keri-ts 1.0.0 → 2.0.0

package/esm/keri/npm/src/app/tcp-egress.js

@@ -1,251 +0,0 @@
-/** Concrete TCP connections and pull-driven writers; applications compose receive work. */
-import { framePayload } from "cesr-ts";
-import { createConnection } from "node:net";
-import { call, resource } from "effection";
-import { ValidationError } from "../core/errors.js";
-import { abortable, rethrowCleanupFailure } from "./abortable.js";
-import { chunkBytes } from "./byte-source.js";
-import { defaultRuntimeClock } from "./runtime-services.js";
-/** Validate actual chunk sizes and deadlines before acquiring a socket. */
-function positive(value, name) {
-    if (!Number.isSafeInteger(value) || value < 1)
-        throw new RangeError(`${name} must be a positive safe integer`);
-    return value;
-}
-/** Lend a paused, half-open-capable socket; no application receiver runs inside transport. */
-export function openTcpConnection(url, options = {}) {
-    return resource(function* (provide) {
-        const parsed = new URL(url), port = Number(parsed.port);
-        if (parsed.protocol !== "tcp:" || !Number.isInteger(port) || port < 1 || port > 65535) {
-            throw new ValidationError(`TCP output requires tcp: with a valid port: ${url}`);
-        }
-        const timeout = positive(options.connectTimeoutMs ?? 30000, "connectTimeoutMs");
-        const clock = options.clock ?? defaultRuntimeClock;
-        const controller = new AbortController();
-        const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
-        signal.throwIfAborted();
-        const socket = createConnection({ host: parsed.hostname, port, allowHalfOpen: true });
-        socket.pause();
-        const closed = new Promise((resolve) => socket.once("close", resolve));
-        const destroy = () => socket.destroy();
-        const close = (reason) => {
-            controller.abort(reason);
-            socket.destroy();
-        };
-        const disconnected = () => {
-            if (!socket.writableFinished)
-                close(new Error("TCP closed before output completed"));
-        };
-        socket.on("error", close);
-        socket.on("close", disconnected);
-        signal.addEventListener("abort", destroy, { once: true });
-        let timer;
-        try {
-            yield* abortable(async (signal) => {
-                timer = clock.setTimeout(() => close(new Error("TCP connect deadline exceeded")), timeout);
-                try {
-                    await interrupted(new Promise((resolve) => socket.once("connect", resolve)), signal);
-                }
-                finally {
-                    clock.clearTimeout(timer);
-                    timer = undefined;
-                }
-            }, signal);
-            yield* provide({ socket, closed, signal, close });
-        }
-        finally {
-            close();
-            yield* call(() => closed);
-            signal.removeEventListener("abort", destroy);
-            socket.off("error", close);
-            socket.off("close", disconnected);
-        }
-    });
-}
-/** Send a resident value over the same concrete connection/source owner as streaming output. */
-export function sendCesrTcp(url, bytes, options = {}) {
-    const cap = positive(options.maxChunkBytes ?? 65536, "maxChunkBytes");
-    return streamCesrTcp(url, (signal) => chunkBytes(bytes, { signal, maxChunkBytes: cap }), options);
-}
-/** Transmit-only flow drains ignored peer bytes so real peer EOF can close the socket. */
-export function streamCesrTcp(url, source, options = {}) {
-    return call(function* () {
-        const connection = yield* openTcpConnection(url, options);
-        connection.socket.resume();
-        return yield* sendCesrTcpSocket(connection, source, options);
-    });
-}
-/** Borrow an already hydrated frame through serializer completion, without reparsing. */
-export function sendCesrTcpFrame(url, frame, options = {}) {
-    const cap = positive(options.maxChunkBytes ?? 65536, "maxChunkBytes");
-    return streamCesrTcp(url, async function* (signal) {
-        for await (const chunk of framePayload(frame).open(signal)) {
-            yield* chunkBytes(chunk, { signal, maxChunkBytes: cap });
-        }
-    }, options);
-}
-/** Pull/write/drain one chunk at a time and join source cleanup before returning. */
-export function writeCesrTcpSocket(socket, factory, { clock = defaultRuntimeClock, signal } = {}) {
-    return abortable(async (signal) => {
-        const destroy = () => socket.destroy();
-        signal.addEventListener("abort", destroy, { once: true });
-        try {
-            return {
-                kind: "transmitted",
-                bytes: await writeBorrowedSource(socket, factory, signal, clock, { fail: destroy }),
-            };
-        }
-        finally {
-            signal.removeEventListener("abort", destroy);
-        }
-    }, signal);
-}
-/** End local output after source EOF, then join peer close under one fixed drain deadline. */
-export function sendCesrTcpSocket(connection, factory, options = {}) {
-    const timeout = positive(options.drainTimeoutMs ?? 30000, "drainTimeoutMs");
-    const clock = options.clock ?? defaultRuntimeClock;
-    return abortable(async (signal) => {
-        let timer;
-        let ending;
-        const stop = () => connection.close(signal.reason);
