keri-ts 0.11.0 → 1.0.0

package/README.md

@@ -15,8 +15,15 @@ npm install keri-ts
 - `keri-ts/runtime`: explicit non-browser-safe runtime surface
 - `keri-ts/db`: explicit LMDB-backed storage surface
 
-Only those three entrypoints are supported public surfaces. Runnable CLI/server
-ownership lives in the separate `tufa` package.
+Those three entrypoints are the general library surfaces. `keri-ts/cli` is the
+separate command-helper boundary used by Tufa. Runnable CLI/server ownership
+lives in `@keri-ts/tufa`.
+
+The runtime exports deliberate operations and data contracts. Scheduling details,
+handler installation, reply-slot state and constructor helpers remain internal;
+implementation-module exports do not automatically become package API. npm deep
+imports such as `keri-ts/app/...` and `keri-ts/core/...` are not supported. Import
+runtime operations from `keri-ts/runtime` and storage from `keri-ts/db`.
 
 ## Maintainer Docs
 

package/esm/keri/npm/src/_dnt.polyfills.js

@@ -125,6 +125,42 @@ export let import_meta_ponyfill = ((...args) => {
     //@ts-ignore
     return import_meta_ponyfill(...args);
 });
+function findLastIndex(self, callbackfn, that) {
+    const boundFunc = that === undefined ? callbackfn : callbackfn.bind(that);
+    let index = self.length - 1;
+    while (index >= 0) {
+        const result = boundFunc(self[index], index, self);
+        if (result) {
+            return index;
+        }
+        index--;
+    }
+    return -1;
+}
+function findLast(self, callbackfn, that) {
+    const index = self.findLastIndex(callbackfn, that);
+    return index === -1 ? undefined : self[index];
+}
+if (!Array.prototype.findLastIndex) {
+    Array.prototype.findLastIndex = function (callbackfn, that) {
+        return findLastIndex(this, callbackfn, that);
+    };
+}
+if (!Array.prototype.findLast) {
+    Array.prototype.findLast = function (callbackfn, that) {
+        return findLast(this, callbackfn, that);
+    };
+}
+if (!Uint8Array.prototype.findLastIndex) {
+    Uint8Array.prototype.findLastIndex = function (callbackfn, that) {
+        return findLastIndex(this, callbackfn, that);
+    };
+}
+if (!Uint8Array.prototype.findLast) {
+    Uint8Array.prototype.findLast = function (callbackfn, that) {
+        return findLast(this, callbackfn, that);
+    };
+}
 // https://github.com/tc39/proposal-accessible-object-hasownproperty/blob/main/polyfill.js
 if (!Object.hasOwn) {
     Object.defineProperty(Object, "hasOwn", {

