keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/app/httping.js

@@ -1,130 +0,0 @@
-import { call, resource } from "effection";
-import { defaultRuntimeServices } from "./runtime-services.js";
-/**
- * Fetch one HTTP response under Effection cancellation control.
- *
- * This is the shared request-lifecycle seam:
- * - create one local `AbortController`
- * - keep the request and response body owned through enclosing scope exit
- * - abort and join late fetch completion when the enclosing operation is canceled
- * - consume each response inside a finite `call`/`scoped` operation in continuous workers
- * - hand the caller both the `Response` and the controller when body policy
- *   needs later abort access, such as mailbox SSE long-poll reads
- */
-export function* fetchResponseHandle(url, init = {}, options = {}) {
-    const { services = defaultRuntimeServices } = options;
-    const handle = yield* fetchResponseHandleInternal(url, init, { services });
-    if (!handle) {
-        throw new Error("HTTP response handle unexpectedly resolved to null.");
-    }
-    return handle;
-}
-/**
- * Fetch one HTTP response handle with an abort-to-null policy.
- *
- * This is for callers such as mailbox polling that treat request timeout as a
- * normal "no response yet" outcome instead of as an exception.
- */
-export function* fetchResponseHandleOrNull(url, init = {}, options = {}) {
-    const { timeoutMs, services = defaultRuntimeServices } = options;
-    return yield* fetchResponseHandleInternal(url, init, {
-        timeoutMs,
-        nullOnAbort: true,
-        services,
-    });
-}
-/**
- * Close one response body under Effection control.
- *
- * Callers should use this instead of open-coding `body.cancel()` so response
- * cleanup policy stays consistent across mailbox, OOBI, auth, and exchange
- * flows.
- */
-export function* closeResponseBody(response) {
-    if (!response.body) {
-        return;
-    }
-    yield* call(function* () {
-        let pending;
-        yield* resource(function* (provide) {
-            try {
-                yield* provide();
-            }
-            finally {
-                // Register before starting cleanup; cancellation joins it and preserves later failure.
-                if (pending)
-                    yield* call(() => pending);
-            }
-        });
-        pending = response.body.cancel();
-        yield* call(() => pending);
-    });
-}
-/** Own fetch completion and the returned body until the enclosing request scope closes. */
-function* fetchResponseHandleInternal(url, init, options = {}) {
-    const { timeoutMs, nullOnAbort = false, services = defaultRuntimeServices, } = options;
-    return yield* resource(function* (provide) {
-        // The response body remains owned after headers settle and until this resource's scope exits.
-        const controller = new AbortController();
-        let timedOut = false;
-        const timeoutId = timeoutMs === undefined ? undefined : services.clock.setTimeout(() => {
-            timedOut = true;
-            controller.abort();
-        }, timeoutMs);
-        /** A header timeout ends when fetch settles; body limits belong to its consumer. */
-        const clearTimer = () => {
-            if (timeoutId !== undefined)
-                services.clock.clearTimeout(timeoutId);
-        };
-        let pending;
-        let deliveredFailure;
-        try {
-            pending = services.http.fetch(url, { ...init, signal: controller.signal });
-            let response;
-            try {
-                response = yield* call(() => pending);
-            }
-            catch (error) {
-                deliveredFailure = { error };
-                if (nullOnAbort && timedOut && error === controller.signal.reason) {
-                    clearTimer();
-                    yield* provide(null);
-                    return;
-                }
-                throw error;
-            }
-            clearTimer();
-            yield* provide({ response, controller });
-        }
-        finally {
-            clearTimer();
-            controller.abort();
-            if (pending) {
-                yield* call(async () => {
-                    // A fetch completing during cancellation still transfers its response to this owner.
-                    let response;
-                    try {
-                        response = await pending;
-                    }
-                    catch (error) {
-                        // Only this controller's abort or the already-propagated identical failure is consumed.