-        signal.addEventListener("abort", stop, { once: true });
-        try {
-            const bytes = await writeBorrowedSource(connection.socket, factory, signal, clock, {
-                fail: connection.close,
-                eof() {
-                    timer = clock.setTimeout(() => connection.close(new Error("TCP drain deadline exceeded")), timeout);
-                },
-            });
-            ending = new Promise((resolve, reject) => connection.socket.end((error) => error ? reject(error) : resolve()));
-            await interrupted(ending, signal);
-            ending = undefined;
-            await interrupted(connection.closed, signal);
-            return { kind: "transmitted", bytes };
-        }
-        finally {
-            if (signal.aborted)
-                connection.close(signal.reason);
-            await ending?.catch(() => undefined);
-            if (timer !== undefined)
-                clock.clearTimeout(timer);
-            signal.removeEventListener("abort", stop);
-        }
-    }, connection.signal);
-}
-/** Wake blocked I/O on cancellation without leaving the underlying promise unobserved. */
-async function interrupted(pending, signal) {
-    signal.throwIfAborted();
-    let abort;
-    try {
-        return await Promise.race([
-            pending,
-            new Promise((_, reject) => {
-                abort = () => reject(signal.reason);
-                signal.addEventListener("abort", abort, { once: true });
-            }),
-        ]);
-    }
-    finally {
-        signal.removeEventListener("abort", abort);
-    }
-}
-/** Shared source/read/callback/drain loop; connection owners handle abort and socket close. */
-async function writeBorrowedSource(socket, factory, signal, clock, hooks = {}) {
-    let iterator;
-    let pendingRead;
-    let pendingWrite;
-    let timer;
-    let failure;
-    let bytes = 0, work = 0;
-    /** Join late failures without reporting the same read/write rejection twice. */
-    const noteCleanup = (error) => {
-        if (failure && error === failure.error)
-            return;
-        try {
-            if (signal.aborted)
-                rethrowCleanupFailure(error, signal);
-            else
-                throw error;
-        }
-        catch (remaining) {
-            failure = {
-                error: failure ? new AggregateError([failure.error, remaining], "TCP source cleanup failed") : remaining,
-            };
-        }
-    };
-    try {
-        const source = await factory(signal);
-        iterator = source[Symbol.asyncIterator]();
-        signal.throwIfAborted();
-        while (true) {
-            // Empty/immediately resolved producers must not starve socket events or scope cancellation.
-            if (++work === 4096) {
-                work = 0;
-                await interrupted(new Promise((resolve) => {
-                    timer = clock.setTimeout(resolve, 0);
-                }), signal);
-                clock.clearTimeout(timer);
-                timer = undefined;
-            }
-            pendingRead = Promise.resolve(iterator.next());
-            const part = await interrupted(pendingRead, signal);
-            pendingRead = undefined;
-            signal.throwIfAborted();
-            if (part.done) {
-                hooks.eof?.();
-                break;
-            }
-            if (!(part.value instanceof Uint8Array))
-                throw new TypeError("TCP source must yield binary chunks");
-            if (!part.value.length)
-                continue;
-            let drain;
-            const drained = new Promise((resolve) => drain = resolve);
-            socket.once("drain", drain);
-            try {
-                let writable = false;
-                pendingWrite = new Promise((resolve, reject) => {
-                    writable = socket.write(part.value, (error) => {
-                        // Destroying our socket cancels its queued write; preserve that owner's abort reason.
-                        if (signal.aborted && error?.code === "ECANCELED") {
-                            reject(signal.reason);
-                        }
-                        else if (error)
-                            reject(error);
-                        else
-                            resolve();
-                    });
-                });
-                await interrupted(pendingWrite, signal);
-                pendingWrite = undefined;
-                if (!writable)
-                    await interrupted(drained, signal);
-            }
-            finally {
-                socket.removeListener("drain", drain);
-            }
-            bytes += part.value.length;
-        }
-    }
-    catch (error) {
-        failure = { error };
-        hooks.fail?.(error);
-    }
-    finally {
-        try {
-            await pendingRead?.catch(noteCleanup);
-            await iterator?.return?.();
-        }
-        catch (error) {
-            noteCleanup(error);
-        }
-        finally {
-            await pendingWrite?.catch(noteCleanup);
-            if (timer !== undefined)
-                clock.clearTimeout(timer);
-        }
-    }
-    if (failure)
-        throw failure.error;
-    return bytes;
-}

package/esm/keri/npm/src/app/verifier-agent.js

@@ -1,443 +0,0 @@
-/**
- * Sally-like verifier agent pipeline.
