keri-ts 0.11.0 → 2.0.0

package/types/app/exchanges/exchanging.d.ts

@@ -0,0 +1,379 @@
+import { type CesrFrame, Cigar, Prefixer, type SealEvent, type SealSource, type SerderKERI, type Texter, type Versionage } from "cesr-ts";
+import { type Operation } from "effection";
+import type { AgentCue } from "../../core/cues.js";
+import { Deck } from "../../core/deck.js";
+import { PathedMaterialGroup, TransIdxSigGroup, type TransLastIdxSigGroup } from "../../core/dispatch.js";
+import { type ExchangeFactors, type MissingExchangeState } from "../../core/exchange/exchange-proofing.js";
+import type { ExchangeRegistryStateShape } from "../../db/exchange/exchange-records.js";
+import type { Hab, Habery } from "../identity/habbing.js";
+/** Pathed attachment projection exposed to exchange-route handlers. */
+export interface ExchangeAttachment {
+    raw: Uint8Array;
+    text: string;
+}
+/** Typed proof/schema dependencies follow authentication; schema is a complete missing resource SAID. */
+export type ExchangeRouteVerification = boolean | {
+    kind: "accept";
+    registryStates: readonly (readonly [node: string, record: ExchangeRegistryStateShape])[];
+} | {
+    kind: "escrow";
+    reason: string;
+    schema?: string;
+};
+/** Exact disclosed node SAIDs authorized for each issuer registry in a live Grant. */
+export type PresentationScope = ReadonlyMap<string, readonly string[]>;
+/** Route-handler contract for accepted exchange messages. */
+export interface ExchangeRouteHandler {
+    readonly resource: string;
+    /** Optional protocol-major specialization; omitted handlers remain the route default. */
+    readonly protocolMajor?: number;
+    /** Opt in only after route-specific child validation and durable replay are implemented. */
+    readonly acceptsNests?: boolean;
+    /** Opt in to verified sender source coordinates required by the v2 IPEX workflow. */
+    readonly acceptsSscs?: boolean;
+    /** Permit selected supplemental factors in verify(), independently of the selection hook. */
+    readonly acceptsEvidence?: boolean;
+    /** Only routes with optional supplemental evidence may query and drop missing factors. */
+    readonly acceptsMissingEvidence?: boolean;
+    /** Select from independently verified non-sender factors; null permanently rejects the route. */
+    verifyEvidence?(args: {
+        serder: SerderKERI;
+        factors: Required<ExchangeFactors>;
+        invalid: boolean;
+        /** Present only when acceptsMissingEvidence is enabled, including an empty list. */
+        missing?: readonly MissingExchangeState[];
+    }): ExchangeFactors | null;
+    /** Validate route policy before publishing accepted evidence. */
+    verify?(args: {
+        serder: SerderKERI;
+        /** Selected supplemental proofs; each factor authenticates this body only. */
+        evidence?: Required<ExchangeFactors>;
+        /** Valid sender-implied source couples, only for opted-in routes. */
+        sscs?: readonly SealSource[];
+        attachments: ExchangeAttachment[];
+        /** Ordered fragments retained independently of the input source. */
+        essrs?: readonly Texter[];
+        /** Borrowed children, with evidence kept on its original message. */
+        nests?: readonly CesrFrame[];
+        /** Hosted endpoint provenance, distinct from the signed sender. */
+        mailboxAid?: string | null;
+        /** Qualified first receiver receipt, retained through dependency retry. */
+        receiverTime?: string;
+        /** Read-only retained inspection may select exact issuer prefixes from its carried openings. */
+        historical?: boolean;
+    }): ExchangeRouteVerification;
+    /** Read fresh issuance registry scope after shared context checks; Exchanger authenticates the sender first. */
+    pendingGrant?(args: Parameters<NonNullable<ExchangeRouteHandler["verify"]>>[0]): readonly string[] | null;
+    /** Read auxiliary presentation scope after Exchanger authenticates the exact retained sender evidence. */
+    presentationContext?(args: Parameters<NonNullable<ExchangeRouteHandler["verify"]>>[0]): PresentationScope | null;
+    /** Consume already durable evidence within the caller's Effection scope. */
+    handle(args: {
+        serder: SerderKERI;
+        /** Valid sender-implied source couples, only for opted-in routes. */
+        sscs?: readonly SealSource[];
+        attachments: ExchangeAttachment[];
+        /** Ordered fragments retained independently of the input source. */
+        essrs?: readonly Texter[];
+        /** Borrowed children, with evidence kept on its original message. */
+        nests?: readonly CesrFrame[];
+        /** Hosted endpoint provenance, distinct from the signed sender. */
+        mailboxAid?: string | null;
+        /** Qualified first receiver receipt, retained through dependency retry. */
+        receiverTime?: string;
+    }): void | Operation<void>;
+    /**
+     * Retry this route's own escrow of accepted exchanges awaiting later local
+     * work (for example `RegistryRoot`). The Exchanger calls it after its own
+     * escrows, as KERIpy `Exchanger.processEscrow` does for handlers that define it.
+     */
+    processEscrows?(): void;
+}
+/** One signed exchange and its attachment views at runtime admission. */
+export interface ExchangeInput {
+    /** Resolved attachment genus retained independently of body protocol metadata. */
+    gvrsn?: Versionage;
+    /** Signed exchange body, including any ESSR byte commitment. */
+    serder: SerderKERI;
+    /** Transferable sender endorsements. */
+    tsgs?: readonly TransIdxSigGroup[];
+    /** Nontransferable sender endorsements. */
+    cigars?: readonly Cigar[];
+    /** Last-establishment references must freeze to historical coordinates before escrow. */
+    lsgs?: readonly TransLastIdxSigGroup[];
+    /** Foreign last references unresolved at their original receipt. */
+    unresolvedLast?: readonly Prefixer[];
+    /** Sender-implied source coordinates from parser normalization. */
+    sscs?: readonly SealSource[];
+    /** Explicit anchoring AID and historical source coordinates. */
+    sourceSeals?: readonly SealEvent[];
+    /** Ordinary pathed attachments. */
+    ptds?: readonly PathedMaterialGroup[];
+    /** Incoming qualified fragments; persistence uses main's insertion-ordered set. */
+    essrs?: readonly Texter[];
+    /** Parent-owned children; admission borrows and snapshots their original wire. */
+    nests?: readonly CesrFrame[];
+    /** Hosted endpoint provenance, retained across escrow. */
+    mailboxAid?: string | null;
+    /** Receiver-observed time supplied by local intake, independent of signed wire. */
+    receiverTime?: string;
+}
+/** Result of this attempt; complete(said) separately reports any earlier durable acceptance. */
+export type ExchangeDecision = {
+    kind: "accept";
+    said: string;
+} | {
