signify-ts 0.3.0 → 0.4.0

package/dist/keri/app/w3cing.d.ts

@@ -0,0 +1,137 @@
+import { SignifyClient } from './clienting.ts';
+import { SignedReplyEnvelope } from './signaling.ts';
+export declare const W3C_SIGNING_ROUTE = "/w3c/signing/request";
+export declare const W3C_REQUEST_DATA_INTEGRITY_PROOF = "data_integrity_proof";
+export declare const W3C_REQUEST_VC_JWT = "vc_jwt";
+export declare const W3C_DEDUPE_IN_FLIGHT = "in_flight";
+export declare const W3C_DEDUPE_SUBMITTED = "submitted";
+export declare const W3C_DEDUPE_COMPLETE = "complete";
+export declare const W3C_DEDUPE_FAILED = "failed";
+export declare const W3C_DEDUPE_REJECTED = "rejected";
+export declare const W3C_DEDUPE_TERMINAL_RETENTION_MS: number;
+export declare const W3C_DEDUPE_IN_FLIGHT_RETENTION_MS: number;
+type MaybePromise<T> = T | Promise<T>;
+export type W3CProjectionDedupeStatus = typeof W3C_DEDUPE_IN_FLIGHT | typeof W3C_DEDUPE_SUBMITTED | typeof W3C_DEDUPE_COMPLETE | typeof W3C_DEDUPE_FAILED | typeof W3C_DEDUPE_REJECTED;
+export interface W3CVerifier {
+    id: string;
+    label: string;
+    kind: string;
+    verifyUrl: string;
+    healthUrl?: string | null;
+}
+export interface W3CProjectionSession {
+    d: string;
+    aid: string;
+    name: string;
+    credentialSaid: string;
+    issuerDid: string;
+    verifierId: string;
+    state: string;
+    created: string;
+    updated: string;
+    expires: string;
+    proofRequest?: string | null;
+    jwtRequest?: string | null;
+    verifierStatus?: number | null;
+    verifierResponse?: unknown;
+    error?: string | null;
+}
+export interface W3CSigningRequest {
+    d: string;
+    session: string;
+    type: string;
+    kind: string;
+    agent: string;
+    aid: string;
+    name: string;
+    credentialSaid: string;
+    signingInputB64: string;
+    encoding: 'base64url';
+    verificationMethod: string;
+    created: string;
+    expires: string;
+    state?: string;
+    lastSignaled?: string | null;
+    error?: string | null;
+    envelope?: SignedReplyEnvelope;
+}
+export interface W3CProjectionDedupeRecord {
+    id: string;
+    aid: string;
+    kind: string;
+    status: W3CProjectionDedupeStatus;
+    updated: string;
+    error?: string | null;
+}
+export interface W3CProjectionDedupeStore {
+    get(id: string): MaybePromise<W3CProjectionDedupeRecord | undefined>;
+    put(record: W3CProjectionDedupeRecord): MaybePromise<void>;
+    delete(id: string): MaybePromise<void>;
+    purgeTerminal(maxAgeMs?: number, now?: string): MaybePromise<number>;
+}
+export declare class MemoryW3CProjectionDedupeStore implements W3CProjectionDedupeStore {
+    records: Map<string, W3CProjectionDedupeRecord>;
+    get(id: string): W3CProjectionDedupeRecord | undefined;
+    put(record: W3CProjectionDedupeRecord): void;
+    delete(id: string): void;
+    purgeTerminal(maxAgeMs?: number, now?: string): number;
+}
+export declare class IndexedDbW3CProjectionDedupeStore implements W3CProjectionDedupeStore {
+    private readonly factory;
+    private readonly dbName;
+    private readonly storeName;
+    private dbPromise?;
+    constructor(factory?: IDBFactory, dbName?: string, storeName?: string);
+    get(id: string): Promise<W3CProjectionDedupeRecord | undefined>;
+    put(record: W3CProjectionDedupeRecord): Promise<void>;
+    delete(id: string): Promise<void>;
+    purgeTerminal(maxAgeMs?: number, now?: string): Promise<number>;
+    private request;
+    private open;
+}
+export declare function defaultW3CProjectionDedupeStore(): W3CProjectionDedupeStore;
+export declare class W3C {
+    private readonly client;
+    constructor(client: SignifyClient);
+    verifiers(): Promise<W3CVerifier[]>;
+    project(name: string, credentialSaid: string, verifierId: string): Promise<W3CProjectionSession>;
+    projection(name: string, sessionId: string): Promise<W3CProjectionSession>;
+    requests(name?: string, includeComplete?: boolean): Promise<W3CSigningRequest[]>;
+    submitSignature(request: W3CSigningRequest, signature: string): Promise<W3CSigningRequest>;
+    private managedIdentifierNames;
+}
+export type W3CProjectionRequestSource = 'sse' | 'polling';
+export type W3CProjectionAutoApproveOutcome = 'submitted' | 'skipped' | 'complete' | 'failed' | 'rejected';
+export interface W3CProjectionAutoApproveResult {
