keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/vdr/registry-tsn-record.js

@@ -0,0 +1,55 @@
+import { Diger, Prefixer } from "cesr-ts";
+import { RegStateRecord } from "../core/records.js";
+import { timestampMicros } from "../time/mod.js";
+/** Require the entire qualified prefix, not a valid prefix followed by untrusted suffix bytes. */
+export function qualifiedPrefix(value) {
+    try {
+        return typeof value === "string" && new Prefixer({ qb64: value }).qb64 === value;
+    }
+    catch {
+        return false;
+    }
+}
+/** Validate unknown notice fields and return the existing record with every field required. */
+export function registryRecord(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return null;
+    if (Object.keys(data).some((key) => !["vn", "i", "s", "d", "ii", "dt", "et", "bt", "b", "c"].includes(key))
+        || !("i" in data) || !qualifiedPrefix(data.i) || !("ii" in data) || !qualifiedPrefix(data.ii)
+        || !("s" in data) || typeof data.s !== "string" || !/^[0-9a-f]{1,14}$/i.test(data.s)
+        || BigInt(`0x${data.s}`) > BigInt(Number.MAX_SAFE_INTEGER)
+        || !("bt" in data) || typeof data.bt !== "string" || !/^[0-9a-f]{1,14}$/i.test(data.bt)
+        || !("et" in data) || (data.et !== "vcp" && data.et !== "vrt")
+        || !("dt" in data) || typeof data.dt !== "string" || timestampMicros(data.dt) === null
+        || !("vn" in data) || !Array.isArray(data.vn) || data.vn.length !== 2
+        || !("b" in data) || !Array.isArray(data.b) || !("c" in data) || !Array.isArray(data.c)
+        || !("d" in data) || typeof data.d !== "string")
+        return null;
+    // Array.isArray erases item types; narrow untrusted elements before constructing owned projections.
+    const version = data.vn, backers = data.b, config = data.c;
+    const [major, minor] = version;
+    if (typeof major !== "number" || !Number.isSafeInteger(major) || major < 0
+        || typeof minor !== "number" || !Number.isSafeInteger(minor) || minor < 0
+        || !backers.every(qualifiedPrefix) || !config.every((item) => typeof item === "string"))
+        return null;
+    try {
+        if (new Diger({ qb64: data.d }).qb64 !== data.d)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    // Keep required-field types while constructing the existing record; these arrays are fresh owned copies.
+    return Object.assign(new RegStateRecord(), {
+        vn: [major, minor],
+        i: data.i,
+        s: data.s,
+        d: data.d,
+        ii: data.ii,
+        dt: data.dt,
+        et: data.et,
+        bt: data.bt,
+        b: [...backers],
+        c: [...config],
+    });
+}