+    kind: "escrow";
+    reason: string;
+    said: string;
+} | {
+    kind: "reject";
+    reason: string;
+    said: string;
+    /** MissingSignatureError preserves an existing escrow but does not authorize creating one. */
+    preserveEscrow?: true;
+    /** Original malformed-wire failure when a rejected attempt was classified from a caught error. */
+    cause?: unknown;
+};
+/**
+ * Refuse every exchange on one route so nothing about it is persisted.
+ *
+ * Ports KERIpy `exchanging.RouteRefuser`. A role that must never accept a
+ * route (a service or verifier offered `/registry/root`) registers this
+ * instead of leaving the route unhandled: an unhandled route is still
+ * authenticated, stored in `exns`/`essrs` and never revisited, while `verify`
+ * returning false here makes the Exchanger reject it before any write. It is
+ * unversioned, so it refuses every protocol major of the route. Sender
+ * authentication and its partial-signature escrow still run first, as for any
+ * route.
+ */
+export declare class RouteRefuser implements ExchangeRouteHandler {
+    readonly resource: string;
+    constructor(resource: string);
+    /** Log the refusal and reject the exchange. */
+    verify(args: {
+        serder: SerderKERI;
+    }): boolean;
+    /** Unreachable: a refused exchange is never dispatched. */
+    handle(): void;
+}
+/**
+ * Peer-to-peer XIP/EXN processor for one `Habery`.
+ *
+ * Responsibilities:
+ * - verify exchange-message signatures against accepted sender state
+ * - persist accepted exchange artifacts in the dedicated exchange stores
+ * - escrow partially verifiable exchange traffic in `epse.` / `epsd.`
+ * - dispatch accepted messages to route-specific handlers such as challenge
+ *
+ * TypeScript design rule:
+ * - use typed `accept` / `escrow` / `reject` outcomes instead of KERIpy's
+ *   exception-only control flow for ordinary branch results
+ *
+ * Admission prepares actual nested evidence before entering a synchronous LMDB
+ * writer, then re-reads retry state and authenticates/persists against that current
+ * view. Accepted and pending EXNs share ordinary Baser evidence tables, including
+ * main's `essrs.` Texter set. There is no external payload authority to publish
+ * or reclaim. Join the LMDB flush before exposing cues or invoking asynchronous
+ * handlers; a handler failure does not roll back an already accepted EXN.
+ */
+export declare class Exchanger {
+    readonly hby: Habery;
+    readonly cues: Deck<AgentCue>;
+    readonly routes: Map<string, ExchangeRouteHandler>;
+    private readonly versionedRoutes;
+    /** Borrow the runtime clock for escrow deadlines and retries. */
+    private readonly now;
+    /** Bind route handlers, cues and the escrow clock to one habitat database. */
+    constructor(hby: Habery, { handlers, cues, now }?: {
+        handlers?: readonly ExchangeRouteHandler[];
+        cues?: Deck<AgentCue>;
+        now?: () => number;
+    });
+    /** Register one route handler for accepted exchange messages. */
+    addHandler(handler: ExchangeRouteHandler): void;
+    /** Resolve the configured body-version route owner without dispatching or changing evidence. */
+    handlerFor(serder: SerderKERI): ExchangeRouteHandler | undefined;
+    /**
+     * Verify, persist, and dispatch one inbound `exn`.
+     *
+     * Accepted messages are durably logged before any route-specific side
+     * effects run so later reopen and verification paths can reuse the same
+     * stored evidence.
+     * Returning a reject/escrow decision describes this attempt, not necessarily
+     * the absence of an earlier accepted copy; complete(said) checks durable
+     * acceptance. Infrastructure and handler errors remain exceptions, so callers
+     * must not interpret every thrown error as a remote protocol rejection.
+     */
+    processEvent(args: ExchangeInput): Operation<ExchangeDecision>;
+    /** Complete only a still-live pending Grant with added proof; serialization cannot extend its original lifetime. */
+    acceptPendingGrantProof(args: ExchangeInput): Operation<ExchangeDecision>;
+    /** Add authentication to a live prepared Grant without replacing its exact disclosure or renewing its deadline. */
+    acceptPreparedGrantContribution(args: ExchangeInput): Operation<ExchangeDecision>;
+    /**
+     * Prepare nested serialization outside the writer, then decide and persist in
+     * one uninterrupted transaction. A retry re-reads current escrow evidence in
+     * that writer: work may have accepted/expired while preparation suspended.
+     * Flush committed storage before publishing cues and awaiting the route handler.
+     * The caller must keep the Baser open through all these completion boundaries.
+     */
+    private admit;
+    /**
+     * Check the signed commitment over this attempt's raw fragment concatenation
+     * before persistence. On retry these inputs come from retained set members.
+     * Match main's separation: valid incoming bytes need not remain reconstructable
+     * after equal Texters deduplicate or alternate fragmentations accumulate.
+     * Do not normalize parser input or weaken digest verification to conceal that
+     * known persistence limitation. Malformed remote CESR yields reject; storage,
+     * hashing and other infrastructure errors propagate.
+     */
+    private verifyEssr;
+    /** Authenticate, validate route policy and write evidence in one uninterrupted owner turn. */
+    private admitCurrent;
+    /** Retry escrows using ordinary LMDB evidence and retained mailbox provenance. */
+    processEscrows(): Operation<void>;
+    /** Retry each bounded escrow inside one structured child scope, then each opted-in route handler's own escrow. */
+    private retryEscrows;
+    /**
+     * Close each cursor before replay; newly discovered dependencies wait for the next finite pass.
+     * Terminal diagnostics follow joined evidence cleanup, while acceptance and dependency migration stay silent.
+     *
+     * @param schema Select missing-schema escrow instead of partial-signature/proof escrow.
+     */
+    private retryEscrowType;
+    /**
+     * Reconstruct accepted signed wire from ordinary Baser evidence, preserving
+     * attachment genus independently of the signed body's protocol version.
+     * Revalidate stored sender proofs, then encode retained pathed/nested/ESSR
+     * material. ESSR set members follow stored order, which can differ from the
+     * originally committed sequence under the documented set limitation; receiving
+     * protocol/recipient processing remains responsible for its digest check.
+     *
+     * @param said Accepted outer EXN SAID; escrow-only evidence cannot be replayed here.
+     * @param signal Optional caller cancellation between reconstruction/output steps.
+     * @yields Ordinary owned wire chunks; no archive handle or plaintext is created.
