keri-ts 2.0.1 → 2.2.0

package/esm/keri/npm/src/app/ipex/pending-presentations.js

@@ -0,0 +1,46 @@
+/**
+ * Pure read of the Grants a disclosee holds pending until it fetches their registry proofs.
+ *
+ * A presentation Grant reaches the disclosee as a pending exchange: it is authenticated and stored, but
+ * stays unfinished until `requestUnblind` completes the registry proofs behind it. This lists the pending
+ * v2 Grants addressed to local identifiers whose deadline has not passed. An issuance Grant waiting for the
+ * holder's exchange consent is pending in the same table; `pendingIssuanceGrants` names those, and a caller
+ * that wants presentations only removes them.
+ */
+import { SerderACDC } from "cesr-ts";
+import { ValidationError } from "../../core/errors.js";
+import { unblindingStatus } from "./unblinding-workflow.js";
+/**
+ * The pending v2 Grants addressed to a local identifier (to `hab` when given) that are inside their deadline.
+ * Mutates nothing.
+ */
+export function pendingPresentations(ops, { hab } = {}) {
+    const { deps } = ops, found = [];
+    for (const [[grant], serder] of [...deps.hby.db.epse.getTopItemIter()]) {
+        const disclosee = serder.sad?.ri;
+        if (serder.route !== "/ipex/grant" || serder.pvrsn.major < 2 || typeof disclosee !== "string")
+            continue;
+        if (!deps.hby.habs.has(disclosee) || (hab && hab.pre !== disclosee))
+            continue;
+        try {
+            const status = unblindingStatus(ops, grant);
+            if (status.state !== "active" && status.state !== "interrupted")
+                continue;
+            const body = deps.exc.retainedInput(grant)?.nests?.[0]?.body;
+            found.push({
+                grant,
+                disclosee,
+                presenter: serder.pre,
+                credential: body instanceof SerderACDC ? body.said ?? undefined : undefined,
+                deadline: deps.exc.exchangeDeadline(serder),
+                status,
+            });
+        }
+        catch (error) {
+            // Not a Grant this runtime can unblind (no deadline): it is not pending here.
+            if (!(error instanceof ValidationError))
+                throw error;
+        }
+    }
+    return found;
+}

package/esm/keri/npm/src/app/ipex/presentation-files.js

@@ -0,0 +1,200 @@
+/**
+ * Exact public Grant files for a group presentation: the runtime's half of the file hand-off.
+ *
+ * A group presenter freezes one selected public view as an exact Grant file, a member appends its signature to
+ * the same file ({@link preparePresentationFile}), and the completed file is imported once the sender threshold
+ * is met ({@link resumePresentationFile}); the elected lead then delivers it ({@link deliverPreparedGrant} in
+ * `presenting.ts`). The file is only the transport between members: every check of what a file may change (the
+ * exact body and nested evidence, the original deadline, the issuer authorization of every selected registry
+ * node) is here, not in the command that reads and writes the file.
+ */
+import { bytesEqual, collectPayload, concatBytes, Counter, framePayload, parseAttachmentGroup, parseBytes, SerderKERI, Vrsn_2_0, } from "cesr-ts";
+import { call } from "effection";
+import { grantTransactionId } from "../../acdc/dhking.js";
+import { ValidationError } from "../../core/errors.js";
+import { messageAttachmentGroups } from "../../core/protocol-serialization.js";
+import { timestampMicros } from "../../time/mod.js";
+import { isLocalGroupHab } from "../multisig/group-members.js";
+import { envelopeFromFrame } from "../protocol/parsering.js";
+import { exchangeWire, IpexDiscloser } from "./ipex-discloser.js";
+/** Borrow the actual local signer and enabled KRAM; KRAM policy owns the preparation lifetime. */
+function discloserOf(deps, hab) {
+    if (deps.hby.habs.get(hab.pre) !== hab || !deps.protocol.kvy.kramer) {
+        throw new ValidationError("Prepared presentation requires its local habitat, registry and enabled KRAM");
+    }
+    return new IpexDiscloser(deps.hby, deps.rgy.store, deps.exc, deps.receiptor, undefined, deps.views);
+}
+/** Keep the original v2 IPEX clock; no file can recreate a missing or terminated preparation. */
+function deadline(deps, said, expected) {
+    const selected = deps.exc.retainedInput(said)?.serder;
+    const date = selected && deps.exc.exchangeDeadline(selected);
+    if (!date || deps.hby.db.erpy.get([said]) || expected !== undefined && date !== expected) {
