keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/acdc/regeventing.js

@@ -3,7 +3,7 @@
  * Mirrors frozen KERIpy acdc.regeventing.vet/vetBinds. Parsing, KEL acceptance,
  * fetching, escrow persistence, and issuer-side TEL processing belong to callers.
  */
-import { commitBlindState, commitBoundState, Ilks, } from "cesr-ts";
+import { commitBlindState, commitBoundState, Diger, Ilks, ParserError, } from "cesr-ts";
 import { timestampMicros } from "../time/mod.js";
 /** Sequence numbers retain protocol precision; database KEL lookups remain safe integers. */
 function ordinal(event) {
@@ -14,9 +14,14 @@ function normalizeEvent(event) {
     if (!event.verify() || (event.ilk !== Ilks.rip && event.ilk !== Ilks.bup))
         return { kind: "reject", reason: "event" };
     const sequence = event.sad?.n;
-    if (typeof sequence !== "string" || !/^[0-9a-fA-F]+$/.test(sequence) || ordinal(event) >= 2n ** 128n) {
+    if (typeof sequence !== "string" || !/^(0|[1-9a-f][0-9a-f]*)$/.test(sequence) || ordinal(event) >= 2n ** 128n) {
         return { kind: "reject", reason: "sequence" };
     }
+    const stamp = event.sad?.dt;
+    if (typeof stamp !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}[+-]\d{2}:\d{2}$/.test(stamp)
+        || stamp.startsWith("0000-")
+        || timestampMicros(stamp) === null)
+        return { kind: "reject", reason: "timestamp" };
     return {
         kind: "valid",
         event: {
@@ -61,8 +66,8 @@ export function validateUpdate(serder, regid, prior) {
     return result;
 }
 /**
- * Check a local TEL anchor against the last accepted, fully witnessed KEL event.
- * Unlike observer vetting, this requires the full registry/ordinal/digest tuple.
+ * Check a local TEL anchor against the current accepted KEL branch and its witness quorum.
+ * V2 TEL admission requires the full registry/ordinal/event-SAID seal.
  * Missing or mismatched evidence returns false; database failures propagate.
  */
 export function verifyRegistryAnchor(event, { db, issuer, number, diger }) {
@@ -70,13 +75,68 @@ export function verifyRegistryAnchor(event, { db, issuer, number, diger }) {
         return false;
     const said = db.kels.getLast(issuer, Number(number.num));
     const anchor = said ? db.getEvtSerder(issuer, said) : null;
-    if (!anchor || anchor.said !== diger.qb64 || !db.fullyWitnessed(anchor))
+    if (!anchor || anchor.said !== diger.qb64 || !onCurrentRegistryBranch(db, issuer, anchor)
+        || !db.fullyWitnessed(anchor))
         return false;
-    return anchor.seals.some((seal) => !!seal && typeof seal === "object" && !Array.isArray(seal)
-        && "i" in seal && "s" in seal && "d" in seal
-        && seal.i === event.regid && seal.s === event.serder.sad.n && seal.d === event.said);
+    return anchor.seals.some((seal) => matchesRegistrySeal(seal, event.serder));
 }
-/** Verifier anchors match digests; a seal's TEL sequence hint is not authoritative. */
+/** Descend the current head's exact prior digests, stopping at missing or noncontiguous ancestry. */
+function* currentRegistryBranch(db, issuer) {
+    let current = db.getKever(issuer)?.serder ?? null;
+    while (current) {
+        yield current;
+        const prior = current.prior ? db.getEvtSerder(issuer, current.prior) : null;
+        if (!prior || prior.sn !== current.sn - 1)
+            return;
+        current = prior;
+    }
+}
+/** Recovery preserves disputed buckets; new TEL authority comes only from the current branch. */
+function onCurrentRegistryBranch(db, issuer, anchor) {
+    for (const current of currentRegistryBranch(db, issuer)) {
+        if (current.sn < anchor.sn)
+            return false;
+        if (current.said === anchor.said)
+            return true;
+    }
+    return false;
+}
+/** Match the full registry/ordinal/event-SAID tuple required for v2 TEL authority. */
