keri-ts 2.1.0 → 2.2.1

package/types/app/runtime/delivery-outbox.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Ordered outbox of signed bytes an operation owes its peers, with retry.
+ *
+ * An operation's steps decide what to send and queue it here; the owner drains the queue each pass. A delivery
+ * that fails keeps its message at the head and is retried after a doubling delay ({@link RetryBackoff}), so a peer
+ * that is briefly offline delays an operation instead of ending it. The owner decides when retrying stops: an
+ * operation with a deadline ends at the deadline, and one without ends once failures have lasted the bound it
+ * states. Memory only: the signed messages themselves are durable in the protocol stores.
+ */
+import type { Operation } from "effection";
+import { type RetryPolicy } from "./retry-backoff.js";
+import type { RuntimeClock } from "./runtime-clock.js";
+/** One message waiting for delivery. */
+export interface Outbound {
+    src: string;
+    dest: string;
+    /** The signed bytes, or a producer called at delivery for a message that must be timely when it leaves (a query). */
+    msg: Uint8Array | (() => Uint8Array);
+    topic?: string;
+}
+/** Signed bytes handed to the transport. */
+export interface DeliveryMessage {
+    src: string;
+    dest: string;
+    msg: Uint8Array;
+    topic?: string;
+}
+/** Delivery of signed bytes; resolves once the transport reports an outcome and throws when it failed. */
+export interface OutboxDelivery {
+    deliver(message: DeliveryMessage): Operation<string[]>;
+}
+/** Why the head delivery is being retried; part of an active operation's status. */
+export interface DeliveryFailure {
+    /** Consecutive failures of the head message. */
+    attempts: number;
+    /** The error's message followed by its `cause` chain, joined with " <- ". */
+    reason: string;
+    /** When the next attempt is due (ISO 8601). */
+    retryAt: string;
+}
+/** Flatten an error and its `cause` chain to one line of text, so a reader sees the transport's own reason. */
+export declare function describeFailure(error: unknown): string;
+/** The queue and its retry state for one live operation. */
+export declare class DeliveryOutbox {
+    private readonly queue;
+    private readonly backoff;
+    /** Destinations the transport reported for everything delivered so far. */
+    readonly delivered: string[];
+    constructor(policy?: Readonly<RetryPolicy>);
+    /** Messages still waiting. */
+    get length(): number;
+    /** Consecutive delivery failures of the head message. */
+    get attempts(): number;
+    /** The latest delivery error, or null. */
+    get lastError(): unknown;
+    /** The retry state of the head message, or null while nothing is failing. */
+    get failure(): DeliveryFailure | null;
+    /** Queue a message behind the others. */
+    enqueue(message: Outbound): void;
+    /**
+     * Deliver the queued messages in order. A failure keeps the message and schedules a retry; it throws only when
+     * `boundMs` is given and failures have lasted that long.
+     *
+     * @returns True when the queue is empty, false while a message waits for its retry.
+     */
+    drain(transport: OutboxDelivery, clock: RuntimeClock, boundMs?: number): Operation<boolean>;
+}
+//# sourceMappingURL=delivery-outbox.d.ts.map

package/types/app/runtime/delivery-outbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-outbox.d.ts","sourceRoot":"","sources":["../../../src/app/runtime/delivery-outbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,wCAAwC;AACxC,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,qHAAqH;IACrH,GAAG,EAAE,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,UAAU,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;CACxD;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+GAA+G;AAC/G,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOtD;AAED,4DAA4D;AAC5D,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAM;gBAEtB,MAAM,GAAE,QAAQ,CAAC,WAAW,CAAwB;IAIhE,8BAA8B;IAC9B,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,yDAAyD;IACzD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,0CAA0C;IAC1C,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,6EAA6E;IAC7E,IAAI,OAAO,IAAI,eAAe,GAAG,IAAI,CAQpC;IAED,yCAAyC;IACzC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI;IAIhC;;;;;OAKG;IACF,KAAK,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC;CAmB7F"}

package/types/app/runtime/doing.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Fixed-tock doers: a background loop is a pass that runs, then waits one tock on the runtime clock, as a HIO
+ * `Doer` is re-run every `tock` (`hio/base/doing.py`) and KERIpy's Doist cycles at 0.03125 s. A loop never
+ * sleeps for a variable time and is never woken early; work that arrives between tocks is seen on the next one.
+ * The wait follows the pass, not a fixed rate, because a pass awaits network I/O.
+ */
+import type { Operation } from "effection";
+import type { RuntimeClock } from "./runtime-clock.js";
+/** One pass of a doer; `tock` counts passes from 0, so a doer can do heavier work on tock 0 and every Nth. */
+export type DoerPass = (tock: number) => Operation<unknown>;
+/**
+ * How often a doer runs, in milliseconds, and how many tocks apart its full sweeps are. A host that must be
+ * gentler (a browser wallet in a background tab, a mobile wallet on battery) supplies longer values.
+ */
+export interface DoerPacing {
+    tockMs: number;
+    sweepTocks: number;
+}
+/** Milliseconds between passes of the protocol-facing background loops: KERIpy's Doist cycle, as the escrow loop uses. */
+export declare const PROTOCOL_TOCK_MS = 31.25;
+/** Tocks between full sweeps of a loop that has one: 1920 tocks of 31.25 ms is a minute. */
+export declare const PROTOCOL_SWEEP_TOCKS = 1920;
+/** The production pacing of the protocol-facing background loops. */
+export declare const PROTOCOL_PACING: Readonly<DoerPacing>;
+/** Run `pass` forever: pass 0, wait `tockMs` on `clock`, pass 1, and so on. A thrown error ends the doer. */
+export declare function doEvery(clock: RuntimeClock, tockMs: number, pass: DoerPass): Operation<never>;
+//# sourceMappingURL=doing.d.ts.map