+        throw new ValidationError("Prepared Grant is unavailable, terminated or its original deadline changed");
+    }
+    const expiry = timestampMicros(date);
+    if (expiry === null)
+        throw new Error("Corrupt prepared presentation deadline");
+    if (BigInt(deps.clock.now()) * 1000n >= expiry) {
+        throw new ValidationError("Original prepared presentation deadline expired");
+    }
+    return date;
+}
+/** Serialize exact existing frames; signatures never authorize a change to nested public evidence. */
+function* wire(frame) {
+    return yield* call(() => collectPayload(framePayload(frame)));
+}
+/** Compare complete nested bytes, including every original proof family and order. */
+function* sameNodes(left, right) {
+    if (left.nests?.length !== right.nests?.length)
+        return false;
+    for (let i = 0; i < (left.nests?.length ?? 0); i++) {
+        if (!bytesEqual(yield* wire(left.nests[i]), yield* wire(right.nests[i])))
+            return false;
+    }
+    return true;
+}
+/** Project individual factors rather than grouping serialization, allowing only authentication additions. */
+function factors(frame) {
+    const proof = envelopeFromFrame(frame);
+    return new Set([
+        ...proof.tsgs.flatMap(group => group.sigers.map(sig => JSON.stringify(["tsg", group.pre, group.sn.toString(), group.said, sig.qb64]))),
+        ...proof.cigars.map(cigar => JSON.stringify(["cigar", cigar.verfer?.qb64, cigar.qb64])),
+        ...proof.ssts.map(seal => JSON.stringify(["seal", seal.i.qb64, seal.s.num.toString(), seal.d.qb64])),
+    ]);
+}
+/** Feed exact signed factors through the ordinary exchange owner; nested authority remains independent. */
+function input(frame) {
+    const proof = envelopeFromFrame(frame);
+    return {
+        serder: frame.body,
+        tsgs: proof.tsgs,
+        cigars: proof.cigars,
+        sourceSeals: proof.ssts,
+        nests: frame.nests,
+        gvrsn: Vrsn_2_0,
+    };
+}
+/** Reconstruct the authenticated original before importing any completed file. */
+function retained(deps, said) {
+    const saved = deps.exc.retainedInput(said);
+    if (!saved)
+        throw new ValidationError("Resume requires the original locally prepared sender threshold");
+    const frame = {
+        body: saved.serder,
+        attachments: messageAttachmentGroups({ tsgs: saved.tsgs, cigars: saved.cigars, sourceSeals: saved.sourceSeals }, Vrsn_2_0).map(group => parseAttachmentGroup(group.raw, Vrsn_2_0, "txt").group),
+        gvrsn: Vrsn_2_0,
+        nests: [...saved.nests ?? []],
+    };
+    return frame;
+}
+/** Require issuer authority for every selected registry node, including retryably unknown current openings. */
+function requireScope(deps, frame) {
+    const body = frame.body, xid = grantTransactionId(body);
+    const context = deps.exc.presentationContext(body.said, {
+        xid,
+        sender: body.pre,
+        recipient: body.sad.ri,
+    });
+    const expected = new Map();
+    for (const node of frame.nests ?? []) {
+        const credential = node.body;
+        if (credential.regid) {
+            const nodes = expected.get(credential.regid) ?? new Set();
+            nodes.add(credential.said);
+            expected.set(credential.regid, nodes);
+        }
+    }
+    if (!expected.size || !context || context.registries.size !== expected.size
+        || [...expected].some(([regid, nodes]) => context.registries.get(regid)?.length !== nodes.size
+            || context.registries.get(regid).some(said => !nodes.has(said)))) {
+        throw new ValidationError("Exact Grant lacks complete issuer authorization for every selected registry node");
+    }
+}
+/** Freeze one selected public view; a group member may append its signature to the same exact proposal file. */
+export function* preparePresentationFile(deps, hab, selection, options, proposal) {
+    const owner = discloserOf(deps, hab);
+    if ((options.gvrsn ?? Vrsn_2_0).major !== 2)
+        throw new ValidationError("Prepared presentation requires genus 2");
+    if (selection.refresh || selection.derive || selection.openings?.length || options.anchor) {
+        throw new ValidationError("Exact preparation preserves the selected view; refresh and anchored presentation use their existing commands");
+    }
+    if (proposal && !isLocalGroupHab(deps.hby, hab)) {
+        throw new ValidationError("A sender contribution requires a local group member");
