keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/runtime/index.js

@@ -1,79 +1,110 @@
 /**
- * Non-browser-safe runtime exports for `keri-ts`.
+ * Supported non-browser-safe KERI operations and data contracts.
  *
- * Maintainer rule:
- * - this surface is explicit because it may depend on Deno, Node, filesystem,
- *   fetch, or LMDB-backed behavior
- * - CLI wiring and HTTP host ownership stay out of this barrel
+ * This curated surface serves library users and Tufa composition. Private
+ * continuation state, handler installation, reply-slot bookkeeping and internal
+ * constructor helpers stay in their owning implementation modules. Adding an
+ * internal export must not silently expand this package contract.
  */
-export * from "../acdc/index.js";
-export * from "../app/agent-runtime.js";
-export * from "../app/authenticating.js";
-export * from "../app/byte-source.js";
-export * from "../app/cesr-egress.js";
-export * from "../app/cesr-http.js";
-export * from "../app/challenging.js";
-export * from "../app/configing.js";
-export * from "../app/credential-workflows.js";
-export * from "../app/cue-runtime.js";
-export * from "../app/delegating.js";
-export * from "../app/endpoint-roleing.js";
-export * from "../app/essr.js";
-export * from "../app/exchanging.js";
-export * from "../app/forwarding.js";
-export * from "../app/grouping.js";
-export * from "../app/habbing.js";
-export * from "../app/httping.js";
-export * from "../app/ipex-building.js";
-export * from "../app/ipex-credentialing.js";
-export * from "../app/ipexing.js";
-export * from "../app/keeping.js";
-export * from "../app/mailbox-director.js";
-export * from "../app/mailbox-sse.js";
-export * from "../app/mailboxing.js";
-export * from "../app/notifying.js";
-export * from "../app/oobiery.js";
-export * from "../app/organizing.js";
-export * from "../app/parsering.js";
-export * from "../app/protocol-host-policy.js";
-export * from "../app/querying.js";
-export * from "../app/reactor.js";
-export * from "../app/reply-streams.js";
-export * from "../app/respondant.js";
-export { queryTransportSink } from "../app/runtime-deliveries.js";
-export * from "../app/runtime-services.js";
-export * from "../app/runtime-turn.js";
-export * from "../app/schema-resolving.js";
-export * from "../app/signaling.js";
-export * from "../app/socket-source.js";
-export * from "../app/tcp-egress.js";
-export * from "../app/verifier-agent.js";
-export * from "../app/verifying.js";
-export { BUILD_METADATA, DISPLAY_VERSION, PACKAGE_VERSION } from "../app/version.js";
-export { drainWitnessCues, processWitnessIngress, processWitnessIngressSource, Receiptor, witnessKeyStateGet, witnessQueryGet, witnessReceiptGet, WitnessReceiptor, witnessReceiptPost, } from "../app/witnessing.js";
-export * from "../core/attachment-countering.js";
-export * from "../core/cues.js";
-export { Deck, DeckFullError } from "../core/deck.js";
-export * from "../core/errors.js";
-export * from "../core/eventing.js";
-export * from "../core/kever.js";
-export * from "../core/logger.js";
-export * from "../core/mailbox-topics.js";
+// Host lifecycle, direct ingress and concrete I/O boundaries.
+export { Respondant, } from "../app/delivery/respondant.js";
+export { envelopeFromFrame, queryEnvelopeFromDispatch, } from "../app/protocol/parsering.js";
+export { createProtocolProcessor, ProtocolProcessor, } from "../app/protocol/protocol-processing.js";
+export { Reactor, } from "../app/protocol/reactor.js";
+export { abortable, rethrowCleanupFailure, } from "../app/runtime/abortable.js";
+export { createAgentRuntime, runAgentRuntime, runAgentRuntimeUntil, runtimeOobiConverged, settleMailboxPollBatch, settleRuntimeIngress, } from "../app/runtime/agent-runtime.js";
+export { cueDo, processCuesOnce, } from "../app/runtime/cue-runtime.js";
+export { chunkBytes, collectBytes, fileBytes, } from "../app/transport/byte-source.js";
+export { CesrHttpRefusal, postCesr, requestFrame, } from "../app/transport/cesr-egress.js";
+export { buildCesrRequest, buildCesrStreamRequest, CESR_ATTACHMENT_HEADER, CESR_CONTENT_TYPE, CESR_DESTINATION_HEADER, isCesrContentType, isMultipartFormContentType, KERIPY_CESR_JSON_CONTENT_TYPE, MULTIPART_CONTENT_TYPE, readCesrRequestBytes, readMailboxAdminRequest, readRequiredCesrRequestBytes, requestBytes, } from "../app/transport/cesr-http.js";
+export { FetchHttpClient, } from "../app/transport/http-client.js";
+export { socketBytes, } from "../app/transport/socket-source.js";
+export { TCPMessenger, } from "../app/transport/tcp-messenger.js";
+export { openTcpConnection, sendCesrTcp, sendCesrTcpFrame, sendCesrTcpSocket, streamCesrTcp, writeCesrTcpSocket, } from "../app/transport/tcp-egress.js";
+export { TransportError } from "../app/transport/transport-error.js";
+// Controller state, credentials and protocol operations.
