keri-ts 0.11.0 → 2.0.0

package/types/app/witness/receipting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipting.d.ts","sourceRoot":"","sources":["../../../src/app/witness/receipting.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,EAQL,KAAK,UAAU,EAEhB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAMjD,OAAO,EAAwC,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAY9D,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEpD,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAmBD;;;;;;;;GAQG;AACH,qBAAa,SAAS;IACpB,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,yGAAyG;IACzG,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;;;;;;;OAQG;gBAED,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,YAAY,EACnB,EAAE,KAAgB,EAAE,GAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAA;KAAO;IAWnD,iFAAiF;IAChF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAU,EAAE,QAAgB,EAAE,GAAE;QAC1D,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,yFAAyF;QACzF,QAAQ,CAAC,EAAE,OAAO,CAAC;KACf,GAAG,SAAS,CAAC,uBAAuB,CAAC;IAG3C;;;;;;;OAOG;IACH,OAAO,CAAE,WAAW;IAkIpB;;;;;;OAMG;IACF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAE;QAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;KACV,GAAG,SAAS,CAAC,OAAO,CAAC;IAoC3B;;;;;OAKG;IACF,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC;IAevD,uHAAuH;IACvH,OAAO,CAAC,QAAQ;CAGjB;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAExB;;;;;;;;OAQG;gBACS,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,KAAa,EAAE,GAAE;QAC9G,KAAK,CAAC,EAAE,OAAO,CAAC;KACZ;IAKN,yEAAyE;IACxE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAU,EAAE,GAAE;QACvC,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,cAAc,CAAC;KACnB,GAAG,SAAS,CAAC,uBAAuB,CAAC;CAmB5C"}

package/types/app/witness/registration.d.ts

@@ -0,0 +1,27 @@
+import { type Operation } from "effection";
+import { type Hab } from "../identity/habbing.js";
+import type { HttpClient } from "../transport/http-client.js";
+/** One witness to register with: its AID and the base URL serving `/aids`. */
+export interface WitnessRegistrationTarget {
+    eid: string;
+    url: string;
+}
+/** Plaintext TOTP secret and the witness's controller OOBI from one registration. */
+export interface WitnessRegistration {
+    secret: string;
+    oobi: string;
+}
+/**
+ * Register `hab` with one witness and return the plaintext TOTP secret.
+ *
+ * Locksmith correspondence: `register_with_witness`. The controller's full KEL
+ * (and, when delegated, its delegation chain as `delkel`) and an optional batch
+ * `secret` go as multipart text fields with `CESR-DESTINATION`; the returned
+ * `totp` ciphertext is opened with the habitat's current keys (`Hab.decrypt`).
+ * Because the full KEL is sent, registration works at any key state. Nothing
+ * is persisted here: retaining or displaying the secret is the caller's choice.
+ */
+export declare function registerWithWitness(hab: Hab, witness: WitnessRegistrationTarget, http: HttpClient, { secret }?: {
+    secret?: string;
+}): Operation<WitnessRegistration>;
+//# sourceMappingURL=registration.d.ts.map

package/types/app/witness/registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../../src/app/witness/registration.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,8EAA8E;AAC9E,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAiB,mBAAmB,CAClC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,yBAAyB,EAClC,IAAI,EAAE,UAAU,EAChB,EAAE,MAAM,EAAE,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,SAAS,CAAC,mBAAmB,CAAC,CA4BhC"}

package/types/cli/common/bootstrap.d.ts

@@ -0,0 +1,5 @@
+/** CLI-only presentation of the finite bootstrap operation's typed result. */
+import type { BootstrapResult } from "../../app/bootstrap/bootstrapping.js";
+/** Refuse unsuccessful bootstrap before command effects or success output continue. */
+export declare function assertBootstrapComplete(result: BootstrapResult): void;
+//# sourceMappingURL=bootstrap.d.ts.map

package/types/cli/common/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../src/cli/common/bootstrap.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAG5E,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAWrE"}

