keri-ts 1.0.0 → 2.0.1

package/esm/keri/npm/src/{app/cli → cli/identity}/rotate.js

@@ -1,48 +1,40 @@
+import { createProtocolProcessor } from "../../app/protocol/protocol-processing.js";
+import { systemClock } from "../../app/runtime/runtime-clock.js";
+import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { createAgentRuntime, runAgentRuntimeUntil, } from "../../app/runtime/agent-runtime.js";
 import { ValidationError } from "../../core/errors.js";
-import { createAgentRuntime, runAgentRuntimeUntil, } from "../agent-runtime.js";
-import { resolveDelegationCommunicationHab } from "../delegating.js";
-import { Receiptor, WitnessReceiptor } from "../witnessing.js";
-import { withExistingHab } from "./common/context.js";
-import { loadRotateFileOptions, parseDataItems, parseThresholdOption, } from "./common/parsing.js";
-import { resolveWitnessAuths } from "./common/witness-auth.js";
+import { resolveDelegationCommunicationHab } from "../../app/identity/delegating.js";
+import { isLocalGroupHab } from "../../app/multisig/group-members.js";
+import { Receiptor, WitnessReceiptor } from "../../app/witness/receipting.js";
+import { withExistingHab } from "../common/context.js";
+import { loadRotateFileOptions, parseBooleanOption, parseCountOption, parseDataItems, parseKeriVersionOption, parseStringListOption, parseStringOption, parseThresholdOption, } from "../common/parsing.js";
+import { resolveWitnessAuths } from "../common/witness-auth.js";
 /** Empty baseline used before CLI/file precedence is applied. */
 function emptyRotateOptions() {
     return {};
 }
-/**
- * Merge CLI arguments over file-backed rotation options with KLI-compatible precedence.
- *
- * KLI quirk preserved intentionally:
- * - absent CLI `--nsith` still forces `'1'`
- * - absent CLI `--next-count` still forces `1`
- */
+/** Overlay supplied CLI values; defaults apply only after file precedence is resolved. */
 function mergeWithFile(args) {
     const options = args.file && args.file !== "" ? loadRotateFileOptions(args.file) : emptyRotateOptions();
     if (args.isith !== undefined) {
-        options.isith = parseThresholdOption(args.isith);
+        options.isith = args.isith;
     }
     if (args.nsith !== undefined) {
-        options.nsith = parseThresholdOption(args.nsith);
-    }
-    else {
-        options.nsith = "1";
+        options.nsith = args.nsith;
     }
     if (args.nextCount !== undefined) {
-        options.ncount = Number(args.nextCount);
-    }
-    else {
-        options.ncount = 1;
+        options.ncount = args.nextCount;
     }
     if (args.toad !== undefined) {
-        options.toad = Number(args.toad);
+        options.toad = args.toad;
     }
-    if ((args.witnesses?.length ?? 0) > 0) {
+    if (args.witnesses !== undefined) {
         options.wits = [...args.witnesses];
     }
-    if ((args.cuts?.length ?? 0) > 0) {
+    if (args.cuts !== undefined) {
         options.witsCut = [...args.cuts];
     }
-    if ((args.witnessAdd?.length ?? 0) > 0) {
+    if (args.witnessAdd !== undefined) {
         options.witsAdd = [...args.witnessAdd];
     }
     if (args.data !== undefined) {
@@ -61,29 +53,35 @@ function difference(left, right) {
  * Maintainer boundary:
  * - CLI concerns stop at option merge/validation and success output
  * - habitat/key-state mutation lives in `Hab.rotate(...)`
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
+ * @param options Optional application-owned authorization resolver, evaluated against prospective witnesses before rotation.
  */
-export function* rotateCommand(args) {
+export function* rotateCommand(args, { witnessAuths } = {}) {
+    // Select one HTTP implementation for all work owned by this command.
+    const http = new FetchHttpClient();
     const rotateArgs = {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        alias: args.alias,
-        compat: args.compat,
-        file: args.file,
-        nextCount: args.nextCount,
-        endpoint: args.endpoint,
-        authenticate: args.authenticate,
-        code: args.code,
-        codeTime: args.codeTime,
-        proxy: args.proxy,
-        isith: args.isith,
-        nsith: args.nsith,
-        toad: args.toad,
-        witnesses: args.witnesses,
-        cuts: args.cuts,
-        witnessAdd: args.witnessAdd,
-        data: args.data,
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        alias: parseStringOption(args.alias, "alias"),
+        compat: parseBooleanOption(args.compat, "compat"),
+        file: parseStringOption(args.file, "file"),
+        nextCount: parseCountOption(args.nextCount, "nextCount"),
+        endpoint: parseBooleanOption(args.endpoint, "endpoint"),
+        authenticate: parseBooleanOption(args.authenticate, "authenticate"),
+        code: parseStringListOption(args.code, "code"),
+        codeTime: parseStringOption(args.codeTime, "codeTime"),
+        proxy: parseStringOption(args.proxy, "proxy"),
+        isith: parseThresholdOption(args.isith),
+        nsith: parseThresholdOption(args.nsith),
+        toad: parseCountOption(args.toad, "toad"),
+        witnesses: parseStringListOption(args.witnesses, "witnesses"),
+        cuts: parseStringListOption(args.cuts, "cuts"),
+        witnessAdd: parseStringListOption(args.witnessAdd, "witnessAdd"),
+        data: parseStringListOption(args.data, "data"),
+        version: parseKeriVersionOption(args.version),
     };
     if (!rotateArgs.name) {
         throw new ValidationError("Name is required and cannot be empty");
@@ -98,42 +96,47 @@ export function* rotateCommand(args) {
         skipConfig: true,
         skipSignator: true,
     }, function* ({ hby, hab }) {
+        if (isLocalGroupHab(hby, hab)) {
+            throw new ValidationError("Group aliases require tufa multisig rotate so member approval and fanout are coordinated.");
+        }
         const kever = hab.kever;
         if (!kever) {
             throw new ValidationError(`Missing accepted key state for ${hab.pre}.`);
         }
         let cuts = [...(options.witsCut ?? [])];
         let adds = [...(options.witsAdd ?? [])];
-        if ((options.wits?.length ?? 0) > 0) {
+        if (options.wits !== undefined) {
             if (cuts.length > 0 || adds.length > 0) {
                 throw new ValidationError("you can only specify witnesses or cuts and add");
             }
             cuts = difference(kever.wits, options.wits ?? []);
             adds = difference(options.wits ?? [], kever.wits);
         }
+        const witnesses = [...kever.wits.filter(witness => !cuts.includes(witness)), ...adds];
+        const auths = witnessAuths ? witnessAuths(hab, witnesses) : resolveWitnessAuths(witnesses, rotateArgs.code ?? [], {
+            codeTime: rotateArgs.codeTime,
+            promptMissing: rotateArgs.authenticate ?? false,
+        });
         hab.rotate({
             isith: options.isith,
-            nsith: options.nsith,
-            ncount: options.ncount,
+            nsith: options.nsith ?? "1",
+            ncount: options.ncount ?? 1,
             toad: options.toad,
             cuts,
             adds,
             data: options.data ?? [],
+            version: rotateArgs.version,
         });
         if (hab.kever?.wits.length) {
-            const auths = resolveWitnessAuths(hab.kever.wits, rotateArgs.code ?? [], {
-                codeTime: rotateArgs.codeTime,
-                promptMissing: rotateArgs.authenticate ?? false,
-            });
             if (rotateArgs.endpoint) {
-                const receiptor = new Receiptor(hby);
+                const receiptor = new Receiptor(hby, createProtocolProcessor(hby), http, systemClock);
                 yield* receiptor.receipt(hab.pre, {
                     sn: hab.kever.sn,
                     auths,
                 });
             }
             else {
-                const witDoer = new WitnessReceiptor(hby);
+                const witDoer = new WitnessReceiptor(hby, createProtocolProcessor(hby), http, systemClock);
                 yield* witDoer.submit(hab.pre, {
                     sn: hab.kever.sn,
                     auths,
@@ -143,7 +146,7 @@ export function* rotateCommand(args) {
         let delegationPhase = null;
         if (kever.delpre !== null && hab.kever) {
             const communicationHab = resolveDelegationCommunicationHab(hby, rotateArgs.proxy);
-            const runtime = yield* createAgentRuntime(hby);
+            const runtime = yield* createAgentRuntime(hby, http, systemClock);
             try {
                 runtime.delegating.beginLatest(hab.pre, hab.kever.sn, {
                     communicationHab,

