keri-ts 1.0.0 → 2.0.1

package/esm/keri/npm/src/app/credential-workflows.js

@@ -1,409 +0,0 @@
-/**
- * Credential registry and lifecycle workflow orchestration.
- *
- * CLI adapters parse inputs and render outputs. This module owns registry state,
- * credential issue/revoke/import/export,
- * and multisig VC proposal coordination.
- */
-import { concatBytes, Diger, NumberPrimitive, NumDex, Prefixer, Saider, Seqner, TraitDex } from "cesr-ts";
-import { ValidationError } from "../core/errors.js";
-import { CREDENTIAL_MAILBOX_TOPIC } from "../core/mailbox-topics.js";
-import { incept as inceptRegistryEvent, issue as issueEvent } from "../core/protocol-vdr-eventing.js";
-import { RegistryRecord } from "../core/records.js";
-import { Schemer } from "../core/scheming.js";
-import { Credentialer, CredentialWallet, Registry, serializeCredential } from "../vdr/credentialing.js";
-import { settleRuntimeIngress } from "./agent-runtime.js";
-import { groupSigningMembers, isLocalGroupHab, localGroupMember } from "./group-members.js";
-import { MULTISIG_ISS_ROUTE, MULTISIG_VCP_ROUTE } from "./grouping.js";
-import { credentialStreamMessages } from "./ipex-credentialing.js";
-const MULTISIG_TOPIC = "multisig";
-/** Pin a JSON schema body into the local schema table. */
-export function pinSchemaBytes(hby, raw) {
-    const schemer = new Schemer({ raw });
-    hby.db.schema.pin(schemer.said, schemer);
-    return schemer.said;
-}
-/** Create a single-sig registry or propose a group registry inception. */
-export function* inceptCredentialRegistry(hby, runtime, hab, options) {
-    const rgy = requireRegery(runtime);
-    if (isLocalGroupHab(hby, hab)) {
-        return yield* proposeGroupRegistryIncept(hby, runtime, rgy, hab, options);
-    }
-    const registry = rgy.makeRegistry(options.registryName, hab, {
-        noBackers: options.noBackers ?? true,
-        estOnly: options.estOnly ?? false,
-    });
-    return {
-        name: options.registryName,
-        registry: registry.regk,
-        issuer: hab.pre,
-    };
-}
-/** Return locally known credential registry records. */
-export function credentialRegistryRecords(reger) {
-    const records = [];
-    for (const [keys, record] of reger.regs.getTopItemIter()) {
-        records.push({
-            name: keys[0],
-            registry: record.registryKey,
-            issuer: record.prefix,
-        });
-    }
-    return records;
-}
-/** Return current TEL status for one local registry name. */
-export function credentialRegistryStatus(runtime, reger, registryName) {
-    const record = reger.regs.get(registryName);
-    if (!record?.registryKey) {
-        throw new ValidationError(`Registry ${registryName} not found.`);
-    }
-    const tever = requireRegery(runtime).tvy.tevers.get(record.registryKey);
-    return {
-        name: registryName,
-        registry: record.registryKey,
-        issuer: record.prefix,
-        state: tever?.state() ?? null,
-    };
-}
-/** Create and issue one registry-backed credential. */
-export function* createCredential(hby, runtime, reger, options) {
-    const rgy = requireRegery(runtime);
-    const registry = requireRegistry(rgy, options.registryName);
-    const credentialer = new Credentialer(hby, {
-        reger,
-        vry: rgy.vry,
-    });
-    const creder = credentialer.create({
-        registry,
-        schema: options.schema,
-        recipient: options.recipient,
-        data: options.data,
-        edges: options.edges,
-        rules: options.rules,
-    });
-    const recipient = options.recipient ?? creder.issuee ?? "";
-    if (isLocalGroupHab(hby, registry.hab)) {
-        const output = yield* proposeGroupCredentialIssue(hby, runtime, reger, registry, creder);
-        return { creder, recipient, output };
-    }
-    const result = credentialer.issue(registry, creder);
-    return {
-        creder,
-        recipient,
-        output: {