package/esm/keri/npm/src/vdr/revoking.js

@@ -0,0 +1,90 @@
+/** Read-only authority and retained-event selection for local legacy NoBackers revocation. */
+import { Ilks, NumDex, Seqner, SerderKERI, TraitDex } from "cesr-ts";
+import { DatabaseOperationError, ValidationError } from "../core/errors.js";
+import { revoke } from "../core/protocol-vdr-eventing.js";
+import { dgKey } from "../db/core/keys.js";
+/**
+ * Check the credential, accepted registry, original issuance and proposed REV
+ * before a local member signs its issuer anchor. Missing authority stays pending;
+ * contradictory evidence refuses. This neither accepts TEL nor changes escrows.
+ * An already accepted matching REV remains valid for explicit approval resume.
+ */
+export function validateCredentialRevocation(reger, issuer, event) {
+    if (!event.verify() || event.ilk !== Ilks.rev || event.sn !== 1 || !event.pre) {
+        throw new ValidationError("Credential revocation requires valid rev evidence at ordinal one.");
+    }
+    const creder = reger.creds.get(event.pre);
+    if (!creder || reger.saved.get(event.pre) === null)
+        return false;
+    if (!creder.verify() || creder.issuer !== issuer || creder.regid !== event.ked?.ri) {
+        throw new ValidationError("Credential revocation does not match its credential, issuer and registry.");
+    }
+    const registry = creder.regid;
+    const state = reger.states.get(registry);
+    if (!state)
+        return false;
+    if (state.ii !== issuer || !(state.c ?? []).includes(TraitDex.NoBackers)) {
+        throw new ValidationError("Local credential revocation requires its issuer's NoBackers registry.");
+    }
+    const issuance = reger.tels.getOn(event.pre, 0);
+    if (!issuance)
+        return false;
+    const original = storedEvent(reger, event.pre, issuance.qb64);
+    if (original.ilk !== Ilks.iss || original.ked?.ri !== registry || event.ked?.p !== issuance.qb64) {
+        throw new ValidationError("Credential revocation predecessor does not match its accepted issuance.");
+    }
+    const accepted = reger.tels.getOn(event.pre, 1);
+    if (accepted && accepted.qb64 !== event.said) {
+        throw new ValidationError("Credential already has another accepted revocation.");
+    }
+    return true;
+}
+/**
+ * Reuse the accepted REV or this issuer's original publication candidate. The
+ * ordinary tmse record identifies locally tracked work; unrelated remote escrow
+ * candidates cannot select an event for local authoring. A fresh REV is returned
+ * only when neither exists. The caller owns anchoring and TEL admission.
+ */
+export function prepareCredentialRevocation(reger, issuer, registry, said) {
+    const creder = reger.creds.get(said);
+    if (!creder || creder.issuer !== issuer || creder.regid !== registry) {
+        throw new ValidationError("Credential is not controlled by the selected issuer and registry.");
+    }
+    const accepted = reger.tels.getOn(said, 1);
+    const rawOrdinal = new Uint8Array(16);
+    rawOrdinal[15] = 1;
+    const ordinal = new Seqner({ code: NumDex.Huge, raw: rawOrdinal }).qb64;
+    const pending = new Set([...reger.tmse.getTopItemIter([said, ordinal])].map(([keys]) => keys[2]));
+    if (pending.size > 1 || (accepted && [...pending].some(digest => digest !== accepted.qb64))) {
+        throw new DatabaseOperationError("Conflicting locally tracked credential revocations.");
+    }
+    const retained = accepted?.qb64 ?? [...pending][0];
+    let event;
+    if (retained) {
+        event = storedEvent(reger, said, retained);
+        if (!reger.ancs.get(dgKey(said, retained))) {
+            throw new DatabaseOperationError("Stored revocation issuer source seal is missing.");
+        }
+    }
+    else {
+        const issuance = reger.tels.getOn(said, 0);
+        if (!issuance)
+            throw new ValidationError(`Cannot revoke unknown credential ${said}.`);
+        event = revoke(said, registry, issuance.qb64);
+    }
+    if (!validateCredentialRevocation(reger, issuer, event)) {
+        throw new ValidationError("Credential revocation is missing accepted credential, registry or issuance evidence.");
+    }
+    return event;
+}
+/** Accepted/publication indexes must reference an intact body with the same immutable identity. */
+function storedEvent(reger, prefix, digest) {
+    const raw = reger.tvts.get(dgKey(prefix, digest));
+    if (!raw)
+        throw new DatabaseOperationError("Stored credential TEL body is missing.");
+    const event = new SerderKERI({ raw });
+    if (event.pre !== prefix || event.said !== digest || !event.verify()) {
+        throw new DatabaseOperationError("Stored credential TEL identity is corrupt.");
+    }
+    return event;
+}

