keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/{app/cli → cli/identity}/delegate.js

@@ -12,15 +12,19 @@
  *   and the delegator's own KEL state
  */
 import { Diger } from "cesr-ts";
+import { call, race, sleep, spawn } from "effection";
+import { runAgentRuntime } from "../../app/runtime/agent-runtime.js";
 import { ValidationError } from "../../core/errors.js";
 import { dgKey } from "../../db/core/keys.js";
-import { processRuntimeTurn, processRuntimeUntil, } from "../agent-runtime.js";
-import { groupSigningMembers, isLocalGroupHab, localGroupMember, } from "../endpoint-roleing.js";
-import { MULTISIG_IXN_ROUTE } from "../grouping.js";
-import { queryTransportSink } from "../runtime-deliveries.js";
-import { WitnessReceiptor } from "../witnessing.js";
-import { withHabAndAgentRuntime } from "./common/context.js";
-import { resolveWitnessAuths } from "./common/witness-auth.js";
+import { parseBooleanOption, parseStringListOption, parseStringOption } from "../common/parsing.js";
+import { createExchangeMessage } from "../../app/exchanges/exchange-messaging.js";
+import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../../app/identity/endpoint-roleing.js";
+import { MULTISIG_IXN_ROUTE } from "../../app/multisig/grouping.js";
+import { SeqNoQuerier } from "../../app/queries/querying.js";
+import { runtimeTurn } from "../../app/runtime/runtime-turn.js";
+import { WitnessReceiptor } from "../../app/witness/receipting.js";
+import { withHabAndAgentRuntime } from "../common/context.js";
+import { resolveWitnessAuths } from "../common/witness-auth.js";
 /** Return pending delegated events for one local delegator, oldest first. */
 function pendingDelegations(hby, delegatorPre) {
     const pending = [];
@@ -86,20 +90,24 @@ function delegateWitnessLogsQuery(hab, serder, witness) {
     if (!serder.pre || !serder.snh) {
         throw new ValidationError("Delegated event is missing pre or sn for query.");
     }
-    const query = { fn: "0", s: serder.snh };
     return {
-        kind: "wire",
-        cue: {
-            kin: "query",
-            pre: serder.pre,
-            src: witness,
-            route: "logs",
-            query,
-            wits: [witness],
-        },
-        messages: [hab.query(serder.pre, witness, query, "logs")],
+        pre: serder.pre,
+        signer: hab.pre,
+        src: witness,
+        route: "logs",
+        q: { fn: "0", s: serder.snh },
+        wits: [witness],
     };
 }
+/**
+ * Publish group delegation approval to remote signing members before advancing the workflow.
+ *
+ * @param runtime Borrowed composed runtime; caller owns its worker and store lifetime.
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param groupHab Group approving habitat.
+ * @param message Signed approving interaction to embed for remote members.
+ * @returns Successful delivery URLs after each concrete Poster outcome.
+ */
 function* publishGroupDelegationApproval(runtime, hby, groupHab, message) {
     const member = localGroupMember(hby, groupHab.pre);
     const smids = groupSigningMembers(hby, groupHab.pre);
@@ -108,14 +116,18 @@ function* publishGroupDelegationApproval(runtime, hby, groupHab, message) {
         if (recipient === member.pre || hby.habs.has(recipient)) {
             continue;
         }
-        const result = yield* runtime.poster.sendExchange(member, {
-            recipient,
+        const { msg } = createExchangeMessage(member, {
+            dest: recipient,
             route: MULTISIG_IXN_ROUTE,
             payload: { gid: groupHab.pre, smids },
             embeds: { ixn: message },
-            topic: "multisig",
         });
-        deliveries.push(...result.deliveries, ...result.queued);
+        const postman = runtime.postman;
+        const evt = postman.send({ src: member.pre, dest: recipient, topic: "multisig", msg }, { notify: true });
+        const result = yield* postman.wait(evt);
+        if (result.kin === "failed")
+            throw result.error;
+        deliveries.push(...result.deliveries);
     }
     return deliveries;
 }
@@ -133,30 +145,26 @@ function pinApprovalSeal(hby, hab, delegated, approving) {
     ]);
     hab.kvy.processEscrowDelegables();
 }
-/** Route query cues through query transport and other cues through Respondant. */
-function delegateConfirmSink(runtime, hby, hab) {
-    const querySink = queryTransportSink(runtime, hby, hab);
-    return {
-        admitQuery: querySink.admitQuery,
-        admitCue: (current, interpreter) => runtime.respondant.admitCue(current, interpreter, hab),
-        *send(emission) {
-            if (emission.kind === "wire" && emission.cue.kin === "query") {
-                yield* querySink.send(emission);
-                return;
-            }
-            yield* runtime.respondant.sendWithHab(emission, hab);
-        },
-    };
+/** Observe approval state while the command's host workers own background progress. */
+function* waitForDelegation(done, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (!done()) {
+        if (Date.now() >= deadline)
+            throw new Error(`Runtime did not converge within ${timeoutMs}ms.`);
+        yield* runtimeTurn();
+    }
 }
-/** Approve pending delegated events for the selected local delegator habitat.