+    }
+    const original = proposal ? owner.inspectGrantFile(proposal).frame : undefined;
+    const body = original?.body;
+    const previous = body && deps.exc.exchangeDeadline(body) ? deadline(deps, body.said) : undefined;
+    const prepared = yield* owner.prepareGrantFileBody(hab.pre, selection, {
+        ...options,
+        ...(body ? { date: body.stamp, kind: body.kind } : {}),
+    });
+    const exn = body?.ilk === "xip"
+        ? new SerderKERI({ sad: { ...prepared.exn.sad, u: body.sad.u }, kind: body.kind, makify: true })
+        : prepared.exn;
+    const unsigned = parseBytes(concatBytes(Counter.makeGVC(Vrsn_2_0), exn.raw, Counter.enclose({ qb64: prepared.nests, version: Vrsn_2_0 })))[0];
+    if (original && (!bytesEqual(exn.raw, original.body.raw) || !(yield* sameNodes(unsigned, original)))) {
+        throw new ValidationError("Group contribution differs from the selected view, exact Grant or parties");
+    }
+    if (previous)
+        deadline(deps, exn.said, previous);
+    const candidate = parseBytes(exchangeWire(hab, exn, prepared.nests))[0];
+    if (original)
+        candidate.attachments = [...original.attachments, ...candidate.attachments];
+    const raw = yield* wire(candidate), checked = owner.inspectGrantFile(raw);
+    if (previous)
+        deadline(deps, exn.said, previous);
+    if (previous) {
+        const decision = yield* deps.exc.acceptPreparedGrantContribution(input(candidate));
+        if (decision.kind === "reject")
+            throw new ValidationError(decision.reason);
+    }
+    else if (checked.completeSigners.includes(hab.pre)) {
+        yield* deps.reactor.processBytes(raw, { local: true });
+    }
+    else {
+        // Keep partial sender proof in ordinary escrow without granting accepted KRAM authority.
+        const decision = yield* deps.exc.processEvent(input(candidate));
+        if (decision.kind === "reject")
+            throw new ValidationError(decision.reason);
+    }
+    // A partial group proposal has no accepted lifetime and grants no auxiliary authority.
+    const frozen = deps.exc.exchangeDeadline(exn) ? deadline(deps, exn.said, previous) : null;
+    const saved = deps.hby.db.exns.get([exn.said]) ?? deps.hby.db.epse.get([exn.said]);
+    if (!saved || !bytesEqual(saved.raw, exn.raw)) {
+        throw new ValidationError("v2 IPEX preparation did not retain the exact Grant");
+    }
+    return { grant: exn.said, wire: raw, prepared: checked.completeSigners.includes(hab.pre), deadline: frozen };
+}
+/** Import only additions to an existing sender-authenticated preparation; missing issuer consent cannot be recreated. */
+export function* resumePresentationFile(deps, hab, said, raw) {
+    const owner = discloserOf(deps, hab), frozen = deadline(deps, said), original = retained(deps, said);
+    if (original.body.pre !== hab.pre) {
+        throw new ValidationError("Resume selects the original local discloser");
+    }
+    const candidate = owner.inspectGrantFile(raw, {
+        said,
+        sender: hab.pre,
+        recipient: original.body.sad.ri,
+    });
+    if (candidate.partialSigners.length || !candidate.completeSigners.includes(hab.pre)
+        || !bytesEqual(candidate.frame.body.raw, original.body.raw) || !(yield* sameNodes(candidate.frame, original))) {
+        throw new ValidationError("Resume requires complete authentication on the exact original Grant and nested evidence");
+    }
+    const added = factors(candidate.frame);
+    if ([...factors(original)].some(factor => !added.has(factor))) {
+        throw new ValidationError("Resume cannot remove original authentication");
+    }
+    deadline(deps, said, frozen);
+    const decision = yield* deps.exc.acceptPreparedGrantContribution(input(candidate.frame));
+    if (decision.kind === "reject")
+        throw new ValidationError(decision.reason);
+    deadline(deps, said, frozen);
+    requireScope(deps, candidate.frame);
+    const nodes = concatBytes(Counter.makeGVC(Vrsn_2_0), ...yield* call(() => Promise.all(candidate.frame.nests.map((node) => collectPayload(framePayload(node))))));
+    return {
+        grant: said,
+        wire: raw.slice(),
+        deadline: frozen,
+        delivery: concatBytes(owner.proofSupport(nodes, hab), raw),
+    };
+}

package/esm/keri/npm/src/app/ipex/presenting.js

@@ -0,0 +1,401 @@
+/**
+ * Runtime-owned operations for single-signature v2 IPEX presentation.