+export function matchesRegistrySeal(candidate, event) {
+    if (!candidate || typeof candidate !== "object" || Array.isArray(candidate))
+        return false;
+    const seal = candidate;
+    const fields = Object.keys(seal).sort().join(",");
+    if (fields !== "d,i,s")
+        return false;
+    return seal.d === event.said
+        && seal.s === event.sad.n
+        && seal.i === (event.ilk === Ilks.rip ? event.said : event.regid);
+}
+/** Refuse resolvable false locators before publication, without persisting unsigned requirements. */
+export function validateRegistrySourceLocators(event, db, issuer, { sscs = [], ssts = [] }) {
+    const locators = [
+        ...sscs.map((seal) => ({ controller: issuer, number: seal.s, diger: seal.d })),
+        ...ssts.map((seal) => ({ controller: seal.i.qb64, number: seal.s, diger: seal.d })),
+    ];
+    for (const { controller, number, diger } of locators) {
+        if (issuer !== null && controller !== issuer)
+            return false;
+        if (controller === null || number.num > BigInt(Number.MAX_SAFE_INTEGER))
+            continue;
+        const accepted = db.kels.getLast(controller, Number(number.num));
+        if (!accepted)
+            continue;
+        if (accepted !== diger.qb64)
+            return false;
+        const anchor = db.getEvtSerder(controller, accepted);
+        if (anchor && (!onCurrentRegistryBranch(db, controller, anchor)
+            || !anchor.seals.some((seal) => matchesRegistrySeal(seal, event))))
+            return false;
+    }
+    return true;
+}
+/** Public stateless vetting authenticates digest commitments; other seal fields are nonbinding hints. */
 function sealDigests(event) {
     return event.seals.flatMap((seal) => {
         if (typeof seal === "string")
@@ -86,19 +146,26 @@ function sealDigests(event) {
         return [];
     });
 }
-/** Scan only the accepted controller's KEL frontier; this does not verify KEL signatures. */
-function scanKel(db, issuer, said) {
-    const kever = db.getKever(issuer);
-    if (!kever)
-        return null;
-    for (const [sn, digest] of db.getKelItemIter(issuer)) {
-        if (sn > kever.sn)
-            break;
-        const event = db.getEvtSerder(issuer, digest);
-        if (event && sealDigests(event).includes(said))
-            return [sn, event.said];
+/** Find an accepted controller event carrying an exact registry seal and its historical witness quorum. */
+export function findRegistryAnchor(db, issuer, registry) {
+    let earliest = null;
+    for (const event of currentRegistryBranch(db, issuer)) {
+        if (db.fullyWitnessed(event)
+            && event.seals.some((seal) => matchesRegistrySeal(seal, registry))) {
+            earliest = [event.sn, event.said];
+        }
+    }
+    return earliest;
+}
+/** Find a public digest commitment without granting v2 registry admission authority. */
+function findDigestAnchor(db, issuer, digest) {
+    let earliest = null;
+    for (const event of currentRegistryBranch(db, issuer)) {
+        if (db.fullyWitnessed(event) && sealDigests(event).includes(digest)) {
+            earliest = [event.sn, event.said];
+        }
     }
-    return null;
+    return earliest;
 }
 /** Match the reference's source-hint fallback and named aggregate-seal refusal. */
 function vetAnchor(event, issuer, db, told, source) {
@@ -111,29 +178,66 @@ function vetAnchor(event, issuer, db, told, source) {
     if (source !== undefined) {
         const said = typeof source === "string" ? source : db.kels.getLast(issuer, source);
         const anchor = said ? db.getEvtSerder(issuer, said) : null;
-        if (anchor) {
+        if (anchor && db.kels.getLast(issuer, anchor.sn) === anchor.said
+            && onCurrentRegistryBranch(db, issuer, anchor)) {
             const digests = sealDigests(anchor);
-            if (digests.includes(event.said))