package/esm/keri/npm/src/vdr/tel-anchor.js

@@ -0,0 +1,29 @@
+/** Exact issuer KEL authority for legacy TEL events. */
+import { Ilks } from "cesr-ts";
+/** Verify the complete TEL seal in the accepted issuer event at the supplied source coordinate. */
+export function verifyTelAnchor(db, issuer, event, ordinal, digest) {
+    if (!ordinal || !digest || ordinal.num > BigInt(Number.MAX_SAFE_INTEGER))
+        return false;
+    const accepted = db.kels.getLast(issuer, Number(ordinal.num));
+    if (accepted !== digest.qb64)
+        return false;
+    const anchor = db.getEvtSerder(issuer, accepted);
+    if (!anchor || anchor.said !== accepted)
+        return false;
+    return telAnchorMatches(issuer, event, anchor);
+}
+/** Match the complete TEL seal in an issuer KEL body before that anchor is signed or accepted. */
+export function telAnchorMatches(issuer, event, anchor) {
+    const seals = anchor.ked?.a;
+    return Array.isArray(seals) && seals.length === 1 && telAnchorIncludes(issuer, event, anchor);
+}
+/** Recognize the exact TEL tuple within an issuer event, including a batch of other seals. */
+export function telAnchorIncludes(issuer, event, anchor) {
+    if (anchor.pre !== issuer || (!anchor.estive && anchor.ilk !== Ilks.ixn))
+        return false;
+    const seals = anchor.ked?.a;
+    return Array.isArray(seals)
+        && seals.some((seal) => !!seal && typeof seal === "object" && !Array.isArray(seal)
+            && "i" in seal && seal.i === event.pre && "s" in seal && seal.s === event.snh
+            && "d" in seal && seal.d === event.said);
+}