package/esm/keri/npm/src/cli/index.js

@@ -0,0 +1,38 @@
+/**
+ * CLI module - public API
+ *
+ * This transitional module now exposes only the remaining non-host command
+ * helpers that still live under `keri-ts`.
+ */
+/** Transitional command consumers share the same strict attachment-genus parser. */
+export { parseGvrsn } from "../core/attachment-countering.js";
+export { withAgentRuntime, withExistingHab, withExistingHabery, withHabAndAgentRuntime, } from "./common/context.js";
+export { ensureHby, setupHby } from "./common/existing.js";
+export { parseBooleanOption, parseCountOption, parseIntegerOption, parseNumberOption, parseStringListOption, parseStringOption, } from "./common/parsing.js";
+export { writeJsonLine, writeTextLines } from "./common/rendering.js";
+export { resolveWitnessAuths } from "./common/witness-auth.js";
+export { ipexAdmitCommand, ipexAgreeCommand, ipexApplyCommand, ipexGrantCommand, ipexJoinCommand, ipexListCommand, ipexOfferCommand, ipexPollCommand, ipexSpurnCommand, joinIpexProposal, } from "./credentials/ipex.js";
+export { vcCreateCommand, vcExportCommand, vcImportCommand, vcListCommand, vcRegistryInceptCommand, vcRegistryListCommand, vcRegistryStatusCommand, vcRevokeCommand, vcSchemaImportCommand, } from "./credentials/vc.js";
+export { dkrResolveCommand, dwsBindCommand, dwsGenerateCommand, dwsResolveCommand } from "./endpoints/did.js";
+export { endsAddCommand } from "./endpoints/ends.js";
+export { locAddCommand } from "./endpoints/loc.js";
+export { oobiCleanCommand } from "./endpoints/oobi-clean.js";
+export { oobiGenerateCommand, oobiRequestCommand, oobiResolveCommand } from "./endpoints/oobi.js";
+export { aidCommand } from "./identity/aid.js";
+export { challengeGenerateCommand, challengeRespondCommand, challengeVerifyCommand } from "./identity/challenge.js";
+export { delegateConfirmCommand } from "./identity/delegate.js";
+export { exportCommand } from "./identity/export.js";
+export { inceptCommand } from "./identity/incept.js";
+export { initCommand } from "./identity/init.js";
+export { interactCommand } from "./identity/interact.js";
+export { listCommand } from "./identity/list.js";
+export { rotateCommand } from "./identity/rotate.js";
+export { exchangeSendCommand } from "./messaging/exchange.js";
+export { multisigInceptCommand, multisigInteractCommand, multisigJoinCommand, multisigRotateCommand, multisigRpyCommand, } from "./messaging/multisig.js";
+export { notificationsListCommand, notificationsMarkReadCommand, notificationsRemoveCommand, } from "./messaging/notifications.js";
+export { annotateCommand } from "./tools/annotate.js";
+export { benchmarkCommand } from "./tools/benchmark.js";
+export { dumpEvts } from "./tools/db-dump.js";
+export { saidifyCommand } from "./tools/saidify.js";
+export { signCommand } from "./tools/sign.js";
+export { verifyCommand } from "./tools/verify.js";