package/types/{app/cli → cli}/common/context.d.ts

@@ -1,8 +1,6 @@
-import type { ResourcePolicy } from "cesr-ts";
 import { type Operation } from "effection";
-import { type AgentRuntime, createAgentRuntime } from "../../agent-runtime.js";
-import type { CesrBodyMode } from "../../cesr-http.js";
-import type { Hab, Habery } from "../../habbing.js";
+import type { Hab, Habery } from "../../app/identity/habbing.js";
+import { type AgentRuntime, createAgentRuntime } from "../../app/runtime/agent-runtime.js";
 import { setupHby } from "./existing.js";
 /** Common store-location and unlock arguments shared by existing-store CLI commands. */
 export interface CommandStoreArgs {
@@ -14,14 +12,10 @@ export interface CommandStoreArgs {
 }
 /** Safe existing-habery open options forwarded through CLI context helpers. */
 export interface CommandHaberyOptions {
-    /** Shared deployment policy forwarded before opening the Habery. */
-    resources?: ResourcePolicy;
     compat?: boolean;
     readonly?: boolean;
     skipConfig?: boolean;
     skipSignator?: boolean;
-    outboxer?: boolean;
-    cesrBodyMode?: CesrBodyMode;
     /**
      * Internal lifecycle seam for focused helper tests and specialized adapters.
      *
@@ -55,7 +49,14 @@ type ContextUse<TContext, TResult> = (context: TContext) => Operation<TResult>;
 export declare function withExistingHabery<TResult>(args: CommandStoreArgs, options: CommandHaberyOptions, use: ContextUse<HaberyContext, TResult>): Operation<TResult>;
 /** Open an existing Habery and required local habitat alias for one CLI command. */
 export declare function withExistingHab<TResult>(args: CommandStoreArgs, alias: string | undefined, options: CommandHaberyOptions, use: ContextUse<HabContext, TResult>): Operation<TResult>;
-/** Open an existing Habery plus local AgentRuntime and close runtime before Habery. */
+/**
+ * Open an existing Habery plus local AgentRuntime and close runtime before Habery.
+ *
+ * @param args Command store identity, path and unlocking inputs.
+ * @param options Habery open/policy choices forwarded by the command root.
+ * @param use Awaited callback borrowing the opened Habery/runtime; start required workers inside its scope.
+ * @returns Callback result after runtime closes before Habery.
+ */
 export declare function withAgentRuntime<TResult>(args: CommandStoreArgs, options: CommandHaberyOptions, use: ContextUse<AgentRuntimeContext, TResult>): Operation<TResult>;
 /** Open an existing Habery, local AgentRuntime, and required local habitat alias. */
 export declare function withHabAndAgentRuntime<TResult>(args: CommandStoreArgs, alias: string | undefined, options: CommandHaberyOptions, use: ContextUse<HabAgentRuntimeContext, TResult>): Operation<TResult>;

package/types/cli/common/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/cli/common/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,KAAK,YAAY,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAK3F,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAED,gFAAgF;AAChF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;CAChD;AAED,sCAAsC;AACtC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,iEAAiE;AACjE,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,iEAAiE;AACjE,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,GAAG,EAAE,GAAG,CAAC;CACV;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,GAAG,EAAE,GAAG,CAAC;CACV;AAED,KAAK,UAAU,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,OAAO,CAAC,CAAC;AAE/E,mFAAmF;AACnF,wBAAiB,kBAAkB,CAAC,OAAO,EACzC,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,GACtC,SAAS,CAAC,OAAO,CAAC,CAiCpB;AAED,oFAAoF;AACpF,wBAAiB,eAAe,CAAC,OAAO,EACtC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,GACnC,SAAS,CAAC,OAAO,CAAC,CASpB;AAED;;;;;;;GAOG;AACH,wBAAiB,gBAAgB,CAAC,OAAO,EACvC,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,UAAU,CAAC,mBAAmB,EAAE,OAAO,CAAC,GAC5C,SAAS,CAAC,OAAO,CAAC,CA6BpB;AAED,qFAAqF;AACrF,wBAAiB,sBAAsB,CAAC,OAAO,EAC7C,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,UAAU,CAAC,sBAAsB,EAAE,OAAO,CAAC,GAC/C,SAAS,CAAC,OAAO,CAAC,CASpB"}

package/types/{app/cli → cli}/common/existing.d.ts

@@ -1,19 +1,13 @@
-import type { ResourcePolicy } from "cesr-ts";
 import { type Operation } from "effection";
-import { type CesrBodyMode } from "../../cesr-http.js";
-import type { Configer } from "../../configing.js";
-import { Habery } from "../../habbing.js";
+import type { Configer } from "../../app/identity/configing.js";
+import { Habery } from "../../app/identity/habbing.js";
 /** Low-level habery-open knobs shared by CLI startup helpers. */
 interface OpenHaberyOptions {
-    /** Shared deployment policy forwarded before opening the Habery. */
-    resources?: ResourcePolicy;
     compat?: boolean;
     readonly?: boolean;
     skipConfig?: boolean;
     skipSignator?: boolean;
     cf?: Configer;
-    outboxer?: boolean;
-    cesrBodyMode?: CesrBodyMode;
 }
 /** Result of "open if present, create if absent" CLI startup behavior. */
 export interface EnsuredHabery {