package/esm/keri/npm/src/vdr/tel-publication.js

@@ -0,0 +1,178 @@
+/** Durable legacy TEL publication progress, separate from observer acceptance. */
+import { Diger, NumberPrimitive, NumDex, Prefixer, Saider, Seqner, Verfer } from "cesr-ts";
+import { DatabaseOperationError, ValidationError } from "../core/errors.js";
+import { dgKey } from "../db/core/keys.js";
+import { telAnchorMatches } from "./tel-anchor.js";
+/** Encode Python's fixed-width Seqner key, independent of the event body's number encoding. */
+function ordinal(sn) {
+    if (!Number.isSafeInteger(sn) || sn < 0)
+        throw new RangeError("Invalid TEL publication ordinal");
+    const raw = new Uint8Array(16);
+    let value = BigInt(sn);
+    for (let index = raw.length - 1; index >= 0; index--) {
+        raw[index] = Number(value & 255n);
+        value >>= 8n;
+    }
+    return new Seqner({ code: NumDex.Huge, raw });
+}
+/**
+ * Own tmse -> tpwe -> tede -> ctel using KERIpy's existing Reger tables.
+ * Accepted issuer anchors, full witness collection and completed local transport
+ * are distinct gates. ctel stores the issuer anchor SAID, as in KERIpy, and never
+ * claims remote TEL acceptance. No network work occurs inside a writer.
+ */
+export class TelPublication {
+    /** Borrow accepted KEL authority and the issuer's existing TEL environment. */
+    constructor(db, reger) {
+        Object.defineProperty(this, "db", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: db
+        });
+        Object.defineProperty(this, "reger", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: reger
+        });
+    }
+    /** Retain the original anchor even while group signatures or TEL dependencies are missing. */
+    track(event, anchor) {
+        if (!event.pre || event.sn === null || !event.said || !anchor.pre || anchor.sn === null || !anchor.said
+            || !telAnchorMatches(anchor.pre, event, anchor)) {
+            throw new ValidationError("TEL publication requires the exact issuer anchor and TEL seal.");
+        }
+        const keys = [event.pre, ordinal(event.sn).qb64, event.said];
+        const seal = [
+            new Prefixer({ qb64: anchor.pre }),
+            new NumberPrimitive({ code: NumDex.Huge, raw: ordinal(anchor.sn).raw }),
+            new Diger({ qb64: anchor.said }),
+        ];
+        const coordinates = keys.slice(0, 2);
+        const sameAnchor = (stored) => stored.every((value, index) => value.qb64 === seal[index].qb64);
+        if (!this.complete(event.pre, event.sn)
+            && !this.reger.tpwe.get(coordinates).some(sameAnchor)
+            && !this.reger.tede.get(coordinates).some(sameAnchor)) {
+            this.reger.tmse.add(keys, seal);
+        }
+        this.advance();
+    }
+    /** Move accepted anchors forward; empty witness/publication cohorts need no I/O. */
+    advance() {
+        this.reger.env.transactionSync(() => {
+            for (const [keys, seal] of [...this.reger.tmse.getTopItemIter()]) {
+                const target = this.target(keys, seal);
+                if (!target || target.said !== keys[2])
+                    continue;
+                this.reger.tpwe.add(keys.slice(0, 2), seal);
+                this.reger.tmse.rem(keys, seal);
+            }
+            for (const target of this.pendingReceipts()) {
+                if (target.witnesses.length === 0)
+                    this.receipted(target);
+            }
+            for (const target of this.pendingPublications()) {
+                if (target.witnesses.length === 0)
+                    this.published(target);
+            }
+        });
+    }
+    /** Snapshot accepted anchors awaiting an actual complete receipt/fanout attempt. */
+    pendingReceipts() {
+        return [...this.reger.tpwe.getTopItemIter()].flatMap(([keys, seal]) => {
+            const target = this.target(keys, seal);
+            return target ? [target] : [];
+        });
+    }
+    /** Commit receipt completion only after the I/O owner returned and all unique proofs still verify. */
+    receipted(target) {
+        if (!this.allReceipts(target))
+            throw new ValidationError("TEL anchor is missing required witness receipts.");
+        const seal = this.seal(target);
+        this.reger.env.transactionSync(() => {
+            this.reger.tede.add(this.keys(target), [seal[0], seal[1], new Saider({ qb64: target.anchorSaid })]);
+            this.reger.tpwe.rem(this.keys(target), seal);
+        });
+    }
+    /** Accepted TEL replay becomes eligible only after the anchor's receipt obligation finished. */
+    pendingPublications() {
+        return [...this.reger.tede.getTopItemIter()].flatMap(([keys, seal]) => {
+            const target = this.target(keys, [seal[0], seal[1], new Diger({ qb64: seal[2].qb64 })]);
+            return target && this.reger.tels.getOn(target.pre, target.sn)?.qb64 === target.said ? [target] : [];
+        });
+    }
+    /** Record finished local publication; an interrupted attempt leaves its ordinary dissemination escrow. */
+    published(target) {
+        if (!this.allReceipts(target) || this.reger.tels.getOn(target.pre, target.sn)?.qb64 !== target.said) {
+            throw new ValidationError("TEL publication dependencies changed before completion.");
+        }
+        const seal = this.seal(target);
+        this.reger.env.transactionSync(() => {
+            this.reger.ctel.pin(this.keys(target), new Saider({ qb64: target.anchorSaid }));
+            this.reger.tede.rem(this.keys(target), [seal[0], seal[1], new Saider({ qb64: target.anchorSaid })]);
+        });
+    }
+    /** Completion is durable local dissemination, not merely accepted TEL storage or peer acknowledgement. */
+    complete(pre, sn = 0) {
+        return this.reger.ctel.get([pre, ordinal(sn).qb64]) !== null;
+    }
+    /** Reverify by unique roster index; multiple signatures from one witness never fill another's slot. */
+    allReceipts(target) {
+        const current = this.target(this.keys(target), this.seal(target));
+        if (!current || current.said !== target.said)
+            return false;
+        const anchor = this.db.getEvtSerder(target.issuer, target.anchorSaid);
+        if (!anchor || this.db.kels.getLast(target.issuer, target.anchorSn) !== target.anchorSaid)
+            return false;
+        const witnesses = this.db.acceptedEventWitnesses(anchor);
+        if (!witnesses || witnesses.length !== target.witnesses.length
+            || witnesses.some((witness, index) => witness !== target.witnesses[index]))
+            return false;
+        const indices = new Set();
+        for (const signature of this.db.wigs.get(dgKey(target.issuer, target.anchorSaid))) {
+            const witness = witnesses[signature.index];
+            if (witness && new Verfer({ qb64: witness }).verify(signature.raw, anchor.raw))
+                indices.add(signature.index);
+        }
+        return indices.size === witnesses.length;
+    }
+    /** Resolve the signed TEL seal from the exact accepted historical issuer event. */
+    target(keys, seal) {
+        const [prefixer, sner, diger] = seal;
+        if (sner.num > BigInt(Number.MAX_SAFE_INTEGER))
+            throw new DatabaseOperationError("Unsafe TEL anchor ordinal");
+        const anchorSn = Number(sner.num);
+        if (this.db.kels.getLast(prefixer.qb64, anchorSn) !== diger.qb64)
+            return null;
+        const anchor = this.db.getEvtSerder(prefixer.qb64, diger.qb64);
+        if (!anchor)
+            throw new DatabaseOperationError("Accepted TEL anchor body is missing");
+        const sn = Number(new Seqner({ qb64: keys[1] }).sn);
+        if (!Number.isSafeInteger(sn) || sn < 0)
+            throw new DatabaseOperationError("Unsafe TEL publication ordinal");
+        const seals = anchor.ked?.a;
+        const eventSeal = Array.isArray(seals) && seals.length === 1 ? seals[0] : null;
+        if (!eventSeal || typeof eventSeal !== "object" || !("i" in eventSeal) || eventSeal.i !== keys[0]
+            || !("s" in eventSeal) || eventSeal.s !== sn.toString(16)
+            || !("d" in eventSeal) || typeof eventSeal.d !== "string") {
+            throw new DatabaseOperationError("Stored TEL publication does not match its issuer anchor");
+        }
+        const witnesses = this.db.acceptedEventWitnesses(anchor);
+        if (!witnesses)
+            return null;
+        return { pre: keys[0], sn, said: eventSeal.d, issuer: prefixer.qb64, anchorSn, anchorSaid: diger.qb64, witnesses };
+    }
+    /** Reuse the TEL coordinate key across witness, dissemination and completion tables. */
+    keys(target) {
+        return [target.pre, ordinal(target.sn).qb64];
+    }
+    /** Serialize the same issuer source coordinate in every escrow stage. */
+    seal(target) {
+        return [
+            new Prefixer({ qb64: target.issuer }),
+            new NumberPrimitive({ code: NumDex.Huge, raw: ordinal(target.anchorSn).raw }),
+            new Diger({ qb64: target.anchorSaid }),
+        ];
+    }
+}

