keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/app/ipex/ipex-credentialing.js

@@ -0,0 +1,359 @@
+/**
+ * IPEX credential artifact assembly for registry-backed ACDC workflows.
+ *
+ * KERIpy correspondence:
+ * - mirrors the byte material gathered by `vdr.credentialing.sendArtifacts`
+ *   and the grant/admit command helpers
+ * - keeps EXN route construction in `ipexing.ts`
+ * - keeps registry, wallet, and verifier persistence in VDR modules
+ */
+import { concatBytes, Counter, Ilks, parseBytes, parsePather, SerderACDC, SerderKERI, Vrsn_1_0, } from "cesr-ts";
+import { resolveAttachmentGvrsn } from "../../core/attachment-countering.js";
+import { ValidationError } from "../../core/errors.js";
+import { dgKey } from "../../db/core/keys.js";
+import { CredentialWallet, serializeCredential } from "../../vdr/credentialing.js";
+import { telAnchorIncludes } from "../../vdr/tel-anchor.js";
+import { validateCredentialSource } from "../credentials/credential-proposals.js";
+import { acceptedEventReplayMessage } from "../identity/habbing.js";
+import { envelopeFromFrame } from "../protocol/parsering.js";
+import { chunkBytes } from "../transport/byte-source.js";
+import { processMessages } from "../transport/message-source.js";
+import { IPEX_GRANT_ROUTE, ipexAdmitExn, ipexGrantExn, ipexRecipient } from "./ipexing.js";
+const textEncoder = new TextEncoder();
+/** Build KERIpy-shaped support artifacts for one credential presentation. */
+export function credentialSupportMessages(hby, reger, creder, recipient) {
+    const messages = [];
+    const issuer = creder.issuer;
+    if (!issuer) {
+        throw new ValidationError("Credential is missing issuer AID.");
+    }
+    const issuerKever = hby.db.getKever(issuer);
+    if (!issuerKever) {
+        throw new ValidationError(`Missing issuer KEL state for ${issuer}.`);
+    }
+    messages.push(...hby.db.cloneDelegation(issuerKever));
+    messages.push(...hby.db.clonePreIter(issuer, 0));
+    const issuee = credentialIssuee(creder);
+    if (issuee && issuee !== recipient) {
+        const issueeKever = hby.db.getKever(issuee);
+        if (!issueeKever) {
+            throw new ValidationError(`Missing issuee KEL state for ${issuee}.`);
+        }
+        messages.push(...hby.db.cloneDelegation(issueeKever));
+        messages.push(...hby.db.clonePreIter(issuee, 0));
+    }
+    const registry = creder.regid;
+    if (registry) {
+        messages.push(...reger.clonePreIter(registry, 0));
+    }
+    const said = credentialSaid(creder);
+    messages.push(...reger.clonePreIter(said, 0));
+    return messages;
+}
+/**
+ * Build the full raw credential stream equivalent of KERIpy `sendCredential`.
+ *
+ * IPEX grant sends the support artifacts and recursively chained source
+ * credentials separately, then embeds the top-level credential in the grant
+ * EXN. Raw import/export paths can append the top-level credential message too.
