keri-ts 2.0.1 → 2.2.0

package/README.md

@@ -13,9 +13,20 @@ npm install keri-ts
 
 - default import: browser-safe core/types surface
 - `keri-ts/runtime`: explicit non-browser-safe runtime surface
-- `keri-ts/db`: explicit LMDB-backed storage surface
+- `keri-ts/db`: backend-neutral storage surface
+- `keri-ts/db/lmdb`: native LMDB storage backend
+- `keri-ts/db/indexeddb`: browser IndexedDB storage backend (`indexedDbOpener`).
+  The opener is single-writer by default: its first store takes a Web Locks lock per
+  store identity (`base`, `name`, `temp`), shared by every family it creates and
+  released when the last closes. A second opener or tab gets `StoreLockHeldError`,
+  and an engine without `navigator.locks` gets `StoreLockUnsupportedError`. Pass
+  `unsafeSkipStoreLock: true` only when another mechanism serializes writers (for
+  example a SharedWorker owner); `locks` injects a lock manager for tests
+- `keri-ts/runtime/web`: browser host concerns (`barrierHttpClient` output barrier,
+  `acquireStoreLock` and `storeLockKey` for hosts that compose stores themselves,
+  `requestPersistentStorage`)
 
-Those three entrypoints are the general library surfaces. `keri-ts/cli` is the
+These entrypoints are the general library surfaces. `keri-ts/cli` is the
 separate command-helper boundary used by Tufa. Runnable CLI/server ownership
 lives in `@keri-ts/tufa`.
 
@@ -25,6 +36,23 @@ implementation-module exports do not automatically become package API. npm deep
 imports such as `keri-ts/app/...` and `keri-ts/core/...` are not supported. Import
 runtime operations from `keri-ts/runtime` and storage from `keri-ts/db`.
 
+## Browser bundles
+
+`keri-ts`, `keri-ts/runtime`, `keri-ts/runtime/web`, `keri-ts/db` and
+`keri-ts/db/indexeddb` carry a
+`browser` export condition that resolves to a build of the same entrypoint
+without the Node polyfill import, so bundlers targeting the browser reach no
+`node:` module. `keri-ts/cli`, `keri-ts/db/lmdb` and `keri-ts/runtime/node` are
+Node-only and have no `browser` condition. The `import` and `types` targets are
+unchanged.
+
+The graph includes `cesr-ts`, which uses a top-level `await` to instantiate its
+Argon2 WebAssembly, so bundle as ESM targeting ES2022 or later. See the
+`cesr-ts` README for the Content Security Policy note.
+
+esbuild also fails on `effection`'s `main()` runner, which lazily imports
+`node:process`; mark `node:process` external. Vite and webpack need nothing.
+
 ## Maintainer Docs
 
 - `docs/ARCHITECTURE_MAP.md`: package and module ownership map

package/esm/keri/npm/src/acdc/authoring.js

@@ -0,0 +1,195 @@
+/**
+ * Finite ACDC v2 registry authoring: stage, anchor and update protocol cores.
+ *
+ * Existing engines own acceptance and receipt authentication; this class only
+ * sequences them for one local individual issuer. It reads and writes no
+ * credential inventory: embedders that keep issued or held records wrap it
+ * (the wallet's `WalletAuthor` adds `issue` and `revoke`). Private derivation
+ * requires a `RegistryCustody`, whose coordinate store the embedder supplies.