package/esm/keri/npm/src/vdr/tsn-query.js

@@ -10,25 +10,30 @@ export function prepareTsnQuery({ serder, source, cigars }, tevers) {
     if (!dest)
         return { kind: "drop", reason: "missingAuthentication" };
     const query = serder.ked?.q;
-    if (!query || typeof query.ri !== "string" || !query.ri || typeof query.i !== "string") {
+    if (!query || typeof query !== "object" || Array.isArray(query)
+        || !("ri" in query) || typeof query.ri !== "string" || !query.ri
+        || !("i" in query) || typeof query.i !== "string") {
         return { kind: "drop", reason: "invalidQuery" };
     }
     const tever = tevers.get(query.ri);
     if (!tever)
-        return { kind: "unavailable", registry: query.ri };
-    const response = (route, data) => ({
+        return { kind: "unavailable" };
+    const querySaid = serder.said ?? undefined;
+    const registry = {
         kin: "reply",
-        route,
-        data,
+        route: "/tsn/registry",
+        data: tever.state(),
         dest,
-        querySaid: serder.said ?? undefined,
-    });
-    const registry = response("/tsn/registry", tever.state().asDict());
+        querySaid,
+    };
     if (!query.i)
         return { kind: "reply", replies: [registry] };
     // 714 processQuery passes nonexistent vcpre=; use the actual vcState(vci) helper.
     const credential = tever.vcState(query.i);
     if (!credential)
-        return { kind: "reply", replies: [registry], missingCredential: query.i };
-    return { kind: "reply", replies: [registry, response("/tsn/credential", credential.asDict())] };
+        return { kind: "reply", replies: [registry] };
+    return {
+        kind: "reply",
+        replies: [registry, { kin: "reply", route: "/tsn/credential", data: credential, dest, querySaid }],
+    };
 }