+ *
+ * `present` is the user's one explicit consent: it selects the credential view, signs the Offer, Grant,
+ * Apply, Agree or Spurn (a Grant may also anchor its presentation proof under that same consent), takes
+ * the signed exchange into local authenticated intake and queues it. It returns after local commit and
+ * never waits for the peer. `PresentationOperations.processOnce` is the only worker: it delivers the
+ * already signed bytes, retries a failed delivery with a doubling delay until the exchange's deadline
+ * and ends the operation at the Grant's original exchange deadline. It never signs.
+ *
+ * There is no operation store. The signed exchange is itself durable (the accepted exchange and its
+ * signatures), and `resendPresentation` rebuilds its wire from those stored factors, signing nothing, so
+ * a process that ended before or during delivery can deliver again on the user's explicit request. Nothing
+ * is sent after a restart on its own.
+ *
+ * Status is the live table plus what the stores prove. Delivery itself leaves no protocol record, so
+ * only the peer's stored answer proves it:
+ *
+ * | stores prove                                              | status                                       |
+ * | --------------------------------------------------------- | -------------------------------------------- |
+ * | the peer's answer is stored (`erpy`)                      | `done`, with the `response`                  |
+ * | signed exchange accepted, deadline passed, no answer      | `expired`                                    |
+ * | signed exchange accepted, no answer, not live             | `interrupted`: `resendPresentation` delivers |
+ *
+ * Lost on reload, by design: the delivery attempts and the last transport failure, the `abandoned` and
+ * `failed` end states with their reasons, the delivery destinations, and the fact of a delivery nobody
+ * answered (it reads `done` in the process that delivered it and `interrupted` after a reload; sending it
+ * again is harmless, the peer deduplicates by SAID).
+ *
+ * Workflow-contract shape (`app/runtime/workflow-contract.ts`): `present` returns after local commit,
+ * `presentationStatus` is a pure read, `waitForPresentation` only observes and returns a `WaitResult`, and
+ * `abandonPresentation` is local. A host that wants only the signed bytes (a file, a QR code) uses
+ * `preparePresentation`, which commits locally and queues nothing.
+ *
+ * Group identifiers are refused here: a group presents through {@link proposeGroupPresentation}, which hands the
+ * frozen Grant to the group IPEX owner (`group-ipex.ts`) for member approval.