package/esm/keri/npm/src/acdc/observing.js

@@ -1,6 +1,6 @@
 /** Explicit public registry intake; this TypeScript integration is beyond frozen KERIpy 927. */
-import { Diger, Ilks, ParserError, ResourceLimitError } from "cesr-ts";
-import { DatabaseNotOpenError } from "../core/errors.js";
+import { Diger, Ilks, ParserError } from "cesr-ts";
+import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
 import { RegistryEventer } from "./regengine.js";
 import { validateRip, validateUpdate } from "./regeventing.js";
 /**
@@ -11,7 +11,7 @@ import { validateRip, validateUpdate } from "./regeventing.js";
  * Parsed evidence stays borrowed. This installs no automatic parser or runtime route.
  */
 export class RegistryObserver {
-    constructor(db, store, { maxEvents = 16384 } = {}) {
+    constructor(db, store) {
         Object.defineProperty(this, "db", {
             enumerable: true,
             configurable: true,
@@ -24,16 +24,6 @@ export class RegistryObserver {
             writable: true,
             value: store
         });
-        Object.defineProperty(this, "maxEvents", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        if (!Number.isSafeInteger(maxEvents) || maxEvents < 1) {
-            throw new RangeError("Registry maxEvents must be positive and safe.");
-        }
-        this.maxEvents = maxEvents;
     }
     /** Stage parsed events before inception, otherwise delegate ordinary validation and acceptance. */
     processEvent(serder) {
@@ -47,11 +37,12 @@ export class RegistryObserver {
                 return { kind: "reject", reason: "registry" };
         }
         catch (error) {
-            if (!(error instanceof ParserError) || error instanceof ResourceLimitError)
+            if (!(error instanceof ParserError))
                 throw error;
             return { kind: "reject", reason: "registry" };
         }
-        this.checkOrdinal(event.sn);
+        if (event.sn > BigInt(Number.MAX_SAFE_INTEGER))
+            return { kind: "reject", reason: "ordinalRange" };
         let engine = this.engine(event.regid);
         if (engine && !(engine instanceof RegistryEventer))
             return engine;
@@ -61,12 +52,12 @@ export class RegistryObserver {
             engine ??= new RegistryEventer(this.db, event.issuer, this.store, event.regid);
         }
         if (engine) {
-            this.checkStored(event.regid, engine);
             return engine.processEvent(serder);
         }
         // Issuer/anchor discovery is impossible until RIP arrives; the existing anchor escrow owns this body.
         const baser = this.store.baser;
-        baser.initializeStorage();
+        if (baser.readonly)
+            throw new DatabaseOperationError("Cannot write readonly registry storage.");
         return baser.env.transactionSync(() => {
             this.store.putEvent(serder);
             this.store.escrowMissingAnchor(event.regid, Number(event.sn), event.said);
@@ -78,7 +69,6 @@ export class RegistryObserver {
         const engine = this.engine(regid);
         if (!(engine instanceof RegistryEventer))
             return;
-        this.checkStored(regid, engine);
         engine.processEscrows();
     }
     /** Stored inception is durable issuer identity, including while its anchor is still absent. */
@@ -103,20 +93,4 @@ export class RegistryObserver {
         }
         return new RegistryEventer(this.db, result.event.issuer, this.store, regid);
     }
-    /** Bound chain length before processing; this does not bound queued rows, scans or native allocation. */
-    checkOrdinal(sn) {
-        if (sn >= BigInt(this.maxEvents))
-            throw new ResourceLimitError("Registry evidence exceeds configured event limit.");
-    }
-    /** A tighter observer must not advance previously staged rows beyond its own finite ceiling. */
-    checkStored(regid, engine) {
-        this.checkOrdinal(engine.sn);
-        for (const escrow of [this.store.baser.maes, this.store.baser.ooes]) {
-            for (const [, sn] of escrow?.getTopItemIter(regid) ?? []) {
-                if (!Number.isSafeInteger(sn) || sn < 0)
-                    throw new RangeError("Unsafe observer escrow ordinal.");
-                this.checkOrdinal(BigInt(sn));
-            }
-        }
-    }
 }