package/types/app/runtime/doing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doing.d.ts","sourceRoot":"","sources":["../../../src/app/runtime/doing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,8GAA8G;AAC9G,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,OAAO,CAAC,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,0HAA0H;AAC1H,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AACtC,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,qEAAqE;AACrE,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,UAAU,CAG/C,CAAC;AAEH,6GAA6G;AAC7G,wBAAiB,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAK9F"}

package/types/app/runtime/ipex-auxiliaries.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Runtime-owned registry of IPEX auxiliary owners (DH and Unblind), keyed by local identifier.
+ *
+ * The runtime registers one query receiver and one reply resource per route. Both resolve the
+ * addressed local identifier at dispatch time and create that identifier's owner then, so a wallet
+ * with several identifiers needs no owner before the first message and no hook when an identifier
+ * is made, joined or reloaded.
+ *
+ * Dispatch key: an `/ipex/*` message carries the sender (`pre`) and the transaction id (`q.x` for
+ * a query, `a.x` for a reply) but no recipient. The addressed local identifier is, from stored state:
+ * the holder of an approved operation for that id; for DH the recipient of a Grant `sender` opened in
+ * that transaction, and for Unblind the sender of a Grant addressed to `sender`; and, for a local
+ * group, itself when it is `sender` (its own members' contributions, which KRAM must pool). Exactly one
+ * such identifier owns the message; none or several leave it unowned, which is exactly a runtime without
+ * that owner: queries drop as `missingProcessor` before KRAM, and replies fail with the Router's
+ * missing-route error. Creating an owner grants no consent.
+ */
+import type { SerderKERI } from "cesr-ts";
+import { Dhke } from "../../acdc/dhking.js";
+import type { RegistryObserver } from "../../acdc/observing.js";
+import { Unblind } from "../../acdc/unblinding.js";
+import type { KeriDispatchEnvelope } from "../../core/dispatch.js";
+import type { Revery, Router } from "../../core/routing.js";
+import type { Exchanger } from "../exchanges/exchanging.js";
+import type { Hab } from "../identity/habbing.js";
+import type { AuxiliaryQueryProcessor, DispatchDecision } from "../protocol/parsering.js";
+/** Per-identifier DH and Unblind owners behind one query receiver and one reply route each. */
+export declare class IpexAuxiliaries implements AuxiliaryQueryProcessor {
+    private readonly exc;
+    private readonly registry;
+    private readonly rvy;
+    private readonly now;
+    /** Whether the runtime's KRAM is on; DH and Unblind approval need the rows only KRAM writes. */
+    private readonly kram;
+    /** Unused: `claims` decides which queries this receiver takes. */
+    readonly resource = "/ipex";
+    private readonly dhkes;
+    private readonly unblinds;
+    /**
+     * @param exc Exchanger shared by every owner.
+     * @param registry Public registry observer shared by every owner.
+     * @param rvy Reply verifier whose router the owners' routes are registered on.
+     * @param now Receiver clock shared by every owner.
+     * @param kram Whether KRAM is enabled; with it off, `approve` of either owner throws.
+     */
+    constructor(exc: Exchanger, registry: RegistryObserver, rvy: Revery, now: () => number, 
+    /** Whether the runtime's KRAM is on; DH and Unblind approval need the rows only KRAM writes. */
+    kram: boolean);
+    private restored;
+    /** Every live DH owner, for hosts draining their completion cues. */
+    dhkeOwners(): IterableIterator<Dhke>;
+    /** Every live Unblind owner, for hosts delivering the replies they owe. */
+    unblindOwners(): IterableIterator<Unblind>;
+    /** Register the DH and Unblind reply routes once; owners are looked up on each reply. */
+    registerReplyRoutes(rtr: Router): void;
+    /** The DH owner for `hab`, created on first use and recreated when `hab` is no longer the owner's object. */
+    dhke(hab: Hab): Dhke;
+    /** The Unblind owner for `hab`, created on first use and recreated when `hab` is no longer the owner's object. */
+    unblind(hab: Hab): Unblind;
+    /** Close and unregister both owners of `pre`; process-local approvals and retries are cleared. */
+    release(pre: string): void;
+    /** Close every owner; the runtime calls this on explicit close and scope exit. */
+    close(): void;
+    claims(serder: SerderKERI): boolean;
+    processQuery(envelope: KeriDispatchEnvelope): DispatchDecision;
+    private reply;
+    private select;
+    /**
+     * The owner of the one local identifier party to the transaction, created now if needed; absent or
+     * ambiguous means unowned. Parties come from live owners (approved operations) and from the store.
+     */
+    private claimant;
+}
+//# sourceMappingURL=ipex-auxiliaries.d.ts.map