+ */
+import { collectPayload, concatBytes, Counter, framePayload, parseBytes, Vrsn_2_0, } from "cesr-ts";
+import { action, call, race } from "effection";
+import { RegistryCustody } from "../../acdc/custody.js";
+import { ValidationError } from "../../core/errors.js";
+import { timestampMicros } from "../../time/mod.js";
+import { registryEventRef } from "../credentials/registry-settling.js";
+import { isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
+import { proposeRegistryEvent } from "../multisig/proposing.js";
+import { DeliveryOutbox } from "../runtime/delivery-outbox.js";
+import { observeUntil, waitOnClock } from "../runtime/workflow-contract.js";
+import { proposeGroupIpex, proposeGroupIpexAfter as groupIpexAfter, } from "./group-ipex.js";
+import { IpexDiscloser, storedExchangeWire, } from "./ipex-discloser.js";
+import { prepareAcdcV2GroupIpex } from "./ipex-grouping.js";
+/** How long delivery failures may last on an exchange with no deadline (an Apply, an Agree) before it reads `failed`. */
+export const PRESENTATION_RETRY_BOUND_MS = 600_000;
+const EXPIRED = "The presentation reached its original exchange deadline";
+const PENDING = "ACDC v2 exchange remains pending authenticated intake.";
+function iso(ms) {
+    return new Date(ms).toISOString();
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Whether the exchange's deadline has passed; an exchange without one never lapses. */
+function lapsed(clock, deadline) {
+    const expiry = timestampMicros(deadline);
+    return expiry !== null && BigInt(clock.now()) * 1000n >= expiry;
+}
+/** The live deliveries table and its driver. One per host runtime; every identifier may present through it. */
+export class PresentationOperations {
+    constructor(deps) {
+        Object.defineProperty(this, "deps", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: deps
+        });
+        /** Deliveries live in this process. Internal to this module's functions. */
+        Object.defineProperty(this, "live", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        /** Presentations that delivered or ended in this process; not durable, see the module doc. */
+        Object.defineProperty(this, "settled", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+    }
+    /** Whether a delivery is live. */
+    active() {
+        return this.live.size > 0;
+    }
+    /** Advance every live delivery by one pass. */
+    *processOnce() {
+        const { deps } = this;
+        for (const op of [...this.live.values()]) {
+            if (op.busy || !this.live.has(op.said))
+                continue;
+            op.busy = true;
+            try {
+                const left = op.expires === null ? null : op.expires - BigInt(deps.clock.now()) * 1000n;
+                if (left !== null && left <= 0n)
+                    this.end(op, "expired", EXPIRED);
+                else if ((yield* race([this.deliver(op), this.timer(left)])) === "expired")
+                    this.end(op, "expired", EXPIRED);
+            }
+            finally {
+                op.busy = false;
+            }
+        }
+    }
+    /** End a live delivery: drop it, remember why until the process ends, tell the sink. */
+    end(op, state, reason) {
+        this.live.delete(op.said);
+        this.settled.set(op.said, { verb: op.verb, state, reason });
+        this.deps.changes?.push({ kind: "presentation", id: op.said });
+    }
+    /** Resolves only when the deadline passes; never resolves for an exchange without one. */
+    *timer(left) {
+        if (left === null)
+            return yield* action(() => () => { });
+        yield* waitOnClock(this.deps.clock, Number(left) / 1000);
+        return "expired";
+    }
+    /**
+     * One attempt: a failure keeps the bytes and is retried after a doubling delay until the exchange's deadline,
+     * or, for an exchange with none, until failures have lasted {@link PRESENTATION_RETRY_BOUND_MS}.
+     */
+    *deliver(op) {
+        const { deps } = this;
+        try {
+            const done = yield* op.outbox.drain(deps.delivery, deps.clock, op.expires === null ? PRESENTATION_RETRY_BOUND_MS : undefined);
+            if (!done) {
+                deps.changes?.push({ kind: "presentation", id: op.said });
+                return;
+            }
+        }
+        catch (error) {
+            this.end(op, "failed", message(error));
+            return;
+        }
+        this.live.delete(op.said);
+        this.settled.set(op.said, { verb: op.verb, state: "done", deliveries: op.outbox.delivered });
+        deps.changes?.push({ kind: "presentation", id: op.said });
+    }
+}
+const RESEND = "Delivery is not recorded across a restart and no answer is stored; resendPresentation delivers it again";
+/** The discloser for one sender; derivation needs custody over the sender's own Keeper root. */
+function discloserFor(deps, hab, derive) {
+    let custody;
+    if (derive) {
+        if (!deps.derived)
+            throw new ValidationError("Derived disclosure requires the embedder's derivation store.");
+        custody = new RegistryCustody({ hby: deps.hby, hab, registry: deps.rgy.store, store: deps.derived });
+    }
+    return new IpexDiscloser(deps.hby, deps.rgy.store, deps.exc, deps.receiptor, custody, deps.views);
+}
+/**
+ * Sign the selected message and take it into local authenticated intake, without recording an operation or
+ * delivering. This is the whole consent: the returned bytes are final.
+ *
+ * @throws ValidationError for a group identifier, an unknown presentation registry, a selection the discloser
+ * refuses, or an exchange that does not reach authenticated intake.