+/**
+ * Approve pending events without starting or serially driving background workers.
  *
- * This is the explicit use-case service for the delegation approval workflow.
- * The public CLI command is now a thin adapter: parse → open context → call → render → close.
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param hab Approving local habitat.
+ * @param runtime Borrowed composed runtime; caller owns its worker and store lifetime.
+ * @param confirmArgs Command approval choices/callback inputs.
  */
-export function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
+function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
     const interactionApproval = confirmArgs.interact ?? false;
-    const sink = delegateConfirmSink(runtime, hby, hab);
-    yield* processRuntimeUntil(runtime, () => pendingDelegations(hby, hab.pre).length > 0, { hab, maxTurns: 64, pollMailbox: true, sink });
+    yield* waitForDelegation(() => pendingDelegations(hby, hab.pre).length > 0, 15_000);
     const pending = pendingDelegations(hby, hab.pre);
     if (pending.length === 0) {
         throw new ValidationError(`No delegated events are awaiting approval for ${hab.pre}.`);
@@ -193,23 +201,12 @@ export function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
             const witnesses = delegateWitnesses(hby, serder).sort();
             const selectedWitness = witnesses[0];
             const member = localGroupMember(hby, hab.pre);
-            const memberSink = delegateConfirmSink(runtime, hby, member);
             pinApprovalSeal(hby, hab, serder, approving);
-            yield* processRuntimeTurn(runtime, {
-                hab: member,
-                pollMailbox: true,
-                sink: memberSink,
-            });
             if (!delegateCommitted(hby, serder) && selectedWitness) {
-                yield* memberSink.send(delegateWitnessLogsQuery(member, serder, selectedWitness));
-                yield* processRuntimeUntil(runtime, () => delegateCommitted(hby, serder), { hab: member, maxTurns: 128, pollMailbox: true, sink: memberSink });
+                runtime.querying.enqueue(delegateWitnessLogsQuery(member, serder, selectedWitness));
+                yield* waitForDelegation(() => delegateCommitted(hby, serder), 30_000);
             }
             pinApprovalSeal(hby, hab, serder, approving);
-            yield* processRuntimeTurn(runtime, {
-                hab: member,
-                pollMailbox: true,
-                sink: memberSink,
-            });
             if (serder.pre && serder.said) {
                 const stillPending = hby.db.delegables.get([serder.pre]).includes(serder.said);
                 if (stillPending) {
@@ -229,7 +226,7 @@ export function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
             hab.rotate({ data: [anchor] });
         }
         if (hab.kever?.wits.length) {
-            const witDoer = new WitnessReceiptor(hby, { runtime });
+            const witDoer = new WitnessReceiptor(hby, runtime.protocol, runtime.http, runtime.clock);
             yield* witDoer.submit(hab.pre, {
                 sn: hab.kever.sn,
                 auths,
@@ -245,18 +242,29 @@ export function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
             // Witnessed delegates must prove the delegated event is committed
             // locally before we pin `aess.` and retry delegated unescrow. Doing
             // it earlier can make local state look approved but incomplete.
