroupAcceptance(hby, runtime, rotated.serder, multisigApprovalOptions(hby, {
+            ...commandArgs,
+            group,
+            auto: true,
+            pollTurns: approvalTimeoutTurns(commandArgs.approvalTimeoutSeconds),
+            pollBudgetMs: 1_000,
+        }));
+        let delegationPhase = null;
+        if (accepted) {
+            yield* receiptAcceptedEvent(hby, rotated.hab.pre, commandArgs);
+            delegationPhase = yield* completeDelegationIfNeeded(hby, runtime, rotated.hab.pre, commandArgs.proxy);
+        }
+        printIdentifier(hby, rotated.hab.pre, delegationPhase);
+        console.log(JSON.stringify({
+            route: MULTISIG_ROT_ROUTE,
+            group: rotated.hab.pre,
+            accepted,
+            deliveries,
+        }));
+    });
+}
+/** Propose one group multisig reply such as `/end/role/add`. */
+export function* multisigRpyCommand(args) {
+    const commandArgs = {
+        name: args.name,
+        base: args.base,
+        headDirPath: args.headDirPath,
+        passcode: args.passcode,
+        alias: args.alias,
+        group: args.group,
+        compat: args.compat,
+        eid: args.eid,
+        role: args.role,
+        allow: args.allow,
+        approvalTimeoutSeconds: nonNegativeNumber(args.approvalTimeoutSeconds, 0, "approval timeout seconds"),
+    };
+    const name = requireText(commandArgs.name, "Name");
+    const group = requireText(commandArgs.group ?? commandArgs.alias, "Group");
+    const eid = requireText(commandArgs.eid, "Endpoint identifier");
+    const role = commandArgs.role ?? Roles.mailbox;
+    yield* withMultisigRuntime(commandArgs, name, function* ({ hby, runtime }) {
+        const groupHab = requireHabByAlias(hby, group);
+        const result = yield* proposeGroupEndpointRole(runtime, groupHab, { eid, role, allow: commandArgs.allow });
+        const accepted = commandArgs.approvalTimeoutSeconds > 0
+            ? yield* waitForReplyAcceptance(hby, runtime, groupHab.pre, role, eid, multisigApprovalOptions(hby, {
+                ...commandArgs,
+                group: groupHab.pre,
+                auto: true,
+                pollTurns: approvalTimeoutTurns(commandArgs.approvalTimeoutSeconds),
+                pollBudgetMs: 1_000,
+            }))
+            : result.accepted;
+        console.log(JSON.stringify({
+            route: result.route,
+            said: result.said,
+            group: result.group,
+            accepted,
+            deliveries: result.deliveries,
+            attachmentBytes: result.attachmentBytes,
+        }));
+    });
+}
+function* withMultisigRuntime(args, name, use) {
+    return yield* withAgentRuntime({ ...args, name }, {
+        compat: args.compat ?? false,
+        readonly: false,
+        skipConfig: true,
+        skipSignator: false,
+    }, use);
+}
+function requireHabByAlias(hby, alias) {
+    const hab = hby.habByName(alias);
+    if (!hab?.pre) {
+        throw new ValidationError(`Alias ${alias} is invalid`);
+    }
+    return hab;
+}
+function mergeRotateOptions(args) {
+    const options = args.file && args.file !== "" ? loadRotateFileOptions(args.file) : {};
+    if (args.isith !== undefined) {
+        options.isith = parseThresholdOption(args.isith);
+    }
+    if (args.nsith !== undefined) {
+        options.nsith = parseThresholdOption(args.nsith);
+    }
+    if (args.toad !== undefined) {
+        options.toad = Number(args.toad);
+    }
+    if ((args.witnesses?.length ?? 0) > 0) {
+        options.wits = [...args.witnesses];
+    }
+    if ((args.cuts?.length ?? 0) > 0) {
+        options.witsCut = [...args.cuts];
+    }
+    if ((args.witnessAdd?.length ?? 0) > 0) {
+        options.witsAdd = [...args.witnessAdd];
+    }
+    if (args.data !== undefined) {
+        options.data = parseDataItems(args.data);
+    }
+    if ((options.wits?.length ?? 0) > 0) {
+        throw new ValidationError("multisig rotate does not accept replacement --witnesses yet; use --witness-cut/--witness-add.");
+    }
+    return options;
