keri-ts 1.0.0 → 2.0.0

package/esm/keri/npm/src/app/{mailboxing.js → mailbox/mailboxing.js}

@@ -1,11 +1,15 @@
-import { TopicsRecord } from "../core/records.js";
-import { Roles } from "../core/roles.js";
-import { createMailboxer } from "../db/mailboxing.js";
+import { TopicsRecord } from "../../core/records.js";
+import { Roles } from "../../core/roles.js";
+import { createMailboxer } from "../../db/mailbox/mailboxing.js";
 /**
  * Derive mailbox open options from one existing habery.
  *
  * This is the supported bridge from core habery state to the additive
  * provider-side mailbox store lifecycle.
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param options Explicit store options overriding the Habery-derived name/path/temp/read-only settings.
+ * @returns Derived open settings.
  */
 export function mailboxerOptionsForHabery(hby, options = {}) {
     return {
@@ -25,6 +29,10 @@ export function mailboxerOptionsForHabery(hby, options = {}) {
  * Ownership rule:
  * - this helper only derives open settings from habery state
  * - the caller that opens the mailboxer owns its lifecycle
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param options Explicit store options overriding the Habery-derived name/path/temp/read-only settings.
+ * @returns Provider sidecar whose acquisition/lifetime belongs to the caller scope.
  */
 export function* openMailboxerForHabery(hby, options = {}) {
     return yield* createMailboxer(mailboxerOptionsForHabery(hby, options));
@@ -34,6 +42,10 @@ export function* openMailboxerForHabery(hby, options = {}) {
  *
  * Topic buckets are normalized as `pre/topic`, with `topic` already carrying
  * the leading slash when it is a protocol mailbox topic like `/challenge`.
+ *
+ * @param pre AID whose mailbox or accepted state is addressed.
+ * @param topic Protocol mailbox topic; leading slash is normalized where required.
+ * @returns Storage key joining the AID and one slash-prefixed topic.
  */
 export function mailboxTopicKey(pre, topic) {
     return topic.startsWith("/") ? `${pre}${topic}` : `${pre}/${topic}`;
@@ -43,6 +55,12 @@ export function mailboxTopicKey(pre, topic) {
  *
  * Cursor records store the last seen ordinal, while mailbox queries ask for
  * the next ordinal wanted.
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param pre AID whose mailbox or accepted state is addressed.
+ * @param witness Remote endpoint AID used in the durable cursor key.
+ * @param topics Topics requested by the poller.
+ * @returns Next-wanted ordinal map, derived from last-consumed rows plus one.
  */
 export function mailboxQueryTopics(hby, pre, witness, topics) {
     const record = mailboxRemoteCursorRecord(hby, pre, witness);
@@ -62,6 +80,12 @@ export function mailboxQueryTopics(hby, pre, witness, topics) {
  *
  * These cursors live in `Baser.tops` because they describe the consumer's
  * remote poll progress, not the provider's stored inbox contents.
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param pre AID whose mailbox or accepted state is addressed.
+ * @param witness Remote endpoint AID.
+ * @param topic Protocol mailbox topic; leading slash is normalized where required.
+ * @param idx Last successfully consumed provider ordinal.
  */
 export function updateMailboxRemoteCursor(hby, pre, witness, topic, idx) {
     const record = mailboxRemoteCursorRecord(hby, pre, witness);
@@ -69,66 +93,43 @@ export function updateMailboxRemoteCursor(hby, pre, witness, topic, idx) {
     hby.db.tops.pin([pre, witness], record);
 }
 /**
- * Return the remote mailbox or witness endpoints a local habitat should poll.
+ * Enumerate authorized mailbox providers and the subject's current KEL witnesses.
  *
- * KERIpy parity rule:
- * - mailbox role endpoints take precedence when authorized
- * - otherwise poll every eligible witness mailbox endpoint
- * - SSE uses HTTP(S) only; a TCP-only mailbox keeps role precedence while awaiting HTTP
+ * Both sets are polled, as in KERIpy MailboxDirector. A provider in both roles
+ * shares one history and cursor, so it gets one worker. Locally controlled AIDs
+ * remain eligible for HTTP polling; provider storage is never scanned directly.
+ * Missing HTTP(S) locations produce no poll target until a location is available.