+            if (db.fullyWitnessed(anchor) && digests.includes(event.said)) {
                 return { kind: "verified", anchor: [anchor.sn, anchor.said] };
+            }
             if (digests.length && !digests.some((digest) => typeof digest === "string" && told.has(digest))) {
                 return { kind: "reject", reason: "rootSeal" };
             }
         }
     }
-    const anchor = scanKel(db, issuer, event.said);
+    const anchor = findDigestAnchor(db, issuer, event.said);
     if (anchor)
         return { kind: "verified", anchor };
     for (const pre of db.kevers.keys()) {
-        if (pre !== issuer && scanKel(db, pre, event.said))
+        if (pre !== issuer && findDigestAnchor(db, pre, event.said))
             return { kind: "reject", reason: "anchor" };
     }
     return missing;
 }
-/** Recompute the disclosed tuple with the reference's default Blake3 commitment. */
-function vetBlind(blinder, blid) {
-    const redone = "bn" in blinder ? commitBoundState(blinder, "E") : commitBlindState(blinder, "E");
+/** Authenticate the declared native BLID against the exact carried primitive tuple. */
+export function vetBlind(blinder, blid) {
+    if (!/^[E-I][A-Za-z0-9_-]{43}$/.test(blid) || blinder.d.nonce !== blid)
+        return false;
+    let digest;
+    try {
+        digest = new Diger({ qb64: blid });
+    }
+    catch (error) {
+        if (error instanceof ParserError)
+            return false;
+        throw error;
+    }
+    if (new Diger({ code: digest.code, raw: digest.raw }).qb64 !== blid)
+        return false;
+    const redone = "bn" in blinder ? commitBoundState(blinder, digest.code) : commitBlindState(blinder, digest.code);
     return redone.d.nonce === blid;
 }
+/** A bound opening names an exact accepted Issuee event, including historical interactions. */
+export function vetBound(blinder, acdc, db) {
+    if (!("bn" in blinder))
+        return null;
+    const number = blinder.bn.num, digest = blinder.bd.nonce;
+    if (!blinder.td.nonce && !blinder.ts.text) {
+        return number === 0n && !digest ? null : { kind: "reject", reason: "binding" };
+    }
+    if (!digest || !acdc || blinder.td.nonce !== acdc.said || !acdc.issuee)
+        return { kind: "reject", reason: "binding" };
+    const issuer = acdc.issuee;
+    const missing = { kind: "missing", reason: "anchor", issuer, said: digest };
+    if (number > BigInt(Number.MAX_SAFE_INTEGER))
+        return missing;
+    const accepted = db.kels.getLast(issuer, Number(number));
+    if (!accepted)
+        return missing;
+    if (accepted !== digest)
+        return { kind: "reject", reason: "anchor" };
+    const event = db.getEvtSerder(issuer, accepted);
+    return event && db.fullyWitnessed(event) ? null : missing;
+}
 /** A registry must bind both the exact credential and its issuer, plus rd when present. */
 function binding(acdc, state) {
     if (!acdc.verify() || state.acdc !== acdc.said || acdc.issuer !== state.issuer)
@@ -200,6 +304,9 @@ export function vet({ rip, updates = [], db, sources = new Map(), acdc, blinder
     if (head.ilk === Ilks.bup && blinder) {
         if (!vetBlind(blinder, head.sad.b))
             return { kind: "reject", reason: "disclosure" };
+        const refusal = vetBound(blinder, acdc, db);
+        if (refusal)
+            return refusal;
         state.acdc = blinder.td.nonce || null;
         state.state = blinder.ts.text || null;
     }
@@ -215,25 +322,28 @@ export function vet({ rip, updates = [], db, sources = new Map(), acdc, blinder
 /**
  * Resolve the latest non-vacuous binding behind a verified (possibly historical)
  * head. Every intervening vacuous update needs exactly one authentic disclosure.
- * The caller supplies a trusted receiver timestamp; this creates no KRAM state.
+ * The selected SAID fixes the TEL prefix; neither timestamps nor source hints select it.