+}
+function multisigApprovalOptions(hby, args) {
+    return {
+        group: args.group,
+        said: args.said,
+        pollTurns: positiveInteger(args.pollTurns, 32, "poll turns"),
+        pollBudgetMs: positiveInteger(args.pollBudgetMs, 2_000, "poll budget milliseconds"),
+        callbacks: multisigApprovalCallbacks(hby, args),
+    };
+}
+function multisigApprovalCallbacks(hby, args) {
+    return {
+        approveProposal: (context) => approvePrompt(args, context),
+        chooseGroupAlias: (groupPre) => chooseGroupAlias(hby, args, groupPre),
+        chooseRegistryName: (regk) => chooseRegistryName(args, regk),
+    };
+}
+function chooseRegistryName(args, regk) {
+    if (args.registryName) {
+        return args.registryName;
+    }
+    if (args.auto) {
+        return `registry-${regk.slice(0, 12)}`;
+    }
+    while (true) {
+        const name = prompt("\nName for Registry: ")?.trim();
+        if (name) {
+            return name;
+        }
+    }
+}
+function chooseGroupAlias(hby, args, groupPre) {
+    if (args.group) {
+        return args.group;
+    }
+    const record = hby.db.getHab(groupPre);
+    if (record?.name) {
+        return record.name;
+    }
+    if (args.auto) {
+        return "default-group";
+    }
+    while (true) {
+        const group = prompt("\nEnter group name for new AID: ")?.trim();
+        if (!group) {
+            continue;
+        }
+        const existing = hby.db.getName("", group);
+        if (existing && existing !== groupPre) {
+            console.log(`AID group name ${group} is already in use, please try again`);
+            continue;
+        }
+        return group;
+    }
+}
+function approvePrompt(args, context) {
+    if (args.auto) {
+        return true;
+    }
+    console.log(JSON.stringify({
+        route: context.route,
+        group: context.group,
+        embedded: context.embedded,
+    }, null, 2));
+    const yn = prompt("\nJoin [Y|n]? ");
+    return yn === null || yn === "" || yn === "y" || yn === "Y";
+}
+function* receiptAcceptedEvent(hby, pre, args) {
+    const kever = hby.db.getKever(pre);
+    if (!kever || kever.wits.length === 0) {
+        return;
+    }
+    const auths = resolveWitnessAuths(kever.wits, args.code ?? [], {
+        codeTime: args.codeTime,
+        promptMissing: args.authenticate ?? false,
+    });
+    if (args.endpoint) {
+        const receiptor = new Receiptor(hby);
+        yield* receiptor.receipt(pre, { sn: kever.sn, auths });
+    }
+    else {
+        const witDoer = new WitnessReceiptor(hby);
+        yield* witDoer.submit(pre, { sn: kever.sn, auths });
+    }
+}
+function positiveInteger(value, fallback, label) {
+    if (value === undefined || value === null || value === "") {
+        return fallback;
+    }
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        throw new ValidationError(`${label} must be a positive integer.`);
+    }
+    return parsed;
+}
+function nonNegativeNumber(value, fallback, label) {
+    if (value === undefined || value === null || value === "") {
+        return fallback;
+    }
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed < 0) {
+        throw new ValidationError(`${label} must be a finite nonnegative number.`);
+    }
+    return parsed;
+}
+function approvalTimeoutTurns(approvalTimeoutSeconds) {
+    if (approvalTimeoutSeconds === undefined || approvalTimeoutSeconds === null) {
+        return 40;
+    }
+    return Math.max(1, Math.floor(Number(approvalTimeoutSeconds) * 4));
+}
+function printIdentifier(hby, pre, delegationPhase) {
+    const state = hby.db.getState(pre);
+    console.log(`Prefix  ${pre}`);
+    console.log(`New Sequence No.  ${state?.s ?? ""}`);
+    for (const [idx, key] of (state?.k ?? []).entries()) {
+        console.log(`\tPublic key ${idx + 1}:  ${key}`);
+    }
+    if (delegationPhase) {
+        console.log(`Delegation status  ${delegationPhase}`);
+    }
+}

package/esm/keri/npm/src/app/cli/query.js

@@ -0,0 +1,143 @@
+/**
+ * `tufa query` command implementation.
