keri-ts 1.0.0 → 2.0.0

package/esm/keri/npm/src/cli/credentials/vc.js

@@ -0,0 +1,399 @@
+import * as dntShim from "../../_dnt.shims.js";
+import { concatBytes } from "cesr-ts";
+import { call, spawn } from "effection";
+import { importCredentialStream } from "../../app/credentials/credential-importing.js";
+import { deliverCredentialRevocation, revocationRecipients, revokeCredential, } from "../../app/credentials/credential-revoking.js";
+import { createCredential, credentialRegistryRecords, credentialRegistryStatus, credentialStreamBytes, exportCredentialStream, inceptCredentialRegistry, listCredentials, pinSchemaBytes, } from "../../app/credentials/credential-workflows.js";
+import { isLocalGroupHab, localGroupMember } from "../../app/multisig/group-members.js";
+import { runAgentRuntime } from "../../app/runtime/agent-runtime.js";
+import { ValidationError } from "../../core/errors.js";
+import { withAgentRuntime, withExistingHabery } from "../common/context.js";
+import { parseBooleanOption, parseNumberOption, parseStringListOption, parseStringOption } from "../common/parsing.js";
+import { waitForIssuedCredential, waitForTelPublication } from "../common/tel-completion.js";
+/** Implement `tufa vc schema import` by pinning JSON schemas into `schema.`. */
+export function* vcSchemaImportCommand(args) {
+    const vcArgs = {
+        ...baseArgs(args),
+        schema: asStringList(args.schema, "schema"),
+    };
+    yield* withVcHabery(vcArgs, function* ({ hby }) {
+        for (const path of vcArgs.schema ?? []) {
+            const schema = pinSchemaBytes(hby, dntShim.Deno.readFileSync(path));
+            console.log(JSON.stringify({ schema, path }));
+        }
+    });
+}
+/**
+ * Implement `tufa vc registry incept` for single-sig or group registries.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export function* vcRegistryInceptCommand(args) {
+    const vcArgs = registryArgs(args);
+    const timeout = publicationTimeout(args.timeout);
+    return yield* withVcRuntime(vcArgs, function* ({ hby, runtime, rgy }) {
+        const hab = requireHab(hby, vcArgs.alias);
+        const group = isLocalGroupHab(hby, hab);
+        const signer = group ? localGroupMember(hby, hab.pre) : hab;
+        const result = yield* call(function* () {
+            const postman = runtime.postman;
+            const worker = yield* spawn(() => runAgentRuntime(runtime, { hab: signer, pollMailbox: group }));
+            try {
+                const deadline = Date.now() + timeout * 1000;
+                const created = yield* inceptCredentialRegistry(rgy, runtime.reactor, postman, hab, {
+                    registryName: vcArgs.registryName,
+                    estOnly: vcArgs.estOnly,
+                    usage: vcArgs.usage,
+                });
+                created.publicationComplete = yield* waitForTelPublication(rgy.publication, created.registry, 0, deadline);
+                if (created.group) {
+                    created.group.accepted = rgy.reger.tels.getOn(created.registry, 0)?.qb64 === created.registry;
+                    if (created.group.accepted)
+                        created.group.status = "accept";
+                }
+                return created;
+            }
+            finally {
+                yield* worker.halt();
+            }
+        });
+        return result;
+    });
+}
+/** Implement `tufa vc registry list` from local `Reger.regs` state. */
+export function* vcRegistryListCommand(args) {
+    const vcArgs = baseArgs(args);
+    yield* withVcRuntime(vcArgs, function* ({ reger }) {
+        for (const record of credentialRegistryRecords(reger)) {
+            console.log(JSON.stringify(record));
+        }
+    });
+}
+/** Implement `tufa vc registry status` from current TEL registry state. */
+export function* vcRegistryStatusCommand(args) {
+    const vcArgs = registryArgs(args, { aliasRequired: false });
+    yield* withVcRuntime(vcArgs, function* ({ rgy }) {
+        console.log(JSON.stringify(credentialRegistryStatus(rgy, vcArgs.registryName)));
+    });
+}
+/**
+ * Implement `tufa vc create` by constructing and issuing one registry-backed ACDC.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export function* vcCreateCommand(args) {
+    const timeout = publicationTimeout(args.timeout);
+    const vcArgs = {
+        ...baseArgs(args),
+        alias: parseStringOption(args.alias, "alias"),
+        registryName: parseStringOption(args.registryName, "registryName"),
+        schema: parseStringOption(args.schema, "schema"),