package/types/cli/common/existing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"existing.d.ts","sourceRoot":"","sources":["../../../src/cli/common/existing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAgB,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAIrE,iEAAiE;AACjE,UAAU,iBAAiB;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,EAAE,CAAC,EAAE,QAAQ,CAAC;CACf;AAED,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;CAClB;AA0CD;;;GAGG;AACH,wBAAiB,QAAQ,CACvB,IAAI,EAAE,MAAM,EACZ,IAAI,SAAK,EACT,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,UAAQ,EACZ,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,GAAE,iBAAsB,GAC9B,SAAS,CAAC,MAAM,CAAC,CA8CnB;AAED;;;;;;GAMG;AACH,wBAAiB,SAAS,CACxB,IAAI,EAAE,MAAM,EACZ,IAAI,SAAK,EACT,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,UAAQ,EACZ,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,GAAE,iBAAsB,GAC9B,SAAS,CAAC,aAAa,CAAC,CA6B1B"}

package/types/{app/cli → cli}/common/parsing.d.ts

@@ -1,4 +1,18 @@
-import type { ThresholdSith } from "cesr-ts";
+import { type ThresholdSith, type Versionage } from "cesr-ts";
+/** Keep omission and explicit empty strings distinct; command policy handles emptiness. */
+export declare function parseStringOption(value: unknown, flag: string): string | undefined;
+/** Preserve an omitted flag until command/file precedence and defaults are applied. */
+export declare function parseBooleanOption(value: unknown, flag: string): boolean | undefined;
+/** Preserve optional decimal quantities while rejecting coercion of booleans, blanks or nonfinite values. */
+export declare function parseNumberOption(value: unknown, flag: string): number | undefined;
+/** Validate a whole decimal count without collapsing omission or zero. */
+export declare function parseIntegerOption(value: unknown, flag: string): number | undefined;
+/** Validate every list member; an explicit empty list remains an override. */
+export declare function parseStringListOption(value: unknown, flag: string): string[] | undefined;
+/** Parse a KLI-style `--version` KERI protocol selection (`1.0` or `2.0`); omission stays undefined. */
+export declare function parseKeriVersionOption(value: unknown, flag?: string): Versionage | undefined;
+/** Require nonnegative whole counts for key and witness options. */
+export declare function parseCountOption(value: unknown, flag: string): number | undefined;
 /**
  * JSON file schema for `tufa incept --file` option loading.
  *
@@ -21,9 +35,8 @@ export interface InceptFileOptions {
 /**
  * JSON file schema for `tufa rotate --file` option loading.
  *
- * The merge semantics intentionally stay close to KLI so tests and operator
- * expectations do not depend on whether an option came from the file or the
- * command line.
+ * Explicit CLI values override file values; omitted flags leave these values
+ * intact until the command applies its defaults.
  */
 export interface RotateFileOptions {
     isith?: ThresholdSith;
@@ -36,10 +49,11 @@ export interface RotateFileOptions {
     data?: unknown[];
 }
 /**
- * Parse one CLI/file threshold input into semantic numeric or weighted form.
+ * Normalize one threshold input from CLI/file JSON into the internal
+ * `ThresholdSith` representation.
  *
- * This is a thin public seam over `normalizeThresholdOption(...)` so command
- * modules do not duplicate threshold coercion rules.
+ * Accepted forms intentionally match the operator-facing KLI shapes:
+ * numeric, hex-string, weighted JSON-array string, or structured array data.
  */
 export declare function parseThresholdOption(value: unknown): ThresholdSith | undefined;
 /**
@@ -67,15 +81,12 @@ export declare function parseExnDataItems(items: string[] | undefined): Record<s
  * direct CLI flag.
  */
 export declare function loadInceptFileOptions(path: string): InceptFileOptions;
-/**
- * Load one JSON file of rotation options using the CLI file-input contract.
- *
- * KLI compatibility notes:
- * - threshold fields are normalized immediately
- * - witness collections are filtered down to strings so malformed JSON does
- *   not propagate surprising non-string values into witness math
- */
+/** Load known rotation fields, rejecting malformed values rather than filtering them. */
 export declare function loadRotateFileOptions(path: string): RotateFileOptions;
+/** JSON option files are objects; individual command fields are validated by their loaders. */
+export declare function loadOptionObject(path: string): Record<string, unknown>;
+/** Anchored JSON data is application-defined, but its outer collection must be an array. */
+export declare function parseFileData(value: unknown): unknown[] | undefined;
 /**
  * Load one required CLI text argument or `@file` reference as UTF-8 bytes.
  *

