keri-ts 1.0.0 → 2.0.0

package/esm/keri/npm/src/app/multisig-workflows.js

@@ -1,457 +0,0 @@
-/**
- * Multisig proposal and approval workflows.
- *
- * CLI orchestration owns timed waits, worker lifetimes, prompts and output.
- * This module publishes proposals and approves stored KEL/RPY/VDR proposals
- * without starting or driving background workers.
- */
-import { concatBytes, Counter, Diger, Ilks, NumberPrimitive, NumDex, Prefixer, Saider, Seqner, SerderACDC, SerderKERI, TraitDex, } from "cesr-ts";
-import { ValidationError } from "../core/errors.js";
-import { exchange } from "../core/protocol-exchanging.js";
-import { messagize } from "../core/protocol-serialization.js";
-import { RegistryRecord } from "../core/records.js";
-import { Credentialer, Registry, serializeCredential } from "../vdr/credentialing.js";
-import { requireRegery } from "./credential-workflows.js";
-import { endpointRoleAccepted, groupEndorseReply, groupEventKeys, groupSigningMembers, localGroupMember, signLocalGroupEvent, } from "./endpoint-roleing.js";
-import { findLocalGroupMember as findLocalMember, uniqueMembers } from "./group-members.js";
-import { MULTISIG_ICP_ROUTE, MULTISIG_ISS_ROUTE, MULTISIG_IXN_ROUTE, MULTISIG_ROT_ROUTE, MULTISIG_RPY_ROUTE, MULTISIG_VCP_ROUTE, multisigChild, multisigChildGenusAttrs, prepareMultisigEventExn, } from "./grouping.js";
-const MULTISIG_TOPIC = "multisig";
-/** Publish a route-correlated event proposal; grouping owns child identity and label derivation. */
-export function* publishProposal(runtime, member, recipients, proposal, embeddedMessage, childGvrsn) {
-    const deliveries = [];
-    for (const recipient of uniqueMembers(recipients)) {
-        if (recipient === member.pre || runtime.hby.habs.has(recipient))
-            continue;
-        const destination = runtime.poster.resolveRecipient(recipient);
-        const prepared = yield* prepareMultisigEventExn(member.pre, proposal, embeddedMessage, {
-            recipient: destination,
-            childGvrsn,
-        });
-        deliveries.push(...yield* registerAndSendProposal(runtime, member, destination, prepared));
-    }
-    return deliveries;
-}
-/** Publish a registry or issuance proposal with its required named children. */
-function* publishVdrProposal(runtime, member, recipients, proposal) {
-    const { route, payload, embeds } = proposal;
-    const deliveries = [];
-    for (const recipient of uniqueMembers(recipients)) {
-        if (recipient === member.pre || runtime.hby.habs.has(recipient)) {
-            continue;
-        }
-        const destination = runtime.poster.resolveRecipient(recipient);
-        const [serder, attachments] = exchange(route, payload, {
-            sender: member.pre,
-            recipient: destination,
-            embeds,
-        });
-        deliveries.push(...yield* registerAndSendProposal(runtime, member, destination, [serder, attachments]));
-    }
-    return deliveries;
-}
-/** Register the exact signed proposal before peers can reply to its delivery. */
-function* registerAndSendProposal(runtime, member, recipient, [serder, attachments]) {
-    const message = concatBytes(member.endorse(serder, { pipelined: false }), attachments);
-    yield* runtime.reactor.processBytes(message, { local: true });
-    const result = yield* runtime.poster.sendPreparedExchange(member, {
-        recipient,
-        serder,
-        message,
-        topic: MULTISIG_TOPIC,
-    });
-    return [...result.deliveries];
-}
-/** True when a KEL event is accepted locally. */
-export function eventAccepted(hby, serder) {
-    const pre = serder.pre;
-    const said = serder.said;
-    const sn = serder.sn;
-    if (!pre || !said || sn === null) {
-        return false;
-    }
-    return hby.db.kels.getLast(pre, sn) === said;
-}
-export function routeForKelEvent(serder) {
-    switch (serder.ilk) {
-        case Ilks.icp:
-        case Ilks.dip:
-            return MULTISIG_ICP_ROUTE;
-        case Ilks.rot:
-        case Ilks.drt:
-            return MULTISIG_ROT_ROUTE;
-        case Ilks.ixn:
-            return MULTISIG_IXN_ROUTE;
-        default:
-            return null;
-    }
-}
-/** Approve the first matching stored proposal; host progress and deadlines belong to the caller. */
-export function* approvePendingMultisigProposal(hby, runtime, options) {
-    const notifier = runtime.notifier;