+export { evaluateChain } from "../acdc/chaining.js";
+export { decodePublicKey, deriveRoot, Dhke, generateKeyPair, } from "../acdc/dhking.js";
+export { RegistryRoot, RootDeferred, rootExn, RootRefused, RootUnverified, } from "../acdc/salting.js";
+export { Unblind } from "../acdc/unblinding.js";
+export { Oobiery, oobiRequestExn, } from "../app/bootstrap/oobiery.js";
+export { importCredentialStream, } from "../app/credentials/credential-importing.js";
+export { deliverCredentialRevocation, revokeCredential, } from "../app/credentials/credential-revoking.js";
+export { createCredential, credentialRegistryRecords, credentialRegistryStatus, exportCredentialStream, inceptCredentialRegistry, listCredentials, pinSchemaBytes, } from "../app/credentials/credential-workflows.js";
+export { Poster, } from "../app/delivery/forwarding.js";
+export { EssrRecipient, } from "../app/exchanges/essr.js";
+export { createExchangeMessage, sendExchangeMessage, } from "../app/exchanges/exchange-messaging.js";
+export { Exchanger, RouteRefuser, } from "../app/exchanges/exchanging.js";
+export { findVerifiedChallengeResponse, generateChallengeWords, markChallengeVerified, parseChallengeWords, } from "../app/identity/challenging.js";
+export { Configer, createConfiger, } from "../app/identity/configing.js";
+export { Anchorer, } from "../app/identity/delegating.js";
+export { endpointRoleAccepted, loadAcceptedEndpointRole, proposeGroupEndpointRole, } from "../app/identity/endpoint-roleing.js";
+export { acceptedEventReplayMessage, createHabery, Hab, Habery, } from "../app/identity/habbing.js";
+export { Algos, Manager, } from "../app/identity/keeping.js";
+export { Organizer, } from "../app/identity/organizing.js";
+export { ipexExnBody, prepareIpexExn } from "../app/ipex/ipex-building.js";
+export { credentialPresentationArtifacts, credentialSaidFromGrant, ipexCredentialAdmit, ipexCredentialGrant, processCredentialPresentationArtifacts, storedGrantArtifacts, } from "../app/ipex/ipex-credentialing.js";
+export { walkIpexGraph } from "../app/ipex/ipex-graph.js";
+export { approveStoredMultisigIpexWrappers, prepareAcdcV2GroupIpex, publishInitialGroupIpex, requireAcdcV2GroupUse, sendCompletedGroupIpex, } from "../app/ipex/ipex-grouping.js";
+export { acceptedRegistryEvidence, authenticateIpexNode, issuedNodeVerdict, } from "../app/ipex/ipex-node-authentication.js";
+export { IPEX_GRANT_ROUTE, IPEX_ROUTES, ipexAdmitExn, ipexAgreeExn, ipexApplyExn, ipexGrantExn, ipexOfferExn, ipexSpurnExn, } from "../app/ipex/ipexing.js";
+export { MailboxDirector, } from "../app/mailbox/mailbox-director.js";
+export { MailboxPoller, } from "../app/mailbox/mailbox-poller.js";
+export { consumeMailboxSse, parseMailboxSse, readMailboxSseBody, } from "../app/mailbox/mailbox-sse.js";
+export { endpointBasePath, fetchEndpointUrls, mailboxPollEndpoints, mailboxQueryTopics, mailboxTopicKey, preferredUrl, resolveHostedEndpointPath, } from "../app/mailbox/mailboxing.js";
+export { groupSigningMembers, groupWitnesserSelection, isLocalGroupHab, latestGroupContribution, localGroupMember, } from "../app/multisig/group-members.js";
+export { Multiplexor, MULTISIG_ROUTES, multisigExn, multisigExnBody, multisigInceptExn, multisigInteractExn, multisigIpexProofExn, multisigIssueExn, multisigQueryExn, multisigRegistryInceptExn, multisigRevokeExn, multisigRotateExn, multisigRpyExn, } from "../app/multisig/grouping.js";
+export { signGroupMessage } from "../app/multisig/multisig-messaging.js";
+export { approveAcdcV2Registry, publishAcdcV2Registry } from "../app/multisig/multisig-workflows.js";
+export { Notifier, } from "../app/notifications/notifying.js";
+export { Signal, Signaler, } from "../app/notifications/signaling.js";
+export { RawRecord } from "../core/records.js";
+export { Verifier, } from "../app/credentials/verifying.js";
+export { witnessKeyStateGet, witnessQueryGet, witnessReceiptGet, witnessReceiptPost, } from "../app/witness/http-endpoints.js";
+export { drainWitnessCues, processWitnessIngress, processWitnessIngressSource, } from "../app/witness/ingress.js";
+export { Receiptor, WitnessReceiptor, } from "../app/witness/receipting.js";
+export { registerWithWitness, } from "../app/witness/registration.js";
+export { BUILD_METADATA, DISPLAY_VERSION, PACKAGE_VERSION, } from "../version.js";
+// Pure protocol construction and typed evidence.