-            said: creder.said,
-            registry: creder.regid,
-            issuer: creder.issuer,
-            issuee: creder.issuee,
-            schema: creder.schema,
-            tel: result.tel.said,
-            status: result.verifierDecision.kind,
-        },
-    };
-}
-/** List locally saved credentials through wallet indexes. */
-export function listCredentials(runtime, reger, options) {
-    const wallet = new CredentialWallet(reger);
-    const tvy = requireRegery(runtime).tvy;
-    return wallet.list({ issued: options.issued ?? false, aid: options.aid, schema: options.schema }).map((said) => {
-        const [creder] = reger.cloneCred(said);
-        const tever = creder.regid ? tvy.tevers.get(creder.regid) : null;
-        return {
-            said,
-            issuer: creder.issuer,
-            issuee: creder.issuee,
-            schema: typeof creder.schema === "string" ? creder.schema : null,
-            status: tever?.vcState(said)?.et ?? null,
-        };
-    });
-}
-/** Build a KERIpy-compatible credential export stream. */
-export function exportCredentialStream(hby, reger, credentialSaid, recipient) {
-    const [creder] = reger.cloneCred(credentialSaid);
-    const resolvedRecipient = recipient ?? creder.issuee ?? "";
-    return {
-        creder,
-        recipient: resolvedRecipient,
-        bytes: credentialStreamBytes(hby, reger, creder, resolvedRecipient),
-    };
-}
-/** Import one CESR credential stream and return newly saved credential SAIDs. */
-export function* importCredentialStream(runtime, reger, bytes) {
-    const before = savedCredentials(reger);
-    yield* settleRuntimeIngress(runtime, [bytes]);
-    yield* runtime.reactor.processEscrowsOnce();
-    return { saved: [...savedCredentials(reger)].filter((said) => !before.has(said)) };
-}
-/** Revoke one credential and optionally deliver revocation stream bytes. */
-export function* revokeCredential(hby, runtime, reger, options) {
-    const registry = requireRegistry(requireRegery(runtime), options.registryName);
-    const result = registry.revoke(options.credentialSaid);
-    const [creder] = reger.cloneCred(options.credentialSaid);
-    const deliveries = [];
-    if ((options.sendRecipients?.length ?? 0) > 0) {
-        if (!options.senderHab) {
-            throw new ValidationError("Revocation sender habitat is required when sending revocation events.");
-        }
-        const messages = revocationStreamMessages(hby, reger, creder);
-        for (const recipient of options.sendRecipients ?? []) {
-            for (const message of messages) {
-                const sent = yield* runtime.poster.sendBytes(options.senderHab, {
-                    recipient,
-                    message,
-                    topic: CREDENTIAL_MAILBOX_TOPIC,
-                    delivery: options.delivery,
-                });
-                deliveries.push(...sent.deliveries);
-            }
-        }
-    }
-    return {
-        creder,
-        said: options.credentialSaid,
-        tel: result.serder.said,
-        status: result.decision.kind,
-        deliveries,
-    };
-}
-/** Build a KERIpy-compatible credential stream for an already loaded credential. */
-export function credentialStreamBytes(hby, reger, creder, recipient) {
-    return concatBytes(...credentialStreamMessages(hby, reger, creder, recipient));
-}
-/** Resolve revoke delivery recipients from explicit recipients and issuee policy. */
-export function revocationRecipients(creder, explicit, includeIssuee) {
-    const recipients = includeIssuee && creder.issuee ? [creder.issuee, ...explicit] : [...explicit];
-    return [...new Set(recipients.filter((recipient) => recipient.length > 0))];
-}
-function revocationStreamMessages(hby, reger, creder) {
-    const issuer = creder.issuer;
-    if (!issuer) {
-        throw new ValidationError("Credential is missing issuer AID.");
-    }