package/types/app/runtime/ipex-auxiliaries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipex-auxiliaries.d.ts","sourceRoot":"","sources":["../../../src/app/runtime/ipex-auxiliaries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,KAAK,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAM1F,+FAA+F;AAC/F,qBAAa,eAAgB,YAAW,uBAAuB;IAc3D,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,gGAAgG;IAChG,OAAO,CAAC,QAAQ,CAAC,IAAI;IAlBvB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2B;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IAEvD;;;;;;OAMG;gBAEgB,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,MAAM;IAClC,gGAAgG;IAC/E,IAAI,EAAE,OAAO;IAGhC,OAAO,CAAC,QAAQ,CAAS;IAEzB,qEAAqE;IACrE,UAAU,IAAI,gBAAgB,CAAC,IAAI,CAAC;IAIpC,2EAA2E;IAC3E,aAAa,IAAI,gBAAgB,CAAC,OAAO,CAAC;IAkB1C,yFAAyF;IACzF,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKtC,6GAA6G;IAC7G,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI;IAgBpB,kHAAkH;IAClH,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO;IAS1B,kGAAkG;IAClG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQ1B,kFAAkF;IAClF,KAAK,IAAI,IAAI;IAMb,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAInC,YAAY,CAAC,QAAQ,EAAE,oBAAoB,GAAG,gBAAgB;IAI9D,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,MAAM;IAKd;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAgCjB"}

package/types/app/runtime/operation-owners.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Composition and loop of the runtime's operations owners.
+ *
+ * The runtime owns one `IssuanceOperations`, one
+ * `PresentationOperations` and one `UnblindingOperations`, each an in-memory live table
+ * with status derived from the protocol stores, and,
+ * when it has a registry root owner, one `RootReplicator`. `runAgentRuntime` runs each
+ * owner's `processOnce` on one fiber with an adaptive cadence ({@link operationOwnersDo}). The owners
+ * act only for operations a user began or copies already owed.
+ *
+ * The root replicator is a runtime reaction. It derives what is owed from state and records
+ * sent copies in the Baser (`rrsn.`), so a CLI command that sends copies through its own
+ * replicator shares that record with the loop and a later pass does not repeat its sends.
+ */
+import { type Operation } from "effection";
+import { type DerivedUpdateStore } from "../../acdc/custody.js";
+import type { Regery } from "../../acdc/registraring.js";
+import type { RegistryRoot } from "../../acdc/salting.js";
+import { RootReplicator } from "../credentials/root-replicator.js";
+import type { Poster } from "../delivery/forwarding.js";
+import type { Exchanger } from "../exchanges/exchanging.js";
+import type { Habery } from "../identity/habbing.js";
+import { GroupIpexOperations } from "../ipex/group-ipex.js";
+import type { CredentialViews } from "../ipex/ipex-discloser.js";
+import { IssuanceOperations } from "../ipex/issuance.js";
+import { PresentationOperations } from "../ipex/presenting.js";
+import { UnblindingOperations } from "../ipex/unblinding-workflow.js";
+import type { Counselor } from "../multisig/counseling.js";
+import type { Multiplexor } from "../multisig/grouping.js";
+import type { ProtocolProcessor } from "../protocol/protocol-processing.js";
+import type { Reactor } from "../protocol/reactor.js";
+import type { Receiptor } from "../witness/receipting.js";
+import { type DoerPacing } from "./doing.js";
+import type { IpexAuxiliaries } from "./ipex-auxiliaries.js";
+import type { RetryPolicy } from "./retry-backoff.js";
+import type { RuntimeClock } from "./runtime-clock.js";
+import type { ChangeSink } from "./workflow-contract.js";
+/** Milliseconds between owner passes; the cadence of the CLI drivers the loop replaced. */
+export declare const OWNER_TOCK_MS = 50;
+/** Tocks between the replicator's full rotation checks: 1200 tocks of 50 ms is a minute. */
+export declare const OWNER_SWEEP_TOCKS = 1200;
+/** The production pacing of the owner loop. */
+export declare const OWNER_PACING: Readonly<DoerPacing>;
+/**
+ * What an embedder may supply; every field is optional. The operation tables are in memory and their status is
+ * derived from the protocol stores, so there is no store port for them.
+ */
+export interface OperationStores {
+    /**
+     * Non-secret blind-derivation coordinates for issuance and derived presentation. Defaults to
+     * {@link BaserDerivedUpdateStore} over the registry environment's database, which is durable wherever the
+     * registry store is; a wallet with its own table supplies that instead.
+     */
+    derived?: DerivedUpdateStore;
+    /** The embedder's credential inventory, from which presentation selects issued and held credentials. Without it only replies and `apply` can be presented. */
+    views?: CredentialViews;
+    /** Receives identity-only changes after commit; defaults to the runtime's Signaler when it has one. */
+    changes?: ChangeSink;
+}
+/** The operations owners of one runtime, additive on `AgentRuntime.operations`. */
+export interface RuntimeOperations {
+    readonly issuance: IssuanceOperations;
+    /** A local group's v2 IPEX messages (its Admit): propose, approve, status, wait. */
+    readonly groupIpex: GroupIpexOperations;
+    readonly presentation: PresentationOperations;
+    readonly unblinding: UnblindingOperations;
+    /** What the owner loop could not do; read by a host that reports runtime health. */
+    readonly health: OwnerHealth;
+}
+/** The last failure of an owner pass that no single operation owned, and how many there have been. */
+export interface OwnerFault {
+    owner: "issuance" | "groupIpex" | "presentation" | "unblinding" | "replicator";
+    error: string;
+    /** ISO 8601 time of the failure on the host clock. */
+    at: string;
+}
+/**
+ * Failures of the owner loop itself. A failure of one operation (a delivery that throws, an unreadable stored
+ * Grant) ends that operation as `failed` and is never recorded here; this records only what escaped an owner
+ * pass, which the loop survives so that the other owners keep running. `faults` counts them and `last` keeps
+ * the latest. Nothing clears it: a host reads it and decides.
+ */
+export declare class OwnerHealth {
+    faults: number;
+    last: OwnerFault | null;
+}
+/** What the runtime composes for its operations owners. */
+export interface ComposedOwners {
+    operations: RuntimeOperations;
+    rootReplicator: RootReplicator | null;
+}
+/** The runtime pieces the owners borrow; no AgentRuntime bundle. */
+export interface OwnerParts {
+    hby: Habery;
+    acdc: Regery;
+    exc: Exchanger;
+    protocol: ProtocolProcessor;
+    reactor: Reactor;
+    postman: Poster;
+    receiptor: Receiptor;
+    ipex: IpexAuxiliaries;
+    clock: RuntimeClock;
+    registryRoot: RegistryRoot | null;
+    /** Delegates the DH wrappers of group issuance; one owner per runtime registers. */
+    mux: Multiplexor;
+    /** Counsels the group anchor of a custodian's registry update. */
+    counselor: Counselor;
+    /** Delivery retry delays of the owners; the production policy when absent. */
+    retry?: Readonly<RetryPolicy>;
+    /** Milliseconds between issuer query resends; one second when absent. */
+    queryResendMs?: number;
+    changes?: ChangeSink;
+}
+/** Construct the owners over their in-memory tables; the derivation store defaults to the registry database. */
+export declare function composeOwners(parts: OwnerParts, stores?: OperationStores): ComposedOwners;
+/** What the owner loop runs: the owners, the replicator, the DH owners whose completion cues prompt it, the clock. */
+export interface OwnerLoopParts extends ComposedOwners {
+    ipex: IpexAuxiliaries;
+    clock: RuntimeClock;
+}
+/**
+ * Run every owner on one fiber until halted, as a fixed-tock doer (`./doing.ts`): each tock runs an owner that
+ * has live work, then the replicator (after prompting it with the live DH owners' `replicated` cues), and then
+ * the loop waits one tock. Work begun between tocks is seen on the next one; nothing wakes the loop early.
+ *
+ * Idle cost, per tock: four constant-time table checks, one in-memory walk of the Unblind owners for an owed
+ * reply, one drain of each DH owner's cue deck, and the replicator's emptiness checks. The replicator's
+ * rotation check (the establishment SAID of each local group, one keyed read per local identifier) runs on
+ * tock 0 and every `pacing.sweepTocks`. No owner reads a protocol store. Only the first pass, once, scans the
+ * pending exchange escrow for resumable Grants.
+ *
+ * A failure that escapes an owner pass is recorded in `operations.health` and the loop keeps running, so
+ * one owner's fault never stops the others. The owners run one after another, so a delivery that does not return holds the others up until it fails or
+ * its Grant deadline passes; operations already bound each delivery by that deadline.
+ */
+export declare function operationOwnersDo(owners: OwnerLoopParts, pacing?: Readonly<DoerPacing>): Operation<never>;
+//# sourceMappingURL=operation-owners.d.ts.map