-    if (!notifier) {
-        throw new ValidationError("Multisig join requires notification storage.");
-    }
-    const notices = notifier.list(0, 100);
-    for (const note of notices) {
-        const route = note.attrs.r;
-        const said = note.attrs.d;
-        if (typeof route !== "string" || typeof said !== "string") {
-            continue;
-        }
-        if (options.said && options.said !== said) {
-            continue;
-        }
-        if (route !== MULTISIG_ICP_ROUTE
-            && route !== MULTISIG_ROT_ROUTE
-            && route !== MULTISIG_IXN_ROUTE
-            && route !== MULTISIG_VCP_ROUTE
-            && route !== MULTISIG_ISS_ROUTE
-            && route !== MULTISIG_RPY_ROUTE) {
-            continue;
-        }
-        const exn = hby.db.exns.get([said]);
-        if (!exn?.ked) {
-            continue;
-        }
-        const result = isKelRoute(route)
-            ? yield* approveKelProposal(hby, runtime, exn, route, options)
-            : isVdrRoute(route)
-                ? yield* approveVdrProposal(hby, runtime, exn, route, options)
-                : yield* approveRpyProposal(hby, runtime, exn, route, options);
-        if (result) {
-            notifier.remove(note.rid);
-            return result;
-        }
-    }
-    return null;
-}
-function* approveRpyProposal(hby, runtime, exn, route, options) {
-    const wrapperSaid = exn.said;
-    if (!wrapperSaid) {
-        return null;
-    }
-    const payload = payloadSection(exn.ked ?? {});
-    const groupPre = requireText(stringField(payload, "gid") || undefined, "Group prefix");
-    const groupHab = hby.habs.get(groupPre);
-    if (!groupHab) {
-        throw new ValidationError(`Group ${groupPre} must be joined before approving ${route}.`);
-    }
-    const member = localGroupMember(hby, groupPre);
-    const child = multisigChild(hby, exn, "rpy");
-    if (!child)
-        return null;
-    const { event: rpySerder, attachment, genus } = child;
-    const embeddedSaid = rpySerder.said ?? "";
-    if (!options.callbacks.approveProposal({ route, group: groupPre, embedded: embeddedSaid || "<unknown>" })) {
-        return null;
-    }
-    yield* runtime.reactor.processBytes(concatBytes(Counter.makeGVC(genus), rpySerder.raw, attachment), { local: true });
-    const localRpy = groupEndorseReply(hby, groupPre, rpySerder, genus);
-    yield* runtime.reactor.processBytes(concatBytes(Counter.makeGVC(genus), localRpy), { local: true });
-    yield* runtime.reactor.processEscrowsOnce();
-    const attrs = rpyAttrs(rpySerder);
-    const deliveries = yield* publishProposal(runtime, member, groupSigningMembers(hby, groupPre), { route, attrs: { gid: groupPre } }, localRpy, genus);
-    const accepted = endpointRoleAccepted(hby, attrs.cid, attrs.role, attrs.eid);
-    return { route, said: wrapperSaid, embedded: embeddedSaid, group: groupPre, accepted, deliveries };
-}
-function* approveKelProposal(hby, runtime, exn, route, options) {
-    const wrapperSaid = exn.said;
-    if (!wrapperSaid) {
-        return null;
-    }
-    const approval = kelApproval(hby, exn, route);
-    if (!approval) {
-        return null;
-    }
-    const { event: serder, group: groupPre, proposal } = approval;
-    const { smids } = proposal.attrs;
-    const embeddedSaid = serder.said;
-    const members = proposal.route === MULTISIG_IXN_ROUTE ? smids : uniqueMembers([...smids, ...proposal.attrs.rmids]);
-    const member = proposal.route === MULTISIG_IXN_ROUTE
-        ? localGroupMember(hby, groupPre)
-        : findLocalMember(hby, members);
-    if (!member) {
-        throw new ValidationError(`No local member found for multisig proposal ${wrapperSaid}.`);
-    }
-    if (!options.callbacks.approveProposal({ route, group: groupPre, embedded: embeddedSaid ?? "<unknown>" })) {
-        return null;
-    }
-    if (proposal.route === MULTISIG_ICP_ROUTE || (proposal.route === MULTISIG_ROT_ROUTE && !hby.habs.has(groupPre))) {
-        const rmids = proposal.attrs.rmids;
-        const alias = options.callbacks.chooseGroupAlias(groupPre);
-        hby.joinGroupHab(groupPre, alias, member, smids, rmids.length > 0 ? rmids : smids);
-    }
-    const keys = groupEventKeys(hby, groupPre, serder);
-    const sigers = signLocalGroupEvent(hby, serder, smids, keys);
-    // Keep the attachment set open until the peer signatures are appended.