  *
- * The result is intentionally already flattened to one preferred URL per
- * endpoint identifier so runtime pollers can stay focused on mailbox protocol
- * work instead of URL selection policy.
+ * @param hab Mailbox subject habitat supplying accepted roles and current witnesses.
+ * @returns One HTTPS-preferred HTTP target per provider AID, with stable worker keys.
  */
-export function mailboxPollEndpoints(hby, hab) {
-    const ends = hab.endsFor(hab.pre);
-    const isHttp = (endpoint) => ["https:", "http:"].includes(new URL(endpoint.url).protocol);
-    const mailbox = flattenRoleUrls(ends[Roles.mailbox])
-        .filter((endpoint) => !hby.db.prefixes.has(endpoint.eid));
-    // Keep mailbox precedence before filtering transport; TCP delivery is a different caller policy.
-    if (mailbox.length > 0) {
-        return mailbox.filter(isHttp).map((endpoint) => ({
-            key: `${Roles.mailbox}:${endpoint.eid}:${endpoint.url}`,
-            eid: endpoint.eid,
-            url: endpoint.url,
-        }));
+export function mailboxPollEndpoints(hab) {
+    const eids = new Set();
+    for (const [keys, end] of hab.db.ends.getTopItemIter([hab.pre, Roles.mailbox], { topive: true })) {
+        if (end.allowed && keys[2])
+            eids.add(keys[2]);
     }
-    // Query replies are stored at the witness that answered; these mailboxes are not interchangeable.
-    return flattenRoleUrls(ends[Roles.witness])
-        .filter((endpoint) => !hby.db.prefixes.has(endpoint.eid) && isHttp(endpoint))
-        .sort((left, right) => left.eid.localeCompare(right.eid))
-        .map((endpoint) => ({
-        key: `${Roles.witness}:${endpoint.eid}:${endpoint.url}`,
-        eid: endpoint.eid,
-        url: endpoint.url,
-    }));
-}
-/**
- * Return the currently authorized mailbox endpoints for one remote recipient.
- *
- * `Poster` treats this as the mailbox-first broadcast target set.
- */
-export function mailboxDeliveryEndpoints(hab, recipient) {
-    return flattenRoleUrls(hab.endsFor(recipient)[Roles.mailbox]);
-}
-/**
- * Return the direct controller and agent endpoints for one remote recipient.
- *
- * These are fallback transport targets only when no mailbox endpoints are
- * configured or when the caller explicitly forces direct delivery.
- */
-export function directDeliveryEndpoints(hab, recipient) {
-    const ends = hab.endsFor(recipient);
-    return [
-        ...flattenRoleUrls(ends[Roles.controller]),
-        ...flattenRoleUrls(ends[Roles.agent]),
-    ];
+    for (const eid of hab.kever?.wits ?? [])
+        eids.add(eid);
+    const endpoints = [];
+    for (const eid of eids) {
+        const urls = hab.fetchUrls(eid);
+        const url = urls.https ?? urls.http;
+        if (url)
+            endpoints.push({ key: `${eid}:${url}`, eid, url });
+    }
+    return endpoints;
 }
 /**
  * Read one endpoint's currently stored URLs directly from shared DB state.
  *
  * This stays DB-oriented on purpose so CLI, server, and forwarding code can
  * inspect authoritative location state without carrying a second cache.
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param eid Endpoint AID whose accepted location replies are loaded.
+ * @param scheme Optional scheme filter; omission returns all recorded schemes.
+ * @returns Scheme-to-URL map from accepted location state.
  */
 export function fetchEndpointUrls(hby, eid, scheme = "") {
     const urls = {};
@@ -144,7 +145,12 @@ export function fetchEndpointUrls(hby, eid, scheme = "") {
     }
     return urls;
 }
-/** Normalize one optional hosted-prefix filter into a membership set. */
+/**
+ * Normalize one optional hosted-prefix filter into a membership set.
+ *
+ * @param eids Optional allowed hosted AID iterable; omission leaves filtering disabled.
+ * @returns Membership set or null when no filter was supplied.