package/types/app/runtime/operation-owners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-owners.d.ts","sourceRoot":"","sources":["../../../src/app/runtime/operation-owners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAqB,kBAAkB,EAAkB,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,KAAK,UAAU,EAAW,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,2FAA2F;AAC3F,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,OAAO,CAAC;AACtC,+CAA+C;AAC/C,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,UAAU,CAG5C,CAAC;AAEH;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,8JAA8J;IAC9J,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,uGAAuG;IACvG,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,sGAAsG;AACtG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,GAAG,YAAY,CAAC;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,qBAAa,WAAW;IACtB,MAAM,SAAK;IACX,IAAI,EAAE,UAAU,GAAG,IAAI,CAAQ;CAChC;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,YAAY,CAAC;IACpB,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,oFAAoF;IACpF,GAAG,EAAE,WAAW,CAAC;IACjB,kEAAkE;IAClE,SAAS,EAAE,SAAS,CAAC;IACrB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9B,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,gHAAgH;AAChH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,GAAE,eAAoB,GAAG,cAAc,CA2D7F;AAED,sHAAsH;AACtH,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAiB,iBAAiB,CAChC,MAAM,EAAE,cAAc,EACtB,MAAM,GAAE,QAAQ,CAAC,UAAU,CAAgB,GAC1C,SAAS,CAAC,KAAK,CAAC,CA6BlB"}

