keri-ts 1.0.0 → 2.0.1

package/esm/keri/npm/src/app/{ipex-credentialing.js → ipex/ipex-credentialing.js}

@@ -7,13 +7,18 @@
  * - keeps EXN route construction in `ipexing.ts`
  * - keeps registry, wallet, and verifier persistence in VDR modules
  */
-import { concatBytes, Counter, parsePather, SerderACDC, SerderKERI, Vrsn_1_0, } from "cesr-ts";
-import { resolveAttachmentGvrsn } from "../core/attachment-countering.js";
-import { ValidationError } from "../core/errors.js";
-import { dgKey } from "../db/core/keys.js";
-import { CredentialWallet, serializeCredential } from "../vdr/credentialing.js";
-import { acceptedEventReplayMessage } from "./habbing.js";
-import { IPEX_GRANT_ROUTE, ipexAdmitExn, ipexGrantExn } from "./ipexing.js";
+import { concatBytes, Counter, Ilks, parseBytes, parsePather, SerderACDC, SerderKERI, Vrsn_1_0, } from "cesr-ts";
+import { resolveAttachmentGvrsn } from "../../core/attachment-countering.js";
+import { ValidationError } from "../../core/errors.js";
+import { dgKey } from "../../db/core/keys.js";
+import { CredentialWallet, serializeCredential } from "../../vdr/credentialing.js";
+import { telAnchorIncludes } from "../../vdr/tel-anchor.js";
+import { validateCredentialSource } from "../credentials/credential-proposals.js";
+import { acceptedEventReplayMessage } from "../identity/habbing.js";
+import { envelopeFromFrame } from "../protocol/parsering.js";
+import { chunkBytes } from "../transport/byte-source.js";
+import { processMessages } from "../transport/message-source.js";
+import { IPEX_GRANT_ROUTE, ipexAdmitExn, ipexGrantExn, ipexRecipient } from "./ipexing.js";
 const textEncoder = new TextEncoder();
 /** Build KERIpy-shaped support artifacts for one credential presentation. */
 export function credentialSupportMessages(hby, reger, creder, recipient) {
@@ -102,6 +107,80 @@ export function credentialPresentationArtifacts(hby, reger, credentialSaidValue,
         anc: { wire: replay.message, genus: resolveAttachmentGvrsn(replay.serder, gvrsn) },
     };
 }
+/**
+ * Check a grant against this member's verified credential and accepted issuer/TEL
+ * evidence before signing. A group holder may present another issuer's credential.
+ * Optional legacy embeds/proofs may be omitted when that authority is already
+ * local; supplied bodies and source seals must agree with it. Nothing is written.
+ */
+export function credentialGrantReady(hby, reger, grant, attachments, genus) {
+    if (grant.route !== IPEX_GRANT_ROUTE)
+        throw new ValidationError("Expected an IPEX grant.");
+    const embeds = embeddedSection(grant);
+    const creder = acdcBody(embeds?.acdc, "acdc");
+    if (!creder.verify())
+        throw new ValidationError("Grant credential has an invalid SAID.");
+    const suppliedIss = embeds?.iss === undefined ? null : keriBody(embeds.iss, "iss");
+    const suppliedAnc = embeds?.anc === undefined ? null : keriBody(embeds.anc, "anc");
+    if (suppliedIss
+        && (!suppliedIss.verify() || ![Ilks.iss, Ilks.bis].some(ilk => ilk === suppliedIss.ilk)
+            || suppliedIss.pre !== creder.said || suppliedIss.sn !== 0)) {
+        throw new ValidationError("Grant issuance does not match its credential.");
+    }
+    if (suppliedAnc && (!suppliedAnc.verify() || suppliedAnc.pre !== creder.issuer)) {
+        throw new ValidationError("Grant anchor does not match its credential issuer.");
+    }
+    const frames = parseBytes(concatBytes(Counter.makeGVC(genus), grant.raw, attachments));
+    if (frames.length !== 1)
+        throw new ValidationError("Grant evidence must contain one exchange.");
+    const paths = envelopeFromFrame(frames[0]).ptds.map(group => group.raw);
+    if (!reger.saved.get([creder.said]))