package/types/cli/common/parsing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parsing.d.ts","sourceRoot":"","sources":["../../../src/cli/common/parsing.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,KAAK,aAAa,EAAE,KAAK,UAAU,EAAsB,MAAM,SAAS,CAAC;AAG3F,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIlF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAIpF;AAED,6GAA6G;AAC7G,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYlF;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUnF;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAMxF;AAED,wGAAwG;AACxG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAY,GAAG,UAAU,GAAG,SAAS,CAK/F;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIjF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAc9E;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,EAAE,CAarE;AAwCD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiDzB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAcrE;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAYrE;AAED,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMtE;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,SAAS,CAInE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKzD;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK5E;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAI9E"}

package/types/cli/common/passcode.d.ts

@@ -0,0 +1,9 @@
+/** Hidden terminal input owned by the command, including cancellation cleanup. */
+import type { Operation } from "effection";
+/**
+ * Read one hidden passcode on a real terminal and join prompt teardown.
+ * Noninteractive callers must provide explicit credentials. Ctrl-D and stream
+ * EOF cancel the prompt rather than leaving readline waiting for an answer.
+ */
+export declare function readPasscode(message: string): Operation<string>;
+//# sourceMappingURL=passcode.d.ts.map

package/types/cli/common/passcode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passcode.d.ts","sourceRoot":"","sources":["../../../src/cli/common/passcode.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAO3C;;;;GAIG;AACH,wBAAiB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAkDhE"}

package/types/cli/common/rendering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rendering.d.ts","sourceRoot":"","sources":["../../../src/cli/common/rendering.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,uDAAuD;AACvD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAElD;AAED,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAI7D"}

package/types/cli/common/tel-completion.d.ts

@@ -0,0 +1,8 @@
+/** Finite CLI observations over the publication owner's durable facts; host workers make progress. */
+import { type Operation } from "effection";
+import type { TelPublication } from "../../vdr/tel-publication.js";
+/** Observe one exact TEL coordinate until completion or an epoch-millisecond deadline; never drive workers here. */
+export declare function waitForTelPublication(publication: TelPublication, pre: string, sn: number, deadline: number): Operation<boolean>;
+/** Issuance additionally needs saved credential evidence; publication alone is not verifier acceptance. */
+export declare function waitForIssuedCredential(publication: TelPublication, said: string, deadline: number): Operation<boolean>;
+//# sourceMappingURL=tel-completion.d.ts.map

package/types/cli/common/tel-completion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tel-completion.d.ts","sourceRoot":"","sources":["../../../src/cli/common/tel-completion.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,oHAAoH;AACpH,wBAAiB,qBAAqB,CACpC,WAAW,EAAE,cAAc,EAC3B,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GACf,SAAS,CAAC,OAAO,CAAC,CAOpB;AAED,2GAA2G;AAC3G,wBAAiB,uBAAuB,CACtC,WAAW,EAAE,cAAc,EAC3B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,SAAS,CAAC,OAAO,CAAC,CAQpB"}

package/types/{app/cli → cli}/common/witness-auth.d.ts

@@ -1,4 +1,4 @@
-import type { WitnessAuthMap } from "../../witnessing.js";
+import type { WitnessAuthMap } from "../../app/witness/receipting.js";
 export interface WitnessAuthOptions {
     codeTime?: string;
     promptMissing?: boolean;

package/types/cli/common/witness-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"witness-auth.d.ts","sourceRoot":"","sources":["../../../src/cli/common/witness-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAItE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CAC/C;AAED,sEAAsE;AACtE,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,GAAE,kBAAuB,GAC/B,cAAc,CA+BhB"}