-                        if (error === controller.signal.reason || (deliveredFailure && error === deliveredFailure.error))
-                            return;
-                        throw error;
-                    }
-                    if (response.body && !response.body.locked) {
-                        try {
-                            await response.body.cancel();
-                        }
-                        catch (error) {
-                            // Fetch may already have errored the body with this controller's exact abort reason.
-                            // Foreign AbortErrors and cleanup failures still propagate, even during cancellation.
-                            if (error !== controller.signal.reason)
-                                throw error;
-                        }
-                    }
-                });
-            }
-        }
-    });
-}

package/esm/keri/npm/src/app/ipex-credentialing.js

@@ -1,245 +0,0 @@
-/**
- * IPEX credential artifact assembly for registry-backed ACDC workflows.
- *
- * KERIpy correspondence:
- * - mirrors the byte material gathered by `vdr.credentialing.sendArtifacts`
- *   and the grant/admit command helpers
- * - keeps EXN route construction in `ipexing.ts`
- * - keeps registry, wallet, and verifier persistence in VDR modules
- */
-import { concatBytes, Counter, parsePather, SerderACDC, SerderKERI, Vrsn_1_0, } from "cesr-ts";
-import { ValidationError } from "../core/errors.js";
-import { dgKey } from "../db/core/keys.js";
-import { CredentialWallet, serializeCredential } from "../vdr/credentialing.js";
-import { acceptedEventReplayMessage } from "./habbing.js";
-import { IPEX_GRANT_ROUTE, ipexAdmitExn, ipexGrantExn } from "./ipexing.js";
-const textEncoder = new TextEncoder();
-/** Build KERIpy-shaped support artifacts for one credential presentation. */
-export function credentialSupportMessages(hby, reger, creder, recipient) {
-    const messages = [];
-    const issuer = creder.issuer;
-    if (!issuer) {
-        throw new ValidationError("Credential is missing issuer AID.");
-    }
-    const issuerKever = hby.db.getKever(issuer);
-    if (!issuerKever) {
-        throw new ValidationError(`Missing issuer KEL state for ${issuer}.`);
-    }
-    messages.push(...hby.db.cloneDelegation(issuerKever));
-    messages.push(...hby.db.clonePreIter(issuer, 0));
-    const issuee = credentialIssuee(creder);
-    if (issuee && issuee !== recipient) {
-        const issueeKever = hby.db.getKever(issuee);
-        if (!issueeKever) {
-            throw new ValidationError(`Missing issuee KEL state for ${issuee}.`);
-        }
-        messages.push(...hby.db.cloneDelegation(issueeKever));
-        messages.push(...hby.db.clonePreIter(issuee, 0));
-    }
-    const registry = creder.regid;
-    if (registry) {
-        messages.push(...reger.clonePreIter(registry, 0));
-    }
-    const said = credentialSaid(creder);
-    messages.push(...reger.clonePreIter(said, 0));
-    return messages;
-}
-/**
- * Build the full raw credential stream equivalent of KERIpy `sendCredential`.
- *
- * IPEX grant sends the support artifacts and recursively chained source
- * credentials separately, then embeds the top-level credential in the grant
- * EXN. Raw import/export paths can append the top-level credential message too.