+ */
+export function credentialStreamMessages(hby, reger, creder, recipient, gvrsn = Vrsn_1_0) {
+    return [
+        ...credentialPresentationSupportMessages(hby, reger, creder, recipient, gvrsn),
+        credentialExportMessage(reger, credentialSaid(creder)),
+    ];
+}
+/** Build the support stream used before sending a credential grant EXN. */
+export function credentialPresentationSupportMessages(hby, reger, creder, recipient, gvrsn = Vrsn_1_0) {
+    const messages = credentialSupportMessages(hby, reger, creder, recipient);
+    for (const [source, atc] of reger.sources(hby.db, creder, gvrsn)) {
+        messages.push(...credentialSupportMessages(hby, reger, source, recipient));
+        messages.push(concatBytes(source.raw, atc));
+    }
+    return messages;
+}
+/** Build grant-embedded `acdc`, `iss`, and `anc` artifacts for one credential. */
+export function credentialPresentationArtifacts(hby, reger, credentialSaidValue, gvrsn = Vrsn_1_0) {
+    const [creder, prefixer, number, diger] = reger.cloneCred(credentialSaidValue);
+    const acdc = serializeCredential(creder, prefixer, number, diger, gvrsn);
+    const iss = reger.cloneTvtAt(credentialSaidValue, 0, gvrsn);
+    const iserder = new SerderKERI({ raw: iss });
+    if (!iserder.said) {
+        throw new ValidationError(`Credential TEL message ${credentialSaidValue} is missing SAID.`);
+    }
+    if (iserder.pre !== prefixer.qb64 || iserder.snh !== number.numh || iserder.said !== diger.qb64) {
+        throw new ValidationError(`Credential source seal mismatch for ${credentialSaidValue}.`);
+    }
+    const telAnchor = reger.ancs.get(dgKey(credentialSaidValue, iserder.said));
+    if (!telAnchor) {
+        throw new ValidationError(`Credential TEL anchor missing for ${credentialSaidValue}.`);
+    }
+    const issuer = creder.issuer;
+    if (!issuer) {
+        throw new ValidationError(`Credential ${credentialSaidValue} is missing issuer.`);
+    }
+    const [anchorNumber, anchorDiger] = telAnchor;
+    const sn = Number(anchorNumber.num);
+    if (!Number.isSafeInteger(sn)) {
+        throw new ValidationError(`Credential anchor sequence is too large for replay: ${anchorNumber.qb64}.`);
+    }
+    const replay = acceptedEventReplayMessage(hby, issuer, sn, gvrsn);
+    if (replay.serder.said !== anchorDiger.qb64) {
+        throw new ValidationError(`Credential anchor event ${replay.serder.said ?? "<missing>"} did not match ${anchorDiger.qb64}.`);
+    }
+    return {
+        acdc: { wire: acdc, genus: resolveAttachmentGvrsn(creder, gvrsn) },
+        iss: { wire: iss, genus: resolveAttachmentGvrsn(iserder, gvrsn) },
+        anc: { wire: replay.message, genus: resolveAttachmentGvrsn(replay.serder, gvrsn) },
+    };
+}
+/**
+ * Check a grant against this member's verified credential and accepted issuer/TEL
+ * evidence before signing. A group holder may present another issuer's credential.
+ * Optional legacy embeds/proofs may be omitted when that authority is already
+ * local; supplied bodies and source seals must agree with it. Nothing is written.
+ */
+export function credentialGrantReady(hby, reger, grant, attachments, genus) {
+    if (grant.route !== IPEX_GRANT_ROUTE)
+        throw new ValidationError("Expected an IPEX grant.");
+    const embeds = embeddedSection(grant);
+    const creder = acdcBody(embeds?.acdc, "acdc");
+    if (!creder.verify())
+        throw new ValidationError("Grant credential has an invalid SAID.");
+    const suppliedIss = embeds?.iss === undefined ? null : keriBody(embeds.iss, "iss");
+    const suppliedAnc = embeds?.anc === undefined ? null : keriBody(embeds.anc, "anc");
+    if (suppliedIss
+        && (!suppliedIss.verify() || ![Ilks.iss, Ilks.bis].some(ilk => ilk === suppliedIss.ilk)
+            || suppliedIss.pre !== creder.said || suppliedIss.sn !== 0)) {
+        throw new ValidationError("Grant issuance does not match its credential.");
+    }
+    if (suppliedAnc && (!suppliedAnc.verify() || suppliedAnc.pre !== creder.issuer)) {
+        throw new ValidationError("Grant anchor does not match its credential issuer.");
+    }
+    const frames = parseBytes(concatBytes(Counter.makeGVC(genus), grant.raw, attachments));
+    if (frames.length !== 1)
+        throw new ValidationError("Grant evidence must contain one exchange.");
+    const paths = envelopeFromFrame(frames[0]).ptds.map(group => group.raw);
+    if (!reger.saved.get([creder.said]))
+        return false;
+    const expected = credentialPresentationArtifacts(hby, reger, creder.said, genus);
+    const issuance = new SerderKERI({ raw: expected.iss.wire });
+    if (suppliedIss && suppliedIss.said !== issuance.said) {
+        throw new ValidationError("Grant issuance conflicts with the saved credential.");