package/esm/keri/npm/src/{app/version.js → version.js}

@@ -6,9 +6,9 @@
  * `src/version.ts` files by hand; edit this template instead.
  */
 /** Package semantic version copied from the owning package manifest. */
-export const PACKAGE_VERSION = "0.11.0";
+export const PACKAGE_VERSION = "2.0.0";
 /** Optional build metadata stamp injected by release/CI workflows. */
-export const BUILD_METADATA = "build.25.59866b6fbed8465bb6feb85dbac38f83c6e476d5";
+export const BUILD_METADATA = "build.27.c6e19e9ebea5a79ed7b5d232ffa4d60a9acb805d";
 /** User-facing version string with build metadata appended when present. */
 export const DISPLAY_VERSION = BUILD_METADATA
     ? `${PACKAGE_VERSION}+${BUILD_METADATA}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keri-ts",
-  "version": "0.11.0",
+  "version": "2.0.0",
   "description": "KERI TypeScript protocol and runtime library",
   "homepage": "https://github.com/kentbull/keri-ts",
   "repository": {
@@ -31,22 +31,6 @@
     "./db": {
       "import": "./esm/keri/npm/src/npm/db.js",
       "types": "./types/npm/db.d.ts"
-    },
-    "./app/*": {
-      "import": "./esm/keri/npm/src/app/*.js",
-      "types": "./types/app/*.d.ts"
-    },
-    "./core/*": {
-      "import": "./esm/keri/npm/src/core/*.js",
-      "types": "./types/core/*.d.ts"
-    },
-    "./db/*": {
-      "import": "./esm/keri/npm/src/db/*.js",
-      "types": "./types/db/*.d.ts"
-    },
-    "./vdr/*": {
-      "import": "./esm/keri/npm/src/vdr/*.js",
-      "types": "./types/vdr/*.d.ts"
     }
   },
   "scripts": {
@@ -68,12 +52,14 @@
   },
   "dependencies": {
     "@deno/shim-deno": "0.18.2",
-    "ajv": "8.17.1",
-    "cesr-ts": ">=0.10.0 <0.11.0",
+    "@inquirer/password": "3.0.1",
+    "@noble/hashes": "1.8.0",
+    "ajv": "8.18.0",
+    "cesr-ts": ">=2.0.0 <2.1.0",
     "effection": "^3.6.0",
     "lmdb": "3.5.3",
-    "@msgpack/msgpack": "^3.1.2",
-    "cbor-x": "^1.6.0",
+    "@msgpack/msgpack": "3.1.3",
+    "cbor-x": "1.6.0",
     "libsodium-wrappers-sumo": "0.8.4"
   },
   "_generatedBy": "dnt@dev"

package/types/_dnt.polyfills.d.ts

@@ -97,6 +97,61 @@ interface ImportMetaPonyfill extends ImportMetaPonyfillCommonjs, ImportMetaPonyf
 export declare let import_meta_ponyfill_commonjs: ImportMetaPonyfillCommonjs;
 export declare let import_meta_ponyfill_esmodule: ImportMetaPonyfillEsmodule;
 export declare let import_meta_ponyfill: ImportMetaPonyfill;
+declare global {
+    interface Error {
+        cause?: unknown;
+    }
+}
+export {};
+declare global {
+    interface Array<T> {
+        /**
+         * Returns the value of the last element in the array where predicate is true, and undefined
+         * otherwise.
+         * @param predicate find calls predicate once for each element of the array, in ascending
+         * order, until it finds one where predicate returns true. If such an element is found, find
+         * immediately returns that element value. Otherwise, find returns undefined.
+         * @param thisArg If provided, it will be used as the this value for each invocation of
+         * predicate. If it is not provided, undefined is used instead.
+         */
+        findLast<S extends T>(predicate: (this: void, value: T, index: number, obj: T[]) => value is S, thisArg?: any): S | undefined;
+        findLast(predicate: (value: T, index: number, obj: T[]) => unknown, thisArg?: any): T | undefined;
+        /**
+         * Returns the index of the last element in the array where predicate is true, and -1
+         * otherwise.
+         * @param predicate find calls predicate once for each element of the array, in ascending
+         * order, until it finds one where predicate returns true. If such an element is found,
+         * findIndex immediately returns that element index. Otherwise, findIndex returns -1.
+         * @param thisArg If provided, it will be used as the this value for each invocation of
+         * predicate. If it is not provided, undefined is used instead.
+         */
+        findLastIndex(predicate: (value: T, index: number, obj: T[]) => unknown, thisArg?: any): number;
+    }
+    interface Uint8Array {
+        /**
+         * Returns the value of the last element in the array where predicate is true, and undefined
+         * otherwise.
+         * @param predicate findLast calls predicate once for each element of the array, in descending
+         * order, until it finds one where predicate returns true. If such an element is found, findLast
+         * immediately returns that element value. Otherwise, findLast returns undefined.
+         * @param thisArg If provided, it will be used as the this value for each invocation of
+         * predicate. If it is not provided, undefined is used instead.
+         */
+        findLast<S extends number>(predicate: (value: number, index: number, array: Uint8Array) => value is S, thisArg?: any): S | undefined;
+        findLast(predicate: (value: number, index: number, array: Uint8Array) => unknown, thisArg?: any): number | undefined;
+        /**
+         * Returns the index of the last element in the array where predicate is true, and -1
+         * otherwise.
+         * @param predicate findLastIndex calls predicate once for each element of the array, in descending
+         * order, until it finds one where predicate returns true. If such an element is found,
+         * findLastIndex immediately returns that element index. Otherwise, findLastIndex returns -1.
+         * @param thisArg If provided, it will be used as the this value for each invocation of
+         * predicate. If it is not provided, undefined is used instead.
+         */
+        findLastIndex(predicate: (value: number, index: number, array: Uint8Array) => unknown, thisArg?: any): number;
+    }
+}
+export {};
 declare global {
     interface Object {
         /**

