keri-ts 1.0.0 → 2.0.0

package/esm/keri/npm/src/acdc/registering.js

@@ -1,9 +1,38 @@
-/** Storage-only facade for public registry evidence and local registry aliases. */
-import { Saider } from "cesr-ts";
+/** Public registry evidence storage, exact opening verification and accepted replay. */
+import { BlindState, BoundState, bytesEqual, Counter, Ilks, isGroupTuple, parseBlinder, Saider, Vrsn_2_0, } from "cesr-ts";
 import { DatabaseNotOpenError, DatabaseOperationError, ValidationError } from "../core/errors.js";
+import { messagize } from "../core/protocol-serialization.js";
 import { RawRecord } from "../core/records.js";
 import { Komer } from "../db/koming.js";
 import { RegBaser } from "./regbasing.js";
+import { vetBlind } from "./regeventing.js";
+/** Encode one deliberately public opening using its exact primitive representations. */
+export function publicOpeningAttachment(opening) {
+    return Counter.enclose({
+        code: "bn" in opening ? "BoundStateSextuples" : "BlindedStateQuadruples",
+        version: Vrsn_2_0,
+        qb64: "bn" in opening ? BoundState.qb64b(opening) : BlindState.qb64b(opening),
+    });
+}
+/** Decode one retained counted tuple through the existing CESR codec and semantic descriptors. */
+function retainedOpening(raw) {
+    const parsed = parseBlinder(raw, Vrsn_2_0, "txt"), tuple = parsed.items[0];
+    if (parsed.consumed !== raw.length || parsed.items.length !== 1 || !tuple || !isGroupTuple(tuple)) {
+        throw new DatabaseOperationError("Corrupt retained public opening.");
+    }
+    const fields = tuple.map((field) => {
+        if (isGroupTuple(field) || !("qb64b" in field))
+            throw new DatabaseOperationError("Corrupt retained opening tuple.");
+        return field.qb64b;
+    });
+    if ((parsed.name === "BlindedStateQuadruples" || parsed.name === "BigBlindedStateQuadruples") && fields.length === 4) {
+        return BlindState.fromQb64bTuple([fields[0], fields[1], fields[2], fields[3]]);
+    }
+    if ((parsed.name === "BoundStateSextuples" || parsed.name === "BigBoundStateSextuples") && fields.length === 6) {
+        return BoundState.fromQb64bTuple([fields[0], fields[1], fields[2], fields[3], fields[4], fields[5]]);
+    }
+    throw new DatabaseOperationError("Corrupt retained public opening family.");
+}
 /** Persisted local registry alias, matching frozen registering.RegistryRecord. */
 export class RegistryRecord extends RawRecord {
 }
@@ -33,7 +62,8 @@ function registryOrdinal(sn) {
 }
 /**
  * Wrap a supplied RegBaser without opening another environment. Reads and writes
- * are storage operations: callers authenticate events/anchors and decide acceptance.
+ * retain public bytes; retainOpening checks the exact body and BLID. Callers
+ * authenticate KEL anchors and decide TEL acceptance.
  * Explicit close delegates to the supplied owner; construction adds no lifetime scope.
  * Local aliases are optional; public observer stores need only evidence tables.
  */
@@ -100,18 +130,56 @@ export class RegistryStore {
     putEvent(serder) {
         return this.baser.evts.pin(serder.said, serder);
     }
+    /** Read deliberately published opening bytes for this exact event, without creating evidence. */
+    opening(said) {
+        return this.baser.openings.get(said);
+    }
+    /** Decode and authenticate one deliberately public stored opening, including pending events. */
+    publicOpening(said) {
+        const raw = this.opening(said);
+        if (!raw)
+            return null;
+        const event = this.event(said), opening = retainedOpening(raw);
+        if (!event || event.said !== said || event.ilk !== Ilks.bup || !event.verify()
+            || !vetBlind(opening, event.sad.b)) {
+            throw new DatabaseOperationError("Retained public opening does not authenticate its stored event.");
+        }
+        return opening;
+    }
+    /** Retain one authentic public BUP opening only against its exact already-stored body. */
+    retainOpening(event, opening) {
+        if (event.ilk !== Ilks.bup || !event.verify())
+            throw new ValidationError("Public opening requires a verified BUP.");
+        const stored = this.event(event.said);
+        if (!stored || !bytesEqual(stored.raw, event.raw)) {
+            throw new ValidationError("Public opening requires the exact stored event body.");
+        }
+        if (!vetBlind(opening, event.sad.b)) {
+            throw new ValidationError("Public opening does not match the event commitment.");
+        }
+        const raw = publicOpeningAttachment(opening), old = this.opening(event.said);
+        if (old) {
+            if (!bytesEqual(old, raw)) {
+                throw new ValidationError("A different public opening is already retained for this event.");
+            }
+        }
+        else if (!this.baser.openings.put(event.said, raw)) {
+            const retained = this.opening(event.said);
+            if (!retained || !bytesEqual(retained, raw)) {
+                throw new ValidationError("A different public opening is already retained for this event.");
+            }
+        }
+        return opening;
+    }
     /** Read a stored source couple. */
     anchor(said) {
         if (!this.baser.opened)
             throw new DatabaseNotOpenError("Registry backing store is closed.");
         return this.baser.ancs.get(said);
     }
-    /** Retain the earliest caller-verified anchor; equal/later reseals cannot reorder siblings. */
+    /** Retain the first caller-verified anchor pair; later presentations cannot replace it. */
     putAnchor(said, number, diger) {
-        const current = this.anchor(said);
-        if (current && current[0].num <= number.num)
-            return false;
-        return this.baser.ancs.pin(said, [number, diger]);
+        return this.baser.ancs.put(said, [number, diger]);
     }
     /** Read the accepted-head cache without verifying the event. */
     head(regk) {
@@ -139,12 +207,16 @@ export class RegistryStore {
         this.baser.tels.putOn(regk, sn, said);
         this.baser.heads.pin(regk, said);
     }
-    /** Yield stored accepted bodies from the inclusive ordinal; skip missing bodies like the reference. */
+    /** Yield accepted public TEL frames, with a retained opening or an explicit empty attachment foot. */
     *cloneTelIter(regk, sn = 0) {
         for (const [, , said] of this.baser.tels.getAllItemIter(regk, registryOrdinal(sn))) {
             const event = this.event(said.qb64);
-            if (event)
-                yield event.raw;
+            if (!event)
+                continue;
+            const raw = this.opening(event.said);
+            if (raw)
+                this.publicOpening(event.said);
+            yield messagize(event, raw ?? new Uint8Array(), { gvrsn: Vrsn_2_0 });
         }
     }
     /** Eagerly collect accepted TEL bytes in ordinal order. */
@@ -168,10 +240,17 @@ export class RegistryStore {
         sn = registryOrdinal(sn);
         return this.baser.ooes.add(regk, sn, [said]);
     }
-    /** Remove this candidate from both escrow families. */
+    /**
+     * Remove this candidate from both escrow families.
+     * @param regk Registry identifier whose candidate slots are being cleared.
+     * @param sn TEL ordinal shared by the candidate's escrow memberships.
+     * @param said Candidate event SAID; other candidates in the slot remain.
+     * @returns Whether either family contained a removed membership.
+     */
     clearEscrows(regk, sn, said) {
         sn = registryOrdinal(sn);
-        this.baser.maes.rem(regk, sn, [said]);
-        this.baser.ooes.rem(regk, sn, [said]);
+        const missingAnchor = this.baser.maes.rem(regk, sn, [said]);
+        const outOfOrder = this.baser.ooes.rem(regk, sn, [said]);
+        return missingAnchor || outOfOrder;
     }
 }