+ */
+export function* preparePresentation(deps, input) {
+    const { hab } = input;
+    let presentation;
+    if (input.verb === "grant" && input.options.presentationRegistry) {
+        presentation = deps.rgy.registryByName(input.options.presentationRegistry);
+        if (!presentation)
+            throw new ValidationError("Unknown presentation registry.");
+    }
+    const discloser = discloserFor(deps, hab, "selection" in input ? input.selection.derive : undefined);
+    const sender = hab.pre;
+    let prepared;
+    switch (input.verb) {
+        case "apply":
+            prepared = yield* discloser.prepareApply(sender, input.options);
+            break;
+        case "agree":
+        case "spurn":
+            prepared = yield* discloser.prepareReply(sender, input.verb, input.prior, input.message ?? "", input.recipient, input.auths);
+            break;
+        case "offer":
+            prepared = yield* discloser.prepareOffer(sender, input.selection, input.options);
+            break;
+        case "grant":
+            prepared = yield* discloser.prepareGrant(sender, input.selection, {
+                ...input.options,
+                presentation: presentation ?? undefined,
+            });
+            break;
+    }
+    const wire = concatBytes(discloser.kel(hab), prepared.support, prepared.wire);
+    yield* deps.reactor.processBytes(wire, { local: true });
+    yield* deps.protocol.processEscrowsOnce();
+    if (!deps.exc.complete(prepared.exn.said))
+        throw new ValidationError(PENDING);
+    return { exn: prepared.exn, wire, recipient: prepared.exn.sad.ri };
+}
+/**
+ * A group's consent to present an accepted Grant or credential view: freezes the Grant body once (selection and
+ * authorization) and proposes it as a group-authored message, so the other members list and approve it with
+ * `approveGroupIpex` and the elected lead delivers the completed Grant. Returns after local commit.
+ *
+ * With `options.presentationRegistry` the Grant carries a presented-state proof: this member also proposes the
+ * registry update that anchors it (`proposeRegistryEvent`; the other members approve that proposal with
+ * `approveGroupProposal`), and the owner signs this member's contribution to the Grant once the group has accepted
+ * the update, under this same consent.
+ *
+ * @throws ValidationError for an identifier that is not a local group, an unknown presentation registry, a
+ * selection the discloser refuses, or a message awaiting authenticating dependencies.
+ */
+export function* proposeGroupPresentation(deps, groupIpex, { hab, selection, options, deliver, counsel }) {
+    const { presentationRegistry, ...body } = options;
+    const gvrsn = body.gvrsn ?? undefined;
+    const discloser = discloserFor(deps, hab, selection.derive);
+    let prepared = yield* discloser.prepareGrantBody(hab.pre, selection, body);
+    if (!presentationRegistry) {
+        return yield* proposeGroupIpex(groupIpex, { hab, exn: prepared.exn, nests: prepared.nests, gvrsn, deliver });
+    }
+    const reg = deps.rgy.registryByName(presentationRegistry);
+    if (!reg)
+        throw new ValidationError("Unknown presentation registry.");
+    const node = parseBytes(prepared.raw)[0].body;
+    if (reg.hab.pre !== hab.pre || node.issuee !== hab.pre || node.sad.a.rd !== reg.regk) {
+        throw new ValidationError("Presentation registry must match the selected disclosed local Issuee declaration.");
+    }
+    const proposals = groupIpex.deps.registry;
+    if (!proposals)
+        throw new ValidationError("This owner was composed without group registry collaborators");
+    // The Grant SAID is frozen before the update is anchored; only its nested proof is extended afterwards.