-            yield* sink.send(delegateWitnessLogsQuery(hab, serder, selectedWitness));
-            yield* processRuntimeUntil(runtime, () => delegateCommitted(hby, serder), { hab, maxTurns: 128, pollMailbox: true, sink });
+            runtime.querying.enqueue(delegateWitnessLogsQuery(hab, serder, selectedWitness));
+            yield* waitForDelegation(() => delegateCommitted(hby, serder), 30_000);
         }
         else {
-            const querier = runtime.querying.watchSeqNo(serder.pre, serder.sn ?? 0, { hab });
             // No delegate witness exists to query. Process the local delegable
             // after the delegator has anchored approval; the delegate still
             // discovers approval through its own delegator-KEL query path.
             pinApprovalSeal(hby, hab, serder, approving);
-            yield* processRuntimeUntil(runtime, () => querier.done, { hab, maxTurns: 128, pollMailbox: true, sink });
+            const observed = yield* race([
+                call(function* () {
+                    yield* new SeqNoQuerier(hby.db, runtime.querying, serder.pre, serder.sn ?? 0, {
+                        signer: hab.pre,
+                    }).queryDo();
+                    return true;
+                }),
+                call(function* () {
+                    yield* sleep(30_000);
+                    return false;
+                }),
+            ]);
+            if (!observed)
+                throw new Error("Runtime did not converge within 30000ms.");
         }
-        yield* processRuntimeTurn(runtime, { hab, pollMailbox: true, sink });
         // Match KERIpy sequencing: only record the approving seal and retry
         // delegated unescrow after the delegate event has been observed as
         // locally committed through the witness-backed query/replay path.
@@ -275,17 +283,17 @@ export function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
 /** Approve pending delegated events for the selected local delegator habitat. */
 export function* delegateConfirmCommand(args) {
     const confirmArgs = {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        alias: args.alias,
-        compat: args.compat,
-        interact: args.interact,
-        auto: args.auto,
-        authenticate: args.authenticate,
-        code: args.code,
-        codeTime: args.codeTime,
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        alias: parseStringOption(args.alias, "alias"),
+        compat: parseBooleanOption(args.compat, "compat"),
+        interact: parseBooleanOption(args.interact, "interact"),
+        auto: parseBooleanOption(args.auto, "auto"),
+        authenticate: parseBooleanOption(args.authenticate, "authenticate"),
+        code: parseStringListOption(args.code, "code"),
+        codeTime: parseStringOption(args.codeTime, "codeTime"),
     };
     if (!confirmArgs.name) {
         throw new ValidationError("Name is required and cannot be empty");
@@ -302,6 +310,13 @@ export function* delegateConfirmCommand(args) {
         if (!hab.kever) {
             throw new ValidationError(`Missing accepted key state for ${hab.pre}.`);
         }
-        yield* performDelegationApproval(hby, hab, runtime, confirmArgs);
+        const signer = isLocalGroupHab(hby, hab) ? localGroupMember(hby, hab.pre) : hab;
+        const worker = yield* spawn(() => runAgentRuntime(runtime, { hab: signer }));
+        try {
+            yield* performDelegationApproval(hby, hab, runtime, confirmArgs);
+        }
+        finally {
+            yield* worker.halt();
+        }
     });
 }

package/esm/keri/npm/src/{app/cli → cli/identity}/export.js

@@ -1,6 +1,7 @@
 import { ValidationError } from "../../core/errors.js";
 import { dgKey } from "../../db/core/keys.js";
-import { withExistingHab } from "./common/context.js";
+import { withExistingHab } from "../common/context.js";
+import { parseBooleanOption, parseStringOption } from "../common/parsing.js";
 /**
  * Implements `tufa export`.
  *
@@ -8,13 +9,13 @@ import { withExistingHab } from "./common/context.js";
  */
 export function* exportCommand(args) {
     const exportArgs = {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        alias: args.alias,
-        files: args.files,
-        ends: args.ends,
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        alias: parseStringOption(args.alias, "alias"),
+        files: parseBooleanOption(args.files, "files"),
+        ends: parseBooleanOption(args.ends, "ends"),
     };
     if (!exportArgs.name) {
         throw new ValidationError("Name is required and cannot be empty");

package/esm/keri/npm/src/cli/identity/incept.js

@@ -0,0 +1,181 @@
+import { call } from "effection";
+import { resolveBootstrap } from "../../app/bootstrap/bootstrapping.js";
+import { createProtocolProcessor } from "../../app/protocol/protocol-processing.js";
+import { createAgentRuntime, runAgentRuntimeUntil, } from "../../app/runtime/agent-runtime.js";
+import { systemClock } from "../../app/runtime/runtime-clock.js";
+import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { ValidationError } from "../../core/errors.js";
+import { assertBootstrapComplete } from "../common/bootstrap.js";
+import { createConfiger } from "../../app/identity/configing.js";
+import { resolveDelegationCommunicationHab } from "../../app/identity/delegating.js";
+import { Receiptor, WitnessReceiptor } from "../../app/witness/receipting.js";
+import { setupHby } from "../common/existing.js";
+import { loadInceptFileOptions, parseBooleanOption, parseCountOption, parseDataItems, parseKeriVersionOption, parseStringListOption, parseStringOption, parseThresholdOption, } from "../common/parsing.js";
+/**
+ * Loads incept options from a file and overlays explicit CLI values.