- */
-export function credentialStreamMessages(hby, reger, creder, recipient, gvrsn = Vrsn_1_0) {
-    return [
-        ...credentialPresentationSupportMessages(hby, reger, creder, recipient, gvrsn),
-        credentialExportMessage(reger, credentialSaid(creder)),
-    ];
-}
-/** Build the support stream used before sending a credential grant EXN. */
-export function credentialPresentationSupportMessages(hby, reger, creder, recipient, gvrsn = Vrsn_1_0) {
-    const messages = credentialSupportMessages(hby, reger, creder, recipient);
-    for (const [source, atc] of reger.sources(hby.db, creder, gvrsn)) {
-        messages.push(...credentialSupportMessages(hby, reger, source, recipient));
-        messages.push(concatBytes(source.raw, atc));
-    }
-    return messages;
-}
-/** Build grant-embedded `acdc`, `iss`, and `anc` artifacts for one credential. */
-export function credentialPresentationArtifacts(hby, reger, credentialSaidValue, gvrsn = Vrsn_1_0) {
-    const [creder, prefixer, number, diger] = reger.cloneCred(credentialSaidValue);
-    const acdc = serializeCredential(creder, prefixer, number, diger, gvrsn);
-    const iss = reger.cloneTvtAt(credentialSaidValue, 0);
-    const iserder = new SerderKERI({ raw: iss });
-    if (!iserder.said) {
-        throw new ValidationError(`Credential TEL message ${credentialSaidValue} is missing SAID.`);
-    }
-    if (iserder.pre !== prefixer.qb64 || iserder.snh !== number.numh || iserder.said !== diger.qb64) {
-        throw new ValidationError(`Credential source seal mismatch for ${credentialSaidValue}.`);
-    }
-    const telAnchor = reger.ancs.get(dgKey(credentialSaidValue, iserder.said));
-    if (!telAnchor) {
-        throw new ValidationError(`Credential TEL anchor missing for ${credentialSaidValue}.`);
-    }
-    const issuer = creder.issuer;
-    if (!issuer) {
-        throw new ValidationError(`Credential ${credentialSaidValue} is missing issuer.`);
-    }
-    const [anchorNumber, anchorDiger] = telAnchor;
-    const sn = Number(anchorNumber.num);
-    if (!Number.isSafeInteger(sn)) {
-        throw new ValidationError(`Credential anchor sequence is too large for replay: ${anchorNumber.qb64}.`);
-    }
-    const replay = acceptedEventReplayMessage(hby, issuer, sn);
-    if (replay.serder.said !== anchorDiger.qb64) {
-        throw new ValidationError(`Credential anchor event ${replay.serder.said ?? "<missing>"} did not match ${anchorDiger.qb64}.`);
-    }
-    return { acdc, iss, anc: replay.message };
-}
-/** Build a signed `/ipex/grant` message with embedded credential artifacts. */
-export function ipexCredentialGrant(args) {
-    const [creder] = args.reger.cloneCred(args.credentialSaid);
-    const gvrsn = args.options?.gvrsn ?? Vrsn_1_0;
-    const artifacts = credentialPresentationArtifacts(args.hby, args.reger, args.credentialSaid, gvrsn);
-    const support = credentialPresentationSupportMessages(args.hby, args.reger, creder, args.recipient, gvrsn);
-    const [grant, attachments] = ipexGrantExn(args.hab, args.recipient, args.message ?? "", artifacts.acdc, {
-        ...(args.options ?? {}),
-        iss: artifacts.iss,
-        anc: artifacts.anc,
-        agree: args.options?.agree ?? null,
-    });
-    return {
-        grant,
-        attachments,
-        wire: args.sign === false ? new Uint8Array() : concatBytes(args.hab.endorse(grant, { pipelined: false, gvrsn }), attachments),
-        artifacts,
-        support,
-    };
-}
-/** Build a signed `/ipex/admit` response for an accepted grant. */
-export function ipexCredentialAdmit(args) {
-    if (args.grant.route !== IPEX_GRANT_ROUTE) {
-        throw new ValidationError(`Expected ${IPEX_GRANT_ROUTE} grant, got ${args.grant.route ?? "<none>"}.`);
-    }
-    const credentialSaidValue = credentialSaidFromGrant(args.grant);
-    if (!credentialSaidValue) {
-        throw new ValidationError("Grant is missing embedded ACDC SAID.");
-    }
-    if ((args.options?.requireSaved ?? true) && !args.reger.saved.get([credentialSaidValue])) {
-        throw new ValidationError(`Credential ${credentialSaidValue} is not saved locally.`);
-    }
-    const [admit, attachments] = ipexAdmitExn(args.hab, args.message ?? "", args.grant, args.options ?? {});