  */
-export function vetBinds({ rip, updates = [], db, sources = new Map(), acdc, blinders, target, controller, cutoff, requireSource = false }) {
-    if (cutoff !== undefined) {
-        const when = timestampMicros(cutoff);
-        const inception = timestampMicros(rip.sad?.dt);
-        if (when === null || inception === null)
-            return { kind: "reject", reason: "timestamp" };
-        if (inception > when)
-            return { kind: "reject", reason: "binding" };
-        const selected = [];
+export function vetBinds({ rip, updates = [], db, sources = new Map(), acdc, blinders, target, controller, cutoff, at, requireSource = false }) {
+    if (cutoff !== undefined)
+        return { kind: "reject", reason: "event" };
+    if (at !== undefined) {
+        const selected = [rip, ...updates].filter((event) => event.said === at);
+        if (selected.length !== 1)
+            return { kind: "missing", reason: "anchor", issuer: rip.issuer, said: at };
+        const checked = selected[0].ilk === Ilks.rip ? validateRip(selected[0]) : validateUpdate(selected[0], rip.said);
+        if (checked.kind === "reject")
+            return checked;
+        const prefix = [];
         for (const update of updates) {
-            const stamp = timestampMicros(update.sad?.dt);
-            if (stamp === null)
-                return { kind: "reject", reason: "timestamp" };
-            if (stamp <= when)
-                selected.push(update);
+            const sequence = update.sad?.n;
+            if (typeof sequence !== "string" || !/^(0|[1-9a-f][0-9a-f]*)$/.test(sequence) || ordinal(update) >= 2n ** 128n) {
+                return { kind: "reject", reason: "sequence" };
+            }
+            if (ordinal(update) <= checked.event.sn)
+                prefix.push(update);
         }
-        updates = selected;
+        updates = prefix;
     }
     const result = vet({ rip, updates, db, sources });
     if (result.kind !== "verified")
@@ -243,10 +353,19 @@ export function vetBinds({ rip, updates = [], db, sources = new Map(), acdc, bli
     const newest = [...updates].sort((a, b) => ordinal(a) > ordinal(b) ? -1 : ordinal(a) < ordinal(b) ? 1 : 0);
     for (const update of newest) {
         const matches = blinders.filter((blinder) => blinder.d.nonce === update.sad.b);
+        if (!matches.length) {
+            if (blinders.some((blinder) => !vetBlind(blinder, blinder.d.nonce))
+                || new Set(blinders.map((blinder) => blinder.d.nonce)).size !== blinders.length)
+                return { kind: "reject", reason: "disclosure" };
+            return { kind: "missing", reason: "disclosure", issuer: result.state.issuer, said: update.said };
+        }
         if (matches.length !== 1 || !vetBlind(matches[0], update.sad.b)) {
             return { kind: "reject", reason: "disclosure" };
         }
         const blinder = matches[0];
+        const refusal = vetBound(blinder, acdc, db);
+        if (refusal)
+            return refusal;
         const td = blinder.td.nonce;
         const state = blinder.ts.text;
         if (!td && !state)

package/esm/keri/npm/src/acdc/registering.js

@@ -1,9 +1,38 @@
-/** Storage-only facade for public registry evidence and local registry aliases. */
-import { Saider } from "cesr-ts";
+/** Public registry evidence storage, exact opening verification and accepted replay. */
+import { BlindState, BoundState, bytesEqual, Counter, Ilks, isGroupTuple, parseBlinder, Saider, Vrsn_2_0, } from "cesr-ts";
 import { DatabaseNotOpenError, DatabaseOperationError, ValidationError } from "../core/errors.js";
+import { messagize } from "../core/protocol-serialization.js";
 import { RawRecord } from "../core/records.js";
 import { Komer } from "../db/koming.js";
 import { RegBaser } from "./regbasing.js";
+import { vetBlind } from "./regeventing.js";
+/** Encode one deliberately public opening using its exact primitive representations. */
+export function publicOpeningAttachment(opening) {
+    return Counter.enclose({
+        code: "bn" in opening ? "BoundStateSextuples" : "BlindedStateQuadruples",