+ *
+ * KERIpy correspondence:
+ * - mirrors the bounded "launch query, poll for replies, print external state"
+ *   behavior of `keri.cli.commands.query`
+ * - builds on the `QueryCoordinator`/querier helpers that correspond to
+ *   KERIpy's query/noticer doers
+ *
+ * `keri-ts` difference:
+ * - transport, mailbox polling, and parser ingress are composed explicitly for
+ *   one bounded command lifetime instead of being spread across long-lived HIO
+ *   doers
+ */
+import * as dntShim from "../../_dnt.shims.js";
+import { ValidationError } from "../../core/errors.js";
+import { Roles } from "../../core/roles.js";
+import { processRuntimeTurn, runtimeHasPendingWork, runtimeTurn } from "../agent-runtime.js";
+import { flattenRoleUrls } from "../mailboxing.js";
+import { queryTransportSink } from "../query-transport.js";
+import { withHabAndAgentRuntime } from "./common/context.js";
+import { printExternal } from "./common/displaying.js";
+/**
+ * Bounded runtime window for the primary query/watch pass.
+ *
+ * KLI compatibility:
+ * - KERIpy's CLI query flow waits for roughly ten seconds before printing the
+ *   best available external state
+ */
+const QueryTimeoutMs = 10_000;
+/** Load and validate one anchor JSON object for `--anchor` query mode. */
+function loadAnchor(path) {
+    const text = dntShim.Deno.readTextFileSync(path);
+    const anchor = JSON.parse(text);
+    if (!anchor || typeof anchor !== "object" || Array.isArray(anchor)) {
+        throw new ValidationError("Anchor file must contain a JSON object.");
+    }
+    return anchor;
+}
+/**
+ * Build the controller OOBI URL used for query catch-up fallback.
+ *
+ * Why this exists:
+ * - a successful `ksn` reply can prove a remote controller is ahead of local
+ *   accepted state without carrying the whole log replay
+ * - when that happens, the CLI falls back to controller OOBI replay so local
+ *   verification state can converge within the command's bounded lifetime
+ */
+function controllerCatchupUrl(hab, queriedPre) {
+    const ends = hab.endsFor(queriedPre);
+    const controller = flattenRoleUrls(ends[Roles.controller])[0]
+        ?? flattenRoleUrls(ends[Roles.agent])[0];
+    if (!controller) {
+        return null;
+    }
+    const url = new URL(controller.url);
+    url.pathname = `/oobi/${queriedPre}/controller`;
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+}
+/**
+ * Query remote key state or anchored logs and then print KLI-style external state.