+     * @throws Missing acceptance, invalid retained authentication and genuine
+     * storage/encoding failures remain visible to the consumer.
+     */
+    replay(said: string, signal?: AbortSignal): AsyncGenerator<Uint8Array>;
+    /** Return true once the named exchange SAID is durably stored as accepted. */
+    complete(said: string): boolean;
+    /** Original accepted KRAM lifetime; partial-escrow timestamps never authorize live auxiliary work. */
+    exchangeDeadline(serder: SerderKERI): string | null;
+    /**
+     * Rehydrate authenticated retained factors without route handling or writes.
+     * Pending-only access also enforces the original deadline with this owner's
+     * clock and refuses terminal responses. It does not require fresh RIP state:
+     * an approved issuance may need these exact factors after its BUP arrives.
+     */
+    retainedInput(said: string, { pending }?: {
+        pending?: boolean;
+    }): ExchangeInput | null;
+    /**
+     * Reauthenticate one accepted body and its exact retained view through its
+     * registered route. No queries, writes, handling or notices occur. Historical
+     * mode proves retained issuer prefixes, not current standing, graph policy or
+     * consent; the default continues to require current issuer history.
+     */
+    verifyAccepted(said: string, route: string, { historical }?: {
+        historical?: boolean;
+    }): boolean;
+    /**
+     * Reverify replacement proofs for one live accepted Grant through its ordinary
+     * route. Bodies and order stay exact; this returns current observations without
+     * writes, handling or new consent. The Unblind owner publishes inside its own
+     * synchronous transaction after comparing the retained evidence snapshot.
+     */
+    verifyGrantProofs(said: string, nests: readonly CesrFrame[]): ExchangeRouteVerification;
+    /**
+     * Read one selected live pending issuance Grant and its exact registry scope.
+     * Escrow presence grants no authority: reauthenticate retained sender factors,
+     * then reuse the v2 route's context checks. This changes no stores or cues
+     * and never accepts the Grant. Auxiliary authority expires at deadline equality.
+     */
+    pendingGrant(said: string, { xid, sender, recipient }: {
+        xid: string;
+        sender: string;
+        recipient: string;
+    }): {
+        serder: SerderKERI;
+        registries: readonly string[];
+    } | null;
+    /**
+     * Reauthenticate a live accepted or pending Grant and its exact retained disclosure.
+     * Scope is per registry, not permission to use every disclosed node or Admit.
+     * The original deadline and terminal response bound authority; inspection never
+     * writes, renews lifetime, emits cues or hydrates a fuller credential view.
+     */
+    presentationContext(said: string, { xid, sender, recipient }: {
+        xid: string;
+        sender: string;
+        recipient: string;
+    }): {
+        serder: SerderKERI;
+        nests: readonly CesrFrame[];
+        registries: PresentationScope;
+    } | null;
+    /**
+     * Elect the lowest verified index in the first authenticated sender proof group.
+     *
+     * Like KERIpy, choose one stored establishment group deterministically. Require
+     * an accepted exchange, or explicitly opt into a live pending presentation,
+     * before reverifying sender proofs against accepted historical establishment state.
+     * Resolve the winning key at that proof's accepted establishment, not the current
+     * group state. The local member's accepted KEL identifies its historical keys;
+     * rotating that member must not transfer or erase an existing approval's lead.
+     * Partial signatures elect no sender. Election alone does not authorize sending
+     * the selected disclosure; callers still approve its complete registry scope.
+     */
+    lead(hab: Hab, said: string, { pendingPresentation }?: {
+        pendingPresentation?: boolean;
+    }): boolean;
+    /** Freeze last-establishment groups and expand sender-implied seals before durable admission. */
+    private resolveProofs;
+    /** Match sender-factor precedence; the caller supplies live admission or isolated inspection cues. */
+    private authenticate;
+    /** Match _cueMissingKeyState's coordinate deduplication within this invocation. */
+    private missingStateCues;
+    /** Reattach the persisted verifier to each nontransferable signature before replay or retry. */
+    private storedCigars;
+    /** Restore source triples without losing the anchoring AID or its historical ordinal. */
+    private storedSeals;
+    /** Classify sender endorsements without publishing exchange evidence. */
+    private verifySignatures;
+    /** Retain incomplete endorsements and the original expiration clock for retry. */
+    private escrowPartialSigned;
+    /** Persist the same independently authenticated evidence for signature and schema dependencies. */
+    private storeEscrowEvidence;
+    /** One absolute deadline spans sequential schema dependencies; receiver receipt is not the TMSC opener. */
+    private escrowMissingSchema;
+    /** V2 Grant validity survives dependency changes and acceptance; it is not cache retention. */
+    private isV2Grant;
+    /**
+     * Bound PSE cleanup by the accepted v2 Grant lifetime (xdt + xl) once KRAM
+     * records sender-threshold receipt; before that, freeze one local PSE timeout
+     * that retransmission never extends. Mirrors KERIpy `_partialSignedDeadline`.
+     */
+    private retainPartialDeadline;
+    /** Preserve the original microsecond deadline without truncating its TMSC opener. */
+    private deadlineDater;
+    /** Trusted clock failures remain infrastructure errors rather than expiring remote work. */
+    private nowMicros;
+    /** Persist protocol evidence inside the admission transaction before route handling. */
+    private logAcceptedEvent;
+    private rebuildEscrowedGroups;
+    /** Clear pending metadata, preserving wire evidence during the acceptance transaction. */
+    private clearEscrow;
+    /** Snapshot current escrow proofs; retry re-reads this data again in its final writer. */
+    private escrowInput;
+    /** Decide eligibility from current accepted records and both protocol deadline stores. */
+    private escrowStatus;
+    /** Describe only the terminal decision that the owning writer actually commits. */
+    private expiryReport;
+    /** Remove pending LMDB evidence inside its owning writer and return the committed diagnostic. */
+    private retireCurrent;
+    /** Decide expiry and remove pending rows in the same native transaction. */
+    private expirePending;
+    /** Clear only dependency markers, keeping all accepted evidence and metadata intact. */
+    private clearPending;
+}
+//# sourceMappingURL=exchanging.d.ts.map