+export { acdcagg, acdcatt, acdcmap, acgSchemaDefault, acmSchemaDefault, actSchemaDefault, blindate, regcept, sectaggr, sectattr, sectedge, sectionate, sectrule, sectschema, update, } from "../acdc/messaging.js";
+export { RegistryObserver, } from "../acdc/observing.js";
+export { matchesRegistrySeal, vet, vetBinds, vetBlind, vetBound, } from "../acdc/regeventing.js";
+/** ACDC v2 services are distinct from the legacy VDR Regery/Registry exports. */
+export { createRegery as createAcdcV2Regery, Regery as AcdcV2Regery, Registry as AcdcV2Registry, } from "../acdc/registraring.js";
+export { validateSchema as validateAcdcSchema } from "../acdc/scheming.js";
+export { publishPendingTel } from "../app/credentials/tel-publishing.js";
+export { Deck } from "../core/deck.js";
+export { AppError, DatabaseError, DatabaseKeyError, DatabaseNotOpenError, DatabaseOperationError, InvalidPathNameError, PathError, ValidationError, } from "../core/errors.js";
+export { verifyExchangeProofs } from "../core/exchange/exchange-proofing.js";
+export { exchange } from "../core/exchange/protocol-exchanging.js";
+export { Kevery, } from "../core/kel/eventing.js";
+export { Kever, } from "../core/kel/kever.js";
+export { consoleLogger, getLogLevel, LOG_LEVELS, noopLogger, setLogLevel, } from "../core/logger.js";
+export { Kramer } from "../core/mailbox/kraming.js";
+export { CREDENTIAL_MAILBOX_TOPIC, DELEGATE_MAILBOX_TOPIC, normalizeMbxTopicCursor, OOBI_MAILBOX_TOPIC, RECEIPT_MAILBOX_TOPIC, REPLAY_MAILBOX_TOPIC, REPLY_MAILBOX_TOPIC, } from "../core/mailbox/mailbox-topics.js";
 export { incept, interact, query, reply, rotate } from "../core/protocol-eventing.js";
-export { exchange } from "../core/protocol-exchanging.js";
-export { messagize } from "../core/protocol-serialization.js";
+export { messageAttachmentGroups, messagize } from "../core/protocol-serialization.js";
 export { incept as inceptRegistry, issue, revoke } from "../core/protocol-vdr-eventing.js";
-export * from "../core/records.js";
-export * from "../core/roles.js";
-export * from "../core/schemes.js";
-export * from "../core/scheming.js";
-export * from "../db/verifier-cueing.js";
-export * from "../did/index.js";
-export * from "../time/mod.js";
-export * from "../vdr/credentialing.js";
-export * from "../vdr/eventing.js";
-export { prepareCueEmission } from "../app/cue-preparation.js";
-export { abortable } from "../app/abortable.js";
-export * from "../acdc/observing.js";
-export * from "../acdc/regeventing.js";
-export { Kramer } from "../core/kraming.js";
+export { CacheTypeRecord, EndAuthRecord, EndpointRecord, EventSourceRecord, HabitatRecord, KeyStateRecord, LocationRecord, MsgCacheRecord, ObservedRecord, OobiQueryRecord, OobiRecord, RegistryRecord, RegStateRecord, StateEERecord, TopicsRecord, TxnMsgCacheRecord, VcStateRecord, WellKnownAuthN, } from "../core/records.js";
+export { EndpointRoles, isEndpointRole, isRole, Roles, } from "../core/roles.js";
+export { isScheme, Schemes, } from "../core/schemes.js";
+export { dumpSchema, Schemer, } from "../core/scheming.js";
+export { UnsupportedTelReplayError } from "../db/replay/tel-replay.js";
+export { credential, Credentialer, CredentialWallet, Regery, Registry, serializeCredential, } from "../vdr/credentialing.js";
+export { Tever, Tevery, } from "../vdr/eventing.js";
+export { TelPublication } from "../vdr/tel-publication.js";
+// Accepted-state DID projection and artifact operations.