+    }
+    const source = pathedAttachment(paths, "acdc");
+    if (source.length)
+        validateCredentialSource(creder, issuance, source, genus);
+    if (suppliedAnc && !acceptedGrantAnchor(hby, creder.issuer, issuance, suppliedAnc))
+        return false;
+    const telProof = pathedAttachment(paths, "iss");
+    if (telProof.length) {
+        const proofFrames = parseBytes(concatBytes(Counter.makeGVC(genus), issuance.raw, telProof));
+        if (proofFrames.length !== 1)
+            throw new ValidationError("Grant TEL evidence must contain one event.");
+        const seal = envelopeFromFrame(proofFrames[0]).lastSsc;
+        if (seal) {
+            if (seal.s.num > BigInt(Number.MAX_SAFE_INTEGER)) {
+                throw new ValidationError("Grant issuer anchor exceeds supported storage ordinals.");
+            }
+            const anchor = hby.db.getEvtSerder(creder.issuer, seal.d.qb64);
+            if (!anchor)
+                return false;
+            if (anchor.sn !== Number(seal.s.num) || (suppliedAnc && suppliedAnc.said !== anchor.said)) {
+                throw new ValidationError("Grant TEL source seal does not match its anchor.");
+            }
+            if (!acceptedGrantAnchor(hby, creder.issuer, issuance, anchor))
+                return false;
+        }
+    }
+    return true;
+}
+/** Local accepted KEL authority, not a proposed anchor or proof supplied by its wrapper. */
+function acceptedGrantAnchor(hby, issuer, issuance, anchor) {
+    if (anchor.sn === null || !Number.isSafeInteger(anchor.sn)) {
+        throw new ValidationError("Grant anchor sequence exceeds supported storage ordinals.");
+    }
+    const accepted = hby.db.kels.getLast(issuer, anchor.sn);
+    if (!accepted)
+        return false;
+    if (accepted !== anchor.said || !telAnchorIncludes(issuer, issuance, anchor)) {
+        throw new ValidationError("Grant anchor does not bind the saved credential issuance.");
+    }
+    return true;
+}
+/** Build a signed `/ipex/grant` message with embedded credential artifacts. */
+export function ipexCredentialGrant(args) {
+    const [creder] = args.reger.cloneCred(args.credentialSaid);
+    const gvrsn = args.options?.gvrsn ?? Vrsn_1_0;
+    const artifacts = credentialPresentationArtifacts(args.hby, args.reger, args.credentialSaid, gvrsn);
+    const support = credentialPresentationSupportMessages(args.hby, args.reger, creder, args.recipient, gvrsn);
+    const [grant, attachments] = ipexGrantExn(args.hab, args.recipient, args.message ?? "", artifacts.acdc.wire, {
+        ...(args.options ?? {}),
+        iss: artifacts.iss.wire,
+        anc: artifacts.anc.wire,
+        agree: args.options?.agree ?? null,
+    });
+    if (!credentialGrantReady(args.hby, args.reger, grant, attachments, gvrsn)) {
+        throw new ValidationError(`Credential ${args.credentialSaid} is missing verified local evidence.`);
+    }
+    return {
+        grant,
+        attachments,
+        wire: args.sign === false ? new Uint8Array() : concatBytes(args.hab.endorse(grant, { pipelined: false, gvrsn }), attachments),
+        artifacts,
+        support,
+    };
+}
+/**
+ * Validate a supplied accepted grant's recipient and wallet obligation before signing.
+ * Explicit no-wait authoring may skip the saved marker; it does not establish
+ * wallet acceptance. Peer approval always checks its own wallet independently.
+ */
+export function validateAdmitGrant(grant, recipient, reger, requireSaved = true) {
+    if (grant.route !== IPEX_GRANT_ROUTE) {
+        throw new ValidationError(`Expected ${IPEX_GRANT_ROUTE} grant, got ${grant.route ?? "<none>"}.`);
+    }
+    if (ipexRecipient(grant) !== recipient) {
+        throw new ValidationError("Grant recipient does not match the admitting identifier.");
+    }
+    const said = credentialSaidFromGrant(grant);
+    if (!said)
+        throw new ValidationError("Grant is missing embedded ACDC SAID.");
+    if (requireSaved && !reger.saved.get([said]))
+        throw new ValidationError(`Credential ${said} is not saved locally.`);
+    return said;
+}
+/** Build an admit after validating its grant; group callers defer the endorsement. */
+export function ipexCredentialAdmit(args) {
+    validateAdmitGrant(args.grant, args.hab.pre, args.reger, args.options?.requireSaved ?? true);
+    const [admit, attachments] = ipexAdmitExn(args.hab, args.message ?? "", args.grant, args.options ?? {});
+    return {
+        admit,
+        attachments,
+        wire: args.sign === false ? new Uint8Array() : concatBytes(args.hab.endorse(admit, { pipelined: false, gvrsn: args.options?.gvrsn ?? undefined }), attachments),
+    };
+}
+/**
+ * Parse grant-embedded artifacts in KERIpy admit order: `anc`, `iss`, `acdc`.