package/types/app/runtime/retry-backoff.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Retry state for a transient delivery failure inside a live operation.
+ *
+ * A member that is briefly offline is normal, so an owner keeps the unsent work, waits with a doubling delay and
+ * tries again on a later pass instead of ending the operation at the first error. The owner decides when retrying
+ * stops: an operation with a deadline ends at the deadline, and one without ends once failures have lasted the
+ * bound it states.
+ */
+/** Delay after the first failure; it doubles per consecutive failure up to {@link RETRY_MAX_MS}. */
+export declare const RETRY_BASE_MS = 1000;
+/** Longest delay between attempts. */
+export declare const RETRY_MAX_MS = 30000;
+/** How long failures may last before an owner with no deadline of its own gives up. */
+export declare const RETRY_BOUND_MS = 600000;
+/**
+ * How long a retried action waits: it starts at `baseMs`, doubles per consecutive failure up to `maxMs`, and an
+ * owner that gives up does so once failures have lasted `boundMs`. Owners that never give up ignore the bound.
+ * Milliseconds; a test passes small values.
+ */
+export interface RetryPolicy {
+    baseMs: number;
+    maxMs: number;
+    boundMs: number;
+}
+/** The production delays of delivery retries. */
+export declare const DEFAULT_RETRY_POLICY: Readonly<RetryPolicy>;
+/** Consecutive-failure counter with a next-attempt time; memory only. */
+export declare class RetryBackoff {
+    #private;
+    private readonly policy;
+    /** Consecutive failures since the last success. */
+    attempts: number;
+    /** Time of the first failure of the current run (host clock, ms); 0 when none. */
+    since: number;
+    /** Error of the latest failure. */
+    last: unknown;
+    constructor(policy?: Readonly<RetryPolicy>);
+    /** Host-clock time (ms) of the next attempt. */
+    get next(): number;
+    /** Whether an attempt may be made at `now`. */
+    due(now: number): boolean;
+    /** Record a failure at `now` and schedule the next attempt. */
+    failed(now: number, error: unknown): void;
+    /** Whether failures have lasted at least `boundMs` by `now`. */
+    exhausted(now: number, boundMs: number): boolean;
+    /** Forget failures after a success. */
+    succeeded(): void;
+}
+//# sourceMappingURL=retry-backoff.d.ts.map

package/types/app/runtime/retry-backoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-backoff.d.ts","sourceRoot":"","sources":["../../../src/app/runtime/retry-backoff.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oGAAoG;AACpG,eAAO,MAAM,aAAa,OAAQ,CAAC;AACnC,sCAAsC;AACtC,eAAO,MAAM,YAAY,QAAS,CAAC;AACnC,uFAAuF;AACvF,eAAO,MAAM,cAAc,SAAU,CAAC;AAEtC;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iDAAiD;AACjD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,WAAW,CAIrD,CAAC;AAEH,yEAAyE;AACzE,qBAAa,YAAY;;IASX,OAAO,CAAC,QAAQ,CAAC,MAAM;IARnC,mDAAmD;IACnD,QAAQ,SAAK;IACb,kFAAkF;IAClF,KAAK,SAAK;IACV,mCAAmC;IACnC,IAAI,EAAE,OAAO,CAAQ;gBAGQ,MAAM,GAAE,QAAQ,CAAC,WAAW,CAAwB;IAEjF,gDAAgD;IAChD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,+CAA+C;IAC/C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,+DAA+D;IAC/D,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAOzC,gEAAgE;IAChE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAIhD,uCAAuC;IACvC,SAAS,IAAI,IAAI;CAMlB"}

package/types/app/runtime/workflow-contract.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared pieces of the library workflow contract.
+ *
+ * Library workflows follow one shape: `begin*` is an explicit operation that
+ * returns after local commit, `*Status` is a pure synchronous read, and
+ * `waitFor*` only observes. A wait never starts runtime workers: a host that
+ * already runs a runtime must not get a second poller and escrow loop. One-shot
+ * hosts such as the CLI run the runtime around the wait themselves
+ * (`cli/common/runtime-workers.ts`). Remote and time-driven outcomes, including
+ * an expired wait, are returned values; only caller-contract, invariant and
+ * infrastructure failures throw.
+ */
+import { type Operation } from "effection";
+import type { Signaler } from "../notifications/signaling.js";
+import { type RuntimeClock } from "./runtime-clock.js";
+/** Workflow families that publish changes. */
+export type WorkflowKind = "oobi" | "query" | "event" | "delegation" | "group" | "issuance" | "ipex" | "presentation" | "unblinding"
+/** A registry root copy was retained; `id` is the registry. */
+ | "root";
+/** Identity of a workflow whose status may have changed; consumers re-read status. */
+export interface WorkflowChange {
+    kind: WorkflowKind;
+    id: string;
+}
+/**
+ * Receiver of change identities. Owners publish after their commit and never
+ * depend on what the sink does with it; a sink must not throw into a workflow.
+ */
+export interface ChangeSink {
+    push(change: WorkflowChange): void;
+}
+/**
+ * Result of a library wait. `settled` means the status reached a terminal or
+ * wanted state; `timed-out` means the budget expired first. Either way `status`
+ * is the status read at return, so a caller never needs a second read to explain
+ * the outcome. `Timed` adds fields to the timed-out arm (default: the budget).
+ */
+export type WaitResult<S, Timed extends object = {
+    timeoutMs: number;
+}> = {
+    readonly outcome: "settled";
+    readonly status: S;
+} | ({
+    readonly outcome: "timed-out";
+    readonly status: S;
+} & Readonly<Timed>);
+/** In-memory sink that records changes in order. */
+export declare class MemoryChangeSink implements ChangeSink {
+    readonly changes: WorkflowChange[];
+    push(change: WorkflowChange): void;
+}
+/**
+ * Back a sink with the host's transient `Signaler`. Publishing needs no polling:
+ * `push` is a synchronous append that collapses repeats of one workflow into a
+ * single signal (collapse key `kind:id`). Delivery is pull-based, though: the
+ * Signaler has no subscriber hook, so the consumer must read `signaler.list()`.
+ * A closed or failing Signaler drops the change instead of throwing: a hint must
+ * never break the workflow that published it.
+ */
+export declare function signalerChangeSink(signaler: Pick<Signaler, "push">): ChangeSink;
+/**
+ * Observe-only wait: poll `done`, yielding to the scheduler between checks,
+ * until it holds or the deadline passes. Starts no worker and has no effects of
+ * its own.
+ *
+ * @param done Synchronous status read; checked before the first yield.
+ * @param pollMs Elapsed milliseconds between checks. Omitted: yield one scheduler turn.
+ * @returns True when `done` held, false when `timeoutMs` elapsed first.
+ */
+export declare function observeUntil(done: () => boolean, { timeoutMs, clock, pollMs }: {
+    timeoutMs: number;
+    clock?: Pick<RuntimeClock, "now">;
+    pollMs?: number;
+}): Operation<boolean>;
+/**
+ * Wait `milliseconds` on the host's clock, so a fake clock drives it and cancellation releases the timer.
+ */
+export declare function waitOnClock(clock: RuntimeClock, milliseconds: number): Operation<void>;
+//# sourceMappingURL=workflow-contract.d.ts.map