package/types/_dnt.polyfills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_dnt.polyfills.d.ts","sourceRoot":"","sources":["../src/_dnt.polyfills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAgC,KAAK,GAAG,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,UAAU;QAClB;;;;;;;;;;;;;;WAcG;QACH,GAAG,EAAE,MAAM,CAAC;QACZ;;;;;;;;;;;;WAYG;QACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC;QACtE;;;;;;;;WAQG;QACH,IAAI,EAAE,OAAO,CAAC;QAEd;;;;;;;;;;;;WAYG;QACH,QAAQ,EAAE,MAAM,CAAC;QAEjB;;;;;;;;;;;;WAYG;QACH,OAAO,EAAE,MAAM,CAAC;KACjB;CACF;AAED,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACpD,KAAK,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,UAAU,0BAA0B;IAClC,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;CACxD;AACD,UAAU,0BAA0B;IAClC,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC;CACtC;AACD,UAAU,kBACR,SAAQ,0BAA0B,EAAE,0BAA0B;CAC/D;AAiBD,eAAO,IAAI,6BAA6B,EA2BnC,0BAA0B,CAAC;AAMhC,eAAO,IAAI,6BAA6B,EA4DnC,0BAA0B,CAAC;AAMhC,eAAO,IAAI,oBAAoB,EAoB1B,kBAAkB,CAAC;AAgBxB,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd;;;;WAIG;QACH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;KAC5C;CACF;AAED,OAAO,EAAE,CAAC"}
+{"version":3,"file":"_dnt.polyfills.d.ts","sourceRoot":"","sources":["../src/_dnt.polyfills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAgC,KAAK,GAAG,EAAE,MAAM,UAAU,CAAC;AAGlE,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,UAAU;QAClB;;;;;;;;;;;;;;WAcG;QACH,GAAG,EAAE,MAAM,CAAC;QACZ;;;;;;;;;;;;WAYG;QACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC;QACtE;;;;;;;;WAQG;QACH,IAAI,EAAE,OAAO,CAAC;QAEd;;;;;;;;;;;;WAYG;QACH,QAAQ,EAAE,MAAM,CAAC;QAEjB;;;;;;;;;;;;WAYG;QACH,OAAO,EAAE,MAAM,CAAC;KACjB;CACF;AAED,KAAK,WAAW,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACpD,KAAK,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,UAAU,0BAA0B;IAClC,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;CACxD;AACD,UAAU,0BAA0B;IAClC,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC;CACtC;AACD,UAAU,kBACR,SAAQ,0BAA0B,EAAE,0BAA0B;CAC/D;AAiBD,eAAO,IAAI,6BAA6B,EA2BnC,0BAA0B,CAAC;AAMhC,eAAO,IAAI,6BAA6B,EA4DnC,0BAA0B,CAAC;AAMhC,eAAO,IAAI,oBAAoB,EAoB1B,kBAAkB,CAAC;AACxB,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,KAAK;QACb,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB;CACF;AAED,OAAO,EAAE,CAAC;AAEV,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,KAAK,CAAC,CAAC;QACf;;;;;;;;WAQG;QACH,QAAQ,CAAC,CAAC,SAAS,CAAC,EAClB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,EACxE,OAAO,CAAC,EAAE,GAAG,GACZ,CAAC,GAAG,SAAS,CAAC;QACjB,QAAQ,CACN,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,OAAO,EACzD,OAAO,CAAC,EAAE,GAAG,GACZ,CAAC,GAAG,SAAS,CAAC;QAEjB;;;;;;;;WAQG;QACH,aAAa,CACX,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,OAAO,EACzD,OAAO,CAAC,EAAE,GAAG,GACZ,MAAM,CAAC;KACX;IACD,UAAU,UAAU;QAClB;;;;;;;;WAQG;QACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EACvB,SAAS,EAAE,CACP,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,KAChB,KAAK,IAAI,CAAC,EACf,OAAO,CAAC,EAAE,GAAG,GACZ,CAAC,GAAG,SAAS,CAAC;QACjB,QAAQ,CACJ,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,KAAK,OAAO,EACvE,OAAO,CAAC,EAAE,GAAG,GACd,MAAM,GAAG,SAAS,CAAC;QAEtB;;;;;;;;WAQG;QACH,aAAa,CACT,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,KAAK,OAAO,EACvE,OAAO,CAAC,EAAE,GAAG,GACd,MAAM,CAAC;KACX;CACF;AA4CD,OAAO,EAAE,CAAC;AAgBV,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd;;;;WAIG;QACH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;KAC5C;CACF;AAED,OAAO,EAAE,CAAC"}