package/types/app/exchanges/exchanging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchanging.d.ts","sourceRoot":"","sources":["../../../src/app/exchanges/exchanging.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,EAQL,QAAQ,EAER,KAAK,SAAS,EACd,KAAK,UAAU,EAEf,KAAK,UAAU,EAGf,KAAK,MAAM,EAEX,KAAK,UAAU,EAChB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE1G,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAE1B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAExF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAoB1D,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,yGAAyG;AACzG,MAAM,MAAM,yBAAyB,GACjC,OAAO,GACP;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC,EAAE,CAAA;CAAE,GAC5G;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAiBxD,sFAAsF;AACtF,MAAM,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAEvE,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,qFAAqF;IACrF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,0FAA0F;IAC1F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,iGAAiG;IACjG,cAAc,CAAC,CACb,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,CAAC;QACjB,oFAAoF;QACpF,OAAO,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;KAC3C,GACA,eAAe,GAAG,IAAI,CAAC;IAC1B,iEAAiE;IACjE,MAAM,CAAC,CAAC,IAAI,EAAE;QACZ,MAAM,EAAE,UAAU,CAAC;QACnB,8EAA8E;QAC9E,QAAQ,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;QACrC,qEAAqE;QACrE,IAAI,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;QAC7B,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAClC,oEAAoE;QACpE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,qEAAqE;QACrE,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAC7B,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,2EAA2E;QAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gGAAgG;QAChG,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,GAAG,yBAAyB,CAAC;IAC9B,gHAAgH;IAChH,YAAY,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1G,0GAA0G;IAC1G,mBAAmB,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAAC;IACjH,4EAA4E;IAC5E,MAAM,CAAC,IAAI,EAAE;QACX,MAAM,EAAE,UAAU,CAAC;QACnB,qEAAqE;QACrE,IAAI,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;QAC7B,WAAW,EAAE,kBAAkB,EAAE,CAAC;QAClC,oEAAoE;QACpE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,qEAAqE;QACrE,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAC7B,mEAAmE;QACnE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,2EAA2E;QAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,IAAI,IAAI,CAAC;CACzB;AACD,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,gEAAgE;IAChE,MAAM,EAAE,UAAU,CAAC;IACnB,wCAAwC;IACxC,IAAI,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACnC,2CAA2C;IAC3C,MAAM,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IAC1B,yFAAyF;IACzF,IAAI,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvC,oEAAoE;IACpE,cAAc,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IACrC,mEAAmE;IACnE,IAAI,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7B,gEAAgE;IAChE,WAAW,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACnC,mCAAmC;IACnC,IAAI,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtC,mFAAmF;IACnF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,kFAAkF;IAClF,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gGAAgG;AAChG,MAAM,MAAM,gBAAgB,GACxB;IACA,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,GACC;IACA,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,GACC;IACA,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,kGAAkG;IAClG,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAoCJ;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,YAAW,oBAAoB;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,QAAQ,EAAE,MAAM;IAI5B,+CAA+C;IAC/C,MAAM,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO;IAS7C,2DAA2D;IAC3D,MAAM,IAAI,IAAI;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,SAAS;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,QAAQ,CAAC,MAAM,oCAA2C;IAC1D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAwD;IACxF,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,8EAA8E;gBAClE,GAAG,EAAE,MAAM,EAAE,EAAE,QAAa,EAAE,IAAI,EAAE,GAAc,EAAE,GAAE;QAChE,QAAQ,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;QAC3C,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KACf;IASN,iEAAiE;IACjE,UAAU,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAuB/C,gGAAgG;IAChG,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB,GAAG,SAAS;IAKhE;;;;;;;;;;OAUG;IACH,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC,gBAAgB,CAAC;IAQ9D,oHAAoH;IACpH,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC,gBAAgB,CAAC;IAOzE,mHAAmH;IACnH,+BAA+B,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC,gBAAgB,CAAC;IAOjF;;;;;;OAMG;IACH,OAAO,CAAE,KAAK;IA0Fd;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;IAsBlB,8FAA8F;IAC9F,OAAO,CAAC,YAAY;IAiHpB,kFAAkF;IAClF,cAAc,IAAI,SAAS,CAAC,IAAI,CAAC;IAGjC,kHAAkH;IAClH,OAAO,CAAE,YAAY;IAOrB;;;;;OAKG;IACH,OAAO,CAAE,eAAe;IAiDxB;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,UAAU,CAAC;IA8C7E,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI/B,sGAAsG;IACtG,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI;IAanD;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAe,EAAE,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,aAAa,GAAG,IAAI;IA2BlG;;;;;OAKG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,UAAkB,EAAE,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO;IAwB3G;;;;;OAKG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,yBAAyB;IA4BvF;;;;;OAKG;IACH,YAAY,CACV,IAAI,EAAE,MAAM,EACZ,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAC7E;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI;IAgC/D;;;;;OAKG;IACH,mBAAmB,CACjB,IAAI,EAAE,MAAM,EACZ,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAC7E;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,UAAU,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI;IAiC5F;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,mBAA2B,EAAE,GAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO;IAgC9G,iGAAiG;IACjG,OAAO,CAAC,aAAa;IA2BrB,sGAAsG;IACtG,OAAO,CAAC,YAAY;IAmHpB,mFAAmF;IACnF,OAAO,CAAC,gBAAgB;IAmBxB,gGAAgG;IAChG,OAAO,CAAC,YAAY;IAIpB,yFAAyF;IACzF,OAAO,CAAC,WAAW;IAQnB,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IAoHxB,kFAAkF;IAClF,OAAO,CAAC,mBAAmB;IAiB3B,mGAAmG;IACnG,OAAO,CAAC,mBAAmB;IAwB3B,2GAA2G;IAC3G,OAAO,CAAC,mBAAmB;IA+B3B,+FAA+F;IAC/F,OAAO,CAAC,SAAS;IAIjB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAY7B,qFAAqF;IACrF,OAAO,CAAC,aAAa;IAQrB,4FAA4F;IAC5F,OAAO,CAAC,SAAS;IAKjB,wFAAwF;IACxF,OAAO,CAAC,gBAAgB;IAiDxB,OAAO,CAAC,qBAAqB;IAyC7B,0FAA0F;IAC1F,OAAO,CAAC,WAAW;IAkBnB,0FAA0F;IAC1F,OAAO,CAAC,WAAW;IAanB,0FAA0F;IAC1F,OAAO,CAAC,YAAY;IAwBpB,mFAAmF;IACnF,OAAO,CAAC,YAAY;IAOpB,iGAAiG;IACjG,OAAO,CAAC,aAAa;IAKrB,4EAA4E;IAC5E,OAAO,CAAE,aAAa;IAiBtB,wFAAwF;IACxF,OAAO,CAAC,YAAY;CAOrB"}