package/types/cli/credentials/ipex.d.ts

@@ -0,0 +1,110 @@
+import { SerderKERI, type Versionage } from "cesr-ts";
+import { type Operation } from "effection";
+import type { Habery } from "../../app/identity/habbing.js";
+import type { GroupSendResult } from "../../app/multisig/multisig-messaging.js";
+import { type AgentRuntime } from "../../app/runtime/agent-runtime.js";
+import { Reger } from "../../db/reger.js";
+/** Selected proposal and finite approval policy; stores and runtime remain borrowed. */
+export interface IpexJoinOptions {
+    alias?: string;
+    gvrsn?: Versionage;
+    said?: string;
+    auto?: boolean;
+    approvalTimeoutSeconds: number;
+}
+/** Captured EXN and finished transport destinations; presentation belongs to Tufa. */
+export interface IpexSendResult {
+    exn: SerderKERI;
+    deliveries: string[];
+    group?: GroupSendResult & {
+        complete: boolean;
+        lead: boolean | null;
+    };
+}
+/** Grant facts survive command cleanup. Group completion is distinct from completed member delivery. */
+export interface IpexGrantResult {
+    grant: SerderKERI;
+    credential: string;
+    support: number;
+    deliveries: string[];
+    group?: GroupSendResult & {
+        complete: boolean;
+        lead: boolean | null;
+    };
+}
+/** Wallet and authored-admit facts after cleanup; null admit means no response was signed. */
+export interface IpexAdmitResult {
+    admit: SerderKERI | null;
+    grant: SerderKERI;
+    credential: string;
+    saved: boolean;
+    deliveries: string[];
+    group?: GroupSendResult & {
+        complete: boolean;
+        lead: boolean | null;
+    };
+}
+/** Settled mailbox observations and ordinary Serders, captured before the stores close. */
+export interface IpexPollResult {
+    batches: number;
+    messages: number;
+    ipex: SerderKERI[];
+    saved: string[];
+}
+/** One selected exchange; null group approval/lead facts mean approval was not requested. */
+export interface IpexJoinResult {
+    exn: SerderKERI;
+    group?: GroupSendResult & {
+        embedded: SerderKERI;
+        accepted: boolean | null;
+        /** Local member approval; null in preview and independent of group acceptance. */
+        approved: boolean | null;
+        lead: boolean | null;
+        /** Present for admit approval; each member checks its own wallet before a fresh signature. */
+        credentialSaved?: boolean;
+    };
+}
+/**
+ * Implement `tufa ipex apply` by sending a schema/attribute request EXN.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export declare function ipexApplyCommand(args: Record<string, unknown>): Operation<IpexSendResult>;
+/**
+ * Implement `tufa ipex offer` with one embedded ACDC stream reference.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export declare function ipexOfferCommand(args: Record<string, unknown>): Operation<IpexSendResult>;
+/** Implement `tufa ipex agree` as a response to an accepted offer EXN. */
+export declare function ipexAgreeCommand(args: Record<string, unknown>): Operation<IpexSendResult>;
+/**
+ * Send an initial IPEX rejection using the donor's stream-delivery operation.
+ * @param args Command values identifying recipient, prior exchange and optional message.
+ */
+export declare function ipexSpurnCommand(args: Record<string, unknown>): Operation<IpexSendResult>;
+/**
+ * Implement `tufa ipex grant` and optional grant artifact export/delivery.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export declare function ipexGrantCommand(args: Record<string, unknown>): Operation<IpexGrantResult>;
+/**
+ * Implement `tufa ipex admit` and holder-side grant artifact processing.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export declare function ipexAdmitCommand(args: Record<string, unknown>): Operation<IpexAdmitResult>;
+/** Implement `tufa ipex list` by printing locally accepted IPEX EXNs. */
+export declare function ipexListCommand(args: Record<string, unknown>): Operation<void>;
+/** Observe settled mailbox input and stored grant replay until new IPEX state or an elapsed deadline. */
+export declare function ipexPollCommand(args: Record<string, unknown>): Operation<IpexPollResult>;
+/**
+ * Implement multisig IPEX approval over a pending `/multisig/exn` wrapper.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export declare function ipexJoinCommand(args: Record<string, unknown>): Operation<IpexJoinResult>;
+/** Borrow existing protocol owners for one selected proposal; review never signs. */
+export declare function joinIpexProposal(hby: Habery, runtime: AgentRuntime, reger: Reger | null, ipexArgs: IpexJoinOptions): Operation<IpexJoinResult>;
+//# sourceMappingURL=ipex.d.ts.map

package/types/cli/credentials/ipex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipex.d.ts","sourceRoot":"","sources":["../../../src/cli/credentials/ipex.ts"],"names":[],"mappings":"AACA,OAAO,EAA+B,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAU,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAO,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAiCjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAGhF,OAAO,EAAE,KAAK,YAAY,EAA2C,MAAM,oCAAoC,CAAC;AAMhH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AA+B1C,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,UAAU,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,wGAAwG;AACxG,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,UAAU,CAAC;IAChB,KAAK,CAAC,EAAE,eAAe,GAAG;QACxB,QAAQ,EAAE,UAAU,CAAC;QACrB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;QACzB,kFAAkF;QAClF,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;QACzB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;QACrB,8FAA8F;QAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAmB1F;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAoB1F;AAED,0EAA0E;AAC1E,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAE1F;AAED;;;GAGG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAe1F;AACD;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,CAyG3F;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,CAiF3F;AAED,yEAAyE;AACzE,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAgB/E;AAED,yGAAyG;AACzG,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CA0DzF;AAED;;;;GAIG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAQzF;AAED,qFAAqF;AACrF,wBAAiB,gBAAgB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,QAAQ,EAAE,eAAe,GACxB,SAAS,CAAC,cAAc,CAAC,CAwF3B"}