+        schemaFile: parseStringOption(args.schemaFile, "schemaFile"),
+        recipient: parseStringOption(args.recipient, "recipient"),
+        data: parseStringOption(args.data, "data"),
+        edges: parseStringOption(args.edges, "edges"),
+        rules: parseStringOption(args.rules, "rules"),
+        out: parseStringOption(args.out, "out"),
+    };
+    requireNonEmpty(vcArgs.alias, "Alias");
+    requireNonEmpty(vcArgs.registryName, "Registry name");
+    const data = parseSubjectDataArg(vcArgs.data) ?? {};
+    const edges = parseJsonSectionArg(vcArgs.edges, "edges");
+    const rules = parseJsonSectionArg(vcArgs.rules, "rules");
+    return yield* withVcRuntime(vcArgs, function* ({ hby, runtime, reger, rgy }) {
+        const schema = vcArgs.schemaFile ? pinSchemaBytes(hby, dntShim.Deno.readFileSync(vcArgs.schemaFile)) : vcArgs.schema;
+        requireNonEmpty(schema, "Schema");
+        const recipient = vcArgs.recipient ? resolveAid(hby, vcArgs.recipient) : undefined;
+        const registry = rgy.registryByName(vcArgs.registryName);
+        if (!registry)
+            throw new ValidationError(`Registry ${vcArgs.registryName} not found.`);
+        const issuer = requireHab(hby, vcArgs.alias);
+        if (issuer.pre !== registry.hab.pre)
+            throw new ValidationError("Selected alias does not control this registry.");
+        const group = isLocalGroupHab(hby, issuer);
+        const signer = group ? localGroupMember(hby, issuer.pre) : issuer;
+        const result = yield* call(function* () {
+            const postman = runtime.postman;
+            const worker = yield* spawn(() => runAgentRuntime(runtime, { hab: signer, pollMailbox: group }));
+            try {
+                const deadline = Date.now() + timeout * 1000;
+                const created = yield* createCredential(rgy, runtime.reactor, postman, {
+                    registryName: vcArgs.registryName,
+                    schema: schema,
+                    recipient,
+                    data,
+                    edges,
+                    rules,
+                });
+                yield* waitForIssuedCredential(rgy.publication, created.creder.said, deadline);
+                const saved = rgy.reger.saved.get(created.creder.said) !== null;
+                created.publicationComplete = rgy.publication.complete(created.creder.said);
+                if (saved)
+                    created.status = "accept";
+                if (created.group) {
+                    created.group.saved = saved;
+                    if (rgy.reger.tels.getOn(created.creder.said, 0)?.qb64 === created.tel)
+                        created.group.telStatus = "accept";
+                }
+                return created;
+            }
+            finally {
+                yield* worker.halt();
+            }
+        });
+        if (vcArgs.out) {
+            writeBytes(credentialStreamBytes(hby, reger, result.creder, result.recipient), vcArgs.out);
+        }
+        return result;
+    });
+}
+/** Implement `tufa vc list` over verifier-backed wallet indexes. */
+export function* vcListCommand(args) {
+    const vcArgs = {
+        ...baseArgs(args),
+        alias: parseStringOption(args.alias, "alias"),
+        aid: parseStringOption(args.aid, "aid"),
+        schema: parseStringOption(args.schema, "schema"),
+        issued: parseBooleanOption(args.issued, "issued"),
+    };
+    yield* withVcRuntime(vcArgs, function* ({ hby, rgy }) {
+        const aid = vcArgs.aid ?? (vcArgs.alias ? requireHab(hby, vcArgs.alias).pre : undefined);
+        for (const item of listCredentials(rgy, { issued: vcArgs.issued ?? false, aid, schema: vcArgs.schema })) {
+            console.log(JSON.stringify(item));
+        }
+    });
+}
+/** Implement `tufa vc export` as a KERIpy-compatible credential support stream. */
+export function* vcExportCommand(args) {
+    const vcArgs = {
+        ...baseArgs(args),
+        said: parseStringOption(args.said, "said"),
+        recipient: parseStringOption(args.recipient, "recipient"),
+        out: parseStringOption(args.out, "out"),
+    };
+    requireNonEmpty(vcArgs.said, "Credential SAID");
+    yield* withVcRuntime(vcArgs, function* ({ hby, reger }) {
+        const recipient = vcArgs.recipient ? resolveAid(hby, vcArgs.recipient) : undefined;
+        const result = exportCredentialStream(hby, reger, vcArgs.said, recipient);
+        writeBytes(result.bytes, vcArgs.out);
+    });
+}
+/**
+ * Import finite CESR input and report its observed records' persisted acceptance.