+        version: Vrsn_2_0,
+        qb64: "bn" in opening ? BoundState.qb64b(opening) : BlindState.qb64b(opening),
+    });
+}
+/** Decode one retained counted tuple through the existing CESR codec and semantic descriptors. */
+function retainedOpening(raw) {
+    const parsed = parseBlinder(raw, Vrsn_2_0, "txt"), tuple = parsed.items[0];
+    if (parsed.consumed !== raw.length || parsed.items.length !== 1 || !tuple || !isGroupTuple(tuple)) {
+        throw new DatabaseOperationError("Corrupt retained public opening.");
+    }
+    const fields = tuple.map((field) => {
+        if (isGroupTuple(field) || !("qb64b" in field))
+            throw new DatabaseOperationError("Corrupt retained opening tuple.");
+        return field.qb64b;
+    });
+    if ((parsed.name === "BlindedStateQuadruples" || parsed.name === "BigBlindedStateQuadruples") && fields.length === 4) {
+        return BlindState.fromQb64bTuple([fields[0], fields[1], fields[2], fields[3]]);
+    }
+    if ((parsed.name === "BoundStateSextuples" || parsed.name === "BigBoundStateSextuples") && fields.length === 6) {
+        return BoundState.fromQb64bTuple([fields[0], fields[1], fields[2], fields[3], fields[4], fields[5]]);
+    }
+    throw new DatabaseOperationError("Corrupt retained public opening family.");
+}
 /** Persisted local registry alias, matching frozen registering.RegistryRecord. */
 export class RegistryRecord extends RawRecord {
 }
@@ -33,9 +62,10 @@ function registryOrdinal(sn) {
 }
 /**
  * Wrap a supplied RegBaser without opening another environment. Reads and writes
- * are storage operations: callers authenticate events/anchors and decide acceptance.
+ * retain public bytes; retainOpening checks the exact body and BLID. Callers
+ * authenticate KEL anchors and decide TEL acceptance.
  * Explicit close delegates to the supplied owner; construction adds no lifetime scope.
- * Missing old-layout facilities remain null until an explicit writable operation.
+ * Local aliases are optional; public observer stores need only evidence tables.
  */
 export class RegistryStore {
     constructor(baser) {
@@ -58,7 +88,7 @@ export class RegistryStore {
             value: null
         });
     }
-    /** Alias mapper is absent for old layouts; refresh it after the owner's reopen. */
+    /** Local alias mapper is optional; refresh it after the owner's reopen. */
     get records() {
         if (!this.baser.env)
             throw new DatabaseNotOpenError("Registry backing store is closed.");
@@ -70,7 +100,7 @@ export class RegistryStore {
         }
         return this.aliases;
     }
-    /** Explicit alias write creates regs. only when needed, without an opening migration. */
+    /** Explicit alias write creates regs. only when needed, for local registry management. */
     putRecord(name, record) {
         return this.initializeRecords().pin(name, record);
     }
@@ -100,19 +130,56 @@ export class RegistryStore {
     putEvent(serder) {
         return this.baser.evts.pin(serder.said, serder);
     }
-    /** Read a stored source couple; missing old-layout ancs. has no anchors. */
+    /** Read deliberately published opening bytes for this exact event, without creating evidence. */
+    opening(said) {
+        return this.baser.openings.get(said);
+    }
+    /** Decode and authenticate one deliberately public stored opening, including pending events. */
+    publicOpening(said) {
+        const raw = this.opening(said);
+        if (!raw)
+            return null;
+        const event = this.event(said), opening = retainedOpening(raw);
+        if (!event || event.said !== said || event.ilk !== Ilks.bup || !event.verify()
+            || !vetBlind(opening, event.sad.b)) {
+            throw new DatabaseOperationError("Retained public opening does not authenticate its stored event.");
+        }
+        return opening;
+    }
+    /** Retain one authentic public BUP opening only against its exact already-stored body. */
+    retainOpening(event, opening) {
+        if (event.ilk !== Ilks.bup || !event.verify())