package/esm/keri/npm/src/acdc/regbasing.js

@@ -1,13 +1,12 @@
 /** Public ACDC registry database layout and joined LMDB lifecycle. */
 import { b, Diger, NumberPrimitive, Saider, SerderACDC } from "cesr-ts";
-import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
+import { DatabaseNotOpenError } from "../core/errors.js";
 import { LMDBer } from "../db/core/lmdber.js";
 import { B64OnIoSetSuber, CatCesrSuber, CesrOnSuber, CesrSuber, SerderSuber } from "../db/subing.js";
 /**
  * Own one environment for public registry TEL bodies, accepted ordinals and heads.
  * Mirrors frozen KERIpy RegBaser's typed tables; opening neither verifies
- * evidence nor migrates rows. Absent anchor/escrow tables stay null until an
- * explicit storage write initializes them, preserving readonly old layouts.
+ * evidence nor migrates rows. Every current store has anchor and escrow tables.
  * Construction stays closed; callers own reopen and joined close.
  */
 export class RegBaser extends LMDBer {
@@ -17,14 +16,6 @@ export class RegBaser extends LMDBer {
             throw new DatabaseNotOpenError("Registry environment is closed.");
         return this.env.getBinary(b(name)) !== undefined;
     }
-    /** Explicit writable initialization; never called by opening or reading a store. */
-    initializeStorage() {
-        if (this.readonly)
-            throw new DatabaseOperationError("Cannot initialize readonly registry storage.");
-        this.ancs ??= new CatCesrSuber(this, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] });
-        this.maes ??= new B64OnIoSetSuber(this, { subkey: "maes." });
-        this.ooes ??= new B64OnIoSetSuber(this, { subkey: "ooes." });
-    }
     constructor(options = {}) {
         super(options, {
             tailDirPath: "keri/acdc/reg",
@@ -54,26 +45,26 @@ export class RegBaser extends LMDBer {
             writable: true,
             value: void 0
         });
-        /** Event-SAID -> earliest verified KEL source couple, when this table exists. */
+        /** Event-SAID -> earliest verified KEL source couple, in the current store. */
         Object.defineProperty(this, "ancs", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: null
+            value: void 0
         });
         /** Insertion-ordered missing-anchor event-SAID tuples by registry and ordinal. */
         Object.defineProperty(this, "maes", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: null
+            value: void 0
         });
         /** Insertion-ordered out-of-order event-SAID tuples by registry and ordinal. */
         Object.defineProperty(this, "ooes", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: null
+            value: void 0
         });
     }
     /** Rebind the same environment's typed tables after every joined reopen. */
@@ -85,11 +76,9 @@ export class RegBaser extends LMDBer {
             this.evts = new SerderSuber(this, { subkey: "evts.", ctor: SerderACDC });
             this.tels = new CesrOnSuber(this, { subkey: "tels.", ctor: Saider });
             this.heads = new CesrSuber(this, { subkey: "heds.", ctor: Saider });
-            this.ancs = this.hasTable("ancs.")
-                ? new CatCesrSuber(this, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] })
-                : null;
-            this.maes = this.hasTable("maes.") ? new B64OnIoSetSuber(this, { subkey: "maes." }) : null;
-            this.ooes = this.hasTable("ooes.") ? new B64OnIoSetSuber(this, { subkey: "ooes." }) : null;
+            this.ancs = new CatCesrSuber(this, { subkey: "ancs.", ctor: [NumberPrimitive, Diger] });
+            this.maes = new B64OnIoSetSuber(this, { subkey: "maes." });
+            this.ooes = new B64OnIoSetSuber(this, { subkey: "ooes." });
             return true;
         }
         catch (error) {