-    return {
-        admit,
-        attachments,
-        wire: concatBytes(args.hab.endorse(admit, { pipelined: false, gvrsn: args.options?.gvrsn ?? undefined }), attachments),
-    };
-}
-/** Parse grant-embedded artifacts in KERIpy admit order: `anc`, `iss`, `acdc`. */
-export function* processCredentialPresentationArtifacts(reactor, artifacts) {
-    yield* reactor.processBytes(artifacts.anc);
-    yield* reactor.processBytes(artifacts.iss);
-    yield* reactor.processBytes(artifacts.acdc);
-    yield* reactor.processEscrowsOnce();
-}
-/** Rebuild grant-embedded `anc`, `iss`, and `acdc` streams from exchange storage. */
-export function storedGrantArtifacts(hby, grant) {
-    if (grant.route !== IPEX_GRANT_ROUTE || !grant.said) {
-        throw new ValidationError(`Expected stored ${IPEX_GRANT_ROUTE} EXN.`);
-    }
-    const embeds = embeddedSection(grant);
-    if (!embeds) {
-        throw new ValidationError(`Grant ${grant.said} is missing embedded artifacts.`);
-    }
-    return {
-        anc: concatBytes(keriRaw(embeds.anc, "anc"), pathedAttachment(hby, grant.said, "anc")),
-        iss: concatBytes(keriRaw(embeds.iss, "iss"), pathedAttachment(hby, grant.said, "iss")),
-        acdc: concatBytes(acdcRaw(embeds.acdc, "acdc"), pathedAttachment(hby, grant.said, "acdc")),
-    };
-}
-/** Extract the embedded credential SAID from an accepted `/ipex/grant`. */
-export function credentialSaidFromGrant(grant) {
-    const embeds = embeddedSection(grant);
-    const acdc = embeds?.acdc;
-    if (!acdc || typeof acdc !== "object" || Array.isArray(acdc)) {
-        return null;
-    }
-    const said = acdc.d;
-    return typeof said === "string" ? said : null;
-}
-/** Return a raw exported credential message by SAID. */
-export function credentialExportMessage(reger, credentialSaidValue) {
-    return new CredentialWallet(reger).exportCredential(credentialSaidValue);
-}
-function credentialSaid(creder) {
-    if (!creder.said) {
-        throw new ValidationError("Credential is missing SAID.");
-    }
-    return creder.said;
-}
-function credentialIssuee(creder) {
-    const attrib = creder.attrib;
-    if (attrib && typeof attrib === "object" && !Array.isArray(attrib)) {
-        const issuee = attrib.i;
-        return typeof issuee === "string" ? issuee : null;
-    }
-    return null;
-}
-function embeddedSection(serder) {
-    const ked = serder.ked;
-    if (!ked) {
-        return null;
-    }
-    if (ked.e && typeof ked.e === "object" && !Array.isArray(ked.e)) {
-        return ked.e;
-    }
-    const attrs = ked.a;
-    if (attrs && typeof attrs === "object" && !Array.isArray(attrs)) {
-        const embeds = attrs.e;
-        if (embeds && typeof embeds === "object" && !Array.isArray(embeds)) {
-            return embeds;
-        }
-    }
-    return null;
-}
-function keriRaw(value, label) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        throw new ValidationError(`Grant embedded ${label} is missing.`);
-    }
-    return new SerderKERI({ sad: value }).raw;
-}
-function acdcRaw(value, label) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        throw new ValidationError(`Grant embedded ${label} is missing.`);
-    }
-    return new SerderACDC({ sad: value, verify: false }).raw;
-}
-function pathedAttachment(hby, said, label) {
-    const path = `/e/${label}`;
-    for (const text of hby.db.epath.get([said])) {
-        const attachment = pathedAttachmentFromRaw(textEncoder.encode(text), path);
-        if (attachment) {
-            return attachment;
-        }
-    }
-    return new Uint8Array();
-}
-function pathedAttachmentFromRaw(raw, path) {
-    if (raw.length === 0) {
-        return null;
-    }
-    const counter = new Counter({ qb64b: raw });
-    const body = raw.slice(counter.fullSize);
-    try {
-        const pather = parsePather(body, "txt");
-        if (pather.path === path) {
-            return body.slice(pather.fullSize);
-        }
-    }
-    catch {
-        // A multisig wrapper can preserve the grant's own pathed-material group as
-        // the counted payload. In that case unwrap one group layer and retry.