+ *
+ * @param protocol Borrowed shared protocol processor; this operation owns its parser and input-specific Kevery.
+ * @param artifacts Grant-embedded anchor, issuance and credential streams in their named fields.
+ */
+export function* processCredentialPresentationArtifacts(protocol, artifacts) {
+    const kvy = protocol.makeKevery();
+    // Each artifact carries its own attachment genus; finish its dispatch before opening the next.
+    for (const artifact of [artifacts.anc, artifacts.iss, artifacts.acdc]) {
+        const bytes = concatBytes(Counter.makeGVC(artifact.genus), artifact.wire);
+        yield* processMessages((signal) => chunkBytes(bytes, { signal }), protocol, kvy);
+    }
+    // Recurring IPEX/verifier callers retain their existing single-pass escrow scheduling.
+    yield* protocol.processEscrowsOnce();
+}
+/** Rebuild grant-embedded `anc`, `iss`, and `acdc` streams from exchange storage. */
+export function storedGrantArtifacts(hby, grant, gvrsn = Vrsn_1_0) {
+    if (!grant.said)
+        throw new ValidationError("Grant is missing its SAID.");
+    return grantPresentationArtifacts(grant, hby.db.epath.get([grant.said]).map(text => textEncoder.encode(text)), gvrsn);
+}
+/**
+ * Decode the supplied grant's bodies and counted path groups without storage or
+ * admission. Approval passes the selected proposal's own evidence; stored replay
+ * passes its retained LMDB groups. Neither source can substitute for the other.
+ */
+export function grantPresentationArtifacts(grant, pathed, gvrsn = Vrsn_1_0) {
+    if (grant.route !== IPEX_GRANT_ROUTE || !grant.said) {
+        throw new ValidationError(`Expected ${IPEX_GRANT_ROUTE} EXN.`);
+    }
+    const embeds = embeddedSection(grant);
+    if (!embeds) {
+        throw new ValidationError(`Grant ${grant.said} is missing embedded artifacts.`);
+    }
+    return {
+        anc: storedArtifact(keriBody(embeds.anc, "anc"), pathedAttachment(pathed, "anc"), gvrsn),
+        iss: storedArtifact(keriBody(embeds.iss, "iss"), pathedAttachment(pathed, "iss"), gvrsn),
+        acdc: storedArtifact(acdcBody(embeds.acdc, "acdc"), pathedAttachment(pathed, "acdc"), gvrsn),
+    };
+}
+/** Extract the embedded credential SAID from an accepted `/ipex/grant`. */
+export function credentialSaidFromGrant(grant) {
+    const embeds = embeddedSection(grant);
+    const acdc = embeds?.acdc;
+    if (!isRecord(acdc))
+        return null;
+    const said = acdc.d;
+    return typeof said === "string" ? said : null;
+}
+/** Return a raw exported credential message by SAID. */
+export function credentialExportMessage(reger, credentialSaidValue) {
+    return new CredentialWallet(reger).exportCredential(credentialSaidValue);
+}
+function credentialSaid(creder) {
+    if (!creder.said) {
+        throw new ValidationError("Credential is missing SAID.");
+    }
+    return creder.said;
+}
+function credentialIssuee(creder) {
+    const attrib = creder.attrib;
+    if (isRecord(attrib)) {
+        const issuee = attrib.i;
+        return typeof issuee === "string" ? issuee : null;
+    }
+    return null;
+}
+/** Project only grant children; protocol readers below own body reconstruction. */
+function embeddedSection(serder) {
+    const ked = serder.ked;
+    if (!ked)
+        return null;
+    const embeds = isRecord(ked.e) ? ked.e : isRecord(ked.a) && isRecord(ked.a.e) ? ked.a.e : null;
+    return embeds ? { anc: embeds.anc, iss: embeds.iss, acdc: embeds.acdc } : null;
+}
+/** Wire/schema-defined SAD keys remain unknown until a named-field check or Serder validates them. */
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function keriBody(value, label) {
+    if (!isRecord(value)) {
+        throw new ValidationError(`Grant embedded ${label} is missing.`);
+    }
+    return new SerderKERI({ sad: value });
+}
+function acdcBody(value, label) {
+    if (!isRecord(value)) {
+        throw new ValidationError(`Grant embedded ${label} is missing.`);
+    }
+    return new SerderACDC({ sad: value, verify: false });
+}
+/** Use the receiver-configured child genus; legacy parent framing does not determine it. */