+    outcome: W3CProjectionAutoApproveOutcome;
+    requestId?: string;
+    source?: W3CProjectionRequestSource;
+    record?: W3CProjectionDedupeRecord;
+    error?: string;
+}
+export interface W3CProjectionAutoApproverOptions {
+    store?: W3CProjectionDedupeStore;
+    now?: () => string;
+    terminalRetentionMs?: number;
+    inFlightRetentionMs?: number;
+}
+export declare class W3CProjectionAutoApprover {
+    private readonly client;
+    private readonly w3c;
+    private readonly store;
+    private readonly now;
+    private readonly terminalRetentionMs;
+    private readonly inFlightRetentionMs;
+    private activeApprovals;
+    constructor(client: SignifyClient, options?: W3CProjectionAutoApproverOptions);
+    handleEnvelope(envelope: SignedReplyEnvelope): Promise<W3CProjectionAutoApproveResult>;
+    handleRequest(request: W3CSigningRequest | undefined, source?: W3CProjectionRequestSource): Promise<W3CProjectionAutoApproveResult>;
+    pollOnce(name?: string): Promise<W3CProjectionAutoApproveResult[]>;
+    reconcile(name?: string): Promise<W3CProjectionDedupeRecord[]>;
+    private handleRequestOnce;
+    private signRequest;
+    private localOwnershipError;
+    private shouldSkip;
+    private putRecord;
+}
+export {};

package/dist/keri/app/w3cing.js

@@ -0,0 +1,337 @@
+import { decodeBase64Url } from "../core/base64.js";
+export const W3C_SIGNING_ROUTE = '/w3c/signing/request';
+export const W3C_REQUEST_DATA_INTEGRITY_PROOF = 'data_integrity_proof';
+export const W3C_REQUEST_VC_JWT = 'vc_jwt';
+export const W3C_DEDUPE_IN_FLIGHT = 'in_flight';
+export const W3C_DEDUPE_SUBMITTED = 'submitted';
+export const W3C_DEDUPE_COMPLETE = 'complete';
+export const W3C_DEDUPE_FAILED = 'failed';
+export const W3C_DEDUPE_REJECTED = 'rejected';
+export const W3C_DEDUPE_TERMINAL_RETENTION_MS = 10 * 60 * 1000;
+export const W3C_DEDUPE_IN_FLIGHT_RETENTION_MS = 10 * 60 * 1000;
+const W3C_DEDUPE_DB_NAME = 'signify-w3c-projection';
+const W3C_DEDUPE_STORE_NAME = 'requestDedupe';
+const W3C_TERMINAL_DEDUPE_STATUSES = new Set([
+    W3C_DEDUPE_COMPLETE,
+    W3C_DEDUPE_FAILED,
+    W3C_DEDUPE_REJECTED,
+]);
+export class MemoryW3CProjectionDedupeStore {
+    constructor() {
+        this.records = new Map();
+    }
+    get(id) {
+        return this.records.get(id);
+    }
+    put(record) {
+        this.records.set(record.id, record);
+    }
+    delete(id) {
+        this.records.delete(id);
+    }
+    purgeTerminal(maxAgeMs = W3C_DEDUPE_TERMINAL_RETENTION_MS, now = new Date().toISOString()) {
+        let deleted = 0;
+        for (const record of this.records.values()) {
+            if (shouldPurgeTerminalRecord(record, maxAgeMs, now)) {
+                this.records.delete(record.id);
+                deleted += 1;
+            }
+        }
+        return deleted;
+    }
+}
+export class IndexedDbW3CProjectionDedupeStore {
+    constructor(factory = globalThis.indexedDB, dbName = W3C_DEDUPE_DB_NAME, storeName = W3C_DEDUPE_STORE_NAME) {
+        this.factory = factory;
+        this.dbName = dbName;
+        this.storeName = storeName;
+        if (factory === undefined) {
+            throw new Error('IndexedDB is unavailable');
+        }
+    }
+    async get(id) {
+        return await this.request('readonly', (store) => store.get(id));
+    }
+    async put(record) {
+        await this.request('readwrite', (store) => store.put(record));
+    }
+    async delete(id) {
+        await this.request('readwrite', (store) => store.delete(id));
+    }
+    async purgeTerminal(maxAgeMs = W3C_DEDUPE_TERMINAL_RETENTION_MS, now = new Date().toISOString()) {
+        const db = await this.open();
+        return await new Promise((resolve, reject) => {
+            let deleted = 0;
+            const transaction = db.transaction(this.storeName, 'readwrite');
+            const store = transaction.objectStore(this.storeName);
+            const request = store.getAll();
+            request.onsuccess = () => {
+                for (const record of request.result) {
+                    if (shouldPurgeTerminalRecord(record, maxAgeMs, now)) {
+                        store.delete(record.id);
+                        deleted += 1;
+                    }
+                }
+            };
+            request.onerror = () => reject(request.error);