package/types/app/runtime/workflow-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-contract.d.ts","sourceRoot":"","sources":["../../../src/app/runtime/workflow-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAU,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,KAAK,YAAY,EAAe,MAAM,oBAAoB,CAAC;AAGpE,8CAA8C;AAC9C,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,OAAO,GACP,OAAO,GACP,YAAY,GACZ,OAAO,GACP,UAAU,GACV,MAAM,GACN,cAAc,GACd,YAAY;AACd,+DAA+D;GAC7D,MAAM,CAAC;AAEX,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,CAAC,CAAC,EAAE,KAAK,SAAS,MAAM,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,IAClE;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;CAAE,GACnD,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;CAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAE9E,oDAAoD;AACpD,qBAAa,gBAAiB,YAAW,UAAU;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,CAAM;IACxC,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;CAGnC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,UAAU,CAU/E;AAED;;;;;;;;GAQG;AACH,wBAAiB,YAAY,CAC3B,IAAI,EAAE,MAAM,OAAO,EACnB,EAAE,SAAS,EAAE,KAAmB,EAAE,MAAM,EAAE,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACA,SAAS,CAAC,OAAO,CAAC,CASpB;AAED;;GAEG;AACH,wBAAiB,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAKvF"}

package/types/app/transport/http-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../../src/app/transport/http-client.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,OAAO,EAAQ,KAAK,SAAS,EAAoB,MAAM,WAAW,CAAC;AAInE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC;IAChD,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;CACvD;AAED,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;CAC1E;AAED;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAChD;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,SAAS,CAAC,YAAY,CAAC;IASzE;;;;;;;;;;OAUG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,SAAS,CAAC,kBAAkB,CAAC;CAsH7E"}
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../../src/app/transport/http-client.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,OAAO,EAAQ,KAAK,SAAS,EAAoB,MAAM,WAAW,CAAC;AAInE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,IAAI,CAAC;IAChD,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAC7B;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;CACvD;AAED,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,qFAAqF;IACrF,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACtE;;;;;;;;;;OAUG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;CAC1E;AAmBD;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAChD;;;;;;;OAOG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,SAAS,CAAC,YAAY,CAAC;IASzE;;;;;;;;;;OAUG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,SAAS,CAAC,kBAAkB,CAAC;CAyH7E"}

package/types/cli/common/event-completion.d.ts

@@ -0,0 +1,26 @@
+import type { Operation } from "effection";
+import type { DelegationWorkflowStatus } from "../../app/identity/delegating.js";
+import { completeEvent, type EventCompletionDeps } from "../../app/identity/event-completion.js";
+import type { Habery } from "../../app/identity/habbing.js";
+import { KelPublisher } from "../../app/mailbox/kel-publisher.js";
+import type { HttpClient } from "../../app/transport/http-client.js";
+/** Event-completion dependencies of a command, with the publisher that tells mailboxes after a rotation. */
+export interface CliEventCompletionDeps extends EventCompletionDeps {
+    readonly publisher: KelPublisher;
+}
+/**
+ * Compose event-completion dependencies for one CLI command.
+ *
+ * A short-lived runtime is created only when a delegated event needs workers.
+ * It is lent to the library for that one scope with its workers running around
+ * the library's observe-only wait, and closed on every exit path.
+ */
+export declare function cliEventCompletionDeps(hby: Habery, http: HttpClient): CliEventCompletionDeps;
+/**
+ * `completeEvent` for commands: an expired delegation wait fails the command with
+ * the text the CLI has always printed, then the caller sees the usual result.
+ */
+export declare function completeEventOrThrow(deps: CliEventCompletionDeps, ...args: Parameters<typeof completeEvent> extends [unknown, ...infer Rest] ? Rest : never): Operation<{
+    delegationPhase: DelegationWorkflowStatus["phase"] | null;
+}>;
+//# sourceMappingURL=event-completion.d.ts.map