+export { resolveDidKeri, } from "../did/keri/resolving.js";
+export { generateDidWebsArtifacts, generateDidWebsCesr, generateDidWebsJson, } from "../did/webs/artifacts.js";
+export { bindDesignatedAliases, DESIGNATED_ALIASES_SCHEMA_SAID, listActiveDesignatedAliasCredentials, } from "../did/webs/designated-aliases.js";
+export { didWebsArtifactUrls, didWebsFromArtifactRequest, parseDid, parseDidKeriIdentifier, parseDidWebs, toCanonicalDidWebs, toHostedDidWeb, } from "../did/webs/dids.js";
+export { didResolutionError, didResolutionResult, generateBareDidDocument, generateDidDocument, } from "../did/webs/documenting.js";
+export { resolveDidWebs, } from "../did/webs/resolving.js";
+export { makeNowIso8601, timestampMicros, } from "../time/mod.js";
+export { HTTPMessenger } from "../app/transport/http-messenger.js";
+export { HTTPStreamMessenger } from "../app/transport/http-stream-messenger.js";
+export { messengerFrom, streamMessengerFrom } from "../app/transport/messengering.js";
+export { TCPStreamMessenger } from "../app/transport/tcp-stream-messenger.js";
+export { systemClock } from "../app/runtime/runtime-clock.js";
+export { AnchorQuerier, KeyStateNoticer, LogQuerier, SeqNoQuerier } from "../app/queries/querying.js";
+export { WitnessInquisitor } from "../app/queries/witness-inquisitor.js";

package/esm/keri/npm/src/vdr/backer-state.js

@@ -0,0 +1,55 @@
+/** Historical TEL backer selection from accepted management coordinates. */
+import { Ilks, ParserError, SerderKERI } from "cesr-ts";
+import { DatabaseOperationError } from "../core/errors.js";
+import { dgKey } from "../db/core/keys.js";
+/** Decode the entire wire threshold; a partial parse or inexact count cannot authorize a quorum. */
+export function backerThreshold(value) {
+    if (typeof value !== "string" || !/^[0-9a-f]+$/i.test(value))
+        return null;
+    const count = Number(BigInt(`0x${value}`));
+    return Number.isSafeInteger(count) ? count : null;
+}
+/**
+ * Resolve the complete ra.i/ra.s/ra.d tuple before reading its ordered roster.
+ * Raw/escrowed management bodies confer no authority. KERIpy's digest-only raw
+ * lookup is deliberately strengthened here; wire fields and signature indexes stay unchanged.
+ */
+export function resolveBackerState(reger, regk, seal) {
+    if (!seal || typeof seal !== "object" || Array.isArray(seal)
+        || !("i" in seal) || seal.i !== regk || !("s" in seal) || typeof seal.s !== "string"
+        || !/^[0-9a-f]+$/.test(seal.s) || !("d" in seal) || typeof seal.d !== "string")
+        return { kind: "reject", reason: "Backer TEL event registry anchor mismatch." };
+    const ordinal = BigInt(`0x${seal.s}`);
+    if (ordinal > BigInt(Number.MAX_SAFE_INTEGER)) {
+        return { kind: "reject", reason: "Backer management ordinal exceeds exact storage representation." };
+    }
+    const accepted = reger.tels.getOn(regk, Number(ordinal));
+    if (!accepted)
+        return { kind: "missing", reason: "Backer TEL event awaits accepted registry management state." };
+    if (accepted.qb64 !== seal.d)
+        return { kind: "reject", reason: "Backer TEL event registry anchor digest mismatch." };
+    const key = dgKey(regk, accepted.qb64), raw = reger.tvts.get(key);
+    if (!raw)
+        throw new DatabaseOperationError("Accepted backer management body is missing.");
+    let event;
+    try {
+        event = new SerderKERI({ raw });
+    }
+    catch (error) {
+        if (!(error instanceof ParserError))
+            throw error;
+        throw new DatabaseOperationError("Accepted backer management body is corrupt.", { cause: error });
+    }
+    if (!event.verify() || event.pre !== regk || event.sn !== Number(ordinal) || event.said !== accepted.qb64
+        || (event.ilk !== Ilks.vcp && event.ilk !== Ilks.vrt))