+            throw new ValidationError("Public opening requires a verified BUP.");
+        const stored = this.event(event.said);
+        if (!stored || !bytesEqual(stored.raw, event.raw)) {
+            throw new ValidationError("Public opening requires the exact stored event body.");
+        }
+        if (!vetBlind(opening, event.sad.b)) {
+            throw new ValidationError("Public opening does not match the event commitment.");
+        }
+        const raw = publicOpeningAttachment(opening), old = this.opening(event.said);
+        if (old) {
+            if (!bytesEqual(old, raw)) {
+                throw new ValidationError("A different public opening is already retained for this event.");
+            }
+        }
+        else if (!this.baser.openings.put(event.said, raw)) {
+            const retained = this.opening(event.said);
+            if (!retained || !bytesEqual(retained, raw)) {
+                throw new ValidationError("A different public opening is already retained for this event.");
+            }
+        }
+        return opening;
+    }
+    /** Read a stored source couple. */
     anchor(said) {
         if (!this.baser.opened)
             throw new DatabaseNotOpenError("Registry backing store is closed.");
-        return this.baser.ancs?.get(said) ?? null;
+        return this.baser.ancs.get(said);
     }
-    /** Retain the earliest caller-verified anchor; equal/later reseals cannot reorder siblings. */
+    /** Retain the first caller-verified anchor pair; later presentations cannot replace it. */
     putAnchor(said, number, diger) {
-        const current = this.anchor(said);
-        if (current && current[0].num <= number.num)
-            return false;
-        this.baser.initializeStorage();
-        return this.baser.ancs.pin(said, [number, diger]);
+        return this.baser.ancs.put(said, [number, diger]);
     }
     /** Read the accepted-head cache without verifying the event. */
     head(regk) {
@@ -140,15 +207,19 @@ export class RegistryStore {
         this.baser.tels.putOn(regk, sn, said);
         this.baser.heads.pin(regk, said);
     }
-    /** Yield stored accepted bodies from the inclusive ordinal; skip missing bodies like the reference. */
+    /** Yield accepted public TEL frames, with a retained opening or an explicit empty attachment foot. */
     *cloneTelIter(regk, sn = 0) {
         for (const [, , said] of this.baser.tels.getAllItemIter(regk, registryOrdinal(sn))) {
             const event = this.event(said.qb64);
-            if (event)
-                yield event.raw;
+            if (!event)
+                continue;
+            const raw = this.opening(event.said);
+            if (raw)
+                this.publicOpening(event.said);
+            yield messagize(event, raw ?? new Uint8Array(), { gvrsn: Vrsn_2_0 });
         }
     }
-    /** Eagerly collect accepted TEL bytes; callers must reserve collection credit, not infer a shared budget. */
+    /** Eagerly collect accepted TEL bytes in ordinal order. */
     cloneTel(regk, sn = 0) {
         const chunks = [...this.cloneTelIter(regk, sn)];
         const stream = new Uint8Array(chunks.reduce((size, raw) => size + raw.length, 0));
@@ -162,19 +233,24 @@ export class RegistryStore {
     /** Add one missing-anchor candidate in insertion order, deduplicating its SAID. */
     escrowMissingAnchor(regk, sn, said) {
         sn = registryOrdinal(sn);
-        this.baser.initializeStorage();
         return this.baser.maes.add(regk, sn, [said]);
     }
     /** Add one out-of-order candidate in insertion order, deduplicating its SAID. */
     escrowOutOfOrder(regk, sn, said) {
         sn = registryOrdinal(sn);
-        this.baser.initializeStorage();
         return this.baser.ooes.add(regk, sn, [said]);
     }
-    /** Remove this candidate from both escrow families without creating absent tables. */
+    /**
+     * Remove this candidate from both escrow families.
+     * @param regk Registry identifier whose candidate slots are being cleared.
+     * @param sn TEL ordinal shared by the candidate's escrow memberships.