package/types/cli/credentials/vc.d.ts

@@ -0,0 +1,42 @@
+import { type Operation } from "effection";
+import { type CredentialRevokeResult } from "../../app/credentials/credential-revoking.js";
+import { type IssueResult, type RegistryResult } from "../../app/credentials/credential-workflows.js";
+/** Implement `tufa vc schema import` by pinning JSON schemas into `schema.`. */
+export declare function vcSchemaImportCommand(args: Record<string, unknown>): Operation<void>;
+/**
+ * Implement `tufa vc registry incept` for single-sig or group registries.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export declare function vcRegistryInceptCommand(args: Record<string, unknown>): Operation<RegistryResult>;
+/** Implement `tufa vc registry list` from local `Reger.regs` state. */
+export declare function vcRegistryListCommand(args: Record<string, unknown>): Operation<void>;
+/** Implement `tufa vc registry status` from current TEL registry state. */
+export declare function vcRegistryStatusCommand(args: Record<string, unknown>): Operation<void>;
+/**
+ * Implement `tufa vc create` by constructing and issuing one registry-backed ACDC.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export declare function vcCreateCommand(args: Record<string, unknown>): Operation<IssueResult>;
+/** Implement `tufa vc list` over verifier-backed wallet indexes. */
+export declare function vcListCommand(args: Record<string, unknown>): Operation<void>;
+/** Implement `tufa vc export` as a KERIpy-compatible credential support stream. */
+export declare function vcExportCommand(args: Record<string, unknown>): Operation<void>;
+/**
+ * Import finite CESR input and report its observed records' persisted acceptance.
+ * Validate the settlement deadline before opening stores or reading input. The importer owns
+ * normalization and post-EOF settlement; incomplete results are printed before command failure.
+ *
+ * @param args Parsed store/file choices and positive finite settlementTimeoutMs, default 5000 milliseconds.
+ * Input is buffered before parser ownership begins; fractions are floored with a one-millisecond minimum.
+ * @throws ValidationError for an invalid deadline or incomplete acceptance; intake and cleanup failures propagate.
+ */
+export declare function vcImportCommand(args: Record<string, unknown>): Operation<void>;
+/**
+ * Implement `tufa vc revoke`, including optional revocation delivery/export.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export declare function vcRevokeCommand(args: Record<string, unknown>): Operation<CredentialRevokeResult>;
+//# sourceMappingURL=vc.d.ts.map

package/types/cli/credentials/vc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc.d.ts","sourceRoot":"","sources":["../../../src/cli/credentials/vc.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAExD,OAAO,EACL,KAAK,sBAAsB,EAI5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAOL,KAAK,WAAW,EAGhB,KAAK,cAAc,EACpB,MAAM,+CAA+C,CAAC;AAiEvD,gFAAgF;AAChF,wBAAiB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAWrF;AAED;;;;GAIG;AACH,wBAAiB,uBAAuB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,cAAc,CAAC,CA6B3B;AAED,uEAAuE;AACvE,wBAAiB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAOrF;AAED,2EAA2E;AAC3E,wBAAiB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAKvF;AAED;;;;GAIG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CA6DtF;AAED,oEAAoE;AACpE,wBAAiB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAgB7E;AAED,mFAAmF;AACnF,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAa/E;AAED;;;;;;;;GAQG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAyB/E;AAED;;;;GAIG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAmDjG"}

package/types/{app/cli → cli/endpoints}/did.d.ts

@@ -3,7 +3,11 @@ import { type Operation } from "effection";
 export declare function dwsBindCommand(args: Record<string, unknown>): Operation<void>;
 /** Implement `tufa dws generate`. */
 export declare function dwsGenerateCommand(args: Record<string, unknown>): Operation<void>;
-/** Implement `tufa dws resolve`. */
+/**
+ * Implement `tufa dws resolve`.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
 export declare function dwsResolveCommand(args: Record<string, unknown>): Operation<void>;
 /** Implement `tufa dkr resolve`. */
 export declare function dkrResolveCommand(args: Record<string, unknown>): Operation<void>;