+            transaction.oncomplete = () => resolve(deleted);
+            transaction.onerror = () => reject(transaction.error);
+            transaction.onabort = () => reject(transaction.error);
+        });
+    }
+    async request(mode, create) {
+        const db = await this.open();
+        return await new Promise((resolve, reject) => {
+            const transaction = db.transaction(this.storeName, mode);
+            const request = create(transaction.objectStore(this.storeName));
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(request.error);
+            transaction.onerror = () => reject(transaction.error);
+            transaction.onabort = () => reject(transaction.error);
+        });
+    }
+    async open() {
+        if (this.dbPromise === undefined) {
+            this.dbPromise = new Promise((resolve, reject) => {
+                const request = this.factory.open(this.dbName, 1);
+                request.onupgradeneeded = () => {
+                    const db = request.result;
+                    if (!db.objectStoreNames.contains(this.storeName)) {
+                        db.createObjectStore(this.storeName, { keyPath: 'id' });
+                    }
+                };
+                request.onsuccess = () => resolve(request.result);
+                request.onerror = () => reject(request.error);
+                request.onblocked = () => reject(new Error('IndexedDB W3C dedupe store is blocked'));
+            });
+        }
+        return await this.dbPromise;
+    }
+}
+export function defaultW3CProjectionDedupeStore() {
+    if (typeof globalThis.indexedDB !== 'undefined') {
+        return new IndexedDbW3CProjectionDedupeStore(globalThis.indexedDB);
+    }
+    return new MemoryW3CProjectionDedupeStore();
+}
+export class W3C {
+    constructor(client) {
+        this.client = client;
+    }
+    async verifiers() {
+        const res = await this.client.fetch('/w3c/verifiers', 'GET', null);
+        const body = await res.json();
+        return body.verifiers;
+    }
+    async project(name, credentialSaid, verifierId) {
+        const res = await this.client.fetch(`/identifiers/${name}/w3c/projections`, 'POST', { credentialSaid, verifierId });
+        return await res.json();
+    }
+    async projection(name, sessionId) {
+        const res = await this.client.fetch(`/identifiers/${name}/w3c/projections/${encodeURIComponent(sessionId)}`, 'GET', null);
+        return await res.json();
+    }
+    async requests(name, includeComplete = false) {
+        const names = name !== undefined ? [name] : await this.managedIdentifierNames();
+        const requests = [];
+        for (const aidName of names) {
+            const params = new URLSearchParams();
+            if (includeComplete) {
+                params.set('includeComplete', 'true');
+            }
+            const query = params.size > 0 ? `?${params.toString()}` : '';
+            const res = await this.client.fetch(`/identifiers/${aidName}/w3c/signing-requests${query}`, 'GET', null);
+            const body = await res.json();
+            requests.push(...body.requests);
+        }
+        return requests;
+    }
+    async submitSignature(request, signature) {
+        const res = await this.client.fetch(`/identifiers/${request.name}/w3c/signing-requests/${encodeURIComponent(request.d)}/signatures`, 'POST', { signature });
+        return await res.json();
+    }
+    async managedIdentifierNames() {
+        const result = await this.client.identifiers().list();
+        return result.aids.map((aid) => aid.name);
+    }
+}
+export class W3CProjectionAutoApprover {
+    constructor(client, options = {}) {
+        var _a, _b, _c, _d;
+        this.activeApprovals = new Map();
+        this.client = client;
+        this.w3c = new W3C(client);
+        this.store = (_a = options.store) !== null && _a !== void 0 ? _a : defaultW3CProjectionDedupeStore();
+        this.now = (_b = options.now) !== null && _b !== void 0 ? _b : (() => new Date().toISOString());
+        this.terminalRetentionMs =
+            (_c = options.terminalRetentionMs) !== null && _c !== void 0 ? _c : W3C_DEDUPE_TERMINAL_RETENTION_MS;
+        this.inFlightRetentionMs =
+            (_d = options.inFlightRetentionMs) !== null && _d !== void 0 ? _d : W3C_DEDUPE_IN_FLIGHT_RETENTION_MS;
+    }
+    async handleEnvelope(envelope) {