package/types/cli/common/event-completion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-completion.d.ts","sourceRoot":"","sources":["../../../src/cli/common/event-completion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAIlE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAGrE,4GAA4G;AAC5G,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,sBAAsB,CAuB5F;AAED;;;GAGG;AACH,wBAAiB,oBAAoB,CACnC,IAAI,EAAE,sBAAsB,EAC5B,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GACxF,SAAS,CAAC;IAAE,eAAe,EAAE,wBAAwB,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;CAAE,CAAC,CAS1E"}

package/types/cli/common/runtime-workers.d.ts

@@ -0,0 +1,23 @@
+import { type Operation } from "effection";
+import type { Hab } from "../../app/identity/habbing.js";
+import { type AgentRuntime } from "../../app/runtime/agent-runtime.js";
+import type { AgentCue } from "../../core/cues.js";
+import type { Deck } from "../../core/deck.js";
+/**
+ * Run the runtime workers around one observe-only library call.
+ *
+ * Library workflows only observe (see `app/runtime/workflow-contract.ts`); a
+ * one-shot CLI command has no running runtime, so it supplies the workers here.
+ * The worker is halted and joined on success, failure and cancellation before
+ * the caller can release stores.
+ *
+ * @param runtime Borrowed composed runtime; the command owns its lifetime.
+ * @param options Signer, mailbox polling and command-owned query cue Deck.
+ * @param use Observe-only operation that depends on the workers' progress.
+ */
+export declare function withRuntimeWorkers<T>(runtime: AgentRuntime, options: {
+    hab?: Hab;
+    pollMailbox?: boolean;
+    queryCues?: Deck<AgentCue>;
+}, use: () => Operation<T>): Operation<T>;
+//# sourceMappingURL=runtime-workers.d.ts.map

package/types/cli/common/runtime-workers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-workers.d.ts","sourceRoot":"","sources":["../../../src/cli/common/runtime-workers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,+BAA+B,CAAC;AACzD,OAAO,EAAE,KAAK,YAAY,EAAmB,MAAM,oCAAoC,CAAC;AACxF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAiB,kBAAkB,CAAC,CAAC,EACnC,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,GAAG,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;CAAE,EACzE,GAAG,EAAE,MAAM,SAAS,CAAC,CAAC,CAAC,GACtB,SAAS,CAAC,CAAC,CAAC,CAOd"}

package/types/cli/credentials/ipex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ipex.d.ts","sourceRoot":"","sources":["../../../src/cli/credentials/ipex.ts"],"names":[],"mappings":"AACA,OAAO,EAA+B,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAU,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAO,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAiCjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAGhF,OAAO,EAAE,KAAK,YAAY,EAA2C,MAAM,oCAAoC,CAAC;AAOhH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AA+B1C,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,UAAU,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,wGAAwG;AACxG,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,UAAU,CAAC;IAChB,KAAK,CAAC,EAAE,eAAe,GAAG;QACxB,QAAQ,EAAE,UAAU,CAAC;QACrB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;QACzB,kFAAkF;QAClF,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;QACzB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;QACrB,8FAA8F;QAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAmB1F;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAoB1F;AAED,0EAA0E;AAC1E,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAE1F;AAED;;;GAGG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAe1F;AACD;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,CAyG3F;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,CAiF3F;AAED,yEAAyE;AACzE,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAgB/E;AAED,yGAAyG;AACzG,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CA0DzF;AAED;;;;GAIG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAQzF;AAED,qFAAqF;AACrF,wBAAiB,gBAAgB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,QAAQ,EAAE,eAAe,GACxB,SAAS,CAAC,cAAc,CAAC,CAwF3B"}
+{"version":3,"file":"ipex.d.ts","sourceRoot":"","sources":["../../../src/cli/credentials/ipex.ts"],"names":[],"mappings":"AACA,OAAO,EAA+B,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAU,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAO,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAmDjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAGhF,OAAO,EAAE,KAAK,YAAY,EAA2C,MAAM,oCAAoC,CAAC;AAMhH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAgC1C,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,UAAU,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,wGAAwG;AACxG,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,UAAU,CAAC;IAChB,KAAK,CAAC,EAAE,eAAe,GAAG;QACxB,QAAQ,EAAE,UAAU,CAAC;QACrB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;QACzB,kFAAkF;QAClF,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;QACzB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;QACrB,8FAA8F;QAC9F,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CA6B1F;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CA8B1F;AAED,0EAA0E;AAC1E,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAE1F;AAED;;;GAGG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAuB1F;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,CAwG3F;AAED;;;;GAIG;AACH,wBAAiB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC,CA8E3F;AAED,yEAAyE;AACzE,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAgB/E;AAED,yGAAyG;AACzG,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAsCzF;AAED;;;;GAIG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAQzF;AAED,qFAAqF;AACrF,wBAAiB,gBAAgB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,QAAQ,EAAE,eAAe,GACxB,SAAS,CAAC,cAAc,CAAC,CAuH3B"}

package/types/cli/credentials/vc.d.ts

@@ -1,4 +1,4 @@
-import { type Operation } from "effection";
+import type { Operation } from "effection";
 import { type CredentialRevokeResult } from "../../app/credentials/credential-revoking.js";
 import { type IssueResult, type RegistryResult } from "../../app/credentials/credential-workflows.js";
 /** Implement `tufa vc schema import` by pinning JSON schemas into `schema.`. */