package/esm/keri/npm/src/acdc/regengine.js

@@ -1,12 +1,10 @@
-/** Internal local TEL acceptance; registry facades own instance naming and scheduling. */
-import { Diger, Ilks, makeBlindState, makeBoundState, NumberPrimitive, SerderACDC, } from "cesr-ts";
-import { DatabaseNotOpenError, ValidationError } from "../core/errors.js";
-import { blindate } from "./messaging.js";
+/** Shared TEL validation, accepted-state publication, anchoring and retry for local and foreign registries. */
+import { Diger, Ilks, NumberPrimitive, } from "cesr-ts";
+import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
 import { validateRip, validateUpdate, verifyRegistryAnchor, } from "./regeventing.js";
-import { FailedSchemaValidationError, MissingSchemaError, validateSchema } from "./scheming.js";
 /**
  * Borrow the issuer's accepted KEL and registry store; no keys or handles are acquired.
- * Event processing is internal until the registry facade is available.
+ * The local facade and foreign observer share this accepted-state engine.
  * Publication is atomic; binding this instance happens only after successful commit.
  */
 export class RegistryEventer {
@@ -36,101 +34,23 @@ export class RegistryEventer {
             value: regk
         });
     }
+    /** Validated accepted head metadata; local construction may inspect it without duplicating acceptance checks. */
+    get acceptedHeadEvent() {
+        return this.regk ? this.acceptedHead(this.regk) : null;
+    }
     /** Read the accepted head only after validating its body and ordinal marker. */
     get head() {
-        const event = this.regk ? this.acceptedHead(this.regk) : null;
+        const event = this.acceptedHeadEvent;
         return event ? this.store.head(event.regid) : null;
     }
     /** Accepted TEL ordinal, retaining -1n for a staged but unaccepted inception. */
     get sn() {
-        return this.regk ? this.acceptedHead(this.regk)?.sn ?? -1n : -1n;
+        return this.acceptedHeadEvent?.sn ?? -1n;
     }
     /** Return an accepted inception; a corrupt marker/body pair throws. */
     get regser() {
         return this.regk ? this.acceptedAt(this.regk, 0) : null;
     }
-    /** Validate credential membership and issuer before deriving its next blinded registry update. */
-    blind(acdc, state, options = {}) {
-        if (!(acdc instanceof SerderACDC) || !acdc.verify()) {
-            throw new ValidationError("Registry blinding requires a self-verifying ACDC.");
-        }
-        if (acdc.regid !== this.regk)
-            throw new ValidationError("Credential belongs to another registry.");
-        if (acdc.issuer !== this.issuer)
-            throw new ValidationError("Credential belongs to another issuer.");
-        const schema = validateSchema(acdc, this.db);
-        if (schema.kind === "missing")
-            throw new MissingSchemaError(schema.said);
-        if (schema.kind === "invalid")
-            throw new FailedSchemaValidationError(schema.reason);
-        return this.blindTarget(acdc.said, state, options);
-    }
-    /** Commit a grant SAID without requiring the grant's issuer to control this presentation registry. */
-    present(grant, state = "presented", options = {}) {
-        const target = typeof grant === "string" ? grant : grant.said;
-        try {
-            new Diger({ qb64: target ?? "" });
-        }
-        catch (cause) {
-            throw new ValidationError("Presentation target must be a valid grant SAID.", { cause });
-        }
-        return this.blindTarget(target, state, options);
-    }
-    /** Empty target/state disclose a vacuous step; downstream verification retains the preceding binding. */
-    vacate(options = {}) {
-        return this.blindTarget("", "", options);
-    }
-    /** Derive and stage a validated target; presentation/vacuous callers own their target checks. */
-    blindTarget(target, state, options) {
-        const tip = this.effectiveFrontier();
-        if (!tip)
-            throw new ValidationError("Registry must be anchored before updates.");
-        if ("blinder" in options)
-            throw new ValidationError("Caller-supplied blinder overrides are unsupported.");
-        const sn = tip.sn + 1n;
-        if (sn > BigInt(Number.MAX_SAFE_INTEGER))
-            throw new RangeError("Unsafe registry update ordinal.");
-        const { raw, salt, tier, bound, bsn, bd, ...wire } = options;