- *
- * Source of truth:
- * - accepted `/ipex/grant` EXNs in `Baser.exns`
- * - embedded credential/TEL/KEL artifacts in `Baser.epath`
- * - saved credentials and TEL state in `Reger`
- * - TEL revocation cues from the shared runtime cue deck
- *
- * `Notifier` rows are intentionally not consumed here; they remain operator
- * visibility, matching the roadmap contract.
- */
-import { Dater, Ilks, Prefixer, Vrsn_1_0 } from "cesr-ts";
-import { ValidationError } from "../core/errors.js";
-import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
-import { abortable } from "./abortable.js";
-import { credentialSaidFromGrant, processCredentialPresentationArtifacts, storedGrantArtifacts, } from "./ipex-credentialing.js";
-import { IPEX_GRANT_ROUTE } from "./ipexing.js";
-const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
-/** Sally-like verifier processor for one `Habery`/`Reger` runtime. */
-export class VerifierAgent {
-    constructor(options) {
-        Object.defineProperty(this, "hby", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "reger", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "cdb", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "reactor", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "cues", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "services", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "hook", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "gvrsn", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "timeoutMs", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "validators", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "requireKnownSchemas", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        this.hby = options.hby;
-        this.reger = options.reger;
-        this.cdb = options.cdb;
-        this.reactor = options.reactor;
-        this.cues = options.cues;
-        this.services = options.services;
-        this.hook = options.hook;
-        this.gvrsn = options.gvrsn ?? Vrsn_1_0;
-        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-        this.validators = { ...(options.validators ?? {}) };
-        this.requireKnownSchemas = options.requireKnownSchemas ?? false;
-    }
-    /** Settle verified artifacts and deliver queued webhooks within the caller's operation. */
-    *processOnce() {
-        const result = {
-            grantsQueued: 0,
-            revocationsQueued: 0,
-            presentationsReady: 0,
-            revocationsReady: 0,
-            webhooksSent: 0,
-            webhooksFailed: 0,
-            rejected: 0,
-        };
-        result.grantsQueued += yield* this.scanAcceptedGrants();
-        result.revocationsQueued += this.processRevokedCues();
-        yield* this.reactor.processEscrowsOnce();
-        result.revocationsQueued += this.scanPersistedRevocations();
-        result.presentationsReady += this.processPresentations();
-        result.revocationsReady += this.processRevocations();
-        result.webhooksSent += yield* this.processReady(this.cdb.recv, "iss", result);
-        result.webhooksSent += yield* this.processReady(this.cdb.revk, "rev", result);
-        return result;
-    }
-    /** Settle grant artifacts before queuing their verified credentials for webhook delivery. */
-    *scanAcceptedGrants() {
-        let queued = 0;
-        for (const [, grant] of this.hby.db.exns.getTopItemIter()) {
-            if (grant.route !== IPEX_GRANT_ROUTE || !grant.said) {
-                continue;
-            }
-            const credentialSaid = credentialSaidFromGrant(grant);
-            if (!credentialSaid || this.hasQueuedOrSent(credentialSaid)) {
-                continue;
-            }
-            const artifacts = storedGrantArtifacts(this.hby, grant, this.gvrsn);
-            yield* processCredentialPresentationArtifacts(this.reactor, artifacts);
-            const creder = this.reger.creds.get([credentialSaid]);
-            if (!creder) {
-                throw new ValidationError(`Credential ${credentialSaid} was not saved after grant artifact processing.`);
-            }
-            const issuer = requireString(creder.issuer, "credential issuer");
-            this.cdb.snd.pin([credentialSaid], new Prefixer({ qb64: issuer }));
-            this.cdb.iss.pin([credentialSaid], nowDater());
-            queued += 1;
-        }
-        return queued;
-    }
-    processRevokedCues() {
-        const retained = [];
-        const count = this.cues.length;
-        let queued = 0;
-        try {
-            for (let index = 0; index < count; index++) {
-                const cue = this.cues.pull();
-                if (!cue)
-                    break;
-                if (cue.kin !== "revoked")
-                    retained.push(cue);
-                else {
-                    try {
-                        queued += this.queueRevocation(cue);
-                    }
-                    catch (error) {
-                        retained.push(cue);
-                        throw error;
-                    }
-                }
-            }
-        }
-        finally {
-            for (const cue of retained.reverse())
-                this.cues.prepend(cue);
-        }
-        return queued;
-    }
-    /** Publish existing durable revocation work synchronously; caller retains source ownership through failure. */
-    queueRevocation(cue) {
-        const said = cue.serder.pre;