+ * Validate the settlement deadline before opening stores or reading input. The importer owns
+ * normalization and post-EOF settlement; incomplete results are printed before command failure.
+ *
+ * @param args Parsed store/file choices and positive finite settlementTimeoutMs, default 5000 milliseconds.
+ * Input is buffered before parser ownership begins; fractions are floored with a one-millisecond minimum.
+ * @throws ValidationError for an invalid deadline or incomplete acceptance; intake and cleanup failures propagate.
+ */
+export function* vcImportCommand(args) {
+    const settlementTimeoutMs = parseNumberOption(args.settlementTimeoutMs, "--settlement-timeout-ms") ?? 5_000;
+    if (settlementTimeoutMs <= 0) {
+        throw new ValidationError("--settlement-timeout-ms must be finite and positive.");
+    }
+    const vcArgs = {
+        ...baseArgs(args),
+        inPath: parseStringOption(args.inPath, "inPath"),
+        settlementTimeoutMs,
+    };
+    yield* withVcRuntime(vcArgs, function* ({ runtime, reger }) {
+        const result = yield* importCredentialStream(runtime.protocol, reger, readBytes(vcArgs.inPath), runtime.clock, vcArgs.settlementTimeoutMs);
+        console.log(JSON.stringify(result));
+        if (!result.complete) {
+            throw new ValidationError("Credential import incomplete; inspect the unaccepted identities and stderr diagnostics.");
+        }
+    });
+}
+/**
+ * Implement `tufa vc revoke`, including optional revocation delivery/export.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export function* vcRevokeCommand(args) {
+    const timeout = publicationTimeout(args.timeout);
+    const vcArgs = {
+        ...baseArgs(args),
+        alias: parseStringOption(args.alias, "alias"),
+        registryName: parseStringOption(args.registryName, "registryName"),
+        said: parseStringOption(args.said, "said"),
+        recipient: parseStringOption(args.recipient, "recipient"),
+        out: parseStringOption(args.out, "out"),
+        send: asStringList(args.send, "send"),
+    };
+    requireNonEmpty(vcArgs.registryName, "Registry name");
+    requireNonEmpty(vcArgs.said, "Credential SAID");
+    return yield* withVcRuntime(vcArgs, function* ({ hby, runtime, reger, rgy }) {
+        const registry = rgy.registryByName(vcArgs.registryName);
+        if (!registry)
+            throw new ValidationError(`Registry ${vcArgs.registryName} not found.`);
+        if (vcArgs.alias && requireHab(hby, vcArgs.alias).pre !== registry.hab.pre) {
+            throw new ValidationError("Selected alias does not control this registry.");
+        }
+        if ((vcArgs.send?.length ?? 0) > 0 && !vcArgs.alias) {
+            throw new ValidationError("Alias is required when sending revocation events.");
+        }
+        const group = isLocalGroupHab(hby, registry.hab);
+        const signer = group ? localGroupMember(hby, registry.hab.pre) : registry.hab;
+        const result = yield* call(function* () {
+            const postman = runtime.postman;
+            const worker = yield* spawn(() => runAgentRuntime(runtime, { hab: signer, pollMailbox: group }));
+            try {
+                const deadline = Date.now() + timeout * 1000;
+                const revoked = yield* revokeCredential(rgy, runtime.reactor, postman, {
+                    registryName: vcArgs.registryName,
+                    credentialSaid: vcArgs.said,
+                });
+                revoked.publicationComplete = yield* waitForTelPublication(rgy.publication, revoked.said, 1, deadline);
+                revoked.accepted = reger.tels.getOn(revoked.said, 1)?.qb64 === revoked.tel;
+                if (revoked.accepted)
+                    revoked.status = "accept";
+                const recipients = revocationRecipients(revoked.creder, vcArgs.send ?? [], !!vcArgs.alias);
+                if (recipients.length > 0) {
+                    revoked.deliveries = yield* deliverCredentialRevocation(rgy, postman, revoked.said, recipients);
+                }
+                return revoked;
+            }
+            finally {
+                yield* worker.halt();
+            }
+        });
+        if (vcArgs.out && result.accepted && result.publicationComplete) {
+            const recipient = vcArgs.recipient ? resolveAid(hby, vcArgs.recipient) : result.creder.issuee ?? "";