+    const [proof, update] = reg.present(prepared.exn, "presented", { stamp: body.stamp });
+    const proposed = yield* proposeRegistryEvent(proposals, hab, update, proof, counsel);
+    const exn = prepared.exn;
+    return groupIpexAfter(groupIpex, {
+        hab,
+        exn,
+        gvrsn,
+        deliver,
+        prerequisite: {
+            anchor: registryEventRef(update, proposed.event),
+            *proceed() {
+                const seal = deps.rgy.store.anchor(update.said);
+                if (!seal)
+                    throw new ValidationError("The presentation update is accepted but its anchor is unavailable");
+                prepared = yield* discloser.attachPresentationProof(prepared, proof, { s: seal[0], d: seal[1] });
+                const candidate = concatBytes(Counter.makeGVC(gvrsn ?? Vrsn_2_0), prepared.exn.raw, Counter.enclose({ qb64: prepared.nests, version: gvrsn ?? Vrsn_2_0 }));
+                const own = yield* prepareAcdcV2GroupIpex(deps.hby, groupIpex.deps.protocol, hab, candidate);
+                if (!own)
+                    throw new ValidationError("ACDC v2 group disclosure awaits authenticating dependencies.");
+                return own;
+            },
+        },
+    });
+}
+/**
+ * Deliver a group's completed prepared Grant ({@link resumePresentationFile}): queues the delivery bytes for
+ * `processOnce` when the local member is the elected lead, with the retry and deadline of any presentation. Signs
+ * nothing. Returns null for a member that is not the lead.
+ */
+export function deliverPreparedGrant(ops, { hab, said, delivery }) {
+    const { deps } = ops, serder = deps.exc.retainedInput(said)?.serder;
+    if (!serder || serder.pre !== hab.pre)
+        throw new ValidationError("Delivery selects the group's own prepared Grant");
+    if (!deps.exc.lead(hab, said, { pendingPresentation: true }))
+        return null;
+    const recipient = String(serder.sad.ri), deadline = deps.exc.exchangeDeadline(serder) ?? undefined;
+    const src = isLocalGroupHab(deps.hby, hab) ? localGroupMember(deps.hby, hab.pre).pre : hab.pre;
+    queue(ops, { said, verb: "grant", hab, src, recipient, wire: delivery, deadline });
+    deps.changes?.push({ kind: "presentation", id: said });
+    return { said, recipient, wire: delivery };
+}
+/**
+ * The user's consent to present: signs and takes the message into local intake ({@link preparePresentation}),
+ * records the operation and queues the signed bytes for `processOnce` to deliver. Returns after local commit.
+ */
+export function* present(ops, input) {
+    const { deps } = ops;
+    const { exn, wire, recipient } = yield* preparePresentation(deps, input);
+    const said = exn.said, deadline = deps.exc.exchangeDeadline(exn) ?? undefined;
+    queue(ops, { said, verb: input.verb, hab: input.hab, recipient, wire, deadline });
+    deps.changes?.push({ kind: "presentation", id: said });
+    return { said, recipient, wire };
+}
+function queue(ops, op) {
+    const outbox = new DeliveryOutbox(ops.deps.retry);
+    outbox.enqueue({ src: op.src ?? op.hab.pre, dest: op.recipient, msg: op.wire });
+    ops.settled.delete(op.said);
+    ops.live.set(op.said, { ...op, expires: timestampMicros(op.deadline), outbox, busy: false });
+}
+/** The signed exchange of a local sender, with the verb its route names. */
+function signed(deps, said) {
+    const serder = deps.hby.db.exns.get([said]), hab = serder?.pre ? deps.hby.habs.get(serder.pre) : undefined;
+    const verb = serder?.route?.startsWith("/ipex/") ? serder.route.slice("/ipex/".length) : undefined;
+    if (!serder || !hab || !["apply", "offer", "agree", "spurn", "grant"].includes(verb ?? "")) {
+        throw new ValidationError("No presentation was begun for this exchange");
+    }
+    return { serder, hab, verb: verb };
+}
+/**
+ * Pure read of one presentation: the live table, what ended or delivered in this process, and what the stored
+ * exchanges prove (the peer's answer, when one was stored; see the module doc for what a reload loses). A
+ * signed exchange no live delivery holds and nobody answered reads `interrupted`, or `expired` past its
+ * deadline; that is a statement, not a write.
+ *
+ * @throws ValidationError when `said` is not a presentation exchange a local identifier signed.
