keri-ts 2.2.4 → 2.2.5

package/esm/keri/npm/src/_dnt.polyfills.js

@@ -1,3 +1,17 @@
+// https://github.com/tc39/proposal-accessible-object-hasownproperty/blob/main/polyfill.js
+if (!Object.hasOwn) {
+    Object.defineProperty(Object, "hasOwn", {
+        value: function (object, property) {
+            if (object == null) {
+                throw new TypeError("Cannot convert undefined or null to object");
+            }
+            return Object.prototype.hasOwnProperty.call(Object(object), property);
+        },
+        configurable: true,
+        enumerable: false,
+        writable: true,
+    });
+}
 function findLastIndex(self, callbackfn, that) {
     const boundFunc = that === undefined ? callbackfn : callbackfn.bind(that);
     let index = self.length - 1;
@@ -34,18 +48,4 @@ if (!Uint8Array.prototype.findLast) {
         return findLast(this, callbackfn, that);
     };
 }
-// https://github.com/tc39/proposal-accessible-object-hasownproperty/blob/main/polyfill.js
-if (!Object.hasOwn) {
-    Object.defineProperty(Object, "hasOwn", {
-        value: function (object, property) {
-            if (object == null) {
-                throw new TypeError("Cannot convert undefined or null to object");
-            }
-            return Object.prototype.hasOwnProperty.call(Object(object), property);
-        },
-        configurable: true,
-        enumerable: false,
-        writable: true,
-    });
-}
 export {};

package/esm/keri/npm/src/acdc/registering.js

@@ -202,6 +202,25 @@ export class RegistryStore {
         const said = this.seqSaider(regk, sn);
         return said ? this.event(said.qb64) : null;
     }
+    /**
+     * Registry identifiers with an accepted head, in key order: a scan of `heds.`. With `issuer`, only those whose
+     * accepted inception (`rip` at ordinal 0) names that issuer. Local aliases (`regs.`) play no part, so this also
+     * lists registries a store learned from others, such as a group registry a co-member incepted.
+     */
+    registries(issuer) {
+        const found = [];
+        for (const [keys] of this.baser.heads.getTopItemIter()) {
+            const regk = String(keys[0]);
+            if (issuer === undefined) {
+                found.push(regk);
+                continue;
+            }
+            const rip = this.seqEvent(regk, 0);
+            if (rip?.ilk === Ilks.rip && rip.issuer === issuer)
+                found.push(regk);
+        }
+        return found;
+    }
     /** Publish caller-approved storage markers; validation and duplicate/head policy belong to the engine. */
     accept(regk, sn, serder) {
         sn = registryOrdinal(sn);

package/esm/keri/npm/src/acdc/salting.js

@@ -641,6 +641,10 @@ export class RegistryRoot {
                 throw new RootUnverified(error.message, { cause: error });
             throw error;
         }
+        // The recipient's key opens the box; without its signer the copy stays pending until the host holds it.
+        if (!hab.mgr.hasSigner(hab.kever.verfers[0].qb64)) {
+            throw new RootUnverified("the recipient's signer is not held; the copy stays pending until it is");
+        }
         let plain;
         try {
             const opened = hab.mgr.open(essr, hab.kever.verfers[0]);

package/esm/keri/npm/src/app/bootstrap/authenticating.js

@@ -2,7 +2,8 @@ import { call, scoped } from "effection";
 import { persistResolvedContact } from "../identity/organizing.js";
 import { doEveryOnWrite, PROTOCOL_PACING } from "../runtime/doing.js";
 import { systemClock } from "../runtime/runtime-clock.js";
-import { isWellKnownOobiUrl, parseOobiUrl } from "./oobiery.js";
+import { isRequestableHttpUrl } from "../transport/http-client.js";
+import { isWellKnownOobiUrl, oobiJobFailure, parseOobiUrl } from "./oobiery.js";
 /**
  * Return true when a well-known URL has been authorized into `wkas.`.
  *
@@ -118,23 +119,20 @@ export class Authenticator {
         return null;
     }
     /**
-     * Fetch one `mfa.` record and persist the terminal auth result.
+     * Fetch one `mfa.` record and persist the terminal auth result. A URL the HTTP client refuses, a refused or failed
+     * request, or a non-OK status each end this authentication as failed in `rmfa.` and remove its `mfa.` row, so the
+     * next pass takes the next one; any other error is a fault and propagates.
      *
      * @param url Exact pending well-known authentication URL.
      * @param record Durable mfa record retained until response handling and cleanup establish terminal state.
      */
     *processPendingAuth(url, record) {
-        // Only HTTP status is needed; the response owner still joins body cleanup.
         const cid = record.cid
             ?? parseOobiUrl(url, record.oobialias ?? undefined).cid
             ?? null;
-        const http = this.http;
-        const response = yield* scoped(function* () {
-            const response = yield* http.open(url);
-            return { ok: response.ok, status: response.status };
-        });
+        const state = yield* this.authenticate(url);
         const date = new Date().toISOString();
-        const state = response.ok ? "resolved" : `http-${response.status}`;
+        const ok = state === "resolved";
         this.hby.db.mfa.rem(url);
         this.hby.db.rmfa.pin(url, {
             ...record,
@@ -142,7 +140,7 @@ export class Authenticator {
             state,
             cid,
         });
-        if (response.ok && cid) {
+        if (ok && cid) {
             this.hby.db.wkas.add(cid, { url, dt: date });
             persistResolvedContact(this.hby, cid, {
                 alias: record.oobialias,
@@ -150,4 +148,28 @@ export class Authenticator {
             });
         }
     }
+    /**
+     * Request one well-known URL and read only its status; the response owner still joins body cleanup.
+     *
+     * @param url Pending well-known authentication URL.
+     * @returns The terminal state: `resolved` for an OK status, `http-<status>` otherwise, or the
+     *   {@link OobiJobFailure} of a URL the client refuses or a refused or failed request.
+     */
+    *authenticate(url) {
+        if (!isRequestableHttpUrl(url))
+            return "url-refused";
+        const http = this.http;
+        try {
+            return yield* scoped(function* () {
+                const response = yield* http.open(url);
+                return response.ok ? "resolved" : `http-${response.status}`;
+            });
+        }
+        catch (error) {
+            const failure = oobiJobFailure(error);
+            if (failure === null)
+                throw error;
+            return failure;
+        }
+    }
 }