keri-ts 1.0.0 → 2.0.0

package/esm/keri/npm/src/{app/cli → cli/identity}/delegate.js

@@ -12,16 +12,19 @@
  *   and the delegator's own KEL state
  */
 import { Diger } from "cesr-ts";
-import { spawn } from "effection";
+import { call, race, sleep, spawn } from "effection";
+import { runAgentRuntime } from "../../app/runtime/agent-runtime.js";
 import { ValidationError } from "../../core/errors.js";
 import { dgKey } from "../../db/core/keys.js";
-import { runAgentRuntime } from "../agent-runtime.js";
-import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../endpoint-roleing.js";
-import { MULTISIG_IXN_ROUTE } from "../grouping.js";
-import { runtimeTurn } from "../runtime-turn.js";
-import { WitnessReceiptor } from "../witnessing.js";
-import { withHabAndAgentRuntime } from "./common/context.js";
-import { resolveWitnessAuths } from "./common/witness-auth.js";
+import { parseBooleanOption, parseStringListOption, parseStringOption } from "../common/parsing.js";
+import { createExchangeMessage } from "../../app/exchanges/exchange-messaging.js";
+import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "../../app/identity/endpoint-roleing.js";
+import { MULTISIG_IXN_ROUTE } from "../../app/multisig/grouping.js";
+import { SeqNoQuerier } from "../../app/queries/querying.js";
+import { runtimeTurn } from "../../app/runtime/runtime-turn.js";
+import { WitnessReceiptor } from "../../app/witness/receipting.js";
+import { withHabAndAgentRuntime } from "../common/context.js";
+import { resolveWitnessAuths } from "../common/witness-auth.js";
 /** Return pending delegated events for one local delegator, oldest first. */
 function pendingDelegations(hby, delegatorPre) {
     const pending = [];
@@ -96,6 +99,15 @@ function delegateWitnessLogsQuery(hab, serder, witness) {
         wits: [witness],
     };
 }
+/**
+ * Publish group delegation approval to remote signing members before advancing the workflow.
+ *
+ * @param runtime Borrowed composed runtime; caller owns its worker and store lifetime.
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param groupHab Group approving habitat.
+ * @param message Signed approving interaction to embed for remote members.
+ * @returns Successful delivery URLs after each concrete Poster outcome.
+ */
 function* publishGroupDelegationApproval(runtime, hby, groupHab, message) {
     const member = localGroupMember(hby, groupHab.pre);
     const smids = groupSigningMembers(hby, groupHab.pre);
@@ -104,13 +116,17 @@ function* publishGroupDelegationApproval(runtime, hby, groupHab, message) {
         if (recipient === member.pre || hby.habs.has(recipient)) {
             continue;
         }
-        const result = yield* runtime.poster.sendExchange(member, {
-            recipient,
+        const { msg } = createExchangeMessage(member, {
+            dest: recipient,
             route: MULTISIG_IXN_ROUTE,
             payload: { gid: groupHab.pre, smids },
             embeds: { ixn: message },
-            topic: "multisig",
         });
+        const postman = runtime.postman;
+        const evt = postman.send({ src: member.pre, dest: recipient, topic: "multisig", msg }, { notify: true });
+        const result = yield* postman.wait(evt);
+        if (result.kin === "failed")
+            throw result.error;
         deliveries.push(...result.deliveries);
     }
     return deliveries;
@@ -138,7 +154,14 @@ function* waitForDelegation(done, timeoutMs) {
         yield* runtimeTurn();
     }
 }
-/** Approve pending events without starting or serially driving background workers. */
+/**