+ *
+ * Behavioral shape:
+ * - start a bounded local runtime
+ * - register either a key-state or anchor continuation
+ * - poll transport/mailbox work until convergence or timeout
+ * - optionally fall back to controller catch-up replay before printing
+ */
+export function* queryCommand(args) {
+    const queryArgs = {
+        name: args.name,
+        base: args.base,
+        headDirPath: args.headDirPath,
+        passcode: args.passcode,
+        alias: args.alias,
+        compat: args.compat,
+        prefix: args.prefix,
+        anchor: args.anchor,
+    };
+    if (!queryArgs.name) {
+        throw new ValidationError("Name is required and cannot be empty");
+    }
+    if (!queryArgs.alias) {
+        throw new ValidationError("Alias is required and cannot be empty");
+    }
+    if (!queryArgs.prefix) {
+        throw new ValidationError("Prefix is required and cannot be empty");
+    }
+    const prefix = queryArgs.prefix;
+    yield* withHabAndAgentRuntime(queryArgs, queryArgs.alias, {
+        compat: queryArgs.compat ?? false,
+        readonly: false,
+        skipConfig: true,
+        skipSignator: true,
+    }, function* ({ hby, runtime, hab }) {
+        const sink = queryTransportSink(runtime, hby, hab);
+        let watchDone = () => false;
+        if (queryArgs.anchor) {
+            const anchor = loadAnchor(queryArgs.anchor);
+            console.log(`Checking for anchor ${JSON.stringify(anchor)}...`);
+            const querier = runtime.querying.watchAnchor(prefix, anchor, {
+                hab,
+            });
+            watchDone = () => querier.done;
+        }
+        else {
+            console.log("Checking for updates...");
+            const noticer = runtime.querying.watchKeyState(prefix, {
+                hab,
+            });
+            watchDone = () => noticer.done;
+        }
+        const deadline = Date.now() + QueryTimeoutMs;
+        while (!watchDone() && Date.now() < deadline) {
+            yield* processRuntimeTurn(runtime, { hab, pollMailbox: true, sink });
+            if (!watchDone()) {
+                yield* runtimeTurn();
+            }
+        }
+        if (!watchDone() && !queryArgs.anchor) {
+            const catchupUrl = controllerCatchupUrl(hab, prefix);
+            if (catchupUrl) {
+                runtime.oobiery.resolve(catchupUrl);
+                const catchupDeadline = Date.now() + 5_000;
+                while (!watchDone() && Date.now() < catchupDeadline) {
+                    yield* processRuntimeTurn(runtime, {
+                        hab,
+                        pollMailbox: true,
+                        sink,
+                    });
+                    if (!runtimeHasPendingWork(runtime)) {
+                        break;
+                    }
+                    yield* runtimeTurn();
+                }
+            }
+        }
+        console.log("");
+        printExternal(hby, prefix);
+    });
+}

package/esm/keri/npm/src/app/cli/saidify.js

@@ -0,0 +1,51 @@
+import * as dntShim from "../../_dnt.shims.js";
+import { Saider } from "cesr-ts";
+import { ValidationError } from "../../core/errors.js";
+/** Implement KLI-compatible `saidify`: mutate one JSON SAD file in place. */
+export function* saidifyCommand(args) {
+    const commandArgs = {
+        file: args.file,
+        label: args.label,
+    };
+    if (!commandArgs.file) {
+        throw new ValidationError("File is required and cannot be empty.");
+    }
+    const raw = dntShim.Deno.readTextFileSync(commandArgs.file);
+    const sad = parseSad(raw, commandArgs.file);
+    const { sad: saidified } = Saider.saidify(sad, {
+        label: commandArgs.label ?? "d",
+    });
+    dntShim.Deno.writeTextFileSync(commandArgs.file, keripyJsonDump(saidified));
+}
+function parseSad(raw, file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new ValidationError(`Error deserializing JSON file ${file}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!isRecord(parsed)) {
+        throw new ValidationError("Saidify input must be a JSON object.");
+    }
+    return parsed;
+}
+function keripyJsonDump(value) {
+    if (value === null || typeof value !== "object") {
+        return jsonScalar(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => keripyJsonDump(item)).join(", ")}]`;
+    }
+    return `{${Object.entries(value).map(([key, item]) => `${JSON.stringify(key)}: ${keripyJsonDump(item)}`).join(", ")}}`;
+}
+function jsonScalar(value) {
+    const encoded = JSON.stringify(value);
+    if (encoded === undefined) {
+        throw new ValidationError("Saidify input cannot contain undefined values.");
+    }
+    return encoded;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}