package/types/cli/endpoints/did.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"did.d.ts","sourceRoot":"","sources":["../../../src/cli/endpoints/did.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAqD3C,iCAAiC;AACjC,wBAAiB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAsC9E;AAED,qCAAqC;AACrC,wBAAiB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CA2ClF;AAED;;;;GAIG;AACH,wBAAiB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAwBjF;AAED,oCAAoC;AACpC,wBAAiB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CA4BjF"}

package/types/{app/cli → cli/endpoints}/ends.d.ts

@@ -1,4 +1,10 @@
 import { type Operation } from "effection";
+import { type GroupRoleResult } from "../../app/identity/endpoint-roleing.js";
+/** Typed endpoint result; Tufa decides how to present the completed operation. */
+export type EndRoleResult = GroupRoleResult | {
+    role: string;
+    eid: string;
+};
 /**
  * Implement `tufa ends add` on top of the shared local runtime.
  *
@@ -10,6 +16,8 @@ import { type Operation } from "effection";
  *
  * This command mutates local state only through normal KERI reply processing,
  * not through a side-channel direct DB write.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
  */
-export declare function endsAddCommand(args: Record<string, unknown>): Operation<void>;
+export declare function endsAddCommand(args: Record<string, unknown>): Operation<EndRoleResult>;
 //# sourceMappingURL=ends.d.ts.map

package/types/cli/endpoints/ends.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ends.d.ts","sourceRoot":"","sources":["../../../src/cli/endpoints/ends.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AACxD,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,wCAAwC,CAAC;AAsBhD,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,wBAAiB,cAAc,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,aAAa,CAAC,CAqF1B"}

package/types/cli/endpoints/loc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loc.d.ts","sourceRoot":"","sources":["../../../src/cli/endpoints/loc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAoB3C;;;;;;;;GAQG;AACH,wBAAiB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAkE7E"}

package/types/cli/endpoints/oobi-clean.d.ts

@@ -0,0 +1,8 @@
+import { type Operation } from "effection";
+/**
+ * Preview by default; apply only after every requested pending key is present.
+ * Publish the actual completed/remaining selection even on a deletion failure.
+ * The operator stops and backs up the service before invoking this command.
+ */
+export declare function oobiCleanCommand(args: Record<string, unknown>): Operation<void>;
+//# sourceMappingURL=oobi-clean.d.ts.map

package/types/cli/endpoints/oobi-clean.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oobi-clean.d.ts","sourceRoot":"","sources":["../../../src/cli/endpoints/oobi-clean.ts"],"names":[],"mappings":"AAGA,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAkCjD;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAkGhF"}

package/types/{app/cli → cli/endpoints}/oobi.d.ts

@@ -14,7 +14,7 @@ export declare function oobiGenerateCommand(args: Record<string, unknown>): Oper
 /**
  * Implement `tufa oobi resolve` using a command-local shared runtime host.
  *
- * The command queues one OOBI job, runs one runtime turn, and succeeds only if
+ * The command queues one OOBI job, runs the shared workers, and succeeds only if
  * the URL lands in `roobi.`. Any reply/event material fetched from the OOBI is
  * forced through the same parser/routing path used by the long-lived host.
  */
@@ -24,6 +24,8 @@ export declare function oobiResolveCommand(args: Record<string, unknown>): Opera
  *
  * This mirrors KERIpy's `"/oobis"` route while keeping the CLI and transport
  * ownership aligned with other outbound messaging commands.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
  */
 export declare function oobiRequestCommand(args: Record<string, unknown>): Operation<void>;
 //# sourceMappingURL=oobi.d.ts.map

package/types/cli/endpoints/oobi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oobi.d.ts","sourceRoot":"","sources":["../../../src/cli/endpoints/oobi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AA8D3C;;;;;;;;;;GAUG;AACH,wBAAiB,mBAAmB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAwFjB;AAED;;;;;;GAMG;AACH,wBAAiB,kBAAkB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAkDjB;AAED;;;;;;;GAOG;AACH,wBAAiB,kBAAkB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CA8DjB"}

package/types/cli/identity/aid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aid.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/aid.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAc3C,6BAA6B;AAC7B,wBAAiB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CA8B1E"}