+     * @param said Candidate event SAID; other candidates in the slot remain.
+     * @returns Whether either family contained a removed membership.
+     */
     clearEscrows(regk, sn, said) {
         sn = registryOrdinal(sn);
-        this.baser.maes?.rem(regk, sn, [said]);
-        this.baser.ooes?.rem(regk, sn, [said]);
+        const missingAnchor = this.baser.maes.rem(regk, sn, [said]);
+        const outOfOrder = this.baser.ooes.rem(regk, sn, [said]);
+        return missingAnchor || outOfOrder;
     }
 }

package/esm/keri/npm/src/acdc/registraring.js

@@ -1,8 +1,11 @@
+/** Named local v2 registry services; legacy VDR services retain their separate module and owner. */
+import { Diger, makeBlindState, makeBoundState, SerderACDC, } from "cesr-ts";
 import { DatabaseNotOpenError, ValidationError } from "../core/errors.js";
-import { regcept } from "./messaging.js";
-import { RegistryEventer, } from "./regengine.js";
-import { validateRip } from "./regeventing.js";
+import { blindate, regcept } from "./messaging.js";
+import { RegistryEventer } from "./regengine.js";
+import { validateRip, validateUpdate } from "./regeventing.js";
 import { openRegistry, RegistryStore } from "./registering.js";
+import { FailedSchemaValidationError, MissingSchemaError, validateSchema } from "./scheming.js";
 /** Acquire a named manager, joining owned-store cleanup if opening or alias loading fails. */
 export function* createRegery({ hby, baser, ...options }) {
     const ownsBaser = baser === undefined;
@@ -90,7 +93,6 @@ export class Regery {
         const env = this.baser.env;
         if (!env)
             throw new DatabaseNotOpenError("Registry backing store is closed.");
-        this.baser.initializeStorage();
         const records = this.store.initializeRecords();
         const registry = new Registry(hab, this.store, name);
         env.transactionSync(() => {
@@ -201,9 +203,21 @@ export class Registry {
             throw new ValidationError(`Registry inception rejected: ${result.reason}`);
         return rip;
     }
-    /** Derive a disclosure and stage its commitment after checking credential membership. */
+    /** Validate credential membership and issuer before deriving its next blinded registry update. */
     blind(acdc, state, options = {}) {
-        return this.eventer.blind(acdc, state, options);
+        if (!(acdc instanceof SerderACDC) || !acdc.verify()) {
+            throw new ValidationError("Registry blinding requires a self-verifying ACDC.");
+        }
+        if (acdc.regid !== this.regk)
+            throw new ValidationError("Credential belongs to another registry.");
+        if (acdc.issuer !== this.hab.pre)
+            throw new ValidationError("Credential belongs to another issuer.");
+        const schema = validateSchema(acdc, this.hab.db);
+        if (schema.kind === "missing")
+            throw new MissingSchemaError(schema.said);
+        if (schema.kind === "invalid")
+            throw new FailedSchemaValidationError(schema.reason);
+        return this.blindTarget(acdc.said, state, options);
     }
     /** Process parsed TEL evidence through the shared typed engine. */
     processEvent(serder) {
@@ -213,52 +227,74 @@ export class Registry {
     anchorMsg(said, number, diger) {
         return this.eventer.anchorMsg(said, number, diger);
     }
-    /** Stage a grant commitment in this registry; grant authentication remains with IPEX. */
+    /** Commit a grant SAID without requiring the grant's issuer to control this presentation registry. */
     present(grant, state = "presented", options = {}) {
-        return this.eventer.present(grant, state, options);
+        const target = typeof grant === "string" ? grant : grant.said;
+        try {
+            new Diger({ qb64: target ?? "" });
+        }
+        catch (cause) {
+            throw new ValidationError("Presentation target must be a valid grant SAID.", { cause });
+        }
+        return this.blindTarget(target, state, options);
     }
-    /** Stage a vacuous disclosure that leaves the prior effective binding in force. */
+    /** Empty target/state disclose a vacuous step; downstream verification retains the preceding binding. */
     vacate(options = {}) {
-        return this.eventer.vacate(options);