-    }
-    return body[0] === "-".charCodeAt(0) ? pathedAttachmentFromRaw(body, path) : null;
-}

package/esm/keri/npm/src/app/ipex-grouping.js

@@ -1,317 +0,0 @@
-/**
- * Group IPEX workflow orchestration.
- *
- * This module owns multisig coordination around embedded `/ipex/*` messages.
- * CLI adapters supply parsed options and output/file handling; this service
- * signs, publishes, waits, and sends completed group IPEX messages.
- */
-import { concatBytes, Diger, makePather, Prefixer, Seqner, SerderKERI, smell, Vrsn_1_0, } from "cesr-ts";
-import { action } from "effection";
-import { TransIdxSigGroup } from "../core/dispatch.js";
-import { ValidationError } from "../core/errors.js";
-import { CREDENTIAL_MAILBOX_TOPIC } from "../core/mailbox-topics.js";
-import { serializeMessage } from "../core/protocol-exchanging.js";
-import { Reger } from "../db/reger.js";
-import { processMailboxTurn } from "./agent-runtime.js";
-import { groupSigningMembers, localGroupMember } from "./group-members.js";
-import { embeddedBusinessExnSAD, MULTISIG_EXN_ROUTE, multisigPathedAttachment } from "./grouping.js";
-import { credentialPresentationArtifacts, credentialPresentationSupportMessages, credentialSaidFromGrant, } from "./ipex-credentialing.js";
-import { IPEX_GRANT_ROUTE } from "./ipexing.js";
-/** Approve one pending multisig wrapper around an embedded IPEX message. */
-export function* approveMultisigIpex(hby, runtime, wrapper, embedded, options = {}) {
-    const group = embedded.pre;
-    const embeddedSaid = embedded.said;
-    const wrapperSaid = wrapper.said;
-    if (!group || !embeddedSaid || !wrapperSaid) {
-        throw new ValidationError("Multisig IPEX approval requires wrapper, group, and embedded SAIDs.");
-    }
-    const groupHab = hby.habs.get(group);
-    if (!groupHab) {
-        throw new ValidationError(`Local group ${group} is missing member signing state.`);
-    }
-    const peerAttachment = multisigPathedAttachment(hby, wrapperSaid, "exn");
-    if (peerAttachment.length > 0) {
-        yield* runtime.reactor.processBytes(concatBytes(embedded.raw, peerAttachment), { local: true });
-        yield* runtime.reactor.processEscrowsOnce();
-    }
-    const approved = groupIpexPartial(hby, groupHab, embedded, wrapperSaid);
-    yield* runtime.reactor.processBytes(approved, { local: true });
-    yield* runtime.reactor.processEscrowsOnce();
-    const deliveries = options.publish ? yield* publishGroupIpexProposal(runtime, groupHab, approved) : [];
-    if ((options.sendLead ?? true)
-        && hby.db.exns.get([embeddedSaid])?.said === embeddedSaid
-        && runtime.reactor.exchanger.lead(groupHab, embeddedSaid)) {
-        deliveries.push(...(yield* sendCompletedGroupIpex(runtime, groupHab, embedded, options.delivery, options.gvrsn)));
-    }
-    return {
-        accepted: hby.db.exns.get([embeddedSaid])?.said === embeddedSaid,
-        deliveries,
-        approved,
-    };
-}
-/** Build the locally signed group IPEX partial stream. */
-export function groupIpexPartial(hby, groupHab, embedded, wrapperSaid, attachments = new Uint8Array()) {
-    const group = groupHab.pre;
-    const groupRecord = hby.db.getHab(group);
-    const memberPre = groupRecord?.mid;
-    const memberHab = memberPre ? hby.habs.get(memberPre) : null;
-    const groupKever = groupHab.kever;
-    const memberKey = memberHab?.kever?.verfers[0]?.qb64;
-    if (!group || !groupKever || !memberHab || !memberKey) {