+        throw new DatabaseOperationError("Accepted backer management coordinate is inconsistent.");
+    const toad = backerThreshold(event.ked?.bt);
+    if (toad === null) {
+        throw new DatabaseOperationError("Accepted backer threshold is invalid.");
+    }
+    const baks = reger.baks.get(key);
+    if (!Number.isSafeInteger(toad) || toad > baks.length || (baks.length > 0 && toad < 1)
+        || new Set(baks).size !== baks.length)
+        throw new DatabaseOperationError("Accepted backer roster and threshold are inconsistent.");
+    return { kind: "backers", toad, baks };
+}

package/esm/keri/npm/src/vdr/credential-tsn-record.js

@@ -0,0 +1,59 @@
+import { Diger } from "cesr-ts";
+import { VcStateRecord } from "../core/records.js";
+import { timestampMicros } from "../time/mod.js";
+import { qualifiedPrefix } from "./registry-tsn-record.js";
+/** Legacy storage ordinals are safe integers even though protocol numbers may be wider. */
+function ordinal(value) {
+    return typeof value === "string" && /^[0-9a-f]{1,14}$/i.test(value)
+        && BigInt(`0x${value}`) <= BigInt(Number.MAX_SAFE_INTEGER);
+}
+/** Require the full qualified digest rather than accepting trailing bytes. */
+function qualifiedDigest(value) {
+    try {
+        return typeof value === "string" && new Diger({ qb64: value }).qb64 === value;
+    }
+    catch {
+        return false;
+    }
+}
+/** Validate unknown fields and construct an owned record without erasing its guarantees. */
+export function credentialRecord(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return null;
+    if (Object.keys(data).some((key) => !["vn", "i", "s", "d", "ri", "ra", "a", "dt", "et"].includes(key))
+        || !("s" in data) || !ordinal(data.s)
+        || !("et" in data) || (data.et !== "iss" && data.et !== "bis" && data.et !== "rev" && data.et !== "brv")
+        || !("ri" in data) || !qualifiedPrefix(data.ri)
+        || !("dt" in data) || typeof data.dt !== "string" || timestampMicros(data.dt) === null
+        || !("i" in data) || !qualifiedDigest(data.i) || !("d" in data) || !qualifiedDigest(data.d)
+        || !("vn" in data) || !Array.isArray(data.vn) || data.vn.length !== 2
+        || !("a" in data) || !data.a || typeof data.a !== "object" || Array.isArray(data.a)
+        || !("ra" in data) || !data.ra || typeof data.ra !== "object" || Array.isArray(data.ra))
+        return null;
+    const version = data.vn;
+    const [major, minor] = version;
+    const a = data.a, rawSeal = data.ra;
+    if (typeof major !== "number" || !Number.isSafeInteger(major) || major < 0
+        || typeof minor !== "number" || !Number.isSafeInteger(minor) || minor < 0
+        || Object.keys(a).length !== 2 || !("s" in a) || typeof a.s !== "number"
+        || !Number.isSafeInteger(a.s) || a.s < 0 || !("d" in a) || !qualifiedDigest(a.d))
+        return null;
+    let ra = {};
+    if (Object.keys(rawSeal).length) {
+        if (Object.keys(rawSeal).length !== 3 || !("i" in rawSeal) || !qualifiedPrefix(rawSeal.i)
+            || !("s" in rawSeal) || !ordinal(rawSeal.s) || !("d" in rawSeal) || !qualifiedDigest(rawSeal.d))
+            return null;
+        ra = { i: rawSeal.i, s: rawSeal.s, d: rawSeal.d };
+    }
+    return Object.assign(new VcStateRecord(), {
+        vn: [major, minor],
+        i: data.i,
+        s: data.s,
+        d: data.d,
+        ri: data.ri,
+        ra,
+        a: { s: a.s, d: a.d },
+        dt: data.dt,
+        et: data.et,
+    });
+}

package/esm/keri/npm/src/vdr/credentialing.js

@@ -7,19 +7,23 @@
  * - keeps credential validation/save ownership in `Verifier`
  *
  * Current boundary:
- * - multisig/counselor and network dissemination escrows are represented by
- *   KERIpy-shaped stores, but only the local single-sig path completes here.