+        return false;
+    const expected = credentialPresentationArtifacts(hby, reger, creder.said, genus);
+    const issuance = new SerderKERI({ raw: expected.iss.wire });
+    if (suppliedIss && suppliedIss.said !== issuance.said) {
+        throw new ValidationError("Grant issuance conflicts with the saved credential.");
+    }
+    const source = pathedAttachment(paths, "acdc");
+    if (source.length)
+        validateCredentialSource(creder, issuance, source, genus);
+    if (suppliedAnc && !acceptedGrantAnchor(hby, creder.issuer, issuance, suppliedAnc))
+        return false;
+    const telProof = pathedAttachment(paths, "iss");
+    if (telProof.length) {
+        const proofFrames = parseBytes(concatBytes(Counter.makeGVC(genus), issuance.raw, telProof));
+        if (proofFrames.length !== 1)
+            throw new ValidationError("Grant TEL evidence must contain one event.");
+        const seal = envelopeFromFrame(proofFrames[0]).lastSsc;
+        if (seal) {
+            if (seal.s.num > BigInt(Number.MAX_SAFE_INTEGER)) {
+                throw new ValidationError("Grant issuer anchor exceeds supported storage ordinals.");
+            }
+            const anchor = hby.db.getEvtSerder(creder.issuer, seal.d.qb64);
+            if (!anchor)
+                return false;
+            if (anchor.sn !== Number(seal.s.num) || (suppliedAnc && suppliedAnc.said !== anchor.said)) {
+                throw new ValidationError("Grant TEL source seal does not match its anchor.");
+            }
+            if (!acceptedGrantAnchor(hby, creder.issuer, issuance, anchor))
+                return false;
+        }
+    }
+    return true;
+}
+/** Local accepted KEL authority, not a proposed anchor or proof supplied by its wrapper. */
+function acceptedGrantAnchor(hby, issuer, issuance, anchor) {
+    if (anchor.sn === null || !Number.isSafeInteger(anchor.sn)) {
+        throw new ValidationError("Grant anchor sequence exceeds supported storage ordinals.");
+    }
+    const accepted = hby.db.kels.getLast(issuer, anchor.sn);
+    if (!accepted)
+        return false;
+    if (accepted !== anchor.said || !telAnchorIncludes(issuer, issuance, anchor)) {
+        throw new ValidationError("Grant anchor does not bind the saved credential issuance.");
+    }
+    return true;
+}
 /** Build a signed `/ipex/grant` message with embedded credential artifacts. */
 export function ipexCredentialGrant(args) {
     const [creder] = args.reger.cloneCred(args.credentialSaid);
@@ -114,6 +193,9 @@ export function ipexCredentialGrant(args) {
         anc: artifacts.anc.wire,
         agree: args.options?.agree ?? null,
     });
+    if (!credentialGrantReady(args.hby, args.reger, grant, attachments, gvrsn)) {
+        throw new ValidationError(`Credential ${args.credentialSaid} is missing verified local evidence.`);
+    }
     return {
         grant,
         attachments,
@@ -122,45 +204,74 @@ export function ipexCredentialGrant(args) {
         support,
     };
 }
-/** Build a signed `/ipex/admit` response for an accepted grant. */
-export function ipexCredentialAdmit(args) {
-    if (args.grant.route !== IPEX_GRANT_ROUTE) {
-        throw new ValidationError(`Expected ${IPEX_GRANT_ROUTE} grant, got ${args.grant.route ?? "<none>"}.`);
-    }
-    const credentialSaidValue = credentialSaidFromGrant(args.grant);
-    if (!credentialSaidValue) {
-        throw new ValidationError("Grant is missing embedded ACDC SAID.");
+/**
+ * Validate a supplied accepted grant's recipient and wallet obligation before signing.
+ * Explicit no-wait authoring may skip the saved marker; it does not establish
+ * wallet acceptance. Peer approval always checks its own wallet independently.