+ */
+import { bytesEqual, makeBlindState } from "cesr-ts";
+import { isLocalGroupHab } from "../app/multisig/group-members.js";
+import { ValidationError } from "../core/errors.js";
+import { acdcmap, blindate } from "./messaging.js";
+import { matchesRegistrySeal } from "./regeventing.js";
+import { validateSchema as validateAcdcSchema } from "./scheming.js";
+/** Borrow the actual registry environment and receipt collector; acquire no handles or workers. */
+export class RegistryAuthor {
+    constructor(rgy, receiptor, custody) {
+        Object.defineProperty(this, "rgy", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: rgy
+        });
+        Object.defineProperty(this, "receiptor", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: receiptor
+        });
+        Object.defineProperty(this, "custody", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: custody
+        });
+        if (receiptor.hby !== rgy.hby) {
+            throw new ValidationError("Authoring requires the registry environment's actual receipt owner.");
+        }
+        if (custody && (custody.options.hby !== rgy.hby || custody.options.registry.baser !== rgy.baser)) {
+            throw new ValidationError("Authoring custody must use this registry environment's actual owners.");
+        }
+    }
+    /** Resolve the actual local registry; staging supports groups while signing methods enforce their owner. */
+    registry(name, controller) {
+        const registry = this.rgy.registryByName(name);
+        if (!registry || registry.hab.pre !== controller) {
+            throw new ValidationError("Unknown registry or different controller.");
+        }
+        return registry;
+    }
+    /** Signing belongs either to this individual owner or to explicit group approval, never a staging flag. */
+    individual(reg) {
+        if (isLocalGroupHab(this.rgy.hby, reg.hab)) {
+            throw new ValidationError("ACDC v2 group authoring requires member approval.");
+        }
+    }
+    /** Idempotently stage an alias, then return only its exact accepted inception. */
+    *incept(name, controller, auths) {
+        const hab = this.rgy.hby.habs.get(controller);
+        if (!hab || isLocalGroupHab(this.rgy.hby, hab)) {
+            throw new ValidationError("ACDC v2 inception requires a local individual controller.");
+        }
+        const reg = this.rgy.registryByName(name) ?? this.rgy.makeRegistry(name, controller);
+        this.registry(name, controller);
+        const event = reg.store.event(reg.regk);
+        yield* this.anchor(reg, event, auths);
+        return event;
+    }
+    /** Construct the issuer's credential using the existing ACDC v2 finite builder. */
+    create(reg, options) {
+        this.registry(reg.name, reg.hab.pre);
+        return acdcmap(reg.hab.pre, { ...options, regid: reg.regk });
+    }
+    /** Stage one BUP state advance, preserving an exact pending retry and its opening. Never author historical upd. */
+    stage(reg, acdc, state, options = {}) {
+        return this.stageState(reg, acdc, state, options);
+    }
+    /** Share validation and exact pending-next reuse; only the concrete revocation ensure operation can reuse an accepted head. */
+    stageState(reg, acdc, state, options, ensureRevoked = false) {
+        this.registry(reg.name, acdc.issuer);
+        if (!acdc.verify() || acdc.regid !== reg.regk) {
+            throw new ValidationError("Credential does not match this registry.");
+        }
+        const schema = validateAcdcSchema(acdc, this.rgy.hby.db);
+        if (schema.kind !== "valid") {
+            throw new ValidationError(schema.kind === "missing" ? `Missing ACDC schema: ${schema.said}` : schema.reason);
+        }
+        const head = reg.store.headEvent(reg.regk);
+        if (!head || head.ilk === "upd")
+            throw new ValidationError("An accepted ACDC v2 registry head is required.");
+        if (options.public && options.boundEvent) {
+            throw new ValidationError("Public opening cannot use private bound coordinates.");
+        }
+        if (!options.public && !this.custody) {
+            throw new ValidationError("Derived authoring requires provisioned registry custody.");
+        }
+        if (!options.public && this.custody.options.hab !== reg.hab) {
+            throw new ValidationError("Derived authoring requires the registry habitat's custody.");
+        }
+        const sn = Number(BigInt(`0x${head.sad.n}`));
+        if (!Number.isSafeInteger(sn + 1))
+            throw new ValidationError("Registry ordinal is not representable.");
+        let bound;
+        if (options.boundEvent) {
+            const issuee = acdc.issuee, db = this.rgy.hby.db;
+            const event = issuee ? db.getEvtSerder(issuee, options.boundEvent) : null;
+            if (!event || event.sn === null || !Number.isSafeInteger(event.sn)
+                || db.kels.getLast(issuee, event.sn) !== event.said || !db.fullyWitnessed(event)) {
+                throw new ValidationError("Bound update requires an exact accepted witnessed Issuee event.");