+function storedArtifact(body, attachment, gvrsn) {
+    return { wire: concatBytes(body.raw, attachment), genus: resolveAttachmentGvrsn(body, gvrsn) };
+}
+function pathedAttachment(pathed, label) {
+    const path = `/e/${label}`;
+    for (const raw of pathed) {
+        const attachment = pathedAttachmentFromRaw(raw, path);
+        if (attachment) {
+            return attachment;
+        }
+    }
+    return new Uint8Array();
+}
+function pathedAttachmentFromRaw(raw, path) {
+    if (raw.length === 0) {
+        return null;
+    }
+    const counter = new Counter({ qb64b: raw });
+    const body = raw.slice(counter.fullSize);
+    try {
+        const pather = parsePather(body, "txt");
+        if (pather.path === path) {
+            return body.slice(pather.fullSize);
+        }
+    }
+    catch {
+        // A multisig wrapper can preserve the grant's own pathed-material group as
+        // the counted payload. In that case unwrap one group layer and retry.
+    }
+    return body[0] === "-".charCodeAt(0) ? pathedAttachmentFromRaw(body, path) : null;
+}

package/esm/keri/npm/src/app/{ipex-graph.js → ipex/ipex-graph.js}

@@ -1,39 +1,25 @@
-/** Borrowed ACDC disclosure DAGs: structure, negotiated paths and edge semantics. */
-import { Compactor, makePather, Saider, SerderACDC } from "cesr-ts";
-import { validateSchema } from "../acdc/scheming.js";
-const sectionLabels = new Set(["d", "u", "o", "w"]);
-const groupLabels = new Set([...sectionLabels, "s"]);
-const nodeLabels = new Set(["d", "u", "n", "s", "o", "w"]);
+/** Borrowed IPEX frame DAGs, negotiated disclosure paths and traversal policy. */
+import { Compactor, makePather, SerderACDC } from "cesr-ts";
+import { acdcEdgeBlocks as blocks, acdcEdgeTarget, acdcGroupLabels } from "../../acdc/chaining.js";
 const nodeIlks = new Set([null, "acm", "ace", "act", "acg"]);
-const unaryOps = new Set(["I2I", "NI2I", "DI2I", "E1E", "NOT"]);
+/** Empty UUID marks field-map metadata; fixed-field public credentials keep that slot empty too. */
+export function isIpexMetadata(node) {
+    return [null, "acm", "ace"].includes(node.ilk) && node.sad.u === "";
+}
+/** Offers carry bodies only; empty counted feet convey no child evidence. */
+export function hasIpexNodeAttachments(frame) {
+    return frame.attachments.some((group) => group.items.length > 0)
+        || Boolean(frame.essrs?.length || frame.nests?.length);
+}
 /** SAD maps, including null-prototype maps, exclude scalar/array representations. */
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-/** Required SAIDs must have valid digest-qualified CESR material. */
-function validSaid(value) {
-    if (typeof value !== "string")
-        return false;
-    try {
-        return new Saider({ qb64: value }).qb64 === value;
-    }
-    catch {
-        return false;
-    }
-}
 /** Python's empty section containers carry no disclosed edge semantics. */
 function present(value) {
     return Array.isArray(value) ? value.length > 0 : record(value) ? Object.keys(value).length > 0 : Boolean(value);
 }
-/** Return disclosed edge blocks, with null distinguishing malformed from absent. */
-function blocks(value) {
-    if (!present(value))
-        return [];
-    if (record(value))
-        return [value];
-    return Array.isArray(value) && value.every(record) ? value : null;
-}
-/** Validate the frozen single-DAG disclosure triple grammar without parsing child bytes. */
+/** Validate disclosure-query shape; actual schema commitments are checked against disclosed nodes. */
 export function validDisclosurePlan(value) {
     if (!Array.isArray(value))
         return false;
@@ -67,6 +53,10 @@ export function validDisclosurePlan(value) {
     }
     return true;
 }
+/** Decode exactly one wire DAG without accepting the retired flat q.dp shape. */
+export function singleDagDisclosurePlan(value) {
+    return Array.isArray(value) && value.length === 1 && validDisclosurePlan(value[0]) ? value[0] : null;
+}
 /**
  * Index unique disclosed credential nodes and walk their reachable graph in BFS order.