-    return [
-        ...hby.db.clonePreIter(issuer),
-        ...reger.clonePreIter(creder.said),
-    ];
-}
-function* proposeGroupRegistryIncept(hby, runtime, rgy, hab, options) {
-    const noBackers = options.noBackers ?? true;
-    const estOnly = options.estOnly ?? false;
-    if (!noBackers) {
-        throw new ValidationError("Group registry inception currently requires a no-backers registry.");
-    }
-    const cnfg = [
-        ...(noBackers ? [TraitDex.NoBackers] : []),
-        ...(estOnly ? [TraitDex.EstOnly] : []),
-    ];
-    const vcp = inceptRegistryEvent(hab.pre, { cnfg });
-    const anchor = hby.interactGroupHab(hab.name, undefined, {
-        data: [eventSeal(vcp)],
-    });
-    const seal = sourceSeal(anchor.serder);
-    const decision = rgy.tvy.processEvent({
-        serder: vcp,
-        seqner: seal.seqner,
-        saider: seal.saider,
-    });
-    rgy.processEscrows();
-    const regk = requireSerderPrefix(vcp, "registry inception");
-    registerRegistry(rgy, options.registryName, hab, regk, { noBackers, estOnly });
-    if (telAccepted(runtime, regk, 0, requireSerderSaid(vcp, "registry inception"))) {
-        markTelComplete(runtime, regk, 0, requireSerderSaid(vcp, "registry inception"));
-    }
-    const deliveries = yield* publishGroupVcProposal(runtime, hab, MULTISIG_VCP_ROUTE, {
-        gid: hab.pre,
-        usage: options.usage ?? options.registryName ?? "credential registry",
-    }, {
-        vcp: vcp.raw,
-        anc: anchor.message,
-    });
-    return {
-        name: options.registryName,
-        registry: regk,
-        issuer: hab.pre,
-        route: MULTISIG_VCP_ROUTE,
-        status: decision.kind,
-        accepted: telAccepted(runtime, regk, 0, requireSerderSaid(vcp, "registry inception")),
-        deliveries,
-    };
-}
-function* proposeGroupCredentialIssue(hby, runtime, reger, registry, creder) {
-    const rgy = requireRegery(runtime);
-    const regk = requireRegistryKey(registry);
-    const iss = issueEvent(requireCredentialSaid(creder), regk);
-    const anchor = hby.interactGroupHab(registry.hab.name, undefined, {
-        data: [eventSeal(iss)],
-    });
-    const seal = sourceSeal(anchor.serder);
-    const telDecision = rgy.tvy.processEvent({
-        serder: iss,
-        seqner: seal.seqner,
-        saider: seal.saider,
-    });
-    rgy.processEscrows();
-    const credentialer = new Credentialer(hby, {
-        reger,
-        vry: rgy.vry,
-    });
-    credentialer.validate(creder);
-    const credentialSeal = telCredentialSeal(iss);
-    const verifierDecision = rgy.vry.processCredential({
-        creder,
-        prefixer: credentialSeal.prefixer,
-        seqner: credentialSeal.seqner,
-        saider: credentialSeal.saider,
-    });
-    if (verifierDecision.kind === "accept") {
-        reger.ccrd.pin(requireCredentialSaid(creder), creder);
-    }
-    rgy.vry.processEscrows();
-    if (telAccepted(runtime, requireSerderPrefix(iss, "credential issue"), iss.sn ?? 0, requireSerderSaid(iss, "credential issue"))) {
-        markTelComplete(runtime, requireCredentialSaid(creder), iss.sn ?? 0, requireSerderSaid(iss, "credential issue"));
-    }
-    const deliveries = yield* publishGroupVcProposal(runtime, registry.hab, MULTISIG_ISS_ROUTE, {
-        gid: registry.hab.pre,
-    }, {
-        acdc: serializeCredential(creder, credentialSeal.prefixer, credentialSeal.seqner, credentialSeal.saider),
-        iss: iss.raw,
-        anc: anchor.message,
-    });
-    return {
-        said: creder.said,
-        registry: creder.regid,
-        issuer: creder.issuer,
-        issuee: creder.issuee,
-        schema: creder.schema,
-        tel: iss.said,
-        route: MULTISIG_ISS_ROUTE,
-        status: verifierDecision.kind,
-        telStatus: telDecision.kind,
-        saved: credentialSaved(reger, creder),
-        deliveries,
-    };
-}