+            }
+            bound = { bsn: event.sn, bd: event.said };
+        }
+        const derive = (ordinal) => options.public
+            ? makeBlindState({ sn: ordinal, acdc: acdc.said, state })
+            : this.custody.derive(reg.regk, ordinal, acdc.said, state, bound ? { bound: true, ...bound } : {});
+        const matches = (event, opening) => event.ilk === "bup" && event.sad.b === opening.d.nonce && opening.td.nonce === acdc.said
+            && opening.ts.label === state;
+        const pending = [...reg.store.baser.evts.getTopItemIter()].map(([, event]) => event).filter((event) => event.regid === reg.regk && event.sad.n === (sn + 1).toString(16));
+        if (pending.length) {
+            const event = pending[0], opening = options.public ? reg.store.publicOpening(event.said) : derive(sn + 1);
+            if (pending.length !== 1 || !opening || !matches(event, opening) || event.sad.p !== head.said) {
+                throw new ValidationError("Registry has a different pending update.");
+            }
+            if (!options.public)
+                this.custody.retainDerivedUpdate(event, opening);
+            return { event, opening };
+        }
+        if (ensureRevoked && sn && head.ilk === "bup") {
+            const published = reg.store.publicOpening(head.said);
+            const opening = options.public ? published : derive(sn);
+            if (opening && matches(head, opening) && (!options.public || published)) {
+                if (!options.public)
+                    this.custody.retainDerivedUpdate(head, opening);
+                return { event: head, opening };
+            }
+        }
+        if (bound && this.rgy.hby.db.getKever(acdc.issuee)?.serder.said !== bound.bd) {
+            throw new ValidationError("New bound update must reference the known current Issuee event.");
+        }
+        const opening = derive(sn + 1), event = blindate(reg.regk, head.said, opening.d.nonce, { sn: sn + 1, stamp: options.stamp });
+        if (!options.public)
+            this.custody.retainDerivedUpdate(event, opening);
+        reg.store.baser.transaction(() => {
+            reg.store.putEvent(event);
+            if (options.public)
+                reg.store.retainOpening(event, opening);
+            const decision = reg.processEvent(event);
+            if (decision.kind === "reject")
+                throw new ValidationError(`Registry update rejected: ${decision.reason}`);
+        });
+        return { event, opening };
+    }
+    /** Advance one explicit state through real anchoring; staging is never reported as accepted. */
+    *update(reg, acdc, state, options = {}) {
+        this.individual(reg);
+        const { event } = this.stage(reg, acdc, state, options);
+        yield* this.anchor(reg, event, options.auths);
+        return event;
+    }
+    /** Reuse the current branch's already signed seal even before receipts; no extra anchor merely to poll. */
+    *anchor(reg, event, auths) {
+        this.registry(reg.name, reg.hab.pre);
+        this.individual(reg);
+        const ordinal = Number(BigInt(`0x${event.sad.n}`));
+        const accepted = reg.store.seqEvent(reg.regk, ordinal);
+        if (accepted && bytesEqual(accepted.raw, event.raw))
+            return;
+        const hab = reg.hab;
+        let current = hab.kever.serder, anchor = null;
+        while (current) {
+            if (current.seals.some((seal) => matchesRegistrySeal(seal, event)))
+                anchor = current;
+            const prior = current.prior ? hab.db.getEvtSerder(hab.pre, current.prior) : null;
+            if (!prior || prior.sn !== current.sn - 1)
+                break;
+            current = prior;
+        }
+        if (!anchor) {
+            const data = [{ i: reg.regk, s: event.sad.n, d: event.said }];
+            if (hab.kever.estOnly)
+                hab.rotate({ data });
+            else
+                hab.interact({ data });
+            anchor = hab.kever.serder;
+        }
+        yield* this.receiptor.receipt(hab.pre, { sn: anchor.sn, allowTcp: true, auths });
+        this.rgy.hby.kevery.processEscrows();
+        reg.processEscrows();
+        const exact = reg.store.seqEvent(reg.regk, ordinal);
+        if (!exact || !bytesEqual(exact.raw, event.raw)) {
+            throw new ValidationError("ACDC v2 registry event remains pending authenticated anchor receipts.");
+        }
+    }
+}

package/esm/keri/npm/src/acdc/chaining.js

@@ -1,28 +1,33 @@
-/** Read-only ACDC chaining over caller-owned node verdicts; authentication and application state policy stay separate. */
+/**
+ * Read-only ACDC chaining over caller-owned node verdicts; authentication and application state policy stay separate.
+ *
+ * KERIpy correspondence: the graph walk and Edge evaluation of upstream PR 1757's
+ * `acdc.evaluating.EdgeEvaluator`. keri-ts keeps a functional seam: protocols
+ * (IPEX) own node authentication and frame admission, then call `walkAcdcGraph`
+ * and `evaluateChain` without this module knowing any disclosure protocol.