+ */
 function hostedPrefixFilter(eids) {
     if (!eids) {
         return null;
@@ -163,6 +169,12 @@ function hostedPrefixFilter(eids) {
  * - optionally append a resource suffix like `/mailboxes`
  * - when more than one local endpoint matches, the caller must treat that as
  *   ambiguous instead of guessing
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param pathname Incoming URL pathname to compare against accepted endpoint base paths.
+ * @param resourceSuffix Protocol resource suffix sought beneath the hosted base path.
+ * @param eids Optional explicit hosted-AID filter; do not infer host eligibility from all local identities.
+ * @returns Matching hosted endpoint projection; ambiguity follows this helper's documented selection policy.
  */
 export function hostedEndpointMatches(hby, pathname, resourceSuffix = "", eids) {
     const target = normalizePath(pathname);
@@ -189,6 +201,12 @@ export function hostedEndpointMatches(hby, pathname, resourceSuffix = "", eids)
  *
  * Callers that need ambiguity details should use `hostedEndpointPathMatches()`
  * directly.
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param pathname Incoming URL pathname to compare against accepted endpoint base paths.
+ * @param resourceSuffix Protocol resource suffix sought beneath the hosted base path.
+ * @param eids Optional explicit hosted-AID filter; do not infer host eligibility from all local identities.
+ * @returns Matching hosted endpoint projection; ambiguity follows this helper's documented selection policy.
  */
 export function hostedEndpointForPath(hby, pathname, resourceSuffix = "", eids) {
     const matches = hostedEndpointMatches(hby, pathname, resourceSuffix, eids);
@@ -203,6 +221,11 @@ export function hostedEndpointForPath(hby, pathname, resourceSuffix = "", eids)
  * - non-root endpoints match their exact base path or any subpath beneath it
  * - callers should prefer the longest matching base path and treat ties as
  *   ambiguous instead of guessing
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param pathname Incoming URL pathname to compare against accepted endpoint base paths.
+ * @param eids Optional explicit hosted-AID filter; do not infer host eligibility from all local identities.
+ * @returns Matching hosted endpoint projection; ambiguity follows this helper's documented selection policy.
  */
 export function hostedEndpointPathMatches(hby, pathname, eids) {
     const target = normalizePath(pathname);
@@ -235,6 +258,12 @@ export function hostedEndpointPathMatches(hby, pathname, eids) {
  * hit?" Keeping it here means `protocol-handler.ts` can reason in terms of
  * explicit route matches while `server.ts` stays out of endpoint-selection
  * policy entirely.
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param pathname Incoming URL pathname to compare against accepted endpoint base paths.
+ * @param resourceSuffix Protocol resource suffix sought beneath the hosted base path.
+ * @param eids Optional explicit hosted-AID filter; do not infer host eligibility from all local identities.
+ * @returns Matching hosted endpoint projection; ambiguity follows this helper's documented selection policy.
  */
 export function resolveHostedEndpointPath(hby, pathname, resourceSuffix = "", eids) {
     const matches = hostedEndpointPathMatches(hby, pathname, eids)
@@ -261,6 +290,9 @@ export function resolveHostedEndpointPath(hby, pathname, resourceSuffix = "", ei
  *
  * This converts stored end-role location shape into the transport-ready tuples
  * used by forwarding and polling logic.
+ *
+ * @param roleUrls Accepted endpoint-AID to scheme/URL map for one role, possibly absent.
+ * @returns All endpoint/preferred-URL pairs.
  */
 export function flattenRoleUrls(roleUrls) {
     if (!roleUrls) {
@@ -275,30 +307,26 @@ export function flattenRoleUrls(roleUrls) {
     }
     return flattened;
 }
-/**
- * Return the deterministic first preferred endpoint from one role map.
- *
- * Forwarding fallback chooses one witness deterministically; mailbox polling
- * enumerates its eligible witnesses separately.
- */
-export function firstSortedEndpoint(roleUrls) {
-    const flattened = flattenRoleUrls(roleUrls).sort((left, right) => left.eid.localeCompare(right.eid));
-    return flattened[0] ?? null;
-}
 /**
  * Return the preferred URL for one endpoint location set.
  *
  * HTTPS wins when present because mailbox and admin URLs are externally
  * advertised endpoints.
+ *
+ * @param urls Accepted scheme-to-URL map for one endpoint.
+ * @returns HTTPS, then HTTP, then TCP; null when no supported location is recorded.