-function* publishGroupVcProposal(runtime, groupHab, route, payload, embeds) {
-    const member = localGroupMember(runtime.hby, groupHab.pre);
-    const deliveries = [];
-    for (const recipient of groupSigningMembers(runtime.hby, groupHab.pre)) {
-        if (recipient === member.pre || runtime.hby.habs.has(recipient)) {
-            continue;
-        }
-        const result = yield* runtime.poster.sendExchange(member, {
-            recipient,
-            route,
-            payload,
-            embeds,
-            topic: MULTISIG_TOPIC,
-        });
-        deliveries.push(...result.deliveries);
-    }
-    return deliveries;
-}
-function registerRegistry(rgy, name, hab, regk, options) {
-    rgy.reger.registries.add(regk);
-    rgy.reger.regs.pin(name, new RegistryRecord({
-        registryKey: regk,
-        prefix: hab.pre,
-    }));
-    if (!rgy.registries.has(name)) {
-        rgy.registries.set(name, new Registry({
-            name,
-            hab,
-            reger: rgy.reger,
-            tvy: rgy.tvy,
-            cues: rgy.cues,
-            regk,
-            noBackers: options.noBackers,
-            estOnly: options.estOnly,
-        }));
-    }
-}
-function eventSeal(serder) {
-    const pre = requireSerderPrefix(serder, "TEL event");
-    const sn = serder.snh ?? (serder.sn ?? 0).toString(16);
-    const dig = requireSerderSaid(serder, "TEL event");
-    return { i: pre, s: sn, d: dig };
-}
-function sourceSeal(serder) {
-    return {
-        prefixer: new Prefixer({ qb64: requireSerderPrefix(serder, "anchor event") }),
-        seqner: ordinal(serder.sn ?? 0),
-        saider: new Diger({ qb64: requireSerderSaid(serder, "anchor event") }),
-    };
-}
-function telCredentialSeal(serder) {
-    return {
-        prefixer: new Prefixer({ qb64: requireSerderPrefix(serder, "credential TEL event") }),
-        seqner: ordinal(serder.sn ?? 0),
-        saider: new Diger({ qb64: requireSerderSaid(serder, "credential TEL event") }),
-    };
-}
-function ordinal(num) {
-    const raw = new Uint8Array(16);
-    let value = BigInt(num);
-    for (let i = raw.length - 1; i >= 0; i--) {
-        raw[i] = Number(value & 0xffn);
-        value >>= 8n;
-    }
-    return new NumberPrimitive({ code: NumDex.Huge, raw });
-}
-function seqner(num) {
-    const raw = new Uint8Array(16);
-    let value = BigInt(num);
-    for (let i = raw.length - 1; i >= 0; i--) {
-        raw[i] = Number(value & 0xffn);
-        value >>= 8n;
-    }
-    return new Seqner({ code: NumDex.Huge, raw });
-}
-function requireRegistry(rgy, name) {
-    const registry = rgy.registryByName(name);
-    if (!registry) {
-        throw new ValidationError(`Registry ${name} not found.`);
-    }
-    return registry;
-}
-function requireRegistryKey(registry) {
-    if (!registry.regk) {
-        throw new ValidationError(`Registry ${registry.name} has not been incepted.`);
-    }
-    return registry.regk;
-}
-function requireCredentialSaid(creder) {
-    if (!creder.said) {
-        throw new ValidationError("Credential is missing SAID.");
-    }
-    return creder.said;
-}
-function credentialSaved(reger, creder) {
-    const said = requireCredentialSaid(creder);
-    return reger.saved.get([said]) !== null || reger.ccrd.get(said) !== null;
-}
-function requireSerderPrefix(serder, label) {
-    if (!serder.pre) {
-        throw new ValidationError(`${label} is missing prefix.`);
-    }
-    return serder.pre;
-}
-function requireSerderSaid(serder, label) {
-    if (!serder.said) {
-        throw new ValidationError(`${label} is missing SAID.`);
-    }
-    return serder.said;
-}
-function telAccepted(runtime, pre, sn, eventSaid) {
-    return requireRegery(runtime).reger.tels.getOn(pre, sn)?.qb64 === eventSaid;
-}
-function markTelComplete(runtime, pre, sn, eventSaid) {
-    requireRegery(runtime).reger.ctel.pin([pre, seqner(sn).qb64], new Saider({ qb64: eventSaid }));
-}