+ */
+function mergeWithFile(args) {
+    let opts = {};
+    if (args.file && args.file !== "") {
+        opts = loadInceptFileOptions(args.file);
+    }
+    if (args.transferable !== undefined)
+        opts.transferable = args.transferable;
+    if (args.wits !== undefined)
+        opts.wits = args.wits;
+    if (args.icount !== undefined)
+        opts.icount = args.icount;
+    if (args.isith !== undefined)
+        opts.isith = args.isith;
+    if (args.ncount !== undefined)
+        opts.ncount = args.ncount;
+    if (args.nsith !== undefined)
+        opts.nsith = args.nsith;
+    if (args.toad !== undefined)
+        opts.toad = args.toad;
+    if (args.estOnly !== undefined)
+        opts.estOnly = args.estOnly;
+    if (args.delpre !== undefined)
+        opts.delpre = args.delpre;
+    if (args.data !== undefined)
+        opts.data = parseDataItems(args.data);
+    return opts;
+}
+/**
+ * Implements `tufa incept`.
+ *
+ * Creates a single-sig identifier locally.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export function* inceptCommand(args) {
+    // Select one HTTP implementation for all work owned by this command.
+    const http = new FetchHttpClient();
+    const inceptArgs = {
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        temp: parseBooleanOption(args.temp, "temp"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        alias: parseStringOption(args.alias, "alias"),
+        configDir: parseStringOption(args.configDir, "configDir"),
+        configFile: parseStringOption(args.configFile, "configFile"),
+        endpoint: parseBooleanOption(args.endpoint, "endpoint"),
+        proxy: parseStringOption(args.proxy, "proxy"),
+        file: parseStringOption(args.file, "file"),
+        transferable: parseBooleanOption(args.transferable, "transferable"),
+        wits: parseStringListOption(args.wits, "wits"),
+        toad: parseCountOption(args.toad, "toad"),
+        icount: parseCountOption(args.icount, "icount"),
+        isith: parseThresholdOption(args.isith),
+        ncount: parseCountOption(args.ncount, "ncount"),
+        nsith: parseThresholdOption(args.nsith),
+        estOnly: parseBooleanOption(args.estOnly, "estOnly"),
+        data: parseStringListOption(args.data, "data"),
+        delpre: parseStringOption(args.delpre, "delpre"),
+        version: parseKeriVersionOption(args.version),
+    };
+    if (!inceptArgs.name) {
+        throw new ValidationError("Name is required and cannot be empty");
+    }
+    if (!inceptArgs.alias) {
+        throw new ValidationError("Alias is required and cannot be empty");
+    }
+    const opts = mergeWithFile(inceptArgs);
+    if (opts.icount === 0)
+        throw new ValidationError("icount must be positive");
+    // A command-local scope owns acquisition and teardown; there is no independent child consumer.