+ * Approve pending events without starting or serially driving background workers.
+ *
+ * @param hby Borrowed local identities and accepted-state stores.
+ * @param hab Approving local habitat.
+ * @param runtime Borrowed composed runtime; caller owns its worker and store lifetime.
+ * @param confirmArgs Command approval choices/callback inputs.
+ */
 function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
     const interactionApproval = confirmArgs.interact ?? false;
     yield* waitForDelegation(() => pendingDelegations(hby, hab.pre).length > 0, 15_000);
@@ -203,7 +226,7 @@ function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
             hab.rotate({ data: [anchor] });
         }
         if (hab.kever?.wits.length) {
-            const witDoer = new WitnessReceiptor(hby, { reactor: runtime.reactor, services: runtime.services });
+            const witDoer = new WitnessReceiptor(hby, runtime.protocol, runtime.http, runtime.clock);
             yield* witDoer.submit(hab.pre, {
                 sn: hab.kever.sn,
                 auths,
@@ -223,12 +246,24 @@ function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
             yield* waitForDelegation(() => delegateCommitted(hby, serder), 30_000);
         }
         else {
-            const querier = runtime.querying.watchSeqNo(serder.pre, serder.sn ?? 0, { signer: hab.pre });
             // No delegate witness exists to query. Process the local delegable
             // after the delegator has anchored approval; the delegate still
             // discovers approval through its own delegator-KEL query path.
             pinApprovalSeal(hby, hab, serder, approving);
-            yield* waitForDelegation(() => querier.done, 30_000);
+            const observed = yield* race([
+                call(function* () {
+                    yield* new SeqNoQuerier(hby.db, runtime.querying, serder.pre, serder.sn ?? 0, {
+                        signer: hab.pre,
+                    }).queryDo();
+                    return true;
+                }),
+                call(function* () {
+                    yield* sleep(30_000);
+                    return false;
+                }),
+            ]);
+            if (!observed)
+                throw new Error("Runtime did not converge within 30000ms.");
         }
         // Match KERIpy sequencing: only record the approving seal and retry
         // delegated unescrow after the delegate event has been observed as
@@ -248,17 +283,17 @@ function* performDelegationApproval(hby, hab, runtime, confirmArgs) {
 /** Approve pending delegated events for the selected local delegator habitat. */
 export function* delegateConfirmCommand(args) {
     const confirmArgs = {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        alias: args.alias,
-        compat: args.compat,
-        interact: args.interact,
-        auto: args.auto,
-        authenticate: args.authenticate,
-        code: args.code,
-        codeTime: args.codeTime,
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        alias: parseStringOption(args.alias, "alias"),
+        compat: parseBooleanOption(args.compat, "compat"),
+        interact: parseBooleanOption(args.interact, "interact"),
+        auto: parseBooleanOption(args.auto, "auto"),
+        authenticate: parseBooleanOption(args.authenticate, "authenticate"),
+        code: parseStringListOption(args.code, "code"),
+        codeTime: parseStringOption(args.codeTime, "codeTime"),
     };
     if (!confirmArgs.name) {
         throw new ValidationError("Name is required and cannot be empty");