+ */
 import { ParserError, Saider } from "cesr-ts";
 import { ValidationError } from "../core/errors.js";
+import { delegationAncestry } from "../core/kel/delegation-ancestry.js";
 import { Schemer } from "../core/scheming.js";
-import { delegationRelation } from "./relating.js";
 import { validateSchema } from "./scheming.js";
-/** Reserved section/group labels include a pin at every level. */
+/** Every Grant-side caller defaults to `open`, matching KERIpy's Grant walk default. */
+export const DEFAULT_GRANT_WALK = "open";
+/** Reserved Edge-group labels include a pin at every level. The top-level Edge Section additionally forbids `w`. */
 export const acdcGroupLabels = new Set(["d", "u", "s", "o", "w"]);
 const leafLabels = new Set([...acdcGroupLabels, "n"]);
-const unary = new Set(["I2I", "NI2I", "DI2I", "E1E", "NOT"]);
+const unary = new Set(["I2I", "NI2I", "DI2I", "E1E", "I1I", "DI1I", "NOT"]);
+/** Latest-wins issuer-to-issuee group. */
 const delegative = new Set(["I2I", "NI2I", "DI2I"]);
-const suppressDefault = new Set([...delegative, "E1E"]);
+/** Latest-wins issuer-to-issuer group, independent of the delegative group; E1E composes with both. */
+const issuerIdentity = new Set(["I1I", "DI1I"]);
+/** Any explicit relation suppresses the implicit I2I/NI2I default. */
+const suppressDefault = new Set([...delegative, "E1E", ...issuerIdentity]);
 /** SAD maps exclude scalar/array edge representations. */
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-/** Empty section containers carry no disclosed edge semantics; malformed nonempty values refuse. */
-export function acdcEdgeBlocks(value) {
-    if (!value || (Array.isArray(value) && !value.length) || (record(value) && !Object.keys(value).length))
-        return [];
-    if (record(value))
-        return [value];
-    return Array.isArray(value) && value.every(record) ? value : null;
-}
-/** Only canonical qualified digests identify expanded leaf targets and schema pins. */
+/** Only canonical qualified digests identify expanded leaf targets, compact commitments and schema pins. */
 function said(value) {
     if (typeof value !== "string")
         return false;
@@ -33,12 +38,116 @@ function said(value) {
         return false;
     }
 }
+/**
+ * Classify a node's `e` field; null is malformed.
+ * Lists, falsy non-map values, non-SAID strings and a top-level `n` or `w` are
+ * malformed. A compact SAID is a valid opaque terminal that names no far nodes.
+ */
+export function acdcEdgeSection(sad) {
+    if (!Object.hasOwn(sad, "e"))
+        return { kind: "none" };
+    const value = sad.e;
+    if (record(value)) {
+        if (!Object.keys(value).length)
+            return { kind: "none" };
+        // The Edge Section is itself an Edge-group, never a leaf, and carries no weight.
+        if (Object.hasOwn(value, "n") || Object.hasOwn(value, "w"))
+            return null;
+        return { kind: "expanded", section: value };
+    }
+    return said(value) ? { kind: "compact", said: value } : null;
+}
 /** Compact Edge strings name blocks, never far ACDCs. Expanded leaves have exact labels. */
 export function acdcEdgeTarget(value) {
     if (!record(value) || !Object.hasOwn(value, "n"))
         return null;
     return Object.keys(value).every((label) => leafLabels.has(label)) && said(value.n) ? value.n : false;
 }
+/**
+ * Walk a disclosed graph of credential views from `origin` in BFS order.
+ *
+ * Every view must verify (including its carried section SAIDs) under its own
+ * SAID key, every Edge Section must be well shaped, every disclosed node must be
+ * reachable and the reachable graph must be acyclic. Closed walks also require
+ * every expanded leaf target to be disclosed; open walks skip undisclosed ones
+ * (see `AcdcWalkPolicy`).
+ * Compact Edge Sections and compact Edge members are opaque terminals.
+ * Protocol frame admission (ilks, nests, duplicates) belongs to the caller.