  */
 export function preferredUrl(urls) {
-    return urls.https ?? urls.http ?? Object.values(urls)[0] ?? null;
+    return urls.https ?? urls.http ?? urls.tcp ?? null;
 }
 /**
  * Extract the normalized base path from one endpoint URL.
  *
  * Mailbox and OOBI hosts serve routes relative to this base path, not only
  * from `/`.
+ *
+ * @param url Advertised endpoint URL; its pathname defines hosted routing.
+ * @returns Normalized base pathname.
  */
 export function endpointBasePath(url) {
     try {
@@ -308,13 +336,25 @@ export function endpointBasePath(url) {
         return "/";
     }
 }
+/**
+ * Join an endpoint base path with a protocol resource suffix.
+ *
+ * @param basePath Hosted endpoint base pathname.
+ * @param suffix Resource suffix to append; empty keeps the normalized base.
+ * @returns Normalized combined pathname.
+ */
 function joinBasePath(basePath, suffix) {
     if (suffix.length === 0) {
         return normalizePath(basePath);
     }
     return normalizePath(`${normalizePath(basePath) === "/" ? "" : normalizePath(basePath)}${suffix}`);
 }
-/** Normalize hosted endpoint paths into the comparison form used everywhere. */
+/**
+ * Normalize hosted endpoint paths into the comparison form used everywhere.
+ *
+ * @param pathname Path to normalize for hosted-route comparison.
+ * @returns Comparison pathname with the existing leading/trailing slash normalization.
+ */
 function normalizePath(pathname) {
     const trimmed = pathname.trim();
     if (trimmed.length === 0 || trimmed === "/") {
@@ -328,6 +368,10 @@ function normalizePath(pathname) {
  *
  * Root-hosted endpoints match every absolute path; non-root endpoints match
  * only their exact base path or descendants beneath it.
+ *
+ * @param basePath Normalized hosted endpoint base.
+ * @param pathname Incoming request path.
+ * @returns Slash-prefixed relative path, or null when outside the base.
  */
 function relativeHostedPath(basePath, pathname) {
     if (basePath === "/") {
@@ -341,7 +385,14 @@ function relativeHostedPath(basePath, pathname) {
     }
     return normalizePath(pathname.slice(basePath.length));
 }
-/** Load or create the durable remote mailbox cursor record for one endpoint. */
+/**
+ * Load or create the durable remote mailbox cursor record for one endpoint.
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param pre AID whose mailbox or accepted state is addressed.
+ * @param witness Remote endpoint AID used with pre as the cursor key.
+ * @returns Existing cursor record or a new empty record; the caller persists updates.
+ */
 function mailboxRemoteCursorRecord(hby, pre, witness) {
     return hby.db.tops.get([pre, witness]) ?? new TopicsRecord({ topics: {} });
 }

package/esm/keri/npm/src/app/mailbox/topic-routing.js

@@ -0,0 +1,54 @@
+/** Map application routes to mailbox topics: queries use slash form; /fwd modifiers use bare form. */
+import { CREDENTIAL_MAILBOX_TOPIC, DELEGATE_MAILBOX_TOPIC, OOBI_MAILBOX_TOPIC, } from "../../core/mailbox/mailbox-topics.js";
+/**
+ * Derive the default mailbox topic from the first non-empty route segment.
+ *
+ * @param route Exchange route whose first nonempty segment chooses the mailbox topic.
+ * @returns Derived topic under the existing route mapping.
+ */
+function defaultTopicForRoute(route) {
+    if (route.startsWith("/delegate")) {
+        return DELEGATE_MAILBOX_TOPIC;
+    }
+    if (route === "/oobis") {
+        return OOBI_MAILBOX_TOPIC;
+    }
+    if (route.startsWith("/ipex/")) {
+        return CREDENTIAL_MAILBOX_TOPIC;
+    }
+    const trimmed = route.replace(/^\/+/, "");
+    return trimmed.split("/")[0] ?? "";
+}
+/**
+ * KERIpy pollers query protocol mailbox topics with a leading slash.
+ *
+ * @param topic Protocol mailbox topic; leading slash is normalized where required.
+ * @returns Slash-prefixed query topic.