package/types/acdc/chaining.d.ts

@@ -0,0 +1,35 @@
+/** Read-only ACDC chaining over caller-owned node verdicts; authentication and application state policy stay separate. */
+import { type SerderACDC } from "cesr-ts";
+import type { Baser } from "../db/basing.js";
+/** Borrow a complete reachable DAG of verified credential views, with its origin first, without projecting frames. */
+export interface AcdcGraph {
+    nodes: ReadonlyMap<string, {
+        readonly body: SerderACDC;
+    }>;
+    order: readonly string[];
+}
+/** Reserved section/group labels include a pin at every level. */
+export declare const acdcGroupLabels: ReadonlySet<string>;
+/** A truth verdict cannot absorb malformed input; callers represent that separately as null. */
+export type ChainVerdict = {
+    kind: "valid";
+} | {
+    kind: "invalid";
+} | {
+    kind: "unknown";
+    retryable: boolean;
+    reason: string;
+    schemas: readonly string[];
+};
+/** Empty section containers carry no disclosed edge semantics; malformed nonempty values refuse. */
+export declare function acdcEdgeBlocks(value: unknown): Record<string, unknown>[] | null;
+/** Compact Edge strings name blocks, never far ACDCs. Expanded leaves have exact labels. */
+export declare function acdcEdgeTarget(value: unknown): string | null | false;
+/**
+ * Validate every own schema, then conjoin each caller verdict with its complete edge expression.
+ * Every branch is inspected for malformed shape, even when its truth value is unused.
+ * Protocol callers supply issuer authentication; applications supply their state policy.
+ * This helper reads schemas but writes no records and publishes no cues.
+ */
+export declare function evaluateChain(graph: AcdcGraph, verdicts: ReadonlyMap<string, ChainVerdict>, db: Baser): ChainVerdict | null;
+//# sourceMappingURL=chaining.d.ts.map

package/types/acdc/chaining.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chaining.d.ts","sourceRoot":"","sources":["../../src/acdc/chaining.ts"],"names":[],"mappings":"AAAA,0HAA0H;AAC1H,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAI7C,sHAAsH;AACtH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IAC1D,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,kEAAkE;AAClE,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAKvF,gGAAgG;AAChG,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAMxF,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAI/E;AAUD,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,KAAK,CAGpE;AAoBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAC3C,EAAE,EAAE,KAAK,GACR,YAAY,GAAG,IAAI,CA6HrB"}