+ */
+export function walkAcdcGraph(origin, nodes, walk) {
+    for (const [id, { body }] of nodes)
+        if (body.said !== id || !body.verify())
+            return null;
+    if (!nodes.has(origin))
+        return null;
+    const seen = new Set();
+    const order = [];
+    const dependencies = new Map();
+    const queue = [origin];
+    for (let index = 0; index < queue.length; index++) {
+        const id = queue[index];
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        order.push(id);
+        const farNodes = new Set();
+        dependencies.set(id, farNodes);
+        const section = acdcEdgeSection(nodes.get(id).body.sad);
+        if (!section)
+            return null;
+        if (section.kind !== "expanded")
+            continue;
+        const groups = [section.section];
+        for (let g = 0; g < groups.length; g++) {
+            for (const [label, member] of Object.entries(groups[g])) {
+                if (acdcGroupLabels.has(label))
+                    continue;
+                if (typeof member === "string") {
+                    if (!said(member))
+                        return null;
+                    continue;
+                }
+                const target = acdcEdgeTarget(member);
+                if (target === false)
+                    return null;
+                if (target === null) {
+                    if (!record(member))
+                        return null;
+                    groups.push(member);
+                }
+                else if (!nodes.has(target)) {
+                    if (walk === "closed")
+                        return null;
+                }
+                else {
+                    farNodes.add(target);
+                    if (!seen.has(target))
+                        queue.push(target);
+                }
+            }
+        }
+    }
+    if (seen.size !== nodes.size)
+        return null;
+    const parents = new Map();
+    for (const [near, children] of dependencies) {
+        for (const far of children) {
+            if (!parents.has(far))
+                parents.set(far, new Set());
+            parents.get(far).add(near);
+        }
+    }
+    const dependencyOrder = order.filter((id) => dependencies.get(id).size === 0);
+    for (let i = 0; i < dependencyOrder.length; i++) {
+        for (const near of parents.get(dependencyOrder[i]) ?? []) {
+            const children = dependencies.get(near);
+            children.delete(dependencyOrder[i]);
+            if (!children.size)
+                dependencyOrder.push(near);
+        }
+    }
+    return dependencyOrder.length === nodes.size ? order : null;
+}
 /** Missing proof/pin dependencies retain their ordered schema causes for the existing escrow owner. */
 function unknown(reason, retryable = false, schemas = []) {
     return { kind: "unknown", reason, retryable, schemas };
@@ -54,11 +163,64 @@ function reduce(op, members) {
     }
     return { kind: op === "AND" ? "valid" : "invalid" };
 }
+/** Accepted delegation ancestry is the only evidence beyond the two ACDCs; missing KEL evidence can still arrive. */
+function delegatedFrom(db, op, pre, ancestor) {
+    const ancestry = delegationAncestry(db, pre, ancestor);
+    if (ancestry.kind === "valid")
+        return { kind: "valid" };
+    if (ancestry.kind === "refused")
+        return { kind: "invalid" };
+    return unknown(`${op} delegation evidence: ${ancestry.reason}`, true);
+}
+/**
+ * Evaluate the unary relations of one leaf between its near and far ACDCs.
+ *
+ * Unrecognized tokens and the unimplemented NOT are non-retryable unknowns that
+ * are ANDed with, not substituted for, the recognized relations. Absent any
+ * explicit relation, I2I applies when the far node has an issuee, else NI2I.
+ * The delegative and issuer-identity groups are each latest-wins.
+ */
+function leafRelation(db, ops, near, far) {
+    const relations = [];
+    const unrecognized = ops.filter((token) => !unary.has(token));
+    if (unrecognized.length)
+        relations.push(unknown(`Unrecognized unary Edge operator ${unrecognized.join(", ")}.`));
+    if (ops.includes("NOT"))
+        relations.push(unknown("Unimplemented unary Edge operator NOT."));
+    const operators = [...ops];
+    if (!operators.some((token) => suppressDefault.has(token)))
+        operators.push(far.issuee !== null ? "I2I" : "NI2I");
+    const delegate = operators.findLast((token) => delegative.has(token));
+    const identity = operators.findLast((token) => issuerIdentity.has(token));
+    const truth = (value) => ({ kind: value ? "valid" : "invalid" });
+    if (operators.includes("E1E")) {
+        relations.push(truth(Boolean(near.issuee && far.issuee && near.issuee === far.issuee)));
+    }
+    if (delegate === "I2I")
+        relations.push(truth(Boolean(far.issuee && near.issuer === far.issuee)));
+    if (delegate === "DI2I") {
+        if (!near.issuer || !far.issuee)
+            relations.push({ kind: "invalid" });
+        else if (near.issuer !== far.issuee)
+            relations.push(delegatedFrom(db, "DI2I", near.issuer, far.issuee));
+    }
+    // Issuer identity never reads issuees.