-        throw new ValidationError(`Local group ${group || "<missing>"} is missing member signing state.`);
-    }
-    const groupIndex = groupKever.verfers.findIndex((verfer) => verfer.qb64 === memberKey);
-    if (groupIndex < 0) {
-        throw new ValidationError(`Local member ${memberHab.pre} is not a current signer for group ${group}.`);
-    }
-    const sigers = memberHab.mgr.sign(embedded.raw, {
-        pubs: [memberKey],
-        indexed: true,
-        indices: [groupIndex],
-    });
-    const estSaid = groupKever.lastEst.d || groupKever.said;
-    const estEvent = estSaid ? hby.db.getEvtSerder(group, estSaid) : null;
-    const seqner = estEvent?.sner;
-    if (!estSaid || !seqner) {
-        throw new ValidationError(`Missing establishment event material for group ${group}.`);
-    }
-    const tsg = new TransIdxSigGroup(new Prefixer({ qb64: group }), seqner, new Diger({ qb64: estSaid }), sigers);
-    const message = concatBytes(serializeMessage(embedded, { tsgs: [tsg], pipelined: false }), attachments);
-    if (!wrapperSaid) {
-        return message;
-    }
-    return concatBytes(message, multisigPathedAttachment(hby, wrapperSaid, "exn"));
-}
-/** Publish one group IPEX proposal to remote signing members. */
-export function* publishGroupIpexProposal(runtime, groupHab, embedded, delivery) {
-    const member = localGroupMember(runtime.hby, groupHab.pre);
-    const deliveries = [];
-    for (const recipient of groupSigningMembers(runtime.hby, groupHab.pre)) {
-        if (recipient === member.pre || runtime.hby.habs.has(recipient)) {
-            continue;
-        }
-        const result = yield* runtime.poster.sendExchange(member, {
-            recipient,
-            route: MULTISIG_EXN_ROUTE,
-            payload: { gid: groupHab.pre },
-            embeds: { exn: embedded },
-            topic: "multisig",
-            delivery,
-        });
-        deliveries.push(...result.deliveries, ...result.queued);
-    }
-    return deliveries;
-}
-/** Wait for a group IPEX message to become complete while approving stored wrappers. */
-export function* waitForMultisigIpexCompletion(hby, runtime, groupHab, embeddedSaid, approvalTimeoutSeconds) {
-    const member = localGroupMember(hby, groupHab.pre);
-    const deadline = Date.now() + approvalTimeoutSeconds * 1000;
-    while (Date.now() <= deadline) {
-        yield* approveStoredMultisigIpexWrappers(hby, runtime, embeddedSaid);
-        yield* runtime.reactor.processEscrowsOnce();
-        if (runtime.reactor.exchanger.complete(embeddedSaid)) {
-            return true;
-        }
-        yield* processMailboxTurn(runtime, { hab: member, budgetMs: 1000 });
-        yield* approveStoredMultisigIpexWrappers(hby, runtime, embeddedSaid);
-        yield* runtime.reactor.processEscrowsOnce();
-        if (runtime.reactor.exchanger.complete(embeddedSaid)) {
-            return true;
-        }
-        yield* sleep(250);
-    }
-    return runtime.reactor.exchanger.complete(embeddedSaid);
-}
-/** Approve all stored multisig wrappers for one embedded IPEX SAID. */
-export function* approveStoredMultisigIpexWrappers(hby, runtime, embeddedSaid) {
-    for (const [, wrapper] of hby.db.exns.getTopItemIter()) {
-        if (wrapper.route !== MULTISIG_EXN_ROUTE) {
-            continue;
-        }
-        const embeddedSad = embeddedBusinessExnSAD(wrapper);
-        if (!embeddedSad || embeddedSad.d !== embeddedSaid) {
-            continue;
-        }
-        const embedded = new SerderKERI({ sad: embeddedSad });