-        if (!said || this.hasRevocationQueuedOrSent(said))
-            return 0;
-        const creder = this.reger.creds.get([said]);
-        if (creder?.issuer)
-            this.cdb.snd.pin([said], new Prefixer({ qb64: creder.issuer }));
-        this.cdb.rev.pin([said], nowDater());
-        return 1;
-    }
-    scanPersistedRevocations() {
-        let queued = 0;
-        for (const [keys] of this.reger.saved.getTopItemIter()) {
-            const said = keys[0];
-            if (!said || this.hasRevocationQueuedOrSent(said)) {
-                continue;
-            }
-            const creder = this.reger.creds.get([said]);
-            if (!creder || !this.hasAcceptedGrantForCredential(said)) {
-                continue;
-            }
-            const state = credentialState(this.reger, creder);
-            if (!state || (state.et !== Ilks.rev && state.et !== Ilks.brv)) {
-                continue;
-            }
-            if (creder.issuer) {
-                this.cdb.snd.pin([said], new Prefixer({ qb64: creder.issuer }));
-            }
-            this.cdb.rev.pin([said], nowDater());
-            queued += 1;
-        }
-        return queued;
-    }
-    processPresentations() {
-        let ready = 0;
-        for (const [keys, dater] of [...this.cdb.iss.getTopItemIter()]) {
-            const said = keys[0];
-            if (!said) {
-                continue;
-            }
-            if (this.expired(dater)) {
-                this.cdb.iss.rem([said]);
-                continue;
-            }
-            if (this.reger.saved.get([said]) === null) {
-                continue;
-            }
-            const creder = this.reger.creds.get([said]);
-            if (!creder) {
-                continue;
-            }
-            const state = credentialState(this.reger, creder);
-            if (!state) {
-                continue;
-            }
-            if (state.et === Ilks.rev || state.et === Ilks.brv) {
-                this.cdb.iss.rem([said]);
-                continue;
-            }
-            const rejection = this.validateCredential(creder);
-            if (rejection) {
-                this.cdb.iss.rem([said]);
-                continue;
-            }
-            this.cdb.recv.pin([said, dater.qb64], creder);
-            this.cdb.iss.rem([said]);
-            ready += 1;
-        }
-        return ready;
-    }
-    processRevocations() {
-        let ready = 0;
-        for (const [keys, dater] of [...this.cdb.rev.getTopItemIter()]) {
-            const said = keys[0];
-            if (!said) {
-                continue;
-            }
-            if (this.expired(dater)) {
-                this.cdb.rev.rem([said]);
-                continue;
-            }
-            const creder = this.reger.creds.get([said]);
-            if (!creder) {
-                continue;
-            }
-            const state = credentialState(this.reger, creder);
-            if (!state || state.et === Ilks.iss || state.et === Ilks.bis) {
-                continue;
-            }
-            if (state.et === Ilks.rev || state.et === Ilks.brv) {
-                if (creder.issuer) {
-                    this.cdb.snd.pin([said], new Prefixer({ qb64: creder.issuer }));
-                }
-                this.cdb.rev.rem([said]);
-                this.cdb.revk.pin([said, dater.qb64], creder);
-                ready += 1;
-            }
-        }
-        return ready;
-    }
-    /** Deliver each ready webhook before recording success or applying its expiry policy. */
-    *processReady(db, action, result) {
-        let sent = 0;
-        for (const [keys, creder] of [...db.getTopItemIter()]) {
-            const [said, daterQb64] = keys;
-            if (!said || !daterQb64) {
-                continue;
-            }
-            const payload = webhookBody(this.reger, creder, action);
-            const accepted = yield* this.postWebhook(payload);
-            if (accepted) {
-                db.rem([said, daterQb64]);
-                if (action === "iss") {
-                    this.cdb.ack.pin([said], creder);
-                }
-                else {
-                    this.cdb.rack.pin([said], creder);
-                }
-                sent += 1;
-                continue;
-            }
-            result.webhooksFailed += 1;
-            const dater = new Dater({ qb64: daterQb64 });
-            if (this.expired(dater)) {
-                db.rem([said, daterQb64]);
-            }
-        }
-        return sent;
-    }
-    /** Bind webhook transport cancellation and completion to the enclosing operation. */
-    *postWebhook(body) {
-        const raw = JSON.stringify(body);
-        return yield* abortable(async (signal) => {
-            const response = await this.services.http.fetch(this.hook, {
-                method: "POST",
-                headers: {
-                    "content-type": "application/json",
-                    "sally-resource": String(body.data.schema ?? ""),
-                    "sally-timestamp": new Date(this.services.clock.now()).toISOString(),
-                },
-                body: raw,
-                signal,
-            });
-            try {
-                return response.ok;
-            }
-            finally {
-                // Webhooks use only the status; release an unread response before this leaf completes.