+        const verified = this.client.signals().verifyReplyEnvelope(envelope, {
+            route: W3C_SIGNING_ROUTE,
+        });
+        if (!verified) {
+            return {
+                outcome: 'rejected',
+                error: 'W3C signing request envelope failed verification',
+            };
+        }
+        return await this.handleRequest(envelope.rpy.a, 'sse');
+    }
+    async handleRequest(request, source = 'polling') {
+        if ((request === null || request === void 0 ? void 0 : request.d) === undefined || request.d === '') {
+            return {
+                outcome: 'rejected',
+                source,
+                error: 'W3C signing request is missing request SAID',
+            };
+        }
+        const active = this.activeApprovals.get(request.d);
+        if (active !== undefined) {
+            return await active;
+        }
+        const approval = this.handleRequestOnce(request, source);
+        this.activeApprovals.set(request.d, approval);
+        try {
+            return await approval;
+        }
+        finally {
+            this.activeApprovals.delete(request.d);
+        }
+    }
+    async pollOnce(name) {
+        const requests = await this.w3c.requests(name);
+        const results = [];
+        for (const request of requests) {
+            results.push(await this.handleRequest(request, 'polling'));
+        }
+        return results;
+    }
+    async reconcile(name) {
+        var _a;
+        await this.store.purgeTerminal(this.terminalRetentionMs, this.now());
+        const requests = await this.w3c.requests(name, true);
+        const records = [];
+        for (const request of requests) {
+            if (request.state === W3C_DEDUPE_COMPLETE) {
+                records.push(await this.putRecord(request, W3C_DEDUPE_COMPLETE));
+            }
+            else if (request.state === W3C_DEDUPE_FAILED) {
+                records.push(await this.putRecord(request, W3C_DEDUPE_FAILED, (_a = request.error) !== null && _a !== void 0 ? _a : 'KERIA reported W3C request failure'));
+            }
+        }
+        return records;
+    }
+    async handleRequestOnce(request, source) {
+        const now = this.now();
+        await this.store.purgeTerminal(this.terminalRetentionMs, now);
+        const existing = await this.store.get(request.d);
+        if (this.shouldSkip(existing, now)) {
+            return {
+                outcome: 'skipped',
+                requestId: request.d,
+                source,
+                record: existing,
+            };
+        }
+        await this.putRecord(request, W3C_DEDUPE_IN_FLIGHT);
+        const ownershipError = await this.localOwnershipError(request);
+        if (ownershipError !== undefined) {
+            const record = await this.putRecord(request, W3C_DEDUPE_REJECTED, ownershipError);
+            return {
+                outcome: 'rejected',
+                requestId: request.d,
+                source,
+                record,
+                error: ownershipError,
+            };
+        }
+        try {
+            const signature = await this.signRequest(request);
+            await this.w3c.submitSignature(request, signature);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const record = await this.putRecord(request, W3C_DEDUPE_FAILED, message);
+            return {
+                outcome: 'failed',
+                requestId: request.d,
+                source,
+                record,
+                error: message,
+            };
+        }
+        const record = await this.putRecord(request, W3C_DEDUPE_SUBMITTED);
+        return {
+            outcome: 'submitted',
+            requestId: request.d,
+            source,
+            record,
+        };
+    }
+    async signRequest(request) {
+        if (![W3C_REQUEST_DATA_INTEGRITY_PROOF, W3C_REQUEST_VC_JWT].includes(request.kind)) {
+            throw new Error(`unsupported W3C signing request kind ${request.kind}`);
+        }
+        const hab = await this.client.identifiers().get(request.name);
+        const keeper = this.client.manager.get(hab);
+        const sigs = await keeper.sign(decodeBase64Url(request.signingInputB64), false);
+        return sigs[0];
+    }
+    async localOwnershipError(request) {
+        let hab;
+        try {