-        const inputs = { raw, salt, tier, sn, acdc: target, state };
-        const blinder = bound ? makeBoundState({ ...inputs, bsn, bd }) : makeBlindState(inputs);
-        const serder = blindate(tip.regid, tip.said, blinder.d.nonce, { ...wire, sn });
-        const decision = this.processEvent(serder);
-        if (decision.kind === "reject")
-            throw new ValidationError(`Registry update rejected: ${decision.reason}`);
-        return [blinder, serder];
-    }
-    /** Extend an accepted head through exactly one staged successor at each ordinal, without mutation. */
-    effectiveFrontier() {
-        let tip = this.regk ? this.acceptedHead(this.regk) : null;
-        while (tip) {
-            const sn = tip.sn + 1n;
-            if (sn > BigInt(Number.MAX_SAFE_INTEGER))
-                return tip;
-            const saids = new Set();
-            for (const escrow of [this.store.baser.maes, this.store.baser.ooes]) {
-                for (const [said] of escrow?.get(tip.regid, Number(sn)) ?? [])
-                    saids.add(said);
-            }
-            let successor = null;
-            for (const said of saids) {
-                const body = this.store.event(said);
-                if (!body)
-                    continue;
-                if (body.said !== said)
-                    throw new Error("Corrupt staged registry event.");
-                const result = validateUpdate(body, tip.regid);
-                if (result.kind !== "valid" || result.event.sn !== sn || result.event.prior !== tip.said)
-                    continue;
-                if (successor)
-                    throw new ValidationError("Registry has conflicting staged successors.");
-                successor = result.event;
-            }
-            if (!successor)
-                return tip;
-            tip = successor;
-        }
-        return null;
-    }
     /** Retry newly visible anchors, then advance the contiguous accepted chain. */
     processEscrows() {
         this.processMissingAnchors();
@@ -185,7 +105,7 @@ export class RegistryEventer {
             const sn = head.sn + 1n;
             if (sn > BigInt(Number.MAX_SAFE_INTEGER))
                 return;
-            const candidates = this.store.baser.ooes?.get(this.regk, Number(sn)).map(([said]) => said) ?? [];
+            const candidates = this.store.baser.ooes.get(this.regk, Number(sn)).map(([said]) => said);
             candidates.sort((a, b) => this.compareAnchors(a, b));
             let advanced = false;
             for (const said of candidates) {
@@ -207,8 +127,8 @@ export class RegistryEventer {
         if (this.regk === null)
             return;
         const slots = new Map();
-        // Finish the read cursor before writes. Shared scan credit belongs to the resource-policy phase.
-        for (const [, sn, [said]] of this.store.baser.maes?.getTopItemIter(this.regk) ?? []) {
+        // Finish the read cursor before writes.
+        for (const [, sn, [said]] of this.store.baser.maes.getTopItemIter(this.regk)) {
             if (!Number.isSafeInteger(sn) || sn < 0)
                 throw new RangeError("Unsafe registry escrow ordinal.");
             const candidates = slots.get(sn) ?? [];
@@ -299,7 +219,8 @@ export class RegistryEventer {
         const env = this.store.baser.env;
         if (!env)
             throw new DatabaseNotOpenError("Registry acceptance requires an open backing store.");
-        this.store.baser.initializeStorage();
+        if (this.store.baser.readonly)
+            throw new DatabaseOperationError("Cannot write readonly registry storage.");
         return env.transactionSync(() => {
             const prior = this.acceptedAt(event.regid, Number(event.sn) - 1);
             if (prior && prior.said !== event.prior)
@@ -342,8 +263,8 @@ export class RegistryEventer {
         const env = this.store.baser.env;
         if (!env)
             throw new DatabaseNotOpenError("Registry acceptance requires an open backing store.");
-        // Bind named tables before the rollback-capable event transaction owns their rows.
-        this.store.baser.initializeStorage();
+        if (this.store.baser.readonly)
+            throw new DatabaseOperationError("Cannot write readonly registry storage.");
         const decision = env.transactionSync(() => {
             const previous = this.acceptedEvent(event);
             if (previous)