+            writeBytes(credentialStreamBytes(hby, reger, result.creder, recipient), vcArgs.out);
+        }
+        return result;
+    });
+}
+function baseArgs(args) {
+    return {
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        compat: parseBooleanOption(args.compat, "compat"),
+    };
+}
+function registryArgs(args, { aliasRequired = true } = {}) {
+    const parsed = {
+        ...baseArgs(args),
+        alias: parseStringOption(args.alias, "alias"),
+        registryName: parseStringOption(args.registryName, "registryName"),
+        estOnly: parseBooleanOption(args.estOnly, "estOnly"),
+        usage: parseStringOption(args.usage, "usage"),
+    };
+    if (aliasRequired) {
+        requireNonEmpty(parsed.alias, "Alias");
+    }
+    requireNonEmpty(parsed.registryName, "Registry name");
+    return parsed;
+}
+function* withVcHabery(args, use) {
+    requireNonEmpty(args.name, "Name");
+    return yield* withExistingHabery(args, vcOpenOptions(args), use);
+}
+function* withVcRuntime(args, use) {
+    requireNonEmpty(args.name, "Name");
+    return yield* withAgentRuntime(args, vcOpenOptions(args), function* ({ hby, runtime }) {
+        const rgy = runtime.vdr;
+        if (!rgy)
+            throw new ValidationError("Legacy credential registry is unavailable in this runtime.");
+        const reger = rgy.reger;
+        return yield* use({ hby, runtime, reger, rgy });
+    });
+}
+function vcOpenOptions(args) {
+    return {
+        compat: args.compat ?? false,
+        skipConfig: true,
+    };
+}
+function requireHab(hby, alias) {
+    requireNonEmpty(alias, "Alias");
+    const hab = hby.habByName(alias);
+    if (!hab?.pre) {
+        throw new ValidationError(`No local AID found for alias ${alias}.`);
+    }
+    return hab;
+}
+function resolveAid(hby, value) {
+    const local = hby.habByName(value);
+    if (local?.pre) {
+        return local.pre;
+    }
+    return value;
+}
+function parseJsonArg(value) {
+    if (!value) {
+        return undefined;
+    }
+    const text = value.startsWith("@") ? dntShim.Deno.readTextFileSync(value.slice(1)) : value;
+    return JSON.parse(text);
+}
+function parseSubjectDataArg(value) {
+    const parsed = parseJsonArg(value);
+    if (parsed === undefined) {
+        return undefined;
+    }
+    if (isRecord(parsed) || typeof parsed === "string") {
+        return parsed;
+    }
+    throw new ValidationError("data must be a JSON object or string.");
+}
+function parseJsonSectionArg(value, label) {
+    const parsed = parseJsonArg(value);
+    if (parsed === undefined) {
+        return undefined;
+    }
+    if (isRecord(parsed)) {
+        return parsed;
+    }
+    if (Array.isArray(parsed) && parsed.every(isRecord)) {
+        return parsed;
+    }
+    throw new ValidationError(`${label} must be a JSON object or array of objects.`);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readBytes(path) {
+    if (path) {
+        return dntShim.Deno.readFileSync(path);
+    }
+    const chunks = [];
+    const buffer = new Uint8Array(64 * 1024);
+    while (true) {
+        const read = dntShim.Deno.stdin.readSync(buffer);
+        if (read === null) {
+            break;
+        }
+        chunks.push(buffer.slice(0, read));
+    }
+    return chunks.length === 0 ? new Uint8Array() : concatBytes(...chunks);
+}
+function writeBytes(bytes, path) {
+    if (path) {
+        dntShim.Deno.writeFileSync(path, bytes);
+        return;
+    }
+    dntShim.Deno.stdout.writeSync(bytes);
+}
+/** Accept the command's scalar/list forms without dropping malformed members. */
+function asStringList(value, label) {
+    if (typeof value === "string")
+        return [value];
+    return parseStringListOption(value, label) ?? [];
+}
+function requireNonEmpty(value, label) {
+    if (!value) {
+        throw new ValidationError(`${label} is required and cannot be empty.`);
+    }
+}
+/** Publication waits accept explicit zero/fractions and reject malformed or overflowing values before opening storage. */
+function publicationTimeout(value) {
+    const seconds = parseNumberOption(value, "timeout") ?? 60;
+    if (seconds < 0 || !Number.isFinite(seconds * 1000)) {
+        throw new ValidationError("timeout must be a finite nonnegative duration.");
+    }
+    return seconds;
+}

package/esm/keri/npm/src/{app/cli → cli/endpoints}/did.js

@@ -2,30 +2,36 @@
  * DID-related CLI operations shared by the Tufa command dispatcher.