+ */
+function pollMailboxTopic(topic) {
+    if (topic.length === 0 || topic.startsWith("/")) {
+        return topic;
+    }
+    return `/${topic}`;
+}
+/**
+ * KERIpy `/fwd` modifiers use the bare topic name, e.g. `multisig`.
+ *
+ * @param topic Protocol mailbox topic; leading slash is normalized where required.
+ * @returns Bare /fwd modifier topic.
+ */
+export function transportMailboxTopic(topic) {
+    return topic.replace(/^\/+/, "");
+}
+/**
+ * Public helper for deriving mailbox topic defaults from one EXN route.
+ *
+ * This stays exported because CLI and runtime call sites both need one shared
+ * answer for "which mailbox topic should this route land in by default?"
+ *
+ * @param route Exchange route whose first nonempty segment chooses the mailbox topic.
+ * @returns Derived topic under the existing route mapping.
+ */
+export function mailboxTopicForRoute(route) {
+    return pollMailboxTopic(defaultTopicForRoute(route));
+}

package/esm/keri/npm/src/app/multisig/group-members.js

@@ -0,0 +1,173 @@
+import { TransIdxSigGroup } from "../../core/dispatch.js";
+import { ValidationError } from "../../core/errors.js";
+import { Kever } from "../../core/kel/kever.js";
+import { dgKey } from "../../db/core/keys.js";
+/** True when the selected habitat is a local group habitat. */
+export function isLocalGroupHab(hby, hab) {
+    return !!hab.pre && !!hby.db.getHab(hab.pre)?.mid;
+}
+/** Return the local member habitat for a persisted group identifier. */
+export function localGroupMember(hby, groupPre) {
+    const record = hby.db.getHab(groupPre);
+    const member = record?.mid ? hby.habs.get(record.mid) : null;
+    if (!member) {
+        throw new ValidationError(`Group ${groupPre} is missing local member metadata.`);
+    }
+    return member;
+}
+/** Find the member's latest accepted single-key contribution to the supplied group keys. */
+export function latestGroupContribution(db, member, verfers) {
+    const state = db.getKever(member);
+    if (!state)
+        return null;
+    const pubs = verfers.map(verfer => verfer.qb64);
+    for (const [, sn, said] of db.kels.getOnItemBackIter(member, state.sn)) {
+        if (db.kels.getLast(member, sn) !== said)
+            continue;
+        const event = db.getEvtSerder(member, said);
+        if (!event)
+            throw new ValidationError(`Missing accepted member event ${member}:${said}.`);
+        if (!event.estive)
+            continue;
+        const keys = event.verfers ?? [];
+        if (keys.length !== 1)
+            throw new ValidationError(`Group signing requires single-key member events for ${member}.`);
+        const index = pubs.indexOf(keys[0].qb64);
+        if (index >= 0)
+            return { event, index, verfer: keys[0] };
+    }
+    return null;
+}
+/**
+ * Verify an accepted coordinator against its historical establishment threshold.
+ * index is the initial election; a frozen operation rechecks indices without
+ * replacing its earlier choice when more valid signatures arrive.
+ */
+export function groupWitnesserSelection(db, group, { sn, said }) {
+    if (!Number.isSafeInteger(sn) || sn < 0 || db.kels.getLast(group, sn) !== said)
+        return null;
+    const event = db.getEvtSerder(group, said);
+    if (!event || event.pre !== group || event.sn !== sn || event.said !== said)
+        return null;
+    for (const [, ordinal, digest] of db.kels.getOnItemBackIter(group, sn)) {
+        if (db.kels.getLast(group, ordinal) !== digest)
+            continue;
+        const establishment = db.getEvtSerder(group, digest);
+        if (!establishment)
+            throw new ValidationError(`Missing accepted group event ${group}:${digest}.`);
+        if (!establishment.estive)
+            continue;
+        const { indices } = Kever.verifyIndexedSignatures(event.raw, db.sigs.get(dgKey(group, said)), establishment.verfers);
+        if (!indices.length || !establishment.tholder?.satisfy(indices))
+            return null;
+        return { establishment, index: Math.min(...indices), indices };
+    }
+    return null;
+}
+/** Return current group signing member AIDs in signing-index order. */
+export function groupSigningMembers(hby, groupPre) {
+    const stored = hby.ks.getSmids(groupPre).map((tuple) => tuple[0].qb64);
+    if (stored.length > 0) {
+        return stored;
+    }
+    const record = hby.db.getHab(groupPre);
+    return record?.smids ?? [];
+}
+/** Return the first locally available habitat from `members`, if any. */
+export function findLocalGroupMember(hby, members) {
+    for (const member of members) {
+        const hab = hby.habs.get(member);
+        if (hab) {
+            return hab;
+        }
+    }
+    return null;
+}
+/** Return unique non-empty member AIDs while preserving first-seen order. */
+export function uniqueMembers(members) {
+    return [...new Set(members.filter((member) => member.length > 0))];
+}
+/** Match a group signing key to one member's accepted establishment history, including retired keys. */
+export function groupMemberHasKey(db, member, key) {
+    for (const [, said] of db.getKelItemIter(member)) {
+        const event = db.getEvtSerder(member, said);
+        if (event?.estive && event.verfers[0]?.qb64 === key)
+            return true;
+    }
+    return false;
+}
+/**
+ * Select only a cryptographically valid local partial at an accepted group establishment.