+ * - TelPublication owns durable anchor/receipt/publication progression; the
+ *   application host owns actual receipt collection and network dissemination.
  */
-import { concatBytes, DigDex, Diger, Kinds, NumberPrimitive, NumDex, Prefixer, Saider, Seqner, SerderACDC, TraitDex, Vrsn_1_0, } from "cesr-ts";
-import { resolveCachedSchema } from "../app/schema-resolving.js";
-import { Verifier } from "../app/verifying.js";
-import { attachmentCounterPayloadQb64b, resolveAttachmentGvrsn } from "../core/attachment-countering.js";
+import { concatBytes, DigDex, Diger, Kinds, NumberPrimitive, NumDex, Prefixer, Saider, SerderACDC, TraitDex, Vrsn_1_0, } from "cesr-ts";
+import { resolveCachedSchema } from "../app/credentials/schema-resolving.js";
+import { Verifier } from "../app/credentials/verifying.js";
+import { attachmentCounterPayloadQb64b, attachmentOrdinal, resolveAttachmentGvrsn, } from "../core/attachment-countering.js";
 import { Deck } from "../core/deck.js";
-import { ValidationError } from "../core/errors.js";
-import { backerIssue, backerRevoke, incept as inceptRegistryEvent, issue as issueEvent, revoke as revokeEvent, rotate as rotateRegistryEvent, } from "../core/protocol-vdr-eventing.js";
+import { DatabaseOperationError, ValidationError } from "../core/errors.js";
+import { incept as inceptRegistryEvent, issue as issueEvent, } from "../core/protocol-vdr-eventing.js";
 import { RegistryRecord } from "../core/records.js";
+import { dgKey } from "../db/core/keys.js";
 import { makeNowIso8601 } from "../time/mod.js";
 import { Tevery } from "./eventing.js";
+import { prepareCredentialRevocation } from "./revoking.js";
+import { telAnchorMatches } from "./tel-anchor.js";
+import { TelPublication } from "./tel-publication.js";
 function ordinal(num) {
     const raw = new Uint8Array(16);
     let value = BigInt(num);
@@ -29,16 +33,6 @@ function ordinal(num) {
     }
     return new NumberPrimitive({ code: NumDex.Huge, raw });
 }
-/** Encode an ordinal value as the fixed-width v1 seal primitive. */
-function seqner(num) {
-    const raw = new Uint8Array(16);
-    let value = BigInt(num);
-    for (let i = raw.length - 1; i >= 0; i--) {
-        raw[i] = Number(value & 0xffn);
-        value >>= 8n;
-    }
-    return new Seqner({ code: NumDex.Huge, raw });
-}
 function said(serder) {
     if (!serder.said) {
         throw new ValidationError("Expected SAID-bearing event.");
@@ -51,13 +45,16 @@ function requireHabPrefix(hab) {
     }
     return hab.pre;
 }
-function anchorTelEvent(hab, serder) {
+/** Anchor under the registry or issuer establishment policy; callers retain the resulting exact coordinate. */
+function anchorTelEvent(hab, serder, estOnly) {
     if (!serder.pre || !serder.snh || !serder.said) {
         throw new ValidationError("TEL event missing seal fields.");
     }
-    hab.interact({
-        data: [{ i: serder.pre, s: serder.snh, d: serder.said }],
-    });
+    const data = [{ i: serder.pre, s: serder.snh, d: serder.said }];
+    if (estOnly || hab.kever?.estOnly)
+        hab.rotate({ data });
+    else
+        hab.interact({ data });
     const sn = hab.kever?.sn;
     const said = hab.kever?.said;
     if (sn === undefined || sn === null || !said) {
@@ -143,11 +140,10 @@ export function credential({ issuer, registry, schema, data, recipient, edges, r
 /** Preserve one ACDC body and encode its source triple at the body/requested genus floor. */
 export function serializeCredential(creder, prefixer, number, saider, gvrsn = Vrsn_1_0) {
     gvrsn = resolveAttachmentGvrsn(creder, gvrsn);
-    // V1 requires a fixed-width Seqner; v2 accepts the stored qualified Number unchanged.