package/types/app/{challenging.d.ts → identity/challenging.d.ts}

@@ -1,7 +1,13 @@
 import { type SerderKERI } from "cesr-ts";
-import type { Baser } from "../db/basing.js";
-import type { ExchangeAttachment, ExchangeRouteHandler } from "./exchanging.js";
-import type { Exchanger } from "./exchanging.js";
+import type { Baser } from "../../db/basing.js";
+import type { ExchangeAttachment, ExchangeRouteHandler } from "../exchanges/exchanging.js";
+import type { Exchanger } from "../exchanges/exchanging.js";
+/** Built-in challenge route; the EXN sender is the authenticated responder. */
+export declare const CHALLENGE_RESPONSE_ROUTE = "/challenge/response";
+/** Known challenge content; EXN recipient projection is separate wire metadata. */
+export type ChallengeResponsePayload = {
+    words: string[];
+};
 /** Output mode supported by `challenge generate`. */
 export type ChallengeOutput = "json" | "string" | "words";
 /**

package/types/app/identity/challenging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenging.d.ts","sourceRoot":"","sources":["../../../src/app/identity/challenging.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAuB5D,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D,mFAAmF;AACnF,MAAM,MAAM,wBAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE3D,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,KAAK,EACT,SAAS,EAAE,SAAS,GACnB,IAAI,CAEN;AAED;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,oBAAoB;IAC3D,MAAM,CAAC,QAAQ,CAAC,QAAQ,yBAA4B;IACpD,QAAQ,CAAC,QAAQ,yBAA6B;IAC9C,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;gBAEP,EAAE,EAAE,KAAK;IAIrB,MAAM,CAAC,IAAI,EAAE;QACX,MAAM,EAAE,UAAU,CAAC;QACnB,WAAW,EAAE,kBAAkB,EAAE,CAAC;KACnC,GAAG,OAAO;IAKX,MAAM,CAAC,IAAI,EAAE;QACX,MAAM,EAAE,UAAU,CAAC;KACpB,GAAG,IAAI;CAQT;AAED,4FAA4F;AAC5F,wBAAgB,6BAA6B,CAC3C,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,UAAU,GAAG,IAAI,CAYnB;AAED,oEAAoE;AACpE,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,GACjB,IAAI,CAKN;AAED,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAW3D;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,GAAG,EAAE,eAAe,GACnB,MAAM,CAUR;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,SAAM,GAAG,MAAM,EAAE,CAe/D"}

package/types/app/{configing.d.ts → identity/configing.d.ts}

@@ -1,5 +1,5 @@
 import { type Operation } from "effection";
-import { PathManager, type PathManagerOptions } from "../db/core/path-manager.js";
+import { PathManager, type PathManagerOptions } from "../../db/core/path-manager.js";
 /** Options for locating and opening one habitat configuration file. */
 export interface ConfigerOptions extends PathManagerOptions {
     /** File extension for the config file */

package/types/app/identity/configing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configing.d.ts","sourceRoot":"","sources":["../../../src/app/identity/configing.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAoBrF,uEAAuE;AACvE,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,QAAQ;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE3B,uEAAuE;gBAC3D,OAAO,GAAE,eAAoB;IAsBzC,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,8DAA8D;IAC9D,OAAO,CAAC,gBAAgB;IAaxB,OAAO,CAAC,cAAc;IAOtB,qEAAqE;IACrE,OAAO,CAAC,iBAAiB;IAazB,yEAAyE;IACzE,OAAO,CAAC,eAAe;IA8BvB;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IA4CnB,yEAAyE;IACxE,MAAM,CAAC,OAAO,GAAE,OAAO,CAAC,eAAe,CAAM,GAAG,SAAS,CAAC,OAAO,CAAC;IA2BnE,4DAA4D;IAC3D,KAAK,CAAC,KAAK,UAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;IAezC,4CAA4C;IAC5C,GAAG,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC;IAerE,iDAAiD;IACjD,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;CAK5C;AAED,qFAAqF;AACrF,wBAAiB,cAAc,CAC7B,OAAO,GAAE,eAAoB,GAC5B,SAAS,CAAC,QAAQ,CAAC,CAOrB"}