-/** Require the optional concrete registry at an application workflow boundary. */
-export function requireRegery(runtime) {
-    if (!runtime.vdr) {
-        throw new ValidationError("Legacy credential registry is unavailable in this runtime.");
-    }
-    return runtime.vdr;
-}
-function savedCredentials(reger) {
-    return new Set([...reger.saved.getTopItemIter()].map(([keys]) => keys[0]).filter((key) => !!key));
-}

package/esm/keri/npm/src/app/cue-runtime.js

@@ -1,38 +0,0 @@
-import { runtimeTurn } from "./runtime-turn.js";
-/** Use an explicitly selected or sole local habitat; never guess among hosted identities. */
-function resolveCueHab(runtime, hab) {
-    if (hab)
-        return hab;
-    const habitats = runtime.hby.habs.values();
-    const first = habitats.next();
-    return first.done || !habitats.next().done ? null : first.value;
-}
-/** Route one initial cue batch to its concrete owners before removing source records. */
-export function* processCuesOnce(runtime, { hab } = {}) {
-    const interpreter = resolveCueHab(runtime, hab);
-    const count = runtime.cues.length;
-    for (let index = 0; index < count; index++) {
-        const cue = runtime.cues.peekHead();
-        if (!cue)
-            break;
-        if (cue.kin === "query") {
-            runtime.querying.enqueueCue(cue, interpreter);
-        }
-        else if (cue.kin === "stream") {
-            runtime.mailboxDirector.retainQueryCue(cue);
-        }
-        else if (interpreter && runtime.respondant.enqueueCue(interpreter, runtime.cues, hab)) {
-            runtime.querying.observeCue(cue);
-            continue;
-        }
-        runtime.querying.observeCue(cue);
-        runtime.cues.pull();
-    }
-}
-/** Continuous cue worker; network output belongs to the concrete query and reply workers. */
-export function* cueDo(runtime, options = {}) {
-    while (true) {
-        yield* processCuesOnce(runtime, options);
-        yield* runtimeTurn();
-    }
-}

package/esm/keri/npm/src/app/essr.js

@@ -1,170 +0,0 @@
-import { collectPayload, Diger, MtrDex, parseBexter, parsePrefixer, ParserError, parseTagger, } from "cesr-ts";
-import { call, resource } from "effection";
-import { payloadRange } from "../db/payload-view.js";
-import { abortable } from "./abortable.js";
-/**
- * Recipient processing compatible with KERIpy StreamPoster's SCS envelope.
- *
- * This is a new explicit receiver integration, not a port of an upstream
- * receiver. Call only after Exchanger acceptance; the accepted EXN is loaded
- * from its durable table. Ciphertext evidence stays owned by that exchange.
- */
-export class EssrRecipient {
-    /** Bind one hosted key owner to its plaintext staging store. */
-    constructor(
-    /** Explicit local key owner; recipient selection never searches other habitats. */
-    hab, 
-    /** Owns authenticated plaintext staging; the successful caller owns its result. */
-    store) {
-        Object.defineProperty(this, "hab", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: hab
-        });
-        Object.defineProperty(this, "store", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: store
-        });
-    }
-    /**
-     * Verify one accepted exchange's ciphertext, decrypt, then stage plaintext.
-     *
-     * Texter fragments must be concatenated by the supplied Payload reader. A
-     * successful result transfers file ownership to the caller; discarding that
-     * file also invalidates body. No complete byte buffer escapes in the result.
-     */
-    decrypt(said, ciphertext, signal) {
-        return call(() => this.receive(said, ciphertext, signal));
-    }
-    /** Isolate cancellation and retain ownership until the consumer receives the result. */
-    *receive(said, ciphertext, signal) {
-        let received;
-        let transferred = false;
-        // The later I/O child is cancelled and joined before this owner is finalized.