+ */
+export function validateAdmitGrant(grant, recipient, reger, requireSaved = true) {
+    if (grant.route !== IPEX_GRANT_ROUTE) {
+        throw new ValidationError(`Expected ${IPEX_GRANT_ROUTE} grant, got ${grant.route ?? "<none>"}.`);
     }
-    if ((args.options?.requireSaved ?? true) && !args.reger.saved.get([credentialSaidValue])) {
-        throw new ValidationError(`Credential ${credentialSaidValue} is not saved locally.`);
+    if (ipexRecipient(grant) !== recipient) {
+        throw new ValidationError("Grant recipient does not match the admitting identifier.");
     }
+    const said = credentialSaidFromGrant(grant);
+    if (!said)
+        throw new ValidationError("Grant is missing embedded ACDC SAID.");
+    if (requireSaved && !reger.saved.get([said]))
+        throw new ValidationError(`Credential ${said} is not saved locally.`);
+    return said;
+}
+/** Build an admit after validating its grant; group callers defer the endorsement. */
+export function ipexCredentialAdmit(args) {
+    validateAdmitGrant(args.grant, args.hab.pre, args.reger, args.options?.requireSaved ?? true);
     const [admit, attachments] = ipexAdmitExn(args.hab, args.message ?? "", args.grant, args.options ?? {});
     return {
         admit,
         attachments,
-        wire: concatBytes(args.hab.endorse(admit, { pipelined: false, gvrsn: args.options?.gvrsn ?? undefined }), attachments),
+        wire: args.sign === false ? new Uint8Array() : concatBytes(args.hab.endorse(admit, { pipelined: false, gvrsn: args.options?.gvrsn ?? undefined }), attachments),
     };
 }
-/** Parse grant-embedded artifacts in KERIpy admit order: `anc`, `iss`, `acdc`. */
-export function* processCredentialPresentationArtifacts(reactor, artifacts) {
-    yield* reactor.processBytes(concatBytes(Counter.makeGVC(artifacts.anc.genus), artifacts.anc.wire));
-    yield* reactor.processBytes(concatBytes(Counter.makeGVC(artifacts.iss.genus), artifacts.iss.wire));
-    yield* reactor.processBytes(concatBytes(Counter.makeGVC(artifacts.acdc.genus), artifacts.acdc.wire));
-    yield* reactor.processEscrowsOnce();
+/**
+ * Parse grant-embedded artifacts in KERIpy admit order: `anc`, `iss`, `acdc`.
+ *
+ * @param protocol Borrowed shared protocol processor; this operation owns its parser and input-specific Kevery.
+ * @param artifacts Grant-embedded anchor, issuance and credential streams in their named fields.
+ */
+export function* processCredentialPresentationArtifacts(protocol, artifacts) {
+    const kvy = protocol.makeKevery();
+    // Each artifact carries its own attachment genus; finish its dispatch before opening the next.
+    for (const artifact of [artifacts.anc, artifacts.iss, artifacts.acdc]) {
+        const bytes = concatBytes(Counter.makeGVC(artifact.genus), artifact.wire);
+        yield* processMessages((signal) => chunkBytes(bytes, { signal }), protocol, kvy);
+    }
+    // Recurring IPEX/verifier callers retain their existing single-pass escrow scheduling.
+    yield* protocol.processEscrowsOnce();
 }
 /** Rebuild grant-embedded `anc`, `iss`, and `acdc` streams from exchange storage. */
 export function storedGrantArtifacts(hby, grant, gvrsn = Vrsn_1_0) {
+    if (!grant.said)
+        throw new ValidationError("Grant is missing its SAID.");
+    return grantPresentationArtifacts(grant, hby.db.epath.get([grant.said]).map(text => textEncoder.encode(text)), gvrsn);
+}
+/**
+ * Decode the supplied grant's bodies and counted path groups without storage or
+ * admission. Approval passes the selected proposal's own evidence; stored replay
+ * passes its retained LMDB groups. Neither source can substitute for the other.
+ */
+export function grantPresentationArtifacts(grant, pathed, gvrsn = Vrsn_1_0) {
     if (grant.route !== IPEX_GRANT_ROUTE || !grant.said) {
-        throw new ValidationError(`Expected stored ${IPEX_GRANT_ROUTE} EXN.`);
+        throw new ValidationError(`Expected ${IPEX_GRANT_ROUTE} EXN.`);
     }
     const embeds = embeddedSection(grant);
     if (!embeds) {
         throw new ValidationError(`Grant ${grant.said} is missing embedded artifacts.`);
     }
     return {
-        anc: storedArtifact(keriBody(embeds.anc, "anc"), pathedAttachment(hby, grant.said, "anc"), gvrsn),
-        iss: storedArtifact(keriBody(embeds.iss, "iss"), pathedAttachment(hby, grant.said, "iss"), gvrsn),
-        acdc: storedArtifact(acdcBody(embeds.acdc, "acdc"), pathedAttachment(hby, grant.said, "acdc"), gvrsn),