-        yield* approveMultisigIpex(hby, runtime, wrapper, embedded, {
-            publish: false,
-            sendLead: false,
-        });
-    }
-}
-/** Poll for the next stored pending multisig IPEX proposal. */
-export function* nextPendingMultisigIpex(hby, runtime, options) {
-    for (let turn = 0; turn < options.pollTurns; turn += 1) {
-        const found = findPendingMultisigIpex(hby, runtime);
-        if (found) {
-            return found;
-        }
-        yield* processMailboxTurn(runtime, { hab: options.hab, budgetMs: options.pollBudgetMs });
-        yield* runtime.reactor.processEscrowsOnce();
-        const afterPoll = findPendingMultisigIpex(hby, runtime);
-        if (afterPoll) {
-            return afterPoll;
-        }
-    }
-    return null;
-}
-/** Return the first incomplete stored `/multisig/exn` wrapping `/ipex/*`. */
-export function findPendingMultisigIpex(hby, runtime) {
-    for (const [, wrapper] of hby.db.exns.getTopItemIter()) {
-        if (wrapper.route !== MULTISIG_EXN_ROUTE) {
-            continue;
-        }
-        const embeddedSad = embeddedBusinessExnSAD(wrapper);
-        if (!embeddedSad || typeof embeddedSad.r !== "string" || !embeddedSad.r.startsWith("/ipex/")) {
-            continue;
-        }
-        const embeddedSaid = embeddedSad.d;
-        if (typeof embeddedSaid !== "string" || runtime.reactor.exchanger.complete(embeddedSaid)) {
-            continue;
-        }
-        return wrapper;
-    }
-    return null;
-}
-/** Send a completed group IPEX message from the elected local lead. */
-export function* sendCompletedGroupIpex(runtime, groupHab, embedded, delivery, gvrsn = Vrsn_1_0) {
-    if (!embedded.said) {
-        throw new ValidationError("Completed group IPEX message is missing a SAID.");
-    }
-    const recipient = ipexRecipient(embedded);
-    if (!recipient) {
-        throw new ValidationError(`Unable to find recipient for ${embedded.route ?? "<unknown>"} ${embedded.said}.`);
-    }
-    const messages = [];
-    let grantPathed;
-    const reger = runtime.vdr.reger;
-    if (embedded.route === IPEX_GRANT_ROUTE) {
-        if (!(reger instanceof Reger)) {
-            throw new ValidationError("VDR runtime did not open Reger.");
-        }
-        const credentialSaid = credentialSaidFromGrant(embedded);
-        if (credentialSaid) {
-            const [creder] = reger.cloneCred(credentialSaid);
-            const artifacts = credentialPresentationArtifacts(runtime.hby, reger, credentialSaid, gvrsn);
-            grantPathed = grantPathedMaterials(artifacts);
-            messages.push(...credentialPresentationSupportMessages(runtime.hby, reger, creder, recipient, gvrsn));
-        }
-    }
-    messages.push(storedExchangeMessage(runtime.hby, requireStoredExchange(runtime.hby, embedded.said), gvrsn, grantPathed));
-    return yield* sendCredentialBytes(runtime, localGroupMember(runtime.hby, groupHab.pre), recipient, messages, delivery);
-}
-/** Load one accepted stored EXN by SAID. */
-export function requireStoredExchange(hby, said) {
-    const stored = hby.db.exns.get([said]);
-    if (!stored) {
-        throw new ValidationError(`Exchange ${said} is not stored as accepted.`);
-    }
-    return stored;
-}
-/** Rebuild a stored EXN wire message with signatures and pathed material. */
-export function storedExchangeMessage(hby, serder, gvrsn = Vrsn_1_0, pathedOverride) {
-    if (!serder.said) {
-        throw new ValidationError("Exchange message is missing a SAID.");
-    }