-    const localMessage = messagize(serder, { sigers, pipelined: false, gvrsn: approval.genus });
-    yield* runtime.reactor.processBytes(concatBytes(Counter.makeGVC(approval.genus), localMessage, approval.attachment), { local: true });
-    yield* runtime.reactor.processEscrowsOnce();
-    const deliveries = yield* publishProposal(runtime, member, members, proposal, localMessage, approval.genus);
-    const accepted = eventAccepted(hby, serder);
-    if (accepted && proposal.route !== MULTISIG_IXN_ROUTE) {
-        const rmids = proposal.attrs.rmids;
-        hby.commitGroupHabMembers(groupPre, smids, rmids.length > 0 ? rmids : smids);
-    }
-    return { route, said: wrapperSaid, embedded: embeddedSaid ?? "", group: groupPre, accepted, deliveries };
-}
-function* approveVdrProposal(hby, runtime, exn, route, options) {
-    const wrapperSaid = exn.said;
-    if (!wrapperSaid) {
-        return null;
-    }
-    const payload = payloadSection(exn.ked ?? {});
-    const groupPre = requireText(stringField(payload, "gid") || undefined, "Group prefix");
-    const groupHab = hby.habs.get(groupPre);
-    if (!groupHab) {
-        throw new ValidationError(`Group ${groupPre} must be joined before approving ${route}.`);
-    }
-    const member = localGroupMember(hby, groupPre);
-    const embed = embeddedSection(exn.ked ?? {});
-    const label = route === MULTISIG_VCP_ROUTE ? "vcp" : "iss";
-    const embeddedSad = embed?.[label];
-    const anchor = multisigChild(hby, exn, "anc");
-    if (!isRecord(embeddedSad) || !anchor) {
-        return null;
-    }
-    if (anchor.event.pre !== groupPre)
-        return null;
-    const embeddedSerder = new SerderKERI({ sad: embeddedSad });
-    // Required children must be decoded before approval can sign or accept the anchor.
-    const acdcSad = embed?.acdc;
-    const proposal = route === MULTISIG_VCP_ROUTE
-        ? { route }
-        : isRecord(acdcSad)
-            ? { route, credential: new SerderACDC({ sad: acdcSad }) }
-            : null;
-    if (!proposal)
-        return null;
-    const { event: anchorSerder, attachment, genus } = anchor;
-    const embeddedSaid = embeddedSerder.said ?? "";
-    if (!options.callbacks.approveProposal({ route, group: groupPre, embedded: embeddedSaid || "<unknown>" })) {
-        return null;
-    }
-    const smids = groupSigningMembers(hby, groupPre);
-    const keys = groupEventKeys(hby, groupPre, anchorSerder);
-    const sigers = signLocalGroupEvent(hby, anchorSerder, smids, keys);
-    // Keep the attachment set open until the peer signatures are appended.