+        anc: storedArtifact(keriBody(embeds.anc, "anc"), pathedAttachment(pathed, "anc"), gvrsn),
+        iss: storedArtifact(keriBody(embeds.iss, "iss"), pathedAttachment(pathed, "iss"), gvrsn),
+        acdc: storedArtifact(acdcBody(embeds.acdc, "acdc"), pathedAttachment(pathed, "acdc"), gvrsn),
     };
 }
 /** Extract the embedded credential SAID from an accepted `/ipex/grant`. */
@@ -218,10 +329,10 @@ function acdcBody(value, label) {
 function storedArtifact(body, attachment, gvrsn) {
     return { wire: concatBytes(body.raw, attachment), genus: resolveAttachmentGvrsn(body, gvrsn) };
 }
-function pathedAttachment(hby, said, label) {
+function pathedAttachment(pathed, label) {
     const path = `/e/${label}`;
-    for (const text of hby.db.epath.get([said])) {
-        const attachment = pathedAttachmentFromRaw(textEncoder.encode(text), path);
+    for (const raw of pathed) {
+        const attachment = pathedAttachmentFromRaw(raw, path);
         if (attachment) {
             return attachment;
         }

package/esm/keri/npm/src/app/ipex/ipex-graph.js

@@ -0,0 +1,243 @@
+/** Borrowed IPEX frame DAGs, negotiated disclosure paths and traversal policy. */
+import { Compactor, makePather, SerderACDC } from "cesr-ts";
+import { acdcEdgeBlocks as blocks, acdcEdgeTarget, acdcGroupLabels } from "../../acdc/chaining.js";
+const nodeIlks = new Set([null, "acm", "ace", "act", "acg"]);
+/** Empty UUID marks field-map metadata; fixed-field public credentials keep that slot empty too. */
+export function isIpexMetadata(node) {
+    return [null, "acm", "ace"].includes(node.ilk) && node.sad.u === "";
+}
+/** Offers carry bodies only; empty counted feet convey no child evidence. */
+export function hasIpexNodeAttachments(frame) {
+    return frame.attachments.some((group) => group.items.length > 0)
+        || Boolean(frame.essrs?.length || frame.nests?.length);
+}
+/** SAD maps, including null-prototype maps, exclude scalar/array representations. */
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Python's empty section containers carry no disclosed edge semantics. */
+function present(value) {
+    return Array.isArray(value) ? value.length > 0 : record(value) ? Object.keys(value).length > 0 : Boolean(value);
+}
+/** Validate disclosure-query shape; actual schema commitments are checked against disclosed nodes. */
+export function validDisclosurePlan(value) {
+    if (!Array.isArray(value))
+        return false;
+    for (const item of value) {
+        if (!Array.isArray(item) || item.length !== 3)
+            return false;
+        const [schema, path, fields] = item;
+        if (typeof schema !== "string" || typeof path !== "string")
+            return false;
+        if (path !== "/") {
+            if (!path.startsWith("/") || !path.endsWith("/"))
+                return false;
+            const parts = path.replace(/^\/+|\/+$/g, "").split("/");
+            if (parts.some((part) => !part) || parts.at(-1) !== "_")
+                return false;
+        }
+        if (!Array.isArray(fields))
+            return false;
+        if (fields.length === 1 && fields[0] === "")
+            continue;
+        for (const field of fields) {
+            if (typeof field !== "string" || !field || field.startsWith("/"))
+                return false;
+            try {
+                makePather(field, { relative: true });
+            }
+            catch {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+/** Decode exactly one wire DAG without accepting the retired flat q.dp shape. */
+export function singleDagDisclosurePlan(value) {
+    return Array.isArray(value) && value.length === 1 && validDisclosurePlan(value[0]) ? value[0] : null;
+}
+/**
+ * Index unique disclosed credential nodes and walk their reachable graph in BFS order.
+ * Offers may omit far nodes; grants require every referenced node. Nested ownership
+ * does not make these nodes independently accepted runtime messages.
+ */
+export function walkIpexGraph(origin, nests, closed) {
+    const nodes = new Map();
+    for (const [index, frame] of nests.entries()) {
+        const body = frame.body;
+        if (!(body instanceof SerderACDC) || !body.verify() || !nodeIlks.has(body.ilk)
+            || !body.said || (index === 0 && body.said !== origin) || nodes.has(body.said))
+            return null;
+        // Descendants are not additional implicit evidence for this disclosed node.