+    if (identity) {
+        if (!near.issuer || !far.issuer)
+            relations.push({ kind: "invalid" });
+        else if (near.issuer !== far.issuer) {
+            relations.push(identity === "I1I" ? { kind: "invalid" } : delegatedFrom(db, "DI1I", near.issuer, far.issuer));
+        }
+    }
+    return reduce("AND", relations);
+}
 /**
  * Validate every own schema, then conjoin each caller verdict with its complete edge expression.
  * Every branch is inspected for malformed shape, even when its truth value is unused.
+ * Under an open walk an undisclosed far node is a non-retryable unknown for its leaf.
  * Protocol callers supply issuer authentication; applications supply their state policy.
- * This helper reads schemas but writes no records and publishes no cues.
+ * The graph must come from `walkAcdcGraph` (directly or through a protocol walk).
+ * This helper reads schemas and KEL state but writes no records and publishes no cues.
  */
 export function evaluateChain(graph, verdicts, db) {
     // Own schemas are global obligations, unlike optional edge pins and node verdicts.
@@ -78,12 +240,15 @@ export function evaluateChain(graph, verdicts, db) {
         if (!node || !auth)
             return null;
         memo.set(id, unknown(`Node ${id} is already being evaluated.`));
-        const blocks = acdcEdgeBlocks(node.sad.e);
-        if (!blocks)
+        const section = acdcEdgeSection(node.sad);
+        if (!section)
             return null;
         const members = [auth];
-        for (const block of blocks) {
-            const result = evaluateEdge(block, node, []);
+        if (section.kind === "compact") {
+            members.push(unknown(`Node ${id} carries compact Edge Section ${section.said}, which cannot be evaluated.`));
+        }
+        else if (section.kind === "expanded") {
+            const result = evaluateGroup(section.section, node, []);
             if (!result)
                 return null;
             members.push(result);
@@ -92,50 +257,41 @@ export function evaluateChain(graph, verdicts, db) {
         memo.set(id, result);
         return result;
     };
-    const evaluateEdge = (edge, near, inherited) => {
-        const target = acdcEdgeTarget(edge);
-        if (target === false)
-            return null;
-        const pins = Object.hasOwn(edge, "s") ? [...inherited, edge.s] : inherited;
-        if (target !== null)
-            return evaluateLeaf(edge, target, near, pins);
-        const op = Object.hasOwn(edge, "o") ? edge.o : "AND";
+    const evaluateGroup = (group, near, inherited) => {
+        const pins = Object.hasOwn(group, "s") ? [...inherited, group.s] : inherited;
+        const op = Object.hasOwn(group, "o") ? group.o : "AND";
         if (typeof op !== "string")
             return null;
         const members = [];
-        for (const [label, member] of Object.entries(edge)) {
+        for (const [label, member] of Object.entries(group)) {
             if (acdcGroupLabels.has(label))
                 continue;
             if (typeof member === "string") {
-                members.push(unknown(`Compact Edge ${label} cannot be dereferenced.`));
-            }
-            else {
-                if (!record(member))
+                if (!said(member))
                     return null;
-                const result = evaluateEdge(member, near, pins);
-                if (!result)
-                    return null;
-                members.push(result);
+                members.push(unknown(`Compact Edge ${label} cannot be dereferenced.`));
+                continue;
             }
+            const target = acdcEdgeTarget(member);
+            if (target === false || !record(member))
+                return null;
+            const result = target === null ? evaluateGroup(member, near, pins) : evaluateLeaf(member, target, near, pins);
+            if (!result)
+                return null;
+            members.push(result);
         }
         if (!members.length)
             return null;
         return op === "AND" || op === "OR" ? reduce(op, members) : unknown(`Unsupported Edge-group operator ${op}.`);
     };
-    const evaluateLeaf = (edge, target, near, pins) => {
-        const far = graph.nodes.get(target)?.body;
-        if (!far)
-            return null;
+    const evaluateLeaf = (edge, target, near, inherited) => {
+        const pins = Object.hasOwn(edge, "s") ? [...inherited, edge.s] : inherited;
         const op = edge.o;
         const ops = op == null ? [] : typeof op === "string" ? [op] : Array.isArray(op) ? [...op] : null;
-        if (!ops)
+        if (!ops || !ops.every((token) => typeof token === "string"))
             return null;
         // Pin shape is morphological, so validate it before unsupported tokens or relations.