-                await response.body?.cancel();
-            }
-        });
-    }
-    validateCredential(creder) {
-        const schema = schemaOf(creder);
-        if (!schema) {
-            return "missing credential schema";
-        }
-        const validator = this.validators[schema];
-        if (!validator) {
-            return this.requireKnownSchemas ? `unsupported credential schema ${schema}` : null;
-        }
-        const result = validator(creder, { hby: this.hby, reger: this.reger });
-        if (typeof result === "string") {
-            return result;
-        }
-        return result === false ? `credential ${creder.said ?? "<unknown>"} failed business validation` : null;
-    }
-    hasQueuedOrSent(said) {
-        return this.cdb.iss.get([said]) !== null
-            || this.cdb.ack.get([said]) !== null
-            || this.hasReady(this.cdb.recv, said);
-    }
-    hasRevocationQueuedOrSent(said) {
-        return this.cdb.rev.get([said]) !== null
-            || this.cdb.rack.get([said]) !== null
-            || this.hasReady(this.cdb.revk, said);
-    }
-    hasAcceptedGrantForCredential(said) {
-        for (const [, grant] of this.hby.db.exns.getTopItemIter()) {
-            if (grant.route === IPEX_GRANT_ROUTE && credentialSaidFromGrant(grant) === said) {
-                return true;
-            }
-        }
-        return false;
-    }
-    hasReady(db, said) {
-        for (const [keys] of db.getTopItemIter([said, ""])) {
-            if (keys[0] === said) {
-                return true;
-            }
-        }
-        return false;
-    }
-    expired(dater) {
-        return this.services.clock.now() - new Date(dater.dts).getTime() > this.timeoutMs;
-    }
-}
-/** Build validators from a local JSON config object. */
-export function validatorsFromVerifierConfig(config) {
-    if (!isRecord(config) || !isRecord(config.schemas)) {
-        return {};
-    }
-    const validators = {};
-    for (const [schema, policy] of Object.entries(config.schemas)) {
-        if (!isRecord(policy)) {
-            continue;
-        }
-        validators[schema] = (creder) => {
-            const issuer = typeof policy.issuer === "string" ? policy.issuer : "";
-            if (issuer && creder.issuer !== issuer) {
-                return `expected issuer ${issuer}, got ${creder.issuer ?? "<missing>"}`;
-            }
-            return true;
-        };
-    }
-    return validators;
-}
-function webhookBody(reger, creder, action) {
-    const actor = creder.issuer ?? "";
-    const data = action === "iss" ? presentationPayload(creder) : revocationPayload(reger, creder);
-    return { action, actor, data };
-}
-function presentationPayload(creder) {
-    const attrs = isRecord(creder.attrib) ? creder.attrib : {};
-    return {
-        schema: schemaOf(creder),
-        issuer: creder.issuer,
-        issueTimestamp: typeof attrs.dt === "string" ? attrs.dt : undefined,
-        credential: creder.said,
-        recipient: typeof attrs.i === "string" ? attrs.i : undefined,
-        attributes: attrs,
-        edge: creder.edge ?? undefined,
-    };
-}
-function revocationPayload(reger, creder) {
-    const state = credentialState(reger, creder);
-    return {
-        schema: schemaOf(creder),
-        credential: creder.said,
-        revocationTimestamp: state?.dt,
-    };
-}
-function schemaOf(creder) {
-    return typeof creder.schema === "string" ? creder.schema : "";
-}
-function credentialState(reger, creder) {
-    const regk = creder.regid;
-    const said = creder.said;
-    if (!regk || !said) {
-        return null;
-    }
-    const tever = reger.tevers.get(regk);
-    if (!isRecord(tever) || typeof tever.vcState !== "function") {
-        return null;
-    }
-    return tever.vcState(said);
-}
-function nowDater() {
-    return new Dater({ qb64: encodeDateTimeToDater(makeNowIso8601()) });
-}
-function requireString(value, label) {
-    if (!value) {
-        throw new ValidationError(`Missing ${label}.`);
-    }
-    return value;
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}