+ */
+export function presentationStatus(ops, said) {
+    const { deps } = ops, ended = ops.settled.get(said), live = ops.live.get(said);
+    const answered = (verb, deliveries) => {
+        const answer = deps.hby.db.erpy.get([said])?.qb64;
+        const response = answer ? { said: answer, route: deps.hby.db.exns.get([answer])?.route ?? null } : undefined;
+        return { state: "done", verb, phase: "delivered", deliveries, response };
+    };
+    if (ended && ended.state !== "done")
+        return { state: ended.state, verb: ended.verb, reason: ended.reason };
+    if (ended)
+        return answered(ended.verb, ended.deliveries);
+    if (live && !lapsed(deps.clock, live.deadline)) {
+        return {
+            state: "active",
+            verb: live.verb,
+            phase: "delivering",
+            deadline: live.deadline,
+            ...(live.outbox.failure && { failure: live.outbox.failure }),
+        };
+    }
+    const { serder, verb } = signed(deps, said);
+    if (deps.hby.db.erpy.get([said]))
+        return answered(verb);
+    if (lapsed(deps.clock, deps.exc.exchangeDeadline(serder) ?? undefined)) {
+        return { state: "expired", verb, reason: EXPIRED };
+    }
+    return { state: "interrupted", verb, reason: RESEND };
+}
+/**
+ * Observe until the presentation is delivered or ended, or the budget expires. Starts no worker and drives
+ * nothing: someone else must call `processOnce`.
+ */
+export function* waitForPresentation(ops, said, { timeoutMs, clock = ops.deps.clock, until = (status) => status.state !== "active" }) {
+    const settled = yield* observeUntil(() => until(presentationStatus(ops, said)), { timeoutMs, clock });
+    const status = presentationStatus(ops, said);
+    return settled ? { outcome: "settled", status } : { outcome: "timed-out", status, timeoutMs };
+}
+/**
+ * Local abandon: stop delivering and read `abandoned` until the process ends. Does not message the peer and
+ * does not retract an exchange already delivered. Does nothing to a presentation that is already delivered
+ * or ended.
+ *
+ * @throws ValidationError when `said` is not a presentation exchange a local identifier signed.
+ */
+export function abandonPresentation(ops, said, reason = "Abandoned by the user") {
+    const status = presentationStatus(ops, said);
+    if (status.state === "done" || status.state === "abandoned" || status.state === "failed")
+        return;
+    const live = ops.live.get(said);
+    if (live)
+        ops.end(live, "abandoned", reason);
+    else {
+        ops.settled.set(said, { verb: status.verb, state: "abandoned", reason });
+        ops.deps.changes?.push({ kind: "presentation", id: said });
+    }
+}
+/**
+ * Deliver a presentation again after a restart, or after delivery failed or was abandoned: rebuilds the wire
+ * of the stored signed exchange from its retained signatures or source seal and nests, so the bytes are the
+ * ones first delivered and nothing is signed. Queues them like `present`, with a fresh outbox; return
+ * is after the queueing, not after delivery.
+ *
+ * @throws ValidationError for an exchange no local identifier signed, one the peer already answered, one past
+ * its deadline, one already being delivered, or one whose retained factors no longer authenticate.
+ */
+export function* resendPresentation(ops, said) {
+    const { deps } = ops, { serder, hab, verb } = signed(deps, said);
+    const status = presentationStatus(ops, said);
+    if (status.state === "active")
+        throw new ValidationError("This presentation is already being delivered");
+    if (deps.hby.db.erpy.get([said]))
+        throw new ValidationError("The peer already answered this presentation");
+    const deadline = deps.exc.exchangeDeadline(serder) ?? undefined;
+    if (lapsed(deps.clock, deadline))
+        throw new ValidationError(EXPIRED);
+    const retained = deps.exc.retainedInput(said);
+    if (!retained)
+        throw new ValidationError("The signed exchange no longer authenticates from stored factors");
+    const discloser = discloserFor(deps, hab);
+    let support = new Uint8Array();
+    if (verb === "grant") {
+        const raw = concatBytes(Counter.makeGVC(Vrsn_2_0), ...yield* call(() => Promise.all((retained.nests ?? []).map((nest) => collectPayload(framePayload(nest))))));
+        support = discloser.proofSupport(raw, hab);
+    }
+    else if (verb === "agree" && retained.sourceSeals?.length)
+        support = discloser.kel(hab);
+    const wire = concatBytes(discloser.kel(hab), support, yield* storedExchangeWire(retained));
+    const recipient = String(serder.sad.ri);
+    queue(ops, { said, verb, hab, recipient, wire, deadline });
+    deps.changes?.push({ kind: "presentation", id: said });
+    return { said, recipient, wire };
+}