-    const localAnchor = messagize(anchorSerder, { sigers, pipelined: false, gvrsn: genus });
-    yield* runtime.reactor.processBytes(concatBytes(Counter.makeGVC(genus), localAnchor, attachment), { local: true });
-    yield* runtime.reactor.processEscrowsOnce();
-    let accepted = false;
-    let publication;
-    const attrs = { gid: groupPre, ...multisigChildGenusAttrs(anchorSerder, genus) };
-    if (proposal.route === MULTISIG_VCP_ROUTE) {
-        accepted = approveRegistryIncept(runtime, groupHab, embeddedSerder, anchorSerder, options);
-        publication = {
-            route: proposal.route,
-            payload: { ...attrs, ...(typeof payload.usage === "string" ? { usage: payload.usage } : {}) },
-            embeds: { vcp: embeddedSerder.raw, anc: localAnchor },
-        };
-    }
-    else {
-        const creder = proposal.credential;
-        accepted = approveCredentialIssue(runtime, hby, creder, embeddedSerder, anchorSerder);
-        const seal = telCredentialSeal(embeddedSerder);
-        publication = {
-            route: proposal.route,
-            payload: attrs,
-            embeds: {
-                acdc: serializeCredential(creder, seal.prefixer, seal.seqner, seal.saider, genus),
-                iss: embeddedSerder.raw,
-                anc: localAnchor,
-            },
-        };
-    }
-    const deliveries = yield* publishVdrProposal(runtime, member, smids, publication);
-    return { route, said: wrapperSaid, embedded: embeddedSaid, group: groupPre, accepted, deliveries };
-}
-/** The supported route determines its one named KEL child. */
-function kelProposalLabel(route) {
-    return route === MULTISIG_ICP_ROUTE ? "icp" : route === MULTISIG_ROT_ROUTE ? "rot" : "ixn";
-}
-/** Decode the fields used by approval, preserving existing missing-embed and member-list behavior. */
-function kelApproval(hby, exn, route) {
-    const child = multisigChild(hby, exn, kelProposalLabel(route));
-    if (!child)
-        return null;
-    const { event } = child;
-    const attrs = exn.ked?.a;
-    const payload = isRecord(attrs) ? attrs : {};
-    const group = requireText(route === MULTISIG_ICP_ROUTE
-        ? event.pre ?? undefined
-        : (typeof payload.gid === "string" ? payload.gid : "") || event.pre || undefined, "Group prefix");
-    // Approval must name the same group whose event we will sign.
-    if (group !== event.pre)
-        return null;
-    const smids = stringArrayField(payload, "smids");
-    if (route === MULTISIG_IXN_ROUTE) {
-        return { ...child, group, proposal: { route, attrs: { gid: group, smids } } };
-    }
-    const rmids = stringArrayField(payload, "rmids");
-    const proposal = route === MULTISIG_ICP_ROUTE
-        ? {
-            route,
-            attrs: { smids, rmids, ...(typeof payload.delegator === "string" ? { delegator: payload.delegator } : {}) },
-        }
-        : { route, attrs: { gid: group, smids, rmids } };
-    return { ...child, group, proposal };
-}
-function approveRegistryIncept(runtime, groupHab, vserder, anchorSerder, options) {
-    const rgy = requireRegery(runtime);
-    const seal = sourceSeal(anchorSerder);
-    rgy.tvy.processEvent({ serder: vserder, seqner: seal.seqner, saider: seal.saider });
-    rgy.processEscrows();
-    const regk = requireSerderPrefix(vserder, "registry inception");
-    const registryName = options.callbacks.chooseRegistryName(regk);
-    const cnfg = stringArrayField(vserder.ked ?? {}, "c");
-    registerRegistry(rgy, registryName, groupHab, regk, {
-        noBackers: cnfg.includes(TraitDex.NoBackers),
-        estOnly: cnfg.includes(TraitDex.EstOnly),
-    });
-    const eventSaid = requireSerderSaid(vserder, "registry inception");
-    if (telAccepted(runtime, regk, 0, eventSaid)) {
-        markTelComplete(runtime, regk, 0, eventSaid);
-    }
-    return telAccepted(runtime, regk, 0, eventSaid);
-}
-function approveCredentialIssue(runtime, hby, creder, iserder, anchorSerder) {
-    const rgy = requireRegery(runtime);
-    const seal = sourceSeal(anchorSerder);
-    rgy.tvy.processEvent({ serder: iserder, seqner: seal.seqner, saider: seal.saider });
-    rgy.processEscrows();
-    const reger = rgy.reger;
-    const vry = rgy.vry;
-    const credentialer = new Credentialer(hby, { reger, vry });
-    credentialer.validate(creder);
-    const credentialSeal = telCredentialSeal(iserder);
-    const verifierDecision = vry.processCredential({
-        creder,
-        prefixer: credentialSeal.prefixer,