+            hab = await this.client.identifiers().get(request.name);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return `W3C request ${request.d} targets ${request.aid}, but local identifier ${request.name} is unavailable: ${message}`;
+        }
+        if (hab.prefix !== request.aid) {
+            return `W3C request ${request.d} targets ${request.aid}, but local identifier ${request.name} is ${hab.prefix}`;
+        }
+        return undefined;
+    }
+    shouldSkip(record, now) {
+        if ((record === null || record === void 0 ? void 0 : record.status) === W3C_DEDUPE_IN_FLIGHT &&
+            recordAgeMs(record, now) >= this.inFlightRetentionMs) {
+            return false;
+        }
+        return (record !== undefined &&
+            [
+                W3C_DEDUPE_IN_FLIGHT,
+                W3C_DEDUPE_SUBMITTED,
+                W3C_DEDUPE_COMPLETE,
+                W3C_DEDUPE_FAILED,
+                W3C_DEDUPE_REJECTED,
+            ].includes(record.status));
+    }
+    async putRecord(request, status, error = null) {
+        const record = {
+            id: request.d,
+            aid: request.aid,
+            kind: request.kind,
+            status,
+            updated: this.now(),
+            error,
+        };
+        await this.store.put(record);
+        return record;
+    }
+}
+function shouldPurgeTerminalRecord(record, maxAgeMs, now) {
+    if (!W3C_TERMINAL_DEDUPE_STATUSES.has(record.status)) {
+        return false;
+    }
+    return recordAgeMs(record, now) >= maxAgeMs;
+}
+function recordAgeMs(record, now) {
+    const updated = Date.parse(record.updated);
+    const current = Date.parse(now);
+    if (Number.isNaN(updated) || Number.isNaN(current)) {
+        return 0;
+    }
+    return current - updated;
+}

package/dist/keri/core/keeping.d.ts

@@ -46,7 +46,18 @@ export interface IdentifierManager<T extends IdentifierManagerParams = Identifie
     params(): T;
     incept(transferable: boolean): Promise<IdentifierManagerResult>;
     rotate(ncodes: string[], transferable: boolean, states?: KeyState[], rstates?: KeyState[]): Promise<IdentifierManagerResult>;
-    sign(ser: Uint8Array, indexed?: boolean, indices?: number[], ondices?: number[]): Promise<SignResult>;
+    /**
+     * Sign serialized bytes.
+     *
+     * `rotated` is meaningful for group identifiers only. Callers building a
+     * group rotation must pass `rotated=true` so the group signature exposes
+     * prior-next `ondex`; non-rotation calls leave it false/current-only.
+     *
+     * `ondices === undefined` uses the default dual-index behavior where each
+     * `ondex` matches its `index`. `ondices[j] === undefined` is the explicit
+     * current-only case for that signature, so no `ondex` is emitted.
+     */
+    sign(ser: Uint8Array, indexed?: boolean, indices?: number[], ondices?: Array<number | undefined>, rotated?: boolean): Promise<SignResult>;
 }
 /**
  * Creates IdentifierManager instances based on the algorithm and key indexes.
@@ -102,7 +113,7 @@ export declare class SaltyIdentifierManager implements IdentifierManager {
     params(): SaltyManagerParams;
     incept(transferable: boolean): Promise<IdentifierManagerResult>;
     rotate(ncodes: string[], transferable: boolean): Promise<[string[], string[]]>;
-    sign(ser: Uint8Array, indexed?: boolean, indices?: number[] | undefined, ondices?: number[] | undefined): Promise<SignResult>;
+    sign(ser: Uint8Array, indexed?: boolean, indices?: number[] | undefined, ondices?: Array<number | undefined> | undefined, _rotated?: boolean): Promise<SignResult>;
 }
 export declare class RandyIdentifierManager implements IdentifierManager {
     private salter;
@@ -126,27 +137,104 @@ export declare class RandyIdentifierManager implements IdentifierManager {
     params(): RandyManagerParams;
     incept(transferable: boolean): Promise<IdentifierManagerResult>;
     rotate(ncodes: string[], transferable: boolean): Promise<IdentifierManagerResult>;
-    sign(ser: Uint8Array, indexed?: boolean, indices?: number[] | undefined, ondices?: number[] | undefined): Promise<SignResult>;
+    sign(ser: Uint8Array, indexed?: boolean, indices?: number[] | undefined, ondices?: Array<number | undefined> | undefined, _rotated?: boolean): Promise<SignResult>;
 }
+/**
+ * Identifier manager for group identifiers.