package/esm/keri/npm/src/acdc/relating.js

@@ -0,0 +1,59 @@
+/** KEL-backed ACDC relations; follows KERIpy 84301a9f's acdc.relating without verifier-owned writes. */
+import { ValidationError } from "../core/errors.js";
+import { dgKey } from "../db/core/keys.js";
+/**
+ * Resolve whether `pre` delegates upward to `delpre`, at any depth.
+ * Each hop requires its fixed dip, the delegator's inception permission and an
+ * accepted approval. Identity equality belongs to the caller's DI2I widening.
+ * Cached first-seen approvals survive superseding; uncached lookup searches the
+ * last accepted KEL events, matching Python's deliberate history asymmetry.
+ * Unlike Python, lookup never repairs aess: accepted KEL intake owns those writes.
+ */
+export function delegationRelation(db, pre, delpre) {
+    const seen = new Set();
+    while (!seen.has(pre)) {
+        seen.add(pre);
+        const kever = db.getKever(pre);
+        if (!kever)
+            return { kind: "pending", reason: `Missing delegate KEL ${pre}.` };
+        const parent = kever.delpre;
+        if (!parent)
+            return { kind: "refused", reason: `Delegation chain ends at ${pre}.` };
+        if (!db.getKever(parent))
+            return { kind: "pending", reason: `Missing delegator KEL ${parent}.` };
+        // Configuration is fixed at inception, including after delegator rotations.
+        const inceptionSaid = db.kels.getLast(parent, 0);
+        const inception = inceptionSaid ? db.getEvtSerder(parent, inceptionSaid) : null;
+        if (!inception)
+            return { kind: "pending", reason: `Missing delegator inception ${parent}.` };
+        if (inception.traits.includes("DND"))
+            return { kind: "refused", reason: `Delegator ${parent} carries DND.` };
+        const dip = db.getEvtSerder(pre, pre);
+        if (!dip)
+            return { kind: "pending", reason: `Missing delegated inception ${pre}.` };
+        // A cached approval names accepted history, not the current event at its ordinal.
+        const source = db.aess.get(dgKey(pre, pre));
+        if (source) {
+            const digest = source[1].qb64;
+            if (!db.fons.get(dgKey(parent, digest))) {
+                return { kind: "pending", reason: `Missing accepted delegation approval ${parent}:${digest}.` };
+            }
+            const approval = db.getEvtSerder(parent, digest);
+            if (!approval)
+                throw new ValidationError(`Missing first-seen delegation event ${parent}:${digest}.`);
+            // Protected intake can retain a raw hint. It neither grants authority nor vetoes a later genuine approval.
+            if (!approval.eventSeals.some(seal => seal.i.qb64 === pre && seal.s.numh === dip.snh && seal.d.qb64 === dip.said)
+                && !db.fetchLastSealingEventByEventSeal(parent, { i: pre, s: dip.snh, d: dip.said })) {
+                return { kind: "pending", reason: `Stored source does not approve delegated inception ${pre}.` };
+            }
+        }
+        else if (!db.fetchLastSealingEventByEventSeal(parent, { i: pre, s: dip.snh, d: dip.said })) {
+            return { kind: "pending", reason: `Missing delegation approval for ${pre} from ${parent}.` };
+        }
+        if (parent === delpre)
+            return { kind: "valid" };
+        pre = parent;
+    }
+    // Hash-linked inception ancestry cannot cycle; terminate corrupt local state without a protocol depth cap.
+    return { kind: "refused", reason: `Delegation chain cycles at ${pre}.` };
+}