         const resolved = [];
-        const ownSchema = far.schema;
-        const ownSchemaId = record(ownSchema) ? ownSchema.$id : ownSchema;
-        if (pins.length && typeof ownSchemaId !== "string")
-            return null;
         for (const pin of pins) {
             if (typeof pin === "string") {
                 if (!said(pin))
@@ -159,55 +315,33 @@ export function evaluateChain(graph, verdicts, db) {
             else
                 return null;
         }
-        let own;
-        if (ops.some((token) => typeof token !== "string" || !unary.has(token))) {
-            own = unknown("Unrecognized unary Edge operator.");
+        const far = graph.nodes.get(target)?.body;
+        if (!far) {
+            // A closed walk never yields a graph with an undisclosed target.
+            return graph.walk === "open" ? unknown(`Far node ${target} is not disclosed.`) : null;
         }
-        else {
-            const operators = ops;
-            if (!operators.some((token) => suppressDefault.has(token)))
-                operators.push(far.issuee !== null ? "I2I" : "NI2I");
-            const delegate = operators.findLast((token) => delegative.has(token));
-            if (operators.includes("NOT")) {
-                own = unknown("Unimplemented unary Edge operator.");
-            }
-            else {
-                let matched = (!operators.includes("E1E") || Boolean(near.issuee && far.issuee && near.issuee === far.issuee))
-                    && (delegate !== "I2I" || Boolean(far.issuee && near.issuer === far.issuee));
-                let pending;
-                if (matched && delegate === "DI2I") {
-                    if (!far.issuee || !near.issuer)
-                        matched = false;
-                    else if (near.issuer !== far.issuee) {
-                        const relation = delegationRelation(db, near.issuer, far.issuee);
-                        if (relation.kind === "refused")
-                            matched = false;
-                        else if (relation.kind === "pending")
-                            pending = unknown(relation.reason, true);
-                    }
-                }
-                own = { kind: matched ? "valid" : "invalid" };
-                if (matched) {
-                    for (let pin of resolved) {
-                        if (pin === ownSchemaId && record(ownSchema))
-                            pin = ownSchema;
-                        const result = validateSchema(far, db, pin);
-                        if (result.kind === "valid")
-                            continue;
-                        own = result.kind === "missing"
-                            ? unknown(`Missing edge schema ${result.said}.`, true, [result.said])
-                            : { kind: "invalid" };
-                        break;
-                    }
-                }
-                // Pending delegation cannot replace a pin's decided refusal.
-                if (pending)
-                    own = reduce("AND", [own, pending]);
+        const ownSchema = far.schema;
+        const ownSchemaId = record(ownSchema) ? ownSchema.$id : ownSchema;
+        if (pins.length && typeof ownSchemaId !== "string")
+            return null;
+        const relation = leafRelation(db, ops, near, far);
+        const own = [relation];
+        // A decided relation refusal needs no pin evidence; otherwise every pin is evaluated, not only the first failure.
+        if (relation.kind !== "invalid") {
+            for (let pin of resolved) {
+                if (pin === ownSchemaId && record(ownSchema))
+                    pin = ownSchema;
+                const result = validateSchema(far, db, pin);
+                if (result.kind === "valid")
+                    continue;
+                own.push(result.kind === "missing"
+                    ? unknown(`Missing edge schema ${result.said}.`, true, [result.said])
+                    : { kind: "invalid" });
             }
         }
         // Do not short-circuit a far subtree: its shape cannot be outvoted by this leaf.
         const farVerdict = evaluateNode(target);
-        return farVerdict ? reduce("AND", [own, farVerdict]) : null;
+        return farVerdict ? reduce("AND", [reduce("AND", own), farVerdict]) : null;
     };
     return graph.order.length ? evaluateNode(graph.order[0]) : null;
 }