package/types/{app/cli → cli/identity}/challenge.d.ts

@@ -1,7 +1,11 @@
 import { type Operation } from "effection";
 /** Implement `tufa challenge generate`. */
 export declare function challengeGenerateCommand(args: Record<string, unknown>): Operation<void>;
-/** Implement `tufa challenge respond` by sending a signed `/challenge/response` exchange message. */
+/**
+ * Implement `tufa challenge respond` by sending a signed `/challenge/response` exchange message.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
 export declare function challengeRespondCommand(args: Record<string, unknown>): Operation<void>;
 /** Implement `tufa challenge verify` by matching accepted challenge responses in local exchange state. */
 export declare function challengeVerifyCommand(args: Record<string, unknown>): Operation<void>;

package/types/cli/identity/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAsD1D,2CAA2C;AAC3C,wBAAiB,wBAAwB,CACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CASjB;AAED;;;;GAIG;AACH,wBAAiB,uBAAuB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CA+DjB;AAED,0GAA0G;AAC1G,wBAAiB,sBAAsB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAwFjB"}

package/types/cli/identity/delegate.d.ts

@@ -0,0 +1,4 @@
+import { type Operation } from "effection";
+/** Approve pending delegated events for the selected local delegator habitat. */
+export declare function delegateConfirmCommand(args: Record<string, unknown>): Operation<void>;
+//# sourceMappingURL=delegate.d.ts.map

package/types/cli/identity/delegate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/delegate.ts"],"names":[],"mappings":"AAcA,OAAO,EAAQ,KAAK,SAAS,EAAsB,MAAM,WAAW,CAAC;AA0YrE,iFAAiF;AACjF,wBAAiB,sBAAsB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAuCjB"}

package/types/cli/identity/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/export.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAgB3C;;;;GAIG;AACH,wBAAiB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAiD7E"}

package/types/{app/cli → cli/identity}/incept.d.ts

@@ -3,6 +3,8 @@ import { type Operation } from "effection";
  * Implements `tufa incept`.
  *
  * Creates a single-sig identifier locally.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
  */
 export declare function inceptCommand(args: Record<string, unknown>): Operation<void>;
 //# sourceMappingURL=incept.d.ts.map

package/types/cli/identity/incept.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incept.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/incept.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AA6EjD;;;;;;GAMG;AACH,wBAAiB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CA6J7E"}

package/types/{app/cli → cli/identity}/init.d.ts

@@ -3,6 +3,8 @@ import { type Operation } from "effection";
  * Implements `tufa init`.
  *
  * Creates/open a habery keystore and database.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
  */
 export declare function initCommand(args: Record<string, unknown>): Operation<void>;
 //# sourceMappingURL=init.d.ts.map

package/types/cli/identity/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAsC3C;;;;;;GAMG;AACH,wBAAiB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAsF3E"}

package/types/{app/cli → cli/identity}/interact.d.ts

@@ -15,6 +15,8 @@ import { type Operation } from "effection";
  * - CLI concerns stop at argument parsing, witness-auth capture, and success
  *   output
  * - interaction event authoring and local acceptance live in `Hab.interact(...)`
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
  */
 export declare function interactCommand(args: Record<string, unknown>): Operation<void>;
 //# sourceMappingURL=interact.d.ts.map

package/types/cli/identity/interact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interact.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/interact.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AA+B3C;;;;;;;;;GASG;AACH,wBAAiB,eAAe,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CA0FjB"}

package/types/cli/identity/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAa3C,8BAA8B;AAC9B,wBAAiB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CA2B3E"}

package/types/{app/cli → cli/identity}/rotate.d.ts

@@ -1,8 +1,10 @@
+import type { Hab } from "../../app/identity/habbing.js";
+import type { WitnessAuthMap } from "../../app/witness/receipting.js";
 /**
  * `tufa rotate` command implementation.
  *
  * KERIpy correspondence:
- * - mirrors the single-sig `kli rotate` command surface and merge semantics
+ * - mirrors the single-sig `kli rotate` command surface
  * - keeps the CLI/output mental model aligned while preserving explicit
  *   TypeScript-native orchestration instead of KERIpy's doer stack
  *
@@ -18,6 +20,11 @@ import { type Operation } from "effection";
  * Maintainer boundary:
  * - CLI concerns stop at option merge/validation and success output
  * - habitat/key-state mutation lives in `Hab.rotate(...)`
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ * @param options Optional application-owned authorization resolver, evaluated against prospective witnesses before rotation.
  */
-export declare function rotateCommand(args: Record<string, unknown>): Operation<void>;
+export declare function rotateCommand(args: Record<string, unknown>, { witnessAuths }?: {
+    witnessAuths?: (hab: Hab, witnesses: readonly string[]) => WitnessAuthMap;
+}): Operation<void>;
 //# sourceMappingURL=rotate.d.ts.map