package/esm/keri/npm/src/{app/cli → cli/identity}/export.js

@@ -1,6 +1,7 @@
 import { ValidationError } from "../../core/errors.js";
 import { dgKey } from "../../db/core/keys.js";
-import { withExistingHab } from "./common/context.js";
+import { withExistingHab } from "../common/context.js";
+import { parseBooleanOption, parseStringOption } from "../common/parsing.js";
 /**
  * Implements `tufa export`.
  *
@@ -8,13 +9,13 @@ import { withExistingHab } from "./common/context.js";
  */
 export function* exportCommand(args) {
     const exportArgs = {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        alias: args.alias,
-        files: args.files,
-        ends: args.ends,
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        alias: parseStringOption(args.alias, "alias"),
+        files: parseBooleanOption(args.files, "files"),
+        ends: parseBooleanOption(args.ends, "ends"),
     };
     if (!exportArgs.name) {
         throw new ValidationError("Name is required and cannot be empty");

package/esm/keri/npm/src/cli/identity/incept.js

@@ -0,0 +1,181 @@
+import { call } from "effection";
+import { resolveBootstrap } from "../../app/bootstrap/bootstrapping.js";
+import { createProtocolProcessor } from "../../app/protocol/protocol-processing.js";
+import { createAgentRuntime, runAgentRuntimeUntil, } from "../../app/runtime/agent-runtime.js";
+import { systemClock } from "../../app/runtime/runtime-clock.js";
+import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { ValidationError } from "../../core/errors.js";
+import { assertBootstrapComplete } from "../common/bootstrap.js";
+import { createConfiger } from "../../app/identity/configing.js";
+import { resolveDelegationCommunicationHab } from "../../app/identity/delegating.js";
+import { Receiptor, WitnessReceiptor } from "../../app/witness/receipting.js";
+import { setupHby } from "../common/existing.js";
+import { loadInceptFileOptions, parseBooleanOption, parseCountOption, parseDataItems, parseKeriVersionOption, parseStringListOption, parseStringOption, parseThresholdOption, } from "../common/parsing.js";
+/**
+ * Loads incept options from a file and overlays explicit CLI values.
+ */
+function mergeWithFile(args) {
+    let opts = {};
+    if (args.file && args.file !== "") {
+        opts = loadInceptFileOptions(args.file);
+    }
+    if (args.transferable !== undefined)
+        opts.transferable = args.transferable;
+    if (args.wits !== undefined)
+        opts.wits = args.wits;
+    if (args.icount !== undefined)
+        opts.icount = args.icount;
+    if (args.isith !== undefined)
+        opts.isith = args.isith;
+    if (args.ncount !== undefined)
+        opts.ncount = args.ncount;
+    if (args.nsith !== undefined)
+        opts.nsith = args.nsith;
+    if (args.toad !== undefined)
+        opts.toad = args.toad;
+    if (args.estOnly !== undefined)
+        opts.estOnly = args.estOnly;
+    if (args.delpre !== undefined)
+        opts.delpre = args.delpre;
+    if (args.data !== undefined)
+        opts.data = parseDataItems(args.data);
+    return opts;
+}
+/**
+ * Implements `tufa incept`.
+ *
+ * Creates a single-sig identifier locally.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export function* inceptCommand(args) {
+    // Select one HTTP implementation for all work owned by this command.
+    const http = new FetchHttpClient();
+    const inceptArgs = {
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        temp: parseBooleanOption(args.temp, "temp"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        alias: parseStringOption(args.alias, "alias"),
+        configDir: parseStringOption(args.configDir, "configDir"),
+        configFile: parseStringOption(args.configFile, "configFile"),
+        endpoint: parseBooleanOption(args.endpoint, "endpoint"),
+        proxy: parseStringOption(args.proxy, "proxy"),
+        file: parseStringOption(args.file, "file"),
+        transferable: parseBooleanOption(args.transferable, "transferable"),
+        wits: parseStringListOption(args.wits, "wits"),
+        toad: parseCountOption(args.toad, "toad"),
+        icount: parseCountOption(args.icount, "icount"),
+        isith: parseThresholdOption(args.isith),
+        ncount: parseCountOption(args.ncount, "ncount"),
+        nsith: parseThresholdOption(args.nsith),
+        estOnly: parseBooleanOption(args.estOnly, "estOnly"),
+        data: parseStringListOption(args.data, "data"),
+        delpre: parseStringOption(args.delpre, "delpre"),
+        version: parseKeriVersionOption(args.version),
+    };