  */
 import * as dntShim from "../../_dnt.shims.js";
+import { isLocalGroupHab } from "../../app/multisig/group-members.js";
+import { runAgentRuntimeUntil, runtimeOobiConverged } from "../../app/runtime/agent-runtime.js";
+import { WitnessReceiptor } from "../../app/witness/receipting.js";
 import { ValidationError } from "../../core/errors.js";
 import { bindDesignatedAliases, DEFAULT_DESIGNATED_ALIASES_REGISTRY_NAME, generateDidWebsArtifacts, parseDidKeriIdentifier, parseDidWebs, resolveDidKeri, resolveDidWebs, } from "../../did/index.js";
-import { runAgentRuntimeUntil, runtimeOobiConverged } from "../agent-runtime.js";
-import { requireRegery } from "../credential-workflows.js";
-import { WitnessReceiptor } from "../witnessing.js";
-import { withAgentRuntime } from "./common/context.js";
-import { requireNonEmpty } from "./common/parsing.js";
+import { withAgentRuntime } from "../common/context.js";
+import { parseBooleanOption, parseStringListOption, parseStringOption, requireNonEmpty } from "../common/parsing.js";
 /** Implement `tufa dws bind`. */
 export function* dwsBindCommand(args) {
     const commandArgs = {
         ...baseArgs(args),
-        alias: args.alias,
-        dids: asStringList(args.did),
-        registryName: args.registryName,
-        createRegistry: args.createRegistry,
-        allowExternalDid: args.allowExternalDid,
+        alias: parseStringOption(args.alias, "alias"),
+        dids: asStringList(args.did, "did"),
+        registryName: parseStringOption(args.registryName, "registryName"),
+        createRegistry: parseBooleanOption(args.createRegistry, "createRegistry"),
+        allowExternalDid: parseBooleanOption(args.allowExternalDid, "allowExternalDid"),
     };
     requireNonEmpty(commandArgs.name, "Name");
     requireNonEmpty(commandArgs.alias, "Alias");
     const alias = commandArgs.alias;
     yield* withAgentRuntime(commandArgs, runtimeOpenOptions(commandArgs), function* ({ hby, runtime }) {
+        const rgy = runtime.vdr;
+        if (!rgy)
+            throw new ValidationError("Legacy credential registry is unavailable in this runtime.");
         const hab = hby.habByName(alias);
+        if (hab && isLocalGroupHab(hby, hab)) {
+            throw new ValidationError("DID binding does not coordinate group credential approval. Use a single-controller alias.");
+        }
         const priorSn = hab?.kever?.sn ?? 0;
-        const result = bindDesignatedAliases(runtime, {
+        const result = bindDesignatedAliases(rgy, {
             alias,
             dids: commandArgs.dids,
             registryName: commandArgs.registryName ?? DEFAULT_DESIGNATED_ALIASES_REGISTRY_NAME,
@@ -42,10 +48,10 @@ export function* dwsBindCommand(args) {
 export function* dwsGenerateCommand(args) {
     const commandArgs = {
         ...baseArgs(args),
-        alias: args.alias,
-        did: args.did,
-        outputDir: args.outputDir,
-        meta: args.meta,
+        alias: parseStringOption(args.alias, "alias"),
+        did: parseStringOption(args.did, "did"),
+        outputDir: parseStringOption(args.outputDir, "outputDir"),
+        meta: parseBooleanOption(args.meta, "meta"),
     };
     requireNonEmpty(commandArgs.name, "Name");
     requireNonEmpty(commandArgs.alias, "Alias");
@@ -55,7 +61,10 @@ export function* dwsGenerateCommand(args) {
     const did = commandArgs.did;
     const outputDir = commandArgs.outputDir;
     yield* withAgentRuntime(commandArgs, runtimeOpenOptions(commandArgs), function* ({ runtime }) {
-        const artifacts = generateDidWebsArtifacts(runtime, {
+        const rgy = runtime.vdr;
+        if (!rgy)
+            throw new ValidationError("Legacy credential registry is unavailable in this runtime.");
+        const artifacts = generateDidWebsArtifacts(rgy, {
             alias,
             did,
             metadata: commandArgs.meta ?? false,
@@ -73,19 +82,26 @@ export function* dwsGenerateCommand(args) {
         }));
     });
 }
-/** Implement `tufa dws resolve`. */
+/**
+ * Implement `tufa dws resolve`.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
 export function* dwsResolveCommand(args) {
     const commandArgs = {
         ...baseArgs(args),
-        did: args.did,