-    const ordinal = gvrsn.major === 1 && !(number instanceof Seqner) ? seqner(number.num) : number;
+    // V1 requires a fixed-width Seqner; v2 writes the compact Number.
     const sealPayload = [
         prefixer.qb64b,
-        ordinal.qb64b,
+        attachmentOrdinal(number, gvrsn).qb64b,
         saider.qb64b,
     ];
     return concatBytes(creder.raw, attachmentCounterPayloadQb64b("SealSourceTriples", 1, sealPayload, gvrsn), ...sealPayload);
@@ -191,8 +187,15 @@ export class Regery {
             writable: true,
             value: new Map()
         });
+        Object.defineProperty(this, "publication", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         this.hby = hby;
         this.reger = options.reger;
+        this.publication = new TelPublication(hby.db, this.reger);
         this.cues = options.cues ?? new Deck();
         this.tvy = options.tvy ?? new Tevery({ db: hby.db, reger: this.reger, cues: this.cues });
         this.vry = options.vry ?? new Verifier(hby, { reger: this.reger, cues: this.cues });
@@ -209,6 +212,7 @@ export class Regery {
                 continue;
             }
             this.registries.set(name, new Registry({
+                publication: this.publication,
                 name,
                 hab,
                 reger: this.reger,
@@ -220,6 +224,7 @@ export class Regery {
     }
     makeRegistry(name, hab, options = {}) {
         const registry = new Registry({
+            publication: this.publication,
             name,
             hab,
             reger: this.reger,
@@ -236,11 +241,18 @@ export class Regery {
     processEscrows() {
         this.tvy.processEscrows();
         this.vry.processEscrows();
+        this.publication.advance();
     }
 }
-/** One credential registry controlled by one issuer habitat. */
+/** Local NoBackers registry authoring; externally backed state remains available for observation. */
 export class Registry {
     constructor(options) {
+        Object.defineProperty(this, "publication", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "name", {
             enumerable: true,
             configurable: true,
@@ -277,105 +289,91 @@ export class Registry {
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "noBackers", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
         Object.defineProperty(this, "estOnly", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
+        if (options.publication.db !== options.hab.db || options.publication.reger !== options.reger) {
+            throw new TypeError("Registry publication must use its issuer KEL and TEL stores.");
+        }
+        this.publication = options.publication;
         this.name = options.name;
         this.hab = options.hab;
         this.reger = options.reger;
         this.tvy = options.tvy;
         this.cues = options.cues ?? new Deck();
         this.regk = options.regk ?? null;
-        this.noBackers = options.noBackers ?? true;
-        this.estOnly = options.estOnly ?? false;
+        const config = this.regk ? this.reger.states.get(this.regk)?.c ?? [] : [];
+        this.estOnly = options.estOnly ?? config.includes(TraitDex.EstOnly);
     }
     incept(options = {}) {
         const cnfg = [
-            ...((options.noBackers ?? true) ? [TraitDex.NoBackers] : []),
+            TraitDex.NoBackers,
             ...(options.estOnly ? [TraitDex.EstOnly] : []),
         ];
         const serder = inceptRegistryEvent(requireHabPrefix(this.hab), {
             cnfg,
-            baks: options.baks,
-            toad: options.toad,
             nonce: options.nonce,
         });
-        const seal = anchorTelEvent(this.hab, serder);
+        const seal = anchorTelEvent(this.hab, serder, options.estOnly ?? this.estOnly);
         const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
         if (decision.kind !== "accept") {
             throw new ValidationError(`Registry inception failed: ${decision.kind}`);
         }
         this.regk = said(serder);
-        this.noBackers = cnfg.includes(TraitDex.NoBackers);
         this.estOnly = cnfg.includes(TraitDex.EstOnly);
         this.reger.registries.add(this.regk);
         this.reger.regs.pin(this.name, new RegistryRecord({
             registryKey: this.regk,
             prefix: requireHabPrefix(this.hab),
         }));
-        this.markComplete(this.regk, 0, said(serder));
-        return decision;
-    }
-    rotate(options = {}) {
-        const tever = this.currentTever();
-        const serder = rotateRegistryEvent(this.requireRegk(), said(tever.serder), {
-            sn: tever.sn + 1,
-            toad: options.toad,
-            baks: [...tever.baks],
-            cuts: options.cuts,
-            adds: options.adds,
-        });
-        const seal = anchorTelEvent(this.hab, serder);
-        const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
-        if (decision.kind === "accept") {
-            this.markComplete(this.requireRegk(), serder.sn ?? tever.sn + 1, said(serder));
-        }
+        this.trackPublication(serder, seal);
         return decision;
     }
     issue(creder) {