+        return this.blindTarget("", "", options);
+    }
+    /** Derive and stage a validated target; presentation/vacuous callers own their target checks. */
+    blindTarget(target, state, options) {
+        const tip = this.effectiveFrontier();
+        if (!tip)
+            throw new ValidationError("Registry must be anchored before updates.");
+        if ("blinder" in options)
+            throw new ValidationError("Caller-supplied blinder overrides are unsupported.");
+        const sn = tip.sn + 1n;
+        if (sn > BigInt(Number.MAX_SAFE_INTEGER))
+            throw new RangeError("Unsafe registry update ordinal.");
+        const { raw, salt, tier, bound, bsn, bd, ...wire } = options;
+        const inputs = { raw, salt, tier, sn, acdc: target, state };
+        const blinder = bound ? makeBoundState({ ...inputs, bsn, bd }) : makeBlindState(inputs);
+        const serder = blindate(tip.regid, tip.said, blinder.d.nonce, { ...wire, sn });
+        const decision = this.processEvent(serder);
+        if (decision.kind === "reject")
+            throw new ValidationError(`Registry update rejected: ${decision.reason}`);
+        return [blinder, serder];
+    }
+    /** Extend an accepted head through exactly one staged successor at each ordinal, without mutation. */
+    effectiveFrontier() {
+        let tip = this.eventer.acceptedHeadEvent;
+        while (tip) {
+            const sn = tip.sn + 1n;
+            if (sn > BigInt(Number.MAX_SAFE_INTEGER))
+                return tip;
+            const saids = new Set();
+            for (const escrow of [this.store.baser.maes, this.store.baser.ooes]) {
+                for (const [said] of escrow?.get(tip.regid, Number(sn)) ?? [])
+                    saids.add(said);
+            }
+            let successor = null;
+            for (const said of saids) {
+                const body = this.store.event(said);
+                if (!body)
+                    continue;
+                if (body.said !== said)
+                    throw new Error("Corrupt staged registry event.");
+                const result = validateUpdate(body, tip.regid);
+                if (result.kind !== "valid" || result.event.sn !== sn || result.event.prior !== tip.said)
+                    continue;
+                if (successor)
+                    throw new ValidationError("Registry has conflicting staged successors.");
+                successor = result.event;
+            }
+            if (!successor)
+                return tip;
+            tip = successor;
+        }
+        return null;
     }
     /** Retry both missing-anchor and ordering prerequisites. */
     processEscrows() {
         this.eventer.processEscrows();
     }
 }
-/** Caller-facing v2 operations over a borrowed Regery; this facade acquires no keys, stores or runtime service. */
-export class Registrar {
-    constructor(rgy) {
-        Object.defineProperty(this, "rgy", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: rgy
-        });
-    }
-    /** Accept instances directly; registry keys take precedence over local aliases, as in frozen KERIpy. */
-    registry(reference) {
-        if (reference instanceof Registry)
-            return reference;
-        const registry = this.rgy.regs.get(reference) ?? this.rgy.registryByName(reference);
-        if (!registry)
-            throw new ValidationError(`Unknown registry: ${reference}`);
-        return registry;
-    }
-    /** Create one named registry through the manager's existing atomic inception/alias workflow. */
-    makeRegistry(name, prefix, options = {}) {
-        return this.rgy.makeRegistry(name, prefix, options);
-    }
-    /** Stage a credential binding, requiring its issuer and registry to match the resolved Registry. */
-    issue(reference, acdc, state = "issued", options = {}) {
-        return this.registry(reference).blind(acdc, state, options);
-    }
-    /** Bind a grant SAID through a registry instance, key or alias. */
-    present(reference, grant, state = "presented", options = {}) {
-        return this.registry(reference).present(grant, state, options);
-    }
-    /** Append a vacuous state disclosure through the resolved registry. */
-    vacate(reference, options = {}) {
-        return this.registry(reference).vacate(options);
-    }
-}