  * Offers may omit far nodes; grants require every referenced node. Nested ownership
@@ -88,6 +78,7 @@ export function walkIpexGraph(origin, nests, closed) {
         return null;
     const seen = new Set();
     const order = [];
+    const dependencies = new Map();
     const queue = [origin];
     for (let index = 0; index < queue.length; index++) {
         const said = queue[index];
@@ -95,35 +86,59 @@ export function walkIpexGraph(origin, nests, closed) {
             continue;
         seen.add(said);
         order.push(said);
+        const farNodes = new Set();
+        dependencies.set(said, farNodes);
         const edges = blocks(nodes.get(said).body.sad.e);
         if (!edges)
             return null;
-        const groups = edges.map((edge) => ({ edge, nested: false }));
+        const groups = [...edges];
         for (let g = 0; g < groups.length; g++) {
-            const { edge, nested } = groups[g];
-            if (Object.hasOwn(edge, "n")) {
-                if (Object.keys(edge).some((key) => !nodeLabels.has(key)) || !validSaid(edge.n))
-                    return null;
-                if (!nodes.has(edge.n)) {
+            const edge = groups[g];
+            const target = acdcEdgeTarget(edge);
+            if (target === false)
+                return null;
+            if (typeof target === "string") {
+                if (!nodes.has(target)) {
                     if (closed)
                         return null;
                 }
-                else if (!seen.has(edge.n))
-                    queue.push(edge.n);
+                else {
+                    farNodes.add(target);
+                    if (!seen.has(target))
+                        queue.push(target);
+                }
             }
             else {
-                const labels = nested ? groupLabels : sectionLabels;
+                if (!record(edge))
+                    return null;
                 for (const [key, value] of Object.entries(edge)) {
-                    if (labels.has(key))
+                    if (acdcGroupLabels.has(key) || typeof value === "string")
                         continue;
-                    if (!record(value))
-                        return null;
-                    groups.push({ edge: value, nested: true });
+                    groups.push(value);
                 }
             }
         }
     }
-    return seen.size === nodes.size ? { nodes, order } : null;
+    if (seen.size !== nodes.size)
+        return null;
+    const parents = new Map();
+    for (const [near, children] of dependencies) {
+        for (const far of children) {
+            if (!parents.has(far))
+                parents.set(far, new Set());
+            parents.get(far).add(near);
+        }
+    }
+    const dependencyOrder = order.filter((said) => dependencies.get(said).size === 0);
+    for (let i = 0; i < dependencyOrder.length; i++) {
+        for (const near of parents.get(dependencyOrder[i]) ?? []) {
+            const children = dependencies.get(near);
+            children.delete(dependencyOrder[i]);
+            if (!children.size)
+                dependencyOrder.push(near);
+        }
+    }
+    return dependencyOrder.length === nodes.size ? { nodes, order } : null;
 }
 /** Compare SAD values structurally while retaining list order; map insertion order is not semantic here. */
 function equal(a, b) {
@@ -137,8 +152,10 @@ function equal(a, b) {
     }
     return false;
 }
-/** Require the plan to select every disclosed node in canonical breadth-first order. */
+/** Select every disclosed node in exact BFS order using literal SAD paths and virtual far-node hops. */
 export function verifyIpexDisclosure(plan, origin, graph) {
+    if (!plan.length || graph.order[0] !== origin)
+        return false;
     const selected = [];
     for (const [schema, prefix, fields] of plan) {
         let said = origin;
@@ -151,18 +168,22 @@ export function verifyIpexDisclosure(plan, origin, graph) {
                 if (part === "_") {
                     if (!record(value) || typeof value.n !== "string")
                         return false;
-                    said = value.n;
+                    const target = value.n;
+                    said = target;
                     node = graph.nodes.get(said);