+ * The shared esigs table can hold unverified escrow candidates, so a matching
+ * index or an authenticated parent wrapper alone is not recorded child approval.
+ */
+export function localIpexContribution(db, member, embedded, proofs) {
+    for (const proof of proofs) {
+        if (proof.pre !== embedded.pre || proof.sn > BigInt(Number.MAX_SAFE_INTEGER))
+            continue;
+        const said = db.kels.getLast(proof.pre, Number(proof.sn));
+        const event = said === proof.said ? db.getEvtSerder(proof.pre, said) : null;
+        if (!event?.estive)
+            continue;
+        const verified = Kever.verifyIndexedSignatures(embedded.raw, proof.sigers, event.verfers);
+        for (const siger of verified.sigers) {
+            if (groupMemberHasKey(db, member, event.verfers[siger.index].qb64)) {
+                return new TransIdxSigGroup(proof.prefixer, event.sner, proof.diger, [siger]);
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Derive the members of `group`'s latest accepted establishment event from
+ * local KELs, as KERIpy `GroupHab.acceptedMembers`.
+ *
+ * Each signing key is attributed to the candidate whose latest contributing
+ * establishment event supplied it, and each next-key digest to the candidate
+ * whose establishment event committed to it. Returns null when the event is
+ * missing or any key cannot be attributed to exactly one candidate.
+ */
+export function acceptedGroupMembers(db, group, candidates) {
+    const kever = db.getKever(group);
+    const event = kever ? db.getEvtSerder(group, kever.lastEst.d) : null;
+    if (!event)
+        return null;
+    const keys = (event.verfers ?? []).map(verfer => verfer.qb64);
+    const digs = (event.ndigers ?? []).map(diger => diger.qb64);
+    const signing = new Map(), rotating = new Map();
+    const attribute = (found, index, aid) => (found.get(index) ?? aid) === aid && !!found.set(index, aid);
+    for (const aid of candidates) {
+        const state = aid === group ? null : db.getKever(aid);
+        if (!state)
+            continue;
+        let signed = false;
+        for (const [, sn, said] of db.kels.getOnItemBackIter(aid, state.lastEst.s)) {
+            if (db.kels.getLast(aid, sn) !== said)
+                continue;
+            const member = db.getEvtSerder(aid, said);
+            if (!member?.estive)
+                continue;
+            // KERIpy fetchLatestContribTo: only the latest contributing establishment counts.
+            const index = signed
+                ? -1
+                : (member.verfers ?? []).map(verfer => keys.indexOf(verfer.qb64)).find(i => i >= 0) ?? -1;
+            if (index >= 0) {
+                signed = true;
+                if (!attribute(signing, index, aid))
+                    return null;
+            }
+            for (const diger of member.ndigers ?? []) {
+                const next = digs.indexOf(diger.qb64);
+                if (next >= 0 && !attribute(rotating, next, aid))
+                    return null;
+            }
+        }
+    }
+    if (signing.size !== keys.length || rotating.size !== digs.length)
+        return null;
+    return {
+        event,
+        smids: keys.map((_, index) => signing.get(index)),
+        rmids: digs.map((_, index) => rotating.get(index)),
+    };
+}