-        const tever = this.currentTever();
+        this.authoringState();
         const regk = this.requireRegk();
-        const serder = tever.noBackers
-            ? issueEvent(said(creder), regk)
-            : backerIssue(said(creder), regk, tever.sn, said(tever.serder));
-        const seal = anchorTelEvent(this.hab, serder);
+        const serder = issueEvent(said(creder), regk);
+        const seal = anchorTelEvent(this.hab, serder, this.estOnly);
         const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
-        if (decision.kind === "accept") {
-            this.markComplete(said(creder), serder.sn ?? 0, said(serder));
-        }
+        this.trackPublication(serder, seal);
         return { serder, decision, seal };
     }
+    /** Select the original REV or prepare one after read-only credential/registry authority checks. */
+    prepareRevocation(credentialSaid) {
+        this.authoringState();
+        return prepareCredentialRevocation(this.reger, requireHabPrefix(this.hab), this.requireRegk(), credentialSaid);
+    }
+    /** Revoke once; explicit retries reuse the retained TEL body and original issuer anchor. */
     revoke(credentialSaid) {
-        const tever = this.currentTever();
-        const prior = this.reger.tels.getOn(credentialSaid, tever.vcSn(credentialSaid) ?? 0);
-        if (!prior) {
-            throw new ValidationError(`Cannot revoke unknown credential ${credentialSaid}.`);
+        const serder = this.prepareRevocation(credentialSaid);
+        const couple = this.reger.ancs.get(dgKey(credentialSaid, serder.said));
+        let seal;
+        if (couple) {
+            const anchor = this.hab.db.getEvtSerder(requireHabPrefix(this.hab), couple[1].qb64);
+            if (!anchor || anchor.sner?.num !== couple[0].num || !telAnchorMatches(this.hab.pre, serder, anchor)) {
+                throw new DatabaseOperationError("Stored revocation issuer anchor is missing or inconsistent.");
+            }
+            seal = { prefixer: new Prefixer({ qb64: this.hab.pre }), seqner: couple[0], saider: couple[1] };
         }
-        const regk = this.requireRegk();
-        const serder = tever.noBackers
-            ? revokeEvent(credentialSaid, regk, prior.qb64)
-            : backerRevoke(credentialSaid, regk, tever.sn, said(tever.serder), prior.qb64);
-        const seal = anchorTelEvent(this.hab, serder);
-        const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
-        if (decision.kind === "accept") {
-            this.markComplete(credentialSaid, serder.sn ?? 1, said(serder));
+        else {
+            seal = anchorTelEvent(this.hab, serder, this.estOnly);
         }
+        const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
+        this.trackPublication(serder, seal);
         return { serder, decision, seal };
     }
     complete(pre, sn = 0) {
-        return this.reger.ctel.get([pre, seqner(sn).qb64]) !== null;
+        return this.publication.complete(pre, sn);
     }
-    markComplete(pre, sn, eventSaid) {
-        this.reger.ctel.pin([pre, seqner(sn).qb64], new Saider({ qb64: eventSaid }));
+    /** Keep publication progress with the original accepted issuer anchor. */
+    trackPublication(event, seal) {
+        const anchor = this.hab.db.getEvtSerder(requireHabPrefix(this.hab), seal.saider.qb64);
+        if (!anchor)
+            throw new ValidationError("Missing locally authored TEL anchor.");
+        this.publication.track(event, anchor);
     }
     requireRegk() {
         if (!this.regk) {
@@ -383,41 +381,18 @@ export class Registry {
         }
         return this.regk;
     }
-    currentTever() {
-        const tever = this.reger.tevers.get(this.requireRegk());
-        if (!(tever instanceof Object) || !("serder" in tever)) {
+    /** Foreign backed registries remain readable, but cannot authorize local TEL authoring. */
+    authoringState() {
+        const tever = this.tvy.tevers.get(this.requireRegk());
+        if (!tever) {
             throw new ValidationError(`Missing TEL state for registry ${this.requireRegk()}.`);
         }
+        if (!tever.noBackers) {
+            throw new ValidationError("Local credential authoring requires a NoBackers registry.");
+        }
         return tever;
     }
 }
-/** Local registrar facade over the single-sig registry completion path. */
-export class Registrar {
-    constructor(rgy) {
-        Object.defineProperty(this, "rgy", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        this.rgy = rgy;
-    }
-    incept(registry, options = {}) {
-        return registry.incept(options);
-    }
-    issue(registry, creder) {
-        return registry.issue(creder).decision;
-    }
-    revoke(registry, credentialSaid) {
-        return registry.revoke(credentialSaid).decision;
-    }
-    complete(registry, pre, sn = 0) {
-        return registry.complete(pre, sn);
-    }
-    processEscrows() {
-        this.rgy.processEscrows();
-    }
-}
 /** Create, validate, issue, and index credentials for one local registry lane. */
 export class Credentialer {
     constructor(hby, options) {