-    const cigars = hby.db.ecigs.get([serder.said]).map(([, cigar]) => cigar);
-    return serializeMessage(serder, {
-        tsgs: rebuildStoredExchangeGroups(hby, serder.said),
-        cigars,
-        pathed: pathedOverride ?? hby.db.epath.get([serder.said]),
-        pipelined: false,
-        gvrsn,
-    });
-}
-/** Send raw credential/IPEX bytes over the credential mailbox topic. */
-export function* sendCredentialBytes(runtime, hab, recipient, messages, delivery) {
-    const sent = [];
-    for (const message of messages) {
-        const result = yield* runtime.poster.sendBytes(hab, {
-            recipient,
-            message,
-            topic: CREDENTIAL_MAILBOX_TOPIC,
-            delivery,
-        });
-        sent.push(...result.deliveries, ...result.queued);
-    }
-    return sent;
-}
-function ipexRecipient(exn) {
-    const rp = exn.ked?.rp;
-    if (typeof rp === "string" && rp.length > 0) {
-        return rp;
-    }
-    const attrs = exn.ked?.a;
-    if (isRecord(attrs) && typeof attrs.i === "string" && attrs.i.length > 0) {
-        return attrs.i;
-    }
-    return null;
-}
-function grantPathedMaterials(artifacts) {
-    return [
-        pathedMaterial("anc", artifacts.anc),
-        pathedMaterial("iss", artifacts.iss),
-        pathedMaterial("acdc", artifacts.acdc),
-    ];
-}
-function pathedMaterial(label, message) {
-    const { smellage } = smell(message);
-    const atc = message.slice(smellage.size);
-    if (atc.length === 0) {
-        return makePather(["e", label]).qb64b;
-    }
-    return concatBytes(makePather(["e", label]).qb64b, atc);
-}
-function rebuildStoredExchangeGroups(hby, said) {
-    const groups = [];
-    let currentKey = null;
-    let currentSigers = [];
-    const flush = () => {
-        if (!currentKey || currentSigers.length === 0) {
-            return;
-        }
-        groups.push(new TransIdxSigGroup(new Prefixer({ qb64: currentKey[0] }), seqnerFromSnh(currentKey[1]), new Diger({ qb64: currentKey[2] }), currentSigers));
-        currentSigers = [];
-    };
-    for (const [keys, siger] of hby.db.esigs.getTopItemIter([said, ""])) {
-        const groupKey = keys.slice(1);
-        if (!groupKey[0] || !groupKey[1] || !groupKey[2]) {
-            continue;
-        }
-        if (currentKey
-            && (currentKey[0] !== groupKey[0] || currentKey[1] !== groupKey[1] || currentKey[2] !== groupKey[2])) {
-            flush();
-        }
-        currentKey = [groupKey[0], groupKey[1], groupKey[2]];
-        currentSigers.push(siger);
-    }
-    flush();
-    return groups;
-}
-function seqnerFromSnh(snh) {
-    return new Seqner({ code: "0A", raw: hexToFixedBytes(snh, 16) });
-}
-function hexToFixedBytes(hex, size) {
-    const normalized = hex.length % 2 === 0 ? hex : `0${hex}`;
-    if (!/^[0-9a-f]+$/i.test(normalized)) {
-        throw new ValidationError(`Invalid hex ordinal ${hex}`);
-    }
-    if (normalized.length > size * 2) {
-        throw new ValidationError(`Hex ordinal ${hex} exceeds ${size} bytes.`);
-    }
-    const raw = new Uint8Array(size);
-    const padded = normalized.padStart(size * 2, "0");
-    for (let index = 0; index < size; index += 1) {
-        raw[index] = Number.parseInt(padded.slice(index * 2, (index * 2) + 2), 16);
-    }
-    return raw;
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function* sleep(ms) {
-    yield* action((resolve) => {
-        const timeout = setTimeout(resolve, ms);
-        return () => clearTimeout(timeout);
-    });
-}