+    if (!inceptArgs.name) {
+        throw new ValidationError("Name is required and cannot be empty");
+    }
+    if (!inceptArgs.alias) {
+        throw new ValidationError("Alias is required and cannot be empty");
+    }
+    const opts = mergeWithFile(inceptArgs);
+    if (opts.icount === 0)
+        throw new ValidationError("icount must be positive");
+    // A command-local scope owns acquisition and teardown; there is no independent child consumer.
+    const result = yield* call(function* () {
+        const cf = inceptArgs.configFile
+            ? (yield* createConfiger({
+                name: inceptArgs.configFile,
+                base: "",
+                temp: false,
+                headDirPath: inceptArgs.configDir,
+                reopen: true,
+                clear: false,
+            }))
+            : undefined;
+        const hby = yield* setupHby(inceptArgs.name, inceptArgs.base ?? "", inceptArgs.passcode, inceptArgs.temp ?? false, inceptArgs.headDirPath, {
+            readonly: false,
+            cf,
+            skipConfig: !cf,
+            skipSignator: true,
+        });
+        let failure;
+        try {
+            if (hby.habByName(inceptArgs.alias)) {
+                throw new ValidationError(`Alias ${inceptArgs.alias} already exists; inception requires an unused alias.`);
+            }
+            assertBootstrapComplete(yield* resolveBootstrap(hby, http));
+            const hab = hby.makeHab(inceptArgs.alias, undefined, {
+                transferable: opts.transferable ?? false,
+                wits: opts.wits ?? [],
+                toad: opts.toad ?? 0,
+                icount: opts.icount ?? 1,
+                isith: opts.isith,
+                ncount: opts.ncount ?? 1,
+                nsith: opts.nsith,
+                estOnly: opts.estOnly ?? false,
+                data: opts.data ?? [],
+                delpre: opts.delpre,
+                version: inceptArgs.version,
+            });
+            if (hab.kever?.wits.length) {
+                if (inceptArgs.endpoint) {
+                    const receiptor = new Receiptor(hby, createProtocolProcessor(hby), http, systemClock);
+                    yield* receiptor.receipt(hab.pre, { sn: 0 });
+                }
+                else {
+                    const witDoer = new WitnessReceiptor(hby, createProtocolProcessor(hby), http, systemClock);
+                    yield* witDoer.submit(hab.pre, { sn: 0 });
+                }
+            }
+            let delegationPhase = null;
+            if (opts.delpre) {
+                const communicationHab = resolveDelegationCommunicationHab(hby, inceptArgs.proxy);
+                if (!communicationHab) {
+                    throw new ValidationError(`Delegated inception for ${hab.pre} requires --proxy <alias>.`);
+                }
+                const runtime = yield* createAgentRuntime(hby, http, systemClock);
+                try {
+                    runtime.delegating.beginLatest(hab.pre, 0, {
+                        communicationHab,
+                    });
+                    yield* runAgentRuntimeUntil(runtime, () => runtime.delegating.complete(hab.pre, 0), { hab, timeoutMs: 120_000, pollMailbox: true });
+                    delegationPhase = runtime.delegating.workflowStatus(hab.pre, "0").phase;
+                }
+                finally {
+                    yield* runtime.close();
+                }
+            }
+            const state = hby.db.getState(hab.pre);
+            return { prefix: hab.pre, keys: state?.k ?? [], delegationPhase };
+        }
+        catch (error) {
+            failure = { error };
+            throw error;
+        }
+        finally {
+            try {
+                yield* hby.close();
+            }
+            catch (error) {
+                if (failure) {
+                    // deno-lint-ignore no-unsafe-finally -- Preserve inception and shutdown failures.
+                    throw new AggregateError([failure.error, error], "Inception and database close failed", {
+                        cause: failure.error,
+                    });
+                }
+                // deno-lint-ignore no-unsafe-finally -- Final success requires resource closure.
+                throw error;
+            }
+        }
+    });
+    console.log(`Prefix  ${result.prefix}`);
+    for (const [idx, key] of result.keys.entries())
+        console.log(`\tPublic key ${idx + 1}:  ${key}`);
+    if (result.delegationPhase)
+        console.log(`Delegation status  ${result.delegationPhase}`);
+    console.log("");
+}