+ *
+ * A group identifier does not have its own private signing keys. Instead, this
+ * manager maps group event signing indexes onto the local member AID (`mhab`)
+ * and delegates actual signing to that member's key manager.
+ *
+ * The central invariant is that indexed rotation signatures carry two
+ * positions:
+ *
+ * - `index` points to the signer's current key in the event's current key list
+ *   (`k`), which SignifyTS derives from `states`.
+ * - `ondex` points to the prior establishment event's next digest list (`n`),
+ *   proving that the current key was a precommitted key.
+ *
+ * `rstates` are the proposed next digest source for the new event. They are not
+ * the signer authorization set for the event being signed.
+ */
 export declare class GroupIdentifierManager implements IdentifierManager {
+    /** Factory used to recover the local member keeper that performs signing. */
     private manager;
+    /** Local member AID whose private key signs on behalf of the group. */
     private mhab;
+    /**
+     * Current group signing public keys for the event being built. During
+     * rotation these come from `states[*].k[0]` and define signature `index`.
+     */
     private gkeys;
+    /**
+     * Proposed next digest list for the event being built. During rotation
+     * these come from `rstates[*].n[0]`, are returned from `rotate()`, and are
+     * serialized as `group.ndigs`.
+     */
     private gdigs;
+    /**
+     * Prior next digest list from the current group establishment event. For
+     * rotations, this is the authorization commitment set used to derive
+     * `ondex`; it must remain separate from proposed next digests in `gdigs`.
+     */
+    private gpndigs;
     algo: Algos;
+    /**
+     * Retained for the `IdentifierManager` interface. Group signing delegates
+     * to the local member AID keeper instead of storing signers here.
+     */
     signers: Signer[];
+    /**
+     * Creates a manager for either a new group event or an existing group AID.
+     *
+     * `states` and `rstates` are app-level key state records used when creating
+     * a new group event. `keys` and `ndigs` are persisted group manager params
+     * used when loading an existing group. For an existing group, `ndigs` is
+     * expected to be the current establishment event's next digest list.
+     *
+     * During group inception there is no separate prior establishment event, so
+     * `gpndigs` starts as the same digest list as `gdigs`. During rotation,
+     * `gdigs` changes to the proposed next digests, while `gpndigs` stays
+     * fixed for `ondex` derivation.
+     */
     constructor(manager: IdentifierManagerFactory, mhab: HabState, states?: KeyState[] | undefined, rstates?: KeyState[] | undefined, keys?: string[], ndigs?: string[]);
+    /**
+     * Returns the inception key material for the group event.
+     *
+     * Inception has no prior group establishment event. The current keys and
+     * proposed next digests are therefore returned directly from the manager's
+     * configured `states` and `rstates`.
+     */
     incept(): Promise<IdentifierManagerResult>;
     /**
-     * Performs a multisig rotation
+     * Performs a multisig rotation.
+     *
+     * `states` supplies the current group signing keys for the event being
+     * signed. `rstates` supplies the proposed next key digests to put in the
+     * new event. The prior next digests used for rotation `ondex` lookup stay
+     * unchanged until KERIA accepts the new establishment event and returns an
+     * updated group state.
+     *
      * @param _ncodes
      * @param _transferable
      * @param states
-     * @param rstates key state records for the prior establishment event indicating next key digests.
-     *                You should pass in the current key
+     * @param rstates
      */
     rotate(_ncodes: string[], _transferable: boolean, states: KeyState[], rstates: KeyState[]): Promise<IdentifierManagerResult>;
-    sign(ser: Uint8Array, indexed?: boolean): Promise<SignResult>;
+    /**
+     * Signs for the group by delegating to the local member keeper.
+     */
+    sign(ser: Uint8Array, indexed?: boolean, _indices?: number[] | undefined, _ondices?: Array<number | undefined> | undefined, rotated?: boolean): Promise<SignResult>;
+    /**
+     * Finds the prior next digest position that precommitted the current key.
+     *
+     * This mirrors KERIpy's exposed-prior-next behavior: for each prior next
+     * digest, hash the current verifier key using that digest's code and compare
+     * the result to the digest at that position. A match means the signer has
+     * exposed that precommitted key, and the matching position is the `ondex`.
+     */
+    private priorNextIndexForKey;
     params(): {
         mhab: {
             name: string;