package/esm/keri/npm/src/acdc/registering.js

@@ -35,7 +35,7 @@ function registryOrdinal(sn) {
  * Wrap a supplied RegBaser without opening another environment. Reads and writes
  * are storage operations: callers authenticate events/anchors and decide acceptance.
  * Explicit close delegates to the supplied owner; construction adds no lifetime scope.
- * Missing old-layout facilities remain null until an explicit writable operation.
+ * Local aliases are optional; public observer stores need only evidence tables.
  */
 export class RegistryStore {
     constructor(baser) {
@@ -58,7 +58,7 @@ export class RegistryStore {
             value: null
         });
     }
-    /** Alias mapper is absent for old layouts; refresh it after the owner's reopen. */
+    /** Local alias mapper is optional; refresh it after the owner's reopen. */
     get records() {
         if (!this.baser.env)
             throw new DatabaseNotOpenError("Registry backing store is closed.");
@@ -70,7 +70,7 @@ export class RegistryStore {
         }
         return this.aliases;
     }
-    /** Explicit alias write creates regs. only when needed, without an opening migration. */
+    /** Explicit alias write creates regs. only when needed, for local registry management. */
     putRecord(name, record) {
         return this.initializeRecords().pin(name, record);
     }
@@ -100,18 +100,17 @@ export class RegistryStore {
     putEvent(serder) {
         return this.baser.evts.pin(serder.said, serder);
     }
-    /** Read a stored source couple; missing old-layout ancs. has no anchors. */
+    /** Read a stored source couple. */
     anchor(said) {
         if (!this.baser.opened)
             throw new DatabaseNotOpenError("Registry backing store is closed.");
-        return this.baser.ancs?.get(said) ?? null;
+        return this.baser.ancs.get(said);
     }
     /** Retain the earliest caller-verified anchor; equal/later reseals cannot reorder siblings. */
     putAnchor(said, number, diger) {
         const current = this.anchor(said);
         if (current && current[0].num <= number.num)
             return false;
-        this.baser.initializeStorage();
         return this.baser.ancs.pin(said, [number, diger]);
     }
     /** Read the accepted-head cache without verifying the event. */
@@ -148,7 +147,7 @@ export class RegistryStore {
                 yield event.raw;
         }
     }
-    /** Eagerly collect accepted TEL bytes; callers must reserve collection credit, not infer a shared budget. */
+    /** Eagerly collect accepted TEL bytes in ordinal order. */
     cloneTel(regk, sn = 0) {
         const chunks = [...this.cloneTelIter(regk, sn)];
         const stream = new Uint8Array(chunks.reduce((size, raw) => size + raw.length, 0));
@@ -162,19 +161,17 @@ export class RegistryStore {
     /** Add one missing-anchor candidate in insertion order, deduplicating its SAID. */
     escrowMissingAnchor(regk, sn, said) {
         sn = registryOrdinal(sn);
-        this.baser.initializeStorage();
         return this.baser.maes.add(regk, sn, [said]);
     }
     /** Add one out-of-order candidate in insertion order, deduplicating its SAID. */
     escrowOutOfOrder(regk, sn, said) {
         sn = registryOrdinal(sn);
-        this.baser.initializeStorage();
         return this.baser.ooes.add(regk, sn, [said]);
     }
-    /** Remove this candidate from both escrow families without creating absent tables. */
+    /** Remove this candidate from both escrow families. */
     clearEscrows(regk, sn, said) {
         sn = registryOrdinal(sn);
-        this.baser.maes?.rem(regk, sn, [said]);
-        this.baser.ooes?.rem(regk, sn, [said]);
+        this.baser.maes.rem(regk, sn, [said]);
+        this.baser.ooes.rem(regk, sn, [said]);
     }
 }