package/types/cli/credentials/vc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vc.d.ts","sourceRoot":"","sources":["../../../src/cli/credentials/vc.ts"],"names":[],"mappings":"AAEA,OAAO,EAAQ,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAExD,OAAO,EACL,KAAK,sBAAsB,EAI5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAOL,KAAK,WAAW,EAGhB,KAAK,cAAc,EACpB,MAAM,+CAA+C,CAAC;AAiEvD,gFAAgF;AAChF,wBAAiB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAWrF;AAED;;;;GAIG;AACH,wBAAiB,uBAAuB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,cAAc,CAAC,CA6B3B;AAED,uEAAuE;AACvE,wBAAiB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAOrF;AAED,2EAA2E;AAC3E,wBAAiB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAKvF;AAED;;;;GAIG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CA6DtF;AAED,oEAAoE;AACpE,wBAAiB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAgB7E;AAED,mFAAmF;AACnF,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAa/E;AAED;;;;;;;;GAQG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAyB/E;AAED;;;;GAIG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAmDjG"}
+{"version":3,"file":"vc.d.ts","sourceRoot":"","sources":["../../../src/cli/credentials/vc.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EACL,KAAK,sBAAsB,EAI5B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAOL,KAAK,WAAW,EAGhB,KAAK,cAAc,EACpB,MAAM,+CAA+C,CAAC;AAwEvD,gFAAgF;AAChF,wBAAiB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAWrF;AAED;;;;GAIG;AACH,wBAAiB,uBAAuB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,cAAc,CAAC,CAuB3B;AAED,uEAAuE;AACvE,wBAAiB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAOrF;AAED,2EAA2E;AAC3E,wBAAiB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAKvF;AAED;;;;GAIG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CAmDtF;AAED,oEAAoE;AACpE,wBAAiB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAgB7E;AAED,mFAAmF;AACnF,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAa/E;AAED;;;;;;;;GAQG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAyB/E;AAED;;;;GAIG;AACH,wBAAiB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,sBAAsB,CAAC,CA8CjG"}

package/types/cli/endpoints/did.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"did.d.ts","sourceRoot":"","sources":["../../../src/cli/endpoints/did.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAqD3C,iCAAiC;AACjC,wBAAiB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAsC9E;AAED,qCAAqC;AACrC,wBAAiB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CA2ClF;AAED;;;;GAIG;AACH,wBAAiB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAwBjF;AAED,oCAAoC;AACpC,wBAAiB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CA4BjF"}
+{"version":3,"file":"did.d.ts","sourceRoot":"","sources":["../../../src/cli/endpoints/did.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAuD3C,iCAAiC;AACjC,wBAAiB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAsC9E;AAED,qCAAqC;AACrC,wBAAiB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CA2ClF;AAED;;;;GAIG;AACH,wBAAiB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAwBjF;AAED,oCAAoC;AACpC,wBAAiB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAgCjF"}

package/types/cli/endpoints/oobi.d.ts

@@ -16,7 +16,9 @@ export declare function oobiGenerateCommand(args: Record<string, unknown>): Oper
  *
  * The command queues one OOBI job, runs the shared workers, and succeeds only if
  * the URL lands in `roobi.`. Any reply/event material fetched from the OOBI is
- * forced through the same parser/routing path used by the long-lived host.
+ * forced through the same parser/routing path used by the long-lived host. It
+ * waits on that URL's own record, never on unrelated pending runtime work such
+ * as group proposals or delegation escrows.
  */
 export declare function oobiResolveCommand(args: Record<string, unknown>): Operation<void>;
 /**

package/types/cli/endpoints/oobi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oobi.d.ts","sourceRoot":"","sources":["../../../src/cli/endpoints/oobi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AA8D3C;;;;;;;;;;GAUG;AACH,wBAAiB,mBAAmB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAwFjB;AAED;;;;;;GAMG;AACH,wBAAiB,kBAAkB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAkDjB;AAED;;;;;;;GAOG;AACH,wBAAiB,kBAAkB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CA8DjB"}
+{"version":3,"file":"oobi.d.ts","sourceRoot":"","sources":["../../../src/cli/endpoints/oobi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AA8D3C;;;;;;;;;;GAUG;AACH,wBAAiB,mBAAmB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAwFjB;AAED;;;;;;;;GAQG;AACH,wBAAiB,kBAAkB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CA+CjB;AAED;;;;;;;GAOG;AACH,wBAAiB,kBAAkB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CA8DjB"}

package/types/cli/identity/challenge.d.ts

@@ -1,4 +1,4 @@
-import { type Operation } from "effection";
+import type { Operation } from "effection";
 /** Implement `tufa challenge generate`. */
 export declare function challengeGenerateCommand(args: Record<string, unknown>): Operation<void>;
 /**

package/types/cli/identity/challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,SAAS,EAAS,MAAM,WAAW,CAAC;AAsD1D,2CAA2C;AAC3C,wBAAiB,wBAAwB,CACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CASjB;AAED;;;;GAIG;AACH,wBAAiB,uBAAuB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CA+DjB;AAED,0GAA0G;AAC1G,wBAAiB,sBAAsB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAwFjB"}
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../src/cli/identity/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAoD3C,2CAA2C;AAC3C,wBAAiB,wBAAwB,CACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CASjB;AAED;;;;GAIG;AACH,wBAAiB,uBAAuB,CACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAmDjB;AAED,0GAA0G;AAC1G,wBAAiB,sBAAsB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,SAAS,CAAC,IAAI,CAAC,CAqFjB"}