package/types/app/{delegating.d.ts → identity/delegating.d.ts}

@@ -14,13 +14,14 @@
  */
 import { type SerderKERI } from "cesr-ts";
 import { type Operation } from "effection";
-import type { AgentRuntime } from "./agent-runtime.js";
-import type { ExchangeAttachment, Exchanger, ExchangeRouteHandler } from "./exchanging.js";
-import { type Poster } from "./forwarding.js";
+import type { QueryRequest } from "../../core/cues.js";
+import { type Poster } from "../delivery/forwarding.js";
+import type { ExchangeAttachment, Exchanger, ExchangeRouteHandler } from "../exchanges/exchanging.js";
+import type { Notifier } from "../notifications/notifying.js";
+import type { ProtocolProcessor } from "../protocol/protocol-processing.js";
+import type { RuntimeClock } from "../runtime/runtime-clock.js";
+import type { HttpClient } from "../transport/http-client.js";
 import { type Hab, type Habery } from "./habbing.js";
-import type { Notifier } from "./notifying.js";
-import type { QueryCoordinator } from "./querying.js";
-import { type RuntimeServices } from "./runtime-services.js";
 export declare const DELEGATE_REQUEST_ROUTE = "/delegate/request";
 /** Durable phase for one delegated event as it moves through approval. */
 export type DelegationPhase = "waitingWitnessReceipts" | "waitingDelegatorAnchor" | "waitingWitnessPublication";
@@ -117,7 +118,7 @@ export declare class DelegateRequestHandler implements ExchangeRouteHandler {
  *   - `cdel.` for completed delegation workflows
  * - outbound correspondence is delegated to `Poster`
  * - delegation-specific anchor discovery stays explicit here and uses
- *   `QueryCoordinator` only as the queued query-delivery seam
+ *   a concrete query producer port; composition owns its consuming worker
  * - witness republication sends the resolved delegator chain directly to the
  *   delegate's witnesses so the flow stays readable against KERIpy
  *
@@ -130,17 +131,41 @@ export declare class DelegateRequestHandler implements ExchangeRouteHandler {
  *   learned locally and pinned into `aess.`
  */
 export declare class Anchorer {
+    /** Borrowed identities and durable delegation escrow stores. */
     readonly hby: Habery;
-    readonly poster: Poster;
-    readonly querying: QueryCoordinator;
-    readonly services: RuntimeServices;
+    /** Queued delivery owner; phase transitions wait for the matching successful outcome. */
+    readonly postman: Poster;
+    /** Query producer port; composition owns the consuming coordinator and its lifetime. */
+    readonly querying: {
+        enqueue(request: QueryRequest): void;
+    };
+    /** Borrowed HTTP and clock services for witness publication. */
+    readonly http: HttpClient;
+    /** Borrowed clock for this owner's actual network deadlines. */
+    readonly clock: RuntimeClock;
+    /** Borrowed receive processing for witness sends; absent explicitly permits transmit-only delivery. */
+    readonly protocol: ProtocolProcessor | null;
+    /** Process-local proxy selection per delegated event; cleared when the workflow ends. */
     readonly communicationHabPins: Map<string, string>;
+    /** Existing query retry-pass bookkeeping; independent of Poster delivery retry. */
     readonly anchorQueryRetryPasses: Map<string, number>;
-    constructor(hby: Habery, { poster, querying, services }: {
-        poster: Poster;
-        querying: QueryCoordinator;
-        services?: RuntimeServices;
-    });
+    /**
+     * Bind delivery/query/protocol collaborators from the same accepted-state domain; acquire no stores.
+     *
+     * @param hby Borrowed local identities and accepted-state stores.
+     * @param postman Borrowed Poster; its delivery worker must run while this operation awaits outcomes.
+     * @param querying Borrowed query-admission owner for anchor discovery.
+     * @param protocol Same-database reply processor, or null when receive support is absent.
+     * @param http Borrowed HTTP implementation selected by composition.
+     * @param clock Borrowed clock with epoch-millisecond now and millisecond timer delays.
+     */
+    constructor(hby: Habery, postman: Poster, querying: Anchorer["querying"], protocol: ProtocolProcessor | null, http: HttpClient, clock: RuntimeClock);
+    /**
+     * Start one delegated event in witness-receipt escrow and replace any previous local proxy pin.
+     *
+     * @param serder Delegated event whose witness/approval workflow is started or reset.
+     * @param options Optional communicationHab pins a local proxy signer for this process.
+     */
     begin(serder: SerderKERI, options?: {
         communicationHab?: Hab;
     }): void;
@@ -152,17 +177,34 @@ export declare class Anchorer {
     workflowStatus(pre: string, snh: string): DelegationWorkflowStatus;
     /** Return true after the delegated event has been durably completed. */
     complete(pre: string, sn: number | string): boolean;