-        meta: args.meta,
-        insecureHttp: args.insecureHttp,
+        did: parseStringOption(args.did, "did"),
+        meta: parseBooleanOption(args.meta, "meta"),
+        insecureHttp: parseBooleanOption(args.insecureHttp, "insecureHttp"),
     };
     requireNonEmpty(commandArgs.name, "Name");
     requireNonEmpty(commandArgs.did, "DID");
     const did = commandArgs.did;
     yield* withAgentRuntime(commandArgs, runtimeOpenOptions(commandArgs), function* ({ runtime }) {
-        const result = yield* resolveDidWebs(runtime, {
+        const rgy = runtime.vdr;
+        if (!rgy)
+            throw new ValidationError("Legacy credential registry is unavailable in this runtime.");
+        const result = yield* resolveDidWebs(rgy, runtime.reactor, runtime.http, {
             did,
             metadata: commandArgs.meta ?? false,
             insecureHttp: commandArgs.insecureHttp ?? false,
@@ -97,30 +113,33 @@ export function* dwsResolveCommand(args) {
 export function* dkrResolveCommand(args) {
     const commandArgs = {
         ...baseArgs(args),
-        did: args.did,
-        oobis: asStringList(args.oobi),
-        meta: args.meta,
+        did: parseStringOption(args.did, "did"),
+        oobis: asStringList(args.oobi, "oobi"),
+        meta: parseBooleanOption(args.meta, "meta"),
     };
     requireNonEmpty(commandArgs.name, "Name");
     requireNonEmpty(commandArgs.did, "DID");
     const did = parseDidKeriIdentifier(commandArgs.did).canonical;
     yield* withAgentRuntime(commandArgs, runtimeOpenOptions(commandArgs), function* ({ hby, runtime }) {
+        const rgy = runtime.vdr;
+        if (!rgy)
+            throw new ValidationError("Legacy credential registry is unavailable in this runtime.");
         for (const oobi of commandArgs.oobis)
             runtime.oobiery.resolve(oobi);
         if (commandArgs.oobis.length > 0) {
             yield* runAgentRuntimeUntil(runtime, () => commandArgs.oobis.every((url) => runtimeOobiConverged(runtime, url)), { timeoutMs: 30_000, pollMailbox: false });
         }
-        const result = resolveDidKeri(hby, requireRegery(runtime), did);
+        const result = resolveDidKeri(hby, rgy, did);
         console.log(JSON.stringify(commandArgs.meta ? result.resolution : result.document, null, 2));
     });
 }
 function baseArgs(args) {
     return {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        compat: args.compat,
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        compat: parseBooleanOption(args.compat, "compat"),
     };
 }
 function runtimeOpenOptions(args) {
@@ -129,22 +148,30 @@ function runtimeOpenOptions(args) {
         skipConfig: true,
     };
 }
+/**
+ * Submit newly created witnessed events in sequence through the composed receipt owner.
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param pre Local AID whose new accepted events need receipts.
+ * @param priorSn Sequence before the operation; only later events are submitted.
+ * @param runtime Borrowed composed runtime; caller owns its worker and store lifetime.
+ */
 function* receiptNewWitnessEvents(hby, pre, priorSn, runtime) {
     const hab = hby.habs.get(pre);
     const latestSn = hab?.kever?.sn;
     if (!hab?.kever || latestSn === undefined || latestSn <= priorSn || hab.kever.wits.length === 0) {
         return;
     }
-    const receiptor = new WitnessReceiptor(hby, { reactor: runtime.reactor, services: runtime.services });
+    const receiptor = new WitnessReceiptor(hby, runtime.protocol, runtime.http, runtime.clock);
     for (let sn = priorSn + 1; sn <= latestSn; sn += 1) {
         yield* receiptor.submit(pre, { sn });
     }
 }
-function asStringList(value) {
-    if (Array.isArray(value)) {
-        return value.filter((item) => typeof item === "string");
-    }
-    return typeof value === "string" ? [value] : [];
+/** Accept a scalar occurrence or the complete repeated-option list without dropping invalid entries. */
+function asStringList(value, flag) {
+    if (typeof value === "string")
+        return [value];
+    return parseStringListOption(value, flag) ?? [];
 }
 function artifactOutputDir(root, didPath, aid) {
     const normalizedRoot = root.replace(/\/+$/u, "");