-        seqner: credentialSeal.seqner,
-        saider: credentialSeal.saider,
-    });
-    if (verifierDecision.kind === "accept") {
-        reger.ccrd.pin(requireCredentialSaid(creder), creder);
-    }
-    vry.processEscrows();
-    const telPre = requireSerderPrefix(iserder, "credential issue");
-    const eventSaid = requireSerderSaid(iserder, "credential issue");
-    const sn = iserder.sn ?? 0;
-    if (telAccepted(runtime, telPre, sn, eventSaid)) {
-        markTelComplete(runtime, requireCredentialSaid(creder), sn, eventSaid);
-    }
-    return credentialer.complete(requireCredentialSaid(creder))
-        || reger.saved.get([requireCredentialSaid(creder)]) !== null;
-}
-function registerRegistry(rgy, name, hab, regk, options) {
-    rgy.reger.registries.add(regk);
-    rgy.reger.regs.pin(name, new RegistryRecord({ registryKey: regk, prefix: hab.pre }));
-    if (!rgy.registries.has(name)) {
-        rgy.registries.set(name, new Registry({
-            name,
-            hab,
-            reger: rgy.reger,
-            tvy: rgy.tvy,
-            cues: rgy.cues,
-            regk,
-            noBackers: options.noBackers,
-            estOnly: options.estOnly,
-        }));
-    }
-}
-function sourceSeal(serder) {
-    return { seqner: ordinal(serder.sn ?? 0), saider: new Diger({ qb64: requireSerderSaid(serder, "anchor event") }) };
-}
-function telCredentialSeal(serder) {
-    return {
-        prefixer: new Prefixer({ qb64: requireSerderPrefix(serder, "credential TEL event") }),
-        seqner: ordinal(serder.sn ?? 0),
-        saider: new Diger({ qb64: requireSerderSaid(serder, "credential TEL event") }),
-    };
-}
-function ordinal(num) {
-    const raw = new Uint8Array(16);
-    let value = BigInt(num);
-    for (let i = raw.length - 1; i >= 0; i--) {
-        raw[i] = Number(value & 0xffn);
-        value >>= 8n;
-    }
-    return new NumberPrimitive({ code: NumDex.Huge, raw });
-}
-function seqner(num) {
-    const raw = new Uint8Array(16);
-    let value = BigInt(num);
-    for (let i = raw.length - 1; i >= 0; i--) {
-        raw[i] = Number(value & 0xffn);
-        value >>= 8n;
-    }
-    return new Seqner({ code: NumDex.Huge, raw });
-}
-function requireSerderPrefix(serder, label) {
-    if (!serder.pre) {
-        throw new ValidationError(`${label} is missing prefix.`);
-    }
-    return serder.pre;
-}
-function requireSerderSaid(serder, label) {
-    if (!serder.said) {
-        throw new ValidationError(`${label} is missing SAID.`);
-    }
-    return serder.said;
-}
-function requireCredentialSaid(creder) {
-    if (!creder.said) {
-        throw new ValidationError("Credential is missing SAID.");
-    }
-    return creder.said;
-}
-function telAccepted(runtime, pre, sn, eventSaid) {
-    return requireRegery(runtime).reger.tels.getOn(pre, sn)?.qb64 === eventSaid;
-}
-function markTelComplete(runtime, pre, sn, eventSaid) {
-    requireRegery(runtime).reger.ctel.pin([pre, seqner(sn).qb64], new Saider({ qb64: eventSaid }));
-}
-function rpyAttrs(serder) {
-    const attrs = serder.ked?.a;
-    if (!attrs || typeof attrs !== "object"
-        || !("cid" in attrs) || typeof attrs.cid !== "string" || !attrs.cid
-        || !("role" in attrs) || typeof attrs.role !== "string" || !attrs.role
-        || !("eid" in attrs) || typeof attrs.eid !== "string" || !attrs.eid) {
-        throw new ValidationError("Multisig reply is missing cid, role, or eid.");
-    }
-    return { cid: attrs.cid, role: attrs.role, eid: attrs.eid };
-}
-function payloadSection(ked) {
-    return isRecord(ked.a) ? ked.a : {};
-}
-function embeddedSection(ked) {
-    if (isRecord(ked.e)) {
-        return ked.e;
-    }
-    const attrs = payloadSection(ked);
-    return isRecord(attrs.e) ? attrs.e : null;
-}
-function stringArrayField(record, field) {
-    const value = record[field];
-    return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-}
-function stringField(record, field) {
-    const value = record[field];
-    return typeof value === "string" ? value : "";
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isKelRoute(route) {
-    return route === MULTISIG_ICP_ROUTE || route === MULTISIG_ROT_ROUTE || route === MULTISIG_IXN_ROUTE;
-}
-function isVdrRoute(route) {
-    return route === MULTISIG_VCP_ROUTE || route === MULTISIG_ISS_ROUTE;
-}
-function requireText(value, label) {
-    if (!value) {
-        throw new ValidationError(`${label} is required and cannot be empty.`);
-    }
-    return value;
-}