-    /** Process delegation escrows; an active runtime lends its same-socket TCP reply receiver. */
-    processAllOnce(runtime?: AgentRuntime): Operation<DelegationWorkflowResult[]>;
+    /** Advance delegation escrows using the protocol receiver selected at construction. */
+    processAllOnce(): Operation<DelegationWorkflowResult[]>;
+    /**
+     * Require delegate receipts, deliver the approval request/event, then move to anchor discovery. Failed delivery leaves this phase retained.
+     *
+     * @param context Escrow key, event, prefix and SAID resolved from durable workflow state.
+     * @returns Current delegation phase result; failed transmission does not advance to anchor discovery.
+     */
     private processPartialWitnessEscrow;
+    /** Wait for locally accepted delegator evidence; pin its seal before completing or publishing to witnesses. */
     private processUnanchoredEscrow;
+    /** Record durable completion only after the preceding publication operation has succeeded. */
     private processWitnessPublication;
+    /** Use the pinned proxy for inception or the existing delegate for rotation; never guess an inception signer. */
     private communicationHab;
+    /** Publish the initial anchor query after successful sending and seed the existing retry-pass bookkeeping. */
     private queueDelegatorWitnessQueryNow;
     /** Retry bounded delegator-witness queries while waiting for the anchor. */
     private retryDelegatorWitnessQuery;
+    /** Retire only this event's process-local signer and query bookkeeping. */
     private clearWorkflowPins;
+    /** Choose the pinned proxy, local group member or existing communication habitat for publication. */
     private publicationTransportHab;
+    /**
+     * Send the delegation chain before the approving event, awaiting actual Poster or witness transmission outcomes.
+     *
+     * @param serder Accepted delegator event to publish after its required delegation chain.
+     */
     private publishDelegator;
 }
 //# sourceMappingURL=delegating.d.ts.map

package/types/app/identity/delegating.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegating.d.ts","sourceRoot":"","sources":["../../../src/app/identity/delegating.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKvD,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACtG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,EAA2C,KAAK,GAAG,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAE9F,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAK1D,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GACvB,wBAAwB,GACxB,wBAAwB,GACxB,2BAA2B,CAAC;AAEhC,8EAA8E;AAC9E,MAAM,MAAM,wBAAwB,GAChC;IACA,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,GACC;IACA,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;IACtB,EAAE,EAAE,eAAe,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB,GACC;IACA,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB,GACC;IACA,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEJ,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AA4JD,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,GACb,GAAG,GAAG,SAAS,CAcjB;AAED,yEAAyE;AACzE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,EACpB,QAAQ,GAAE,QAAQ,GAAG,IAAW,GAC/B,IAAI,CAEN;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,sBAAuB,YAAW,oBAAoB;IACjE,MAAM,CAAC,QAAQ,CAAC,QAAQ,uBAA0B;IAClD,QAAQ,CAAC,QAAQ,uBAAmC;IACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;gBAGjC,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,QAAQ,GAAG,IAAW;IAMlC,MAAM,CAAC,IAAI,EAAE;QACX,MAAM,EAAE,UAAU,CAAC;QACnB,WAAW,EAAE,kBAAkB,EAAE,CAAC;KACnC,GAAG,OAAO;IAQX,0FAA0F;IAC1F,MAAM,CAAC,IAAI,EAAE;QACX,MAAM,EAAE,UAAU,CAAC;QACnB,WAAW,EAAE,kBAAkB,EAAE,CAAC;KACnC,GAAG,IAAI;CAyBT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBAAa,QAAQ;IACnB,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5D,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC5C,yFAAyF;IACzF,QAAQ,CAAC,oBAAoB,sBAA6B;IAC1D,mFAAmF;IACnF,QAAQ,CAAC,sBAAsB,sBAA6B;IAE5D;;;;;;;;;OASG;gBAED,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,EAC9B,QAAQ,EAAE,iBAAiB,GAAG,IAAI,EAClC,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,YAAY;IAarB;;;;;OAKG;IACH,KAAK,CACH,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE;QAAE,gBAAgB,CAAC,EAAE,GAAG,CAAA;KAAO,GACvC,IAAI;IAeP,8EAA8E;IAC9E,WAAW,CACT,GAAG,EAAE,MAAM,EACX,EAAE,CAAC,EAAE,MAAM,EACX,OAAO,GAAE;QAAE,gBAAgB,CAAC,EAAE,GAAG,CAAA;KAAO,GACvC,UAAU;IAsBb,+EAA+E;IAC/E,cAAc,CACZ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,GACV,wBAAwB;IA0B3B,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;IAkBnD,uFAAuF;IACtF,cAAc,IAAI,SAAS,CAAC,wBAAwB,EAAE,CAAC;IAiCxD;;;;;OAKG;IACH,OAAO,CAAE,2BAA2B;IA2GpC,+GAA+G;IAC/G,OAAO,CAAE,uBAAuB;IAuEhC,8FAA8F;IAC9F,OAAO,CAAE,yBAAyB;IAiBlC,iHAAiH;IACjH,OAAO,CAAC,gBAAgB;IAoBxB,8GAA8G;IAC9G,OAAO,CAAC,6BAA6B;IAkCrC,4EAA4E;IAC5E,OAAO,CAAC,0BAA0B;IAwDlC,2EAA2E;IAC3E,OAAO,CAAC,iBAAiB;IAMzB,qGAAqG;IACrG,OAAO,CAAC,uBAAuB;IAY/B;;;;OAIG;IACH,OAAO,CAAE,gBAAgB;CAoC1B"}