                     if (!node)
                         return false;
                     value = node.body.sad;
                 }
-                else if (record(value) && Object.hasOwn(value, part))
-                    value = value[part];
-                else if (Array.isArray(value) && /^\d+$/.test(part) && Number(part) < value.length)
-                    value = value[Number(part)];
-                else
-                    return false;
+                else {
+                    if (record(value) && Object.hasOwn(value, part))
+                        value = value[part];
+                    else if (Array.isArray(value) && /^\d+$/.test(part) && Number(part) < value.length) {
+                        value = value[Number(part)];
+                    }
+                    else
+                        return false;
+                }
             }
         }
         selected.push(said);
@@ -220,78 +241,3 @@ export function verifyIpexDisclosure(plan, origin, graph) {
     }
     return equal(selected, graph.order);
 }
-/** Check one declared edge relation and its schema pin after the graph's issuer proofs pass. */
-function leafRelation(group, near, graph, inheritedSchema, db) {
-    if (Object.keys(group).some((key) => !nodeLabels.has(key)) || typeof group.n !== "string")
-        return null;
-    const far = graph.nodes.get(group.n)?.body;
-    if (!far)
-        return null;
-    const op = group.o;
-    const operators = op == null
-        ? []
-        : typeof op === "string"
-            ? [op]
-            : Array.isArray(op) && op.length && op.every((item) => typeof item === "string")
-                ? op
-                : null;
-    if (!operators || operators.some((item) => !unaryOps.has(item)))
-        return null;
-    // The frozen reference recognizes these operators but leaves them unsatisfied.
-    if (operators.includes("NOT") || operators.includes("DI2I"))
-        return false;
-    if (operators.includes("E1E") && (!near.issuee || !far.issuee || near.issuee !== far.issuee))
-        return false;
-    if (operators.includes("I2I") && (!far.issuee || near.issuer !== far.issuee))
-        return false;
-    const schema = Object.hasOwn(group, "s") ? group.s : inheritedSchema;
-    if (schema == null)
-        return true;
-    if (typeof schema !== "string" && !record(schema))
-        return false;
-    const result = validateSchema(far, db, schema);
-    return result.kind === "missing" ? result : result.kind === "valid";
-}
-/** Evaluate AND/OR edge groups; malformed members cannot be hidden by a passing sibling. */
-function groupRelation(group, near, graph, inheritedSchema, nested, db) {
-    const op = group.o ?? "AND";
-    if (op !== "AND" && op !== "OR")
-        return null;
-    const labels = nested ? groupLabels : sectionLabels;
-    const schema = nested && Object.hasOwn(group, "s") ? group.s : inheritedSchema;
-    const results = [];
-    for (const [key, node] of Object.entries(group)) {
-        if (labels.has(key))
-            continue;
-        if (!record(node))
-            return null;
-        const result = Object.hasOwn(node, "n")
-            ? leafRelation(node, near, graph, schema, db)
-            : groupRelation(node, near, graph, schema, true, db);
-        if (result === null)
-            return null;
-        if (typeof result === "object")
-            return result;
-        results.push(result);
-    }
-    return !results.length ? null : op === "OR" ? results.some(Boolean) : results.every(Boolean);
-}
-/** Validate edge blocks against authenticated nodes; unavailable schemas remain typed dependencies. */
-export function verifyIpexRelations(graph, db) {
-    for (const said of graph.order) {
-        const near = graph.nodes.get(said).body;
-        const edges = blocks(near.sad.e);
-        if (!edges)
-            return false;
-        for (const edge of edges) {
-            const matched = Object.hasOwn(edge, "n")
-                ? leafRelation(edge, near, graph, null, db)
-                : groupRelation(edge, near, graph, null, false, db);
-            if (matched !== null && typeof matched === "object")
-                return matched;
-            if (matched !== true)
-                return false;
-        }
-    }
-    return true;
-}