-        yield* resource(function* (provide) {
-            try {
-                yield* provide(undefined);
-            }
-            finally {
-                if (!transferred && received)
-                    yield* call(() => received.plaintext.discard());
-            }
-        });
-        const result = yield* abortable(async (scopeSignal) => {
-            const decision = await this.decryptMessage(said, ciphertext, scopeSignal);
-            if (decision.kind === "accept")
-                received = decision.message;
-            scopeSignal.throwIfAborted();
-            return decision;
-        }, signal);
-        transferred = true;
-        return result;
-    }
-    /** Own the crypto buffer and unfinished file until signal-aware cleanup completes. */
-    async decryptMessage(said, ciphertext, signal) {
-        signal.throwIfAborted();
-        if (!Number.isSafeInteger(ciphertext.size) || ciphertext.size < 0) {
-            throw new RangeError("Invalid payload size");
-        }
-        if (ciphertext.size < 48)
-            return { kind: "reject", reason: "envelope" };
-        // Keep buffers and any finished file owned until the result can transfer them.
-        let plain = null;
-        let plaintext;
-        try {
-            const serder = this.hab.db.exns.get([said]);
-            if (!serder)
-                return { kind: "refuse", reason: "unaccepted" };
-            if (serder.said !== said)
-                throw new Error("Stored ESSR exchange SAID does not match its key");
-            const modifiers = serder.ked?.q;
-            if (serder.ilk !== "exn" || serder.route !== "/essr/req"
-                || !serder.pre || modifiers?.src !== serder.pre
-                || modifiers?.dest !== this.hab.pre || !this.hab.db.prefixes.has(this.hab.pre)
-                || typeof serder.a !== "string") {
-                return { kind: "reject", reason: "envelope" };
-            }
-            const verfer = this.hab.kever?.verfers[0];
-            if (!verfer)
-                throw new Error("ESSR recipient has no accepted verification key");
-            let diger;
-            try {
-                diger = new Diger({ qb64: serder.a });
-            }
-            catch (error) {
-                if (error instanceof ParserError)
-                    return { kind: "reject", reason: "envelope" };
-                throw error;
-            }
-            const sealed = await collectPayload(ciphertext, signal);
-            if (!diger.verify(sealed))
-                return { kind: "reject", reason: "digest" };
-            signal?.throwIfAborted();
-            // The raw crypto boundary returns null only for authentication failure.
-            // Keeper reads, key derivation and unexpected backend failures stay abrupt.
-            plain = this.hab.mgr.open(sealed, verfer);
-            if (plain === null)
-                return { kind: "reject", reason: "decrypt" };
-            signal?.throwIfAborted();
-            const offset = bodyOffset(plain, serder.pre);
-            if (offset === null)
-                return { kind: "reject", reason: "framing" };
-            const sink = await this.store.stage(signal);
-            try {
-                for (let start = 0; start < plain.length; start += 65536) {
-                    await sink.write(plain.subarray(start, start + 65536));
-                }
-                plaintext = await sink.finish();
-            }
-            finally {
-                // Successful finish transferred ownership, so this only removes an
-                // unfinished stage when writing or cancellation failed.
-                await sink.abort();
-            }
-            return {
-                kind: "accept",
-                message: { sender: serder.pre, recipient: this.hab.pre, plaintext, body: payloadRange(plaintext, offset) },
-            };
-        }
-        catch (error) {
-            // finish may have transferred a file before abort/hand-off failed.
-            if (plaintext) {
-                try {
-                    await plaintext.discard();
-                }
-                catch (cleanup) {
-                    throw new AggregateError([error, cleanup], "ESSR processing and plaintext cleanup failed");
-                }
-            }
-            throw error;
-        }
-        finally {
-            plain?.fill(0);
-        }
-    }
-}
-/** Read KERIpy's text-qualified SCS tag, source prefix, and variable padding. */
-function bodyOffset(plain, sender) {
-    try {
-        const tag = parseTagger(plain, "txt");
-        if (tag.code !== MtrDex.Tag3 || tag.tag !== "SCS")
-            return null;
-        const prefix = parsePrefixer(plain.subarray(tag.fullSize), "txt");
-        if (prefix.qb64 !== sender)
-            return null;
-        const paddingAt = tag.fullSize + prefix.fullSize;
-        const padding = parseBexter(plain.subarray(paddingAt), "txt");
-        const offset = paddingAt + padding.fullSize;
-        if (offset >= plain.length)
-            return null;
-        return offset;
-    }
-    catch (error) {
-        if (error instanceof ParserError)
-            return null;
-        throw error;
-    }
-}