+    const result = yield* call(function* () {
+        const cf = inceptArgs.configFile
+            ? (yield* createConfiger({
+                name: inceptArgs.configFile,
+                base: "",
+                temp: false,
+                headDirPath: inceptArgs.configDir,
+                reopen: true,
+                clear: false,
+            }))
+            : undefined;
+        const hby = yield* setupHby(inceptArgs.name, inceptArgs.base ?? "", inceptArgs.passcode, inceptArgs.temp ?? false, inceptArgs.headDirPath, {
+            readonly: false,
+            cf,
+            skipConfig: !cf,
+            skipSignator: true,
+        });
+        let failure;
+        try {
+            if (hby.habByName(inceptArgs.alias)) {
+                throw new ValidationError(`Alias ${inceptArgs.alias} already exists; inception requires an unused alias.`);
+            }
+            assertBootstrapComplete(yield* resolveBootstrap(hby, http));
+            const hab = hby.makeHab(inceptArgs.alias, undefined, {
+                transferable: opts.transferable ?? false,
+                wits: opts.wits ?? [],
+                toad: opts.toad ?? 0,
+                icount: opts.icount ?? 1,
+                isith: opts.isith,
+                ncount: opts.ncount ?? 1,
+                nsith: opts.nsith,
+                estOnly: opts.estOnly ?? false,
+                data: opts.data ?? [],
+                delpre: opts.delpre,
+                version: inceptArgs.version,
+            });
+            if (hab.kever?.wits.length) {
+                if (inceptArgs.endpoint) {
+                    const receiptor = new Receiptor(hby, createProtocolProcessor(hby), http, systemClock);
+                    yield* receiptor.receipt(hab.pre, { sn: 0 });
+                }
+                else {
+                    const witDoer = new WitnessReceiptor(hby, createProtocolProcessor(hby), http, systemClock);
+                    yield* witDoer.submit(hab.pre, { sn: 0 });
+                }
+            }
+            let delegationPhase = null;
+            if (opts.delpre) {
+                const communicationHab = resolveDelegationCommunicationHab(hby, inceptArgs.proxy);
+                if (!communicationHab) {
+                    throw new ValidationError(`Delegated inception for ${hab.pre} requires --proxy <alias>.`);
+                }
+                const runtime = yield* createAgentRuntime(hby, http, systemClock);
+                try {
+                    runtime.delegating.beginLatest(hab.pre, 0, {
+                        communicationHab,
+                    });
+                    yield* runAgentRuntimeUntil(runtime, () => runtime.delegating.complete(hab.pre, 0), { hab, timeoutMs: 120_000, pollMailbox: true });
+                    delegationPhase = runtime.delegating.workflowStatus(hab.pre, "0").phase;
+                }
+                finally {
+                    yield* runtime.close();
+                }
+            }
+            const state = hby.db.getState(hab.pre);
+            return { prefix: hab.pre, keys: state?.k ?? [], delegationPhase };
+        }
+        catch (error) {
+            failure = { error };
+            throw error;
+        }
+        finally {
+            try {
+                yield* hby.close();
+            }
+            catch (error) {
+                if (failure) {
+                    // deno-lint-ignore no-unsafe-finally -- Preserve inception and shutdown failures.
+                    throw new AggregateError([failure.error, error], "Inception and database close failed", {
+                        cause: failure.error,
+                    });
+                }
+                // deno-lint-ignore no-unsafe-finally -- Final success requires resource closure.
+                throw error;
+            }
+        }
+    });
+    console.log(`Prefix  ${result.prefix}`);
+    for (const [idx, key] of result.keys.entries())
+        console.log(`\tPublic key ${idx + 1}:  ${key}`);
+    if (result.delegationPhase)
+        console.log(`Delegation status  ${result.delegationPhase}`);
+    console.log("");
+}

package/esm/keri/npm/src/cli/identity/init.js

@@ -0,0 +1,153 @@
+import { Encrypter } from "cesr-ts";
+import { resolveBootstrap } from "../../app/bootstrap/bootstrapping.js";
+import { createConfiger } from "../../app/identity/configing.js";
+import { branToSeedAeid, createHabery } from "../../app/identity/habbing.js";
+import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { ValidationError } from "../../core/errors.js";
+import { assertBootstrapComplete } from "../common/bootstrap.js";
+import { parseBooleanOption, parseStringOption } from "../common/parsing.js";
+import { readPasscode } from "../common/passcode.js";
+/**
+ * Implements `tufa init`.