package/esm/keri/npm/src/cli/identity/init.js

@@ -0,0 +1,153 @@
+import { Encrypter } from "cesr-ts";
+import { resolveBootstrap } from "../../app/bootstrap/bootstrapping.js";
+import { createConfiger } from "../../app/identity/configing.js";
+import { branToSeedAeid, createHabery } from "../../app/identity/habbing.js";
+import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { ValidationError } from "../../core/errors.js";
+import { assertBootstrapComplete } from "../common/bootstrap.js";
+import { parseBooleanOption, parseStringOption } from "../common/parsing.js";
+import { readPasscode } from "../common/passcode.js";
+/**
+ * Implements `tufa init`.
+ *
+ * Creates/open a habery keystore and database.
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export function* initCommand(args) {
+    // Extract values from args
+    const initArgs = {
+        name: parseStringOption(args.name, "--name"),
+        base: parseStringOption(args.base, "--base"),
+        headDirPath: parseStringOption(args.headDirPath, "--head-dir"),
+        temp: parseBooleanOption(args.temp, "--temp") ?? false,
+        salt: parseStringOption(args.salt, "--salt"),
+        configDir: parseStringOption(args.configDir, "--config-dir"),
+        configFile: parseStringOption(args.configFile, "--config-file"),
+        passcode: parseStringOption(args.passcode, "--passcode"),
+        nopasscode: parseBooleanOption(args.nopasscode, "--nopasscode") ?? false,
+        aeid: parseStringOption(args.aeid, "--aeid"),
+        seed: parseStringOption(args.seed, "--seed"),
+    };
+    const name = initArgs.name;
+    if (!name || name.trim().length === 0) {
+        throw new ValidationError("Name is required and cannot be empty");
+    }
+    let credentials = resolveCredentials(initArgs);
+    if (credentials.kind === "prompt") {
+        const passcode = yield* readPasscode("Passcode:");
+        requirePasscode(passcode);
+        const retry = yield* readPasscode("Re-enter passcode:");
+        requirePasscode(retry);
+        if (passcode !== retry)
+            throw new ValidationError("Passcodes do not match");
+        credentials = passcodeCredentials(passcode);
+    }
+    const cf = initArgs.configFile
+        ? (yield* createConfiger({
+            name: initArgs.configFile,
+            base: "",
+            temp: false,
+            headDirPath: initArgs.configDir,
+            reopen: true,
+            clear: false,
+        }))
+        : undefined;
+    let hby;
+    let created;
+    let failure;
+    try {
+        let seed;
+        let aeid;
+        if (credentials.kind === "encrypted") {
+            seed = credentials.seed;
+            aeid = credentials.aeid;
+        }
+        hby = yield* createHabery({
+            name,
+            base: initArgs.base ?? "",
+            headDirPath: initArgs.headDirPath,
+            temp: initArgs.temp ?? false,
+            cf,
+            skipConfig: !cf,
+            skipSignator: true,
+            aeid,
+            seed,
+            salt: initArgs.salt,
+        });
+        assertBootstrapComplete(yield* resolveBootstrap(hby, new FetchHttpClient()));
+        created = { keystore: hby.ks.path, database: hby.db.path, aeid: hby.mgr.aeid };
+    }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
+    finally {
+        try {
+            if (hby)
+                yield* hby.close();
+            else if (cf)
+                yield* cf.close();
+        }
+        catch (error) {
+            if (failure) {
+                // deno-lint-ignore no-unsafe-finally -- Preserve initialization and shutdown failures.
+                throw new AggregateError([failure.error, error], "Initialization and database close failed", {
+                    cause: failure.error,
+                });
+            }
+            // deno-lint-ignore no-unsafe-finally -- Final success requires resource closure.
+            throw error;
+        }
+    }
+    console.log("KERI Keystore created at:", created.keystore);
+    console.log("KERI Database created at:", created.database);
+    if (created.aeid)
+        console.log("\taeid:", created.aeid);
+}
+/** Refuse empty secrets without changing passcode normalization or derivation. */
+function requirePasscode(passcode) {
+    if (passcode.trim().length === 0)
+        throw new ValidationError("Passcode cannot be empty");
+    if (passcode.length < 21)
+        throw new ValidationError("Passcode must contain at least 21 characters");
+}
+/** Derive once through the same primitive path used for encrypted Habery reopen. */
+function passcodeCredentials(passcode) {
+    requirePasscode(passcode);
+    return { kind: "encrypted", ...branToSeedAeid(passcode) };
+}
+/** Validate one explicit encryption method, including a matching AEID/seed pair. */
+function resolveCredentials(args) {
+    const passcodeProvided = args.passcode !== undefined;
+    const aeidProvided = args.aeid !== undefined;
+    const seedProvided = args.seed !== undefined;
+    if (args.nopasscode) {
+        if (passcodeProvided || aeidProvided || seedProvided) {
+            throw new ValidationError("--nopasscode cannot be combined with --passcode, --aeid or --seed");
+        }
+        return { kind: "plaintext" };
+    }
+    if (passcodeProvided) {
+        if (aeidProvided || seedProvided) {
+            throw new ValidationError("Choose either --passcode or --aeid with --seed");
+        }
+        return passcodeCredentials(args.passcode);
+    }
+    if (aeidProvided || seedProvided) {
+        if (!args.aeid || !args.seed)
+            throw new ValidationError("--aeid and --seed must be supplied together");
+        try {
+            if (!new Encrypter({ verkey: args.aeid }).verifySeed(args.seed)) {
+                throw new ValidationError("Seed is not associated with the supplied AEID");
+            }
+        }
+        catch (cause) {
+            if (cause instanceof ValidationError)
+                throw cause;
+            throw new ValidationError("Invalid AEID/seed credentials", { cause });
+        }
+        return { kind: "encrypted", aeid: args.aeid, seed: args.seed };
+    }
+    return { kind: "prompt" };
+}