package/esm/keri/npm/src/{app/cli → cli/messaging}/exchange.js

@@ -1,30 +1,33 @@
+import { sendExchangeMessage } from "../../app/exchanges/exchange-messaging.js";
+import { isLocalGroupHab } from "../../app/multisig/group-members.js";
+import { systemClock } from "../../app/runtime/runtime-clock.js";
+import { FetchHttpClient } from "../../app/transport/http-client.js";
 import { ValidationError } from "../../core/errors.js";
-import { normalizeCesrBodyMode } from "../cesr-http.js";
-import { sendExchangeMessage } from "../forwarding.js";
-import { withExistingHab } from "./common/context.js";
-import { parseExnDataItems } from "./common/parsing.js";
+import { withExistingHab } from "../common/context.js";
+import { parseBooleanOption, parseExnDataItems, parseStringListOption, parseStringOption } from "../common/parsing.js";
 /**
  * Implement `tufa exchange send` / `tufa exn send` with KERIpy-shaped EXN behavior.
  *
  * Public contract:
- * - sender is a local alias
+ * - sender is a local single-controller alias; group business workflows own approval
  * - recipient is an AID or exact contact alias
  * - payload comes from repeatable `--data`
  * - topic defaults to the first route segment
+ *
+ * @param args Parsed command flags and positionals; required identifiers and policy values are validated before effects.
  */
 export function* exchangeSendCommand(args) {
     const commandArgs = {
-        name: args.name,
-        base: args.base,
-        headDirPath: args.headDirPath,
-        passcode: args.passcode,
-        sender: args.sender,
-        recipient: args.recipient,
-        route: args.route,
-        topic: args.topic,
+        name: parseStringOption(args.name, "name"),
+        base: parseStringOption(args.base, "base"),
+        headDirPath: parseStringOption(args.headDirPath, "headDirPath"),
+        passcode: parseStringOption(args.passcode, "passcode"),
+        sender: parseStringOption(args.sender, "sender"),
+        recipient: parseStringOption(args.recipient, "recipient"),
+        route: parseStringOption(args.route, "route"),
+        topic: parseStringOption(args.topic, "topic"),
         data: normalizeDataArgs(args.data),
-        compat: args.compat,
-        cesrBodyMode: normalizeCesrBodyMode(args.cesrBodyMode),
+        compat: parseBooleanOption(args.compat, "compat"),
     };
     if (!commandArgs.name) {
         throw new ValidationError("Name is required and cannot be empty");
@@ -46,10 +49,12 @@ export function* exchangeSendCommand(args) {
         readonly: false,
         skipConfig: false,
         skipSignator: false,
-        cesrBodyMode: commandArgs.cesrBodyMode,
     }, function* ({ hby, hab }) {
-        const { serder } = yield* sendExchangeMessage(hby, hab, {
-            recipient,
+        if (isLocalGroupHab(hby, hab)) {
+            throw new ValidationError("Generic exchange send does not coordinate group approval. Use a member alias or the matching group IPEX workflow.");
+        }
+        const { serder } = yield* sendExchangeMessage(hby, hab, new FetchHttpClient(), systemClock, {
+            dest: recipient,
             route,
             topic: commandArgs.topic,
             payload,
@@ -59,11 +64,8 @@ export function* exchangeSendCommand(args) {
     });
 }
 function normalizeDataArgs(value) {
-    if (Array.isArray(value)) {
-        return value.filter((item) => typeof item === "string");
-    }
     if (typeof value === "string") {
         return [value];
     }
-    return [];
+    return parseStringListOption(value, "data") ?? [];
 }