package/esm/keri/npm/src/acdc/registraring.js

@@ -1,8 +1,11 @@
+/** Named local v2 registry services; legacy VDR services retain their separate module and owner. */
+import { Diger, makeBlindState, makeBoundState, SerderACDC, } from "cesr-ts";
 import { DatabaseNotOpenError, ValidationError } from "../core/errors.js";
-import { regcept } from "./messaging.js";
-import { RegistryEventer, } from "./regengine.js";
-import { validateRip } from "./regeventing.js";
+import { blindate, regcept } from "./messaging.js";
+import { RegistryEventer } from "./regengine.js";
+import { validateRip, validateUpdate } from "./regeventing.js";
 import { openRegistry, RegistryStore } from "./registering.js";
+import { FailedSchemaValidationError, MissingSchemaError, validateSchema } from "./scheming.js";
 /** Acquire a named manager, joining owned-store cleanup if opening or alias loading fails. */
 export function* createRegery({ hby, baser, ...options }) {
     const ownsBaser = baser === undefined;
@@ -90,7 +93,6 @@ export class Regery {
         const env = this.baser.env;
         if (!env)
             throw new DatabaseNotOpenError("Registry backing store is closed.");
-        this.baser.initializeStorage();
         const records = this.store.initializeRecords();
         const registry = new Registry(hab, this.store, name);
         env.transactionSync(() => {
@@ -201,9 +203,21 @@ export class Registry {
             throw new ValidationError(`Registry inception rejected: ${result.reason}`);
         return rip;
     }
-    /** Derive a disclosure and stage its commitment after checking credential membership. */
+    /** Validate credential membership and issuer before deriving its next blinded registry update. */
     blind(acdc, state, options = {}) {
-        return this.eventer.blind(acdc, state, options);
+        if (!(acdc instanceof SerderACDC) || !acdc.verify()) {
+            throw new ValidationError("Registry blinding requires a self-verifying ACDC.");
+        }
+        if (acdc.regid !== this.regk)
+            throw new ValidationError("Credential belongs to another registry.");
+        if (acdc.issuer !== this.hab.pre)
+            throw new ValidationError("Credential belongs to another issuer.");
+        const schema = validateSchema(acdc, this.hab.db);
+        if (schema.kind === "missing")
+            throw new MissingSchemaError(schema.said);
+        if (schema.kind === "invalid")
+            throw new FailedSchemaValidationError(schema.reason);
+        return this.blindTarget(acdc.said, state, options);
     }
     /** Process parsed TEL evidence through the shared typed engine. */
     processEvent(serder) {
@@ -213,52 +227,74 @@ export class Registry {
     anchorMsg(said, number, diger) {
         return this.eventer.anchorMsg(said, number, diger);
     }
-    /** Stage a grant commitment in this registry; grant authentication remains with IPEX. */
+    /** Commit a grant SAID without requiring the grant's issuer to control this presentation registry. */
     present(grant, state = "presented", options = {}) {
-        return this.eventer.present(grant, state, options);
+        const target = typeof grant === "string" ? grant : grant.said;
+        try {
+            new Diger({ qb64: target ?? "" });
+        }
+        catch (cause) {
+            throw new ValidationError("Presentation target must be a valid grant SAID.", { cause });
+        }
+        return this.blindTarget(target, state, options);
     }
-    /** Stage a vacuous disclosure that leaves the prior effective binding in force. */
+    /** Empty target/state disclose a vacuous step; downstream verification retains the preceding binding. */
     vacate(options = {}) {
-        return this.eventer.vacate(options);
+        return this.blindTarget("", "", options);
+    }
+    /** Derive and stage a validated target; presentation/vacuous callers own their target checks. */
+    blindTarget(target, state, options) {
+        const tip = this.effectiveFrontier();
+        if (!tip)
+            throw new ValidationError("Registry must be anchored before updates.");
+        if ("blinder" in options)
+            throw new ValidationError("Caller-supplied blinder overrides are unsupported.");
+        const sn = tip.sn + 1n;
+        if (sn > BigInt(Number.MAX_SAFE_INTEGER))
+            throw new RangeError("Unsafe registry update ordinal.");
+        const { raw, salt, tier, bound, bsn, bd, ...wire } = options;
+        const inputs = { raw, salt, tier, sn, acdc: target, state };
+        const blinder = bound ? makeBoundState({ ...inputs, bsn, bd }) : makeBlindState(inputs);
+        const serder = blindate(tip.regid, tip.said, blinder.d.nonce, { ...wire, sn });
+        const decision = this.processEvent(serder);
+        if (decision.kind === "reject")
+            throw new ValidationError(`Registry update rejected: ${decision.reason}`);
+        return [blinder, serder];
+    }
+    /** Extend an accepted head through exactly one staged successor at each ordinal, without mutation. */
+    effectiveFrontier() {
+        let tip = this.eventer.acceptedHeadEvent;
+        while (tip) {
+            const sn = tip.sn + 1n;
+            if (sn > BigInt(Number.MAX_SAFE_INTEGER))
+                return tip;
+            const saids = new Set();
+            for (const escrow of [this.store.baser.maes, this.store.baser.ooes]) {
+                for (const [said] of escrow?.get(tip.regid, Number(sn)) ?? [])
+                    saids.add(said);
+            }
+            let successor = null;
+            for (const said of saids) {
+                const body = this.store.event(said);
+                if (!body)
+                    continue;
+                if (body.said !== said)
+                    throw new Error("Corrupt staged registry event.");
+                const result = validateUpdate(body, tip.regid);
+                if (result.kind !== "valid" || result.event.sn !== sn || result.event.prior !== tip.said)
+                    continue;
+                if (successor)
+                    throw new ValidationError("Registry has conflicting staged successors.");
+                successor = result.event;
+            }
+            if (!successor)
+                return tip;
+            tip = successor;
+        }
+        return null;
     }
     /** Retry both missing-anchor and ordering prerequisites. */
     processEscrows() {
         this.eventer.processEscrows();
     }
 }
-/** Caller-facing v2 operations over a borrowed Regery; this facade acquires no keys, stores or runtime service. */
-export class Registrar {
-    constructor(rgy) {
-        Object.defineProperty(this, "rgy", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: rgy
-        });
-    }
-    /** Accept instances directly; registry keys take precedence over local aliases, as in frozen KERIpy. */
-    registry(reference) {
-        if (reference instanceof Registry)
-            return reference;
-        const registry = this.rgy.regs.get(reference) ?? this.rgy.registryByName(reference);
-        if (!registry)
-            throw new ValidationError(`Unknown registry: ${reference}`);
-        return registry;
-    }
-    /** Create one named registry through the manager's existing atomic inception/alias workflow. */
-    makeRegistry(name, prefix, options = {}) {
-        return this.rgy.makeRegistry(name, prefix, options);
-    }
-    /** Stage a credential binding, requiring its issuer and registry to match the resolved Registry. */
-    issue(reference, acdc, state = "issued", options = {}) {
-        return this.registry(reference).blind(acdc, state, options);
-    }
-    /** Bind a grant SAID through a registry instance, key or alias. */
-    present(reference, grant, state = "presented", options = {}) {
-        return this.registry(reference).present(grant, state, options);
-    }
-    /** Append a vacuous state disclosure through the resolved registry. */
-    vacate(reference, options = {}) {
-        return this.registry(reference).vacate(options);
-    }
-}