package/types/app/identity/endpoint-roleing.d.ts

@@ -0,0 +1,54 @@
+import { SerderKERI, Siger, type Versionage } from "cesr-ts";
+import { type Operation } from "effection";
+import type { Poster } from "../delivery/forwarding.js";
+import { MULTISIG_RPY_ROUTE } from "../multisig/grouping.js";
+import type { ProtocolProcessor } from "../protocol/protocol-processing.js";
+import type { Hab, Habery } from "./habbing.js";
+import { type GroupSendResult } from "../multisig/multisig-messaging.js";
+export { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
+/**
+ * One group endpoint-role proposal: coordination send facts plus the current
+ * accepted authorization predicate. The signed rpy bytes are library evidence;
+ * Tufa's output adapter deliberately omits them from its JSON summary.
+ */
+export interface GroupRoleResult extends GroupSendResult {
+    route: typeof MULTISIG_RPY_ROUTE;
+    group: string;
+    /** Current Baser.ends authorization, not proof that other participants approved. */
+    accepted: boolean;
+    rpy: Uint8Array;
+}
+/** Return whether endpoint-role state currently authorizes `eid` for `cid`. */
+export declare function endpointRoleAccepted(hby: Habery, cid: string, role: string, eid: string): boolean;
+/** Load an accepted endpoint-role reply or throw a command-facing error. */
+export declare function loadAcceptedEndpointRole(hab: Hab, eid: string, role?: string): Uint8Array;
+/**
+ * Propose one group endpoint-role reply under `/multisig/rpy`.
+ *
+ * @param hby Borrowed identities and accepted group state.
+ * @param protocol Shared semantic owner; the proposal owns its local byte-input context.
+ * @param postman Borrowed delivery owner; the caller runs and joins its worker.
+ * @param groupHab Local group habitat whose endpoint-role reply needs member approvals.
+ * @param args Endpoint AID, role and allow/cut decision used to construct the signed proposal.
+ * @returns Proposal identifiers, current acceptance and actual delivery URLs.
+ */
+export declare function proposeGroupEndpointRole(hby: Habery, protocol: ProtocolProcessor, postman: Poster, groupHab: Hab, args: {
+    eid: string;
+    role?: string;
+    allow?: boolean;
+}): Operation<GroupRoleResult>;
+/** Endorse one reply with locally available group member signatures. */
+export declare function groupEndorseReply(hby: Habery, groupPre: string, serder: SerderKERI, gvrsn?: Versionage): Uint8Array;
+/**
+ * Resolve the public keys that should sign one group event or reply.
+ *
+ * Inception/rotation-style events carry their signing keys in the event body;
+ * reply endorsements use the currently accepted group key state.
+ */
+export declare function groupEventKeys(hby: Habery, groupPre: string, serder: SerderKERI): string[];
+/**
+ * Sign a group event with every locally available member key in signing-index
+ * order.
+ */
+export declare function signLocalGroupEvent(hby: Habery, serder: SerderKERI, smids: readonly string[], keys: readonly string[]): Siger[];
+//# sourceMappingURL=endpoint-roleing.d.ts.map

package/types/app/identity/endpoint-roleing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-roleing.d.ts","sourceRoot":"","sources":["../../../src/app/identity/endpoint-roleing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,UAAU,EAAE,KAAK,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAM3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAGL,KAAK,eAAe,EAIrB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEtG;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,KAAK,EAAE,OAAO,kBAAkB,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAET;AAED,4EAA4E;AAC5E,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,MAAyB,GAC9B,UAAU,CAQZ;AAED;;;;;;;;;GASG;AACH,wBAAiB,wBAAwB,CACvC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,GAAG,EACb,IAAI,EAAE;IACJ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GACA,SAAS,CAAC,eAAe,CAAC,CAgC5B;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,UAAU,GACjB,UAAU,CAgBZ;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,GACjB,MAAM,EAAE,CAgBV;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,KAAK,EAAE,CAoBT"}