package/esm/keri/npm/src/cli/identity/interact.js

@@ -0,0 +1,84 @@
+import { createProtocolProcessor } from "../../app/protocol/protocol-processing.js";
+import { systemClock } from "../../app/runtime/runtime-clock.js";
+import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { isLocalGroupHab } from "../../app/multisig/group-members.js";
+import { Receiptor, WitnessReceiptor } from "../../app/witness/receipting.js";
+import { ValidationError } from "../../core/errors.js";
+import { withExistingHab } from "../common/context.js";
+import { parseBooleanOption, parseDataItems, parseKeriVersionOption, parseStringListOption, parseStringOption, } from "../common/parsing.js";
+import { resolveWitnessAuths } from "../common/witness-auth.js";
+/**
+ * Create one local interaction event and optionally converge witness receipts.
+ *
+ * Maintainer boundary:
+ * - CLI concerns stop at argument parsing, witness-auth capture, and success
+ *   output
+ * - interaction event authoring and local acceptance live in `Hab.interact(...)`
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ */
+export function* interactCommand(args) {
+    // Select one HTTP implementation for all work owned by this command.
+    const http = new FetchHttpClient();
+    const interactArgs = {
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        alias: parseStringOption(args.alias, "alias"),
+        compat: parseBooleanOption(args.compat, "compat"),
+        endpoint: parseBooleanOption(args.endpoint, "endpoint"),
+        authenticate: parseBooleanOption(args.authenticate, "authenticate"),
+        code: parseStringListOption(args.code, "code"),
+        codeTime: parseStringOption(args.codeTime, "codeTime"),
+        data: parseStringListOption(args.data, "data"),
+        version: parseKeriVersionOption(args.version),
+    };
+    if (!interactArgs.name) {
+        throw new ValidationError("Name is required and cannot be empty");
+    }
+    if (!interactArgs.alias) {
+        throw new ValidationError("Alias is required and cannot be empty");
+    }
+    const data = parseDataItems(interactArgs.data);
+    yield* withExistingHab(interactArgs, interactArgs.alias, {
+        compat: interactArgs.compat ?? false,
+        readonly: false,
+        skipConfig: true,
+        skipSignator: true,
+    }, function* ({ hby, hab }) {
+        if (isLocalGroupHab(hby, hab)) {
+            throw new ValidationError("Group aliases require tufa multisig interact so member approval and fanout are coordinated.");
+        }
+        if (!hab.kever) {
+            throw new ValidationError(`Missing accepted key state for ${hab.pre}.`);
+        }
+        hab.interact({ data, version: interactArgs.version });
+        if (hab.kever?.wits.length) {
+            const auths = resolveWitnessAuths(hab.kever.wits, interactArgs.code ?? [], {
+                codeTime: interactArgs.codeTime,
+                promptMissing: interactArgs.authenticate ?? false,
+            });
+            if (interactArgs.endpoint) {
+                const receiptor = new Receiptor(hby, createProtocolProcessor(hby), http, systemClock);
+                yield* receiptor.receipt(hab.pre, {
+                    sn: hab.kever.sn,
+                    auths,
+                });
+            }
+            else {
+                const witDoer = new WitnessReceiptor(hby, createProtocolProcessor(hby), http, systemClock);
+                yield* witDoer.submit(hab.pre, {
+                    sn: hab.kever.sn,
+                    auths,
+                });
+            }
+        }
+        const state = hby.db.getState(hab.pre);
+        console.log(`Prefix  ${hab.pre}`);
+        console.log(`New Sequence No.  ${hab.kever?.sn ?? state?.s ?? ""}`);
+        for (const [idx, key] of (state?.k ?? []).entries()) {
+            console.log(`\tPublic key ${idx + 1}:  ${key}`);
+        }
+    });
+}

package/esm/keri/npm/src/{app/cli → cli/identity}/list.js

@@ -1,13 +1,14 @@
 import { ValidationError } from "../../core/errors.js";
-import { withExistingHabery } from "./common/context.js";
+import { withExistingHabery } from "../common/context.js";
+import { parseBooleanOption, parseStringOption } from "../common/parsing.js";
 /** Implements `tufa list`. */
 export function* listCommand(args) {
     const listArgs = {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        compat: args.compat,
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        compat: parseBooleanOption(args.compat, "compat"),
     };
     if (!listArgs.name) {
         throw new ValidationError("Name is required and cannot be empty");