+        if (frame.nests?.length)
+            return null;
+        nodes.set(body.said, frame);
+    }
+    if (!nodes.has(origin))
+        return null;
+    const seen = new Set();
+    const order = [];
+    const dependencies = new Map();
+    const queue = [origin];
+    for (let index = 0; index < queue.length; index++) {
+        const said = queue[index];
+        if (seen.has(said))
+            continue;
+        seen.add(said);
+        order.push(said);
+        const farNodes = new Set();
+        dependencies.set(said, farNodes);
+        const edges = blocks(nodes.get(said).body.sad.e);
+        if (!edges)
+            return null;
+        const groups = [...edges];
+        for (let g = 0; g < groups.length; g++) {
+            const edge = groups[g];
+            const target = acdcEdgeTarget(edge);
+            if (target === false)
+                return null;
+            if (typeof target === "string") {
+                if (!nodes.has(target)) {
+                    if (closed)
+                        return null;
+                }
+                else {
+                    farNodes.add(target);
+                    if (!seen.has(target))
+                        queue.push(target);
+                }
+            }
+            else {
+                if (!record(edge))
+                    return null;
+                for (const [key, value] of Object.entries(edge)) {
+                    if (acdcGroupLabels.has(key) || typeof value === "string")
+                        continue;
+                    groups.push(value);
+                }
+            }
+        }
+    }
+    if (seen.size !== nodes.size)
+        return null;
+    const parents = new Map();
+    for (const [near, children] of dependencies) {
+        for (const far of children) {
+            if (!parents.has(far))
+                parents.set(far, new Set());
+            parents.get(far).add(near);
+        }
+    }
+    const dependencyOrder = order.filter((said) => dependencies.get(said).size === 0);
+    for (let i = 0; i < dependencyOrder.length; i++) {
+        for (const near of parents.get(dependencyOrder[i]) ?? []) {
+            const children = dependencies.get(near);
+            children.delete(dependencyOrder[i]);
+            if (!children.size)
+                dependencyOrder.push(near);
+        }
+    }
+    return dependencyOrder.length === nodes.size ? { nodes, order } : null;
+}
+/** Compare SAD values structurally while retaining list order; map insertion order is not semantic here. */
+function equal(a, b) {
+    if (a === b)
+        return true;
+    if (Array.isArray(a) && Array.isArray(b))
+        return a.length === b.length && a.every((item, i) => equal(item, b[i]));
+    if (record(a) && record(b)) {
+        return Object.keys(a).length === Object.keys(b).length
+            && Object.entries(a).every(([key, value]) => Object.hasOwn(b, key) && equal(value, b[key]));
+    }
+    return false;
+}
+/** Select every disclosed node in exact BFS order using literal SAD paths and virtual far-node hops. */
+export function verifyIpexDisclosure(plan, origin, graph) {
+    if (!plan.length || graph.order[0] !== origin)
+        return false;
+    const selected = [];
+    for (const [schema, prefix, fields] of plan) {
+        let said = origin;
+        let node = graph.nodes.get(said);
+        if (!node)
+            return false;
+        let value = node.body.sad;
+        if (prefix !== "/") {
+            for (const part of prefix.replace(/^\/+|\/+$/g, "").split("/")) {
+                if (part === "_") {
+                    if (!record(value) || typeof value.n !== "string")
+                        return false;
+                    const target = value.n;
+                    said = target;
+                    node = graph.nodes.get(said);
+                    if (!node)
+                        return false;
+                    value = node.body.sad;
+                }
+                else {
+                    if (record(value) && Object.hasOwn(value, part))
+                        value = value[part];
+                    else if (Array.isArray(value) && /^\d+$/.test(part) && Number(part) < value.length) {
+                        value = value[Number(part)];
+                    }
+                    else
+                        return false;
+                }
+            }
+        }
+        selected.push(said);
+        const serder = node.body;
+        const nodeSchema = serder.schema;
+        if ((record(nodeSchema) ? nodeSchema.$id : nodeSchema) !== schema)
+            return false;
+        if (fields.length === 1 && fields[0] === "") {
+            for (const label of ["a", "e", "r"]) {
+                const section = serder.sad[label];
+                if (present(section) && !record(section))
+                    return false;
+            }
+            if (present(serder.sad.A) && !Array.isArray(serder.sad.A))
+                return false;
+            continue;
+        }
+        const sections = new Map();
+        for (const field of fields) {
+            try {
+                const pather = makePather(field, { relative: true });
+                pather.resolve(serder.sad);
+                const root = pather.rparts[0];
+                if (root !== undefined)
+                    sections.set(root, [...(sections.get(root) ?? []), field]);
+            }
+            catch {
+                return false;
+            }
+        }
+        for (const [root, paths] of sections) {
+            const section = serder.sad[root];
+            if (!record(section))
+                continue;
+            try {
+                const compactor = new Compactor({
+                    mad: structuredClone(section),
+                    makify: true,
+                    kind: serder.kind,
+                });
+                compactor.compact(paths, root);
+                const partial = compactor.partials?.[paths.join("|")];
+                if (!partial)
+                    return false;
+                const expected = partial.mad;
+                if (section.d === "" && expected.d)
+                    expected.d = "";
+                if (!equal(expected, section))
+                    return false;
+            }
+            catch {
+                return false;
+            }
+        }
+    }
+    return equal(selected, graph.order);
+}