+ *
+ * Creates/open a habery keystore and database.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export function* initCommand(args) {
+    // Extract values from args
+    const initArgs = {
+        name: parseStringOption(args.name, "--name"),
+        base: parseStringOption(args.base, "--base"),
+        headDirPath: parseStringOption(args.headDirPath, "--head-dir"),
+        temp: parseBooleanOption(args.temp, "--temp") ?? false,
+        salt: parseStringOption(args.salt, "--salt"),
+        configDir: parseStringOption(args.configDir, "--config-dir"),
+        configFile: parseStringOption(args.configFile, "--config-file"),
+        passcode: parseStringOption(args.passcode, "--passcode"),
+        nopasscode: parseBooleanOption(args.nopasscode, "--nopasscode") ?? false,
+        aeid: parseStringOption(args.aeid, "--aeid"),
+        seed: parseStringOption(args.seed, "--seed"),
+    };
+    const name = initArgs.name;
+    if (!name || name.trim().length === 0) {
+        throw new ValidationError("Name is required and cannot be empty");
+    }
+    let credentials = resolveCredentials(initArgs);
+    if (credentials.kind === "prompt") {
+        const passcode = yield* readPasscode("Passcode:");
+        requirePasscode(passcode);
+        const retry = yield* readPasscode("Re-enter passcode:");
+        requirePasscode(retry);
+        if (passcode !== retry)
+            throw new ValidationError("Passcodes do not match");
+        credentials = passcodeCredentials(passcode);
+    }
+    const cf = initArgs.configFile
+        ? (yield* createConfiger({
+            name: initArgs.configFile,
+            base: "",
+            temp: false,
+            headDirPath: initArgs.configDir,
+            reopen: true,
+            clear: false,
+        }))
+        : undefined;
+    let hby;
+    let created;
+    let failure;
+    try {
+        let seed;
+        let aeid;
+        if (credentials.kind === "encrypted") {
+            seed = credentials.seed;
+            aeid = credentials.aeid;
+        }
+        hby = yield* createHabery({
+            name,
+            base: initArgs.base ?? "",
+            headDirPath: initArgs.headDirPath,
+            temp: initArgs.temp ?? false,
+            cf,
+            skipConfig: !cf,
+            skipSignator: true,
+            aeid,
+            seed,
+            salt: initArgs.salt,
+        });
+        assertBootstrapComplete(yield* resolveBootstrap(hby, new FetchHttpClient()));
+        created = { keystore: hby.ks.path, database: hby.db.path, aeid: hby.mgr.aeid };
+    }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
+    finally {
+        try {
+            if (hby)
+                yield* hby.close();
+            else if (cf)
+                yield* cf.close();
+        }
+        catch (error) {
+            if (failure) {
+                // deno-lint-ignore no-unsafe-finally -- Preserve initialization and shutdown failures.
+                throw new AggregateError([failure.error, error], "Initialization and database close failed", {
+                    cause: failure.error,
+                });
+            }
+            // deno-lint-ignore no-unsafe-finally -- Final success requires resource closure.
+            throw error;
+        }
+    }
+    console.log("KERI Keystore created at:", created.keystore);
+    console.log("KERI Database created at:", created.database);
+    if (created.aeid)
+        console.log("\taeid:", created.aeid);
+}
+/** Refuse empty secrets without changing passcode normalization or derivation. */
+function requirePasscode(passcode) {
+    if (passcode.trim().length === 0)
+        throw new ValidationError("Passcode cannot be empty");
+    if (passcode.length < 21)
+        throw new ValidationError("Passcode must contain at least 21 characters");
+}
+/** Derive once through the same primitive path used for encrypted Habery reopen. */
+function passcodeCredentials(passcode) {
+    requirePasscode(passcode);
+    return { kind: "encrypted", ...branToSeedAeid(passcode) };
+}
+/** Validate one explicit encryption method, including a matching AEID/seed pair. */
+function resolveCredentials(args) {
+    const passcodeProvided = args.passcode !== undefined;
+    const aeidProvided = args.aeid !== undefined;
+    const seedProvided = args.seed !== undefined;
+    if (args.nopasscode) {
+        if (passcodeProvided || aeidProvided || seedProvided) {
+            throw new ValidationError("--nopasscode cannot be combined with --passcode, --aeid or --seed");
+        }
+        return { kind: "plaintext" };
+    }
+    if (passcodeProvided) {
+        if (aeidProvided || seedProvided) {
+            throw new ValidationError("Choose either --passcode or --aeid with --seed");
+        }
+        return passcodeCredentials(args.passcode);
+    }
+    if (aeidProvided || seedProvided) {
+        if (!args.aeid || !args.seed)
+            throw new ValidationError("--aeid and --seed must be supplied together");
+        try {
+            if (!new Encrypter({ verkey: args.aeid }).verifySeed(args.seed)) {
+                throw new ValidationError("Seed is not associated with the supplied AEID");
+            }
+        }
+        catch (cause) {
+            if (cause instanceof ValidationError)
+                throw cause;
+            throw new ValidationError("Invalid AEID/seed credentials", { cause });
+        }
+        return { kind: "encrypted", aeid: args.aeid, seed: args.seed };
+    }
+    return { kind: "prompt" };
+}