keri-ts 1.0.0 → 2.0.0

package/esm/keri/npm/src/vdr/credentialing.js

@@ -7,19 +7,23 @@
  * - keeps credential validation/save ownership in `Verifier`
  *
  * Current boundary:
- * - multisig/counselor and network dissemination escrows are represented by
- *   KERIpy-shaped stores, but only the local single-sig path completes here.
+ * - TelPublication owns durable anchor/receipt/publication progression; the
+ *   application host owns actual receipt collection and network dissemination.
  */
-import { concatBytes, DigDex, Diger, Kinds, NumberPrimitive, NumDex, Prefixer, Saider, Seqner, SerderACDC, TraitDex, Vrsn_1_0, } from "cesr-ts";
-import { resolveCachedSchema } from "../app/schema-resolving.js";
-import { Verifier } from "../app/verifying.js";
-import { attachmentCounterPayloadQb64b, resolveAttachmentGvrsn } from "../core/attachment-countering.js";
+import { concatBytes, DigDex, Diger, Kinds, NumberPrimitive, NumDex, Prefixer, Saider, SerderACDC, TraitDex, Vrsn_1_0, } from "cesr-ts";
+import { resolveCachedSchema } from "../app/credentials/schema-resolving.js";
+import { Verifier } from "../app/credentials/verifying.js";
+import { attachmentCounterPayloadQb64b, attachmentOrdinal, resolveAttachmentGvrsn, } from "../core/attachment-countering.js";
 import { Deck } from "../core/deck.js";
-import { ValidationError } from "../core/errors.js";
-import { backerIssue, backerRevoke, incept as inceptRegistryEvent, issue as issueEvent, revoke as revokeEvent, rotate as rotateRegistryEvent, } from "../core/protocol-vdr-eventing.js";
+import { DatabaseOperationError, ValidationError } from "../core/errors.js";
+import { incept as inceptRegistryEvent, issue as issueEvent, } from "../core/protocol-vdr-eventing.js";
 import { RegistryRecord } from "../core/records.js";
+import { dgKey } from "../db/core/keys.js";
 import { makeNowIso8601 } from "../time/mod.js";
 import { Tevery } from "./eventing.js";
+import { prepareCredentialRevocation } from "./revoking.js";
+import { telAnchorMatches } from "./tel-anchor.js";
+import { TelPublication } from "./tel-publication.js";
 function ordinal(num) {
     const raw = new Uint8Array(16);
     let value = BigInt(num);
@@ -29,16 +33,6 @@ function ordinal(num) {
     }
     return new NumberPrimitive({ code: NumDex.Huge, raw });
 }
-/** Encode an ordinal value as the fixed-width v1 seal primitive. */
-function seqner(num) {
-    const raw = new Uint8Array(16);
-    let value = BigInt(num);
-    for (let i = raw.length - 1; i >= 0; i--) {
-        raw[i] = Number(value & 0xffn);
-        value >>= 8n;
-    }
-    return new Seqner({ code: NumDex.Huge, raw });
-}
 function said(serder) {
     if (!serder.said) {
         throw new ValidationError("Expected SAID-bearing event.");
@@ -51,13 +45,16 @@ function requireHabPrefix(hab) {
     }
     return hab.pre;
 }
-function anchorTelEvent(hab, serder) {
+/** Anchor under the registry or issuer establishment policy; callers retain the resulting exact coordinate. */
+function anchorTelEvent(hab, serder, estOnly) {
     if (!serder.pre || !serder.snh || !serder.said) {
         throw new ValidationError("TEL event missing seal fields.");
     }
-    hab.interact({
-        data: [{ i: serder.pre, s: serder.snh, d: serder.said }],
-    });
+    const data = [{ i: serder.pre, s: serder.snh, d: serder.said }];
+    if (estOnly || hab.kever?.estOnly)
+        hab.rotate({ data });
+    else
+        hab.interact({ data });
     const sn = hab.kever?.sn;
     const said = hab.kever?.said;
     if (sn === undefined || sn === null || !said) {
@@ -143,11 +140,10 @@ export function credential({ issuer, registry, schema, data, recipient, edges, r
 /** Preserve one ACDC body and encode its source triple at the body/requested genus floor. */
 export function serializeCredential(creder, prefixer, number, saider, gvrsn = Vrsn_1_0) {
     gvrsn = resolveAttachmentGvrsn(creder, gvrsn);
-    // V1 requires a fixed-width Seqner; v2 accepts the stored qualified Number unchanged.
-    const ordinal = gvrsn.major === 1 && !(number instanceof Seqner) ? seqner(number.num) : number;
+    // V1 requires a fixed-width Seqner; v2 writes the compact Number.
     const sealPayload = [
         prefixer.qb64b,
-        ordinal.qb64b,
+        attachmentOrdinal(number, gvrsn).qb64b,
         saider.qb64b,
     ];
     return concatBytes(creder.raw, attachmentCounterPayloadQb64b("SealSourceTriples", 1, sealPayload, gvrsn), ...sealPayload);
@@ -191,8 +187,15 @@ export class Regery {
             writable: true,
             value: new Map()
         });
+        Object.defineProperty(this, "publication", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         this.hby = hby;
         this.reger = options.reger;
+        this.publication = new TelPublication(hby.db, this.reger);
         this.cues = options.cues ?? new Deck();
         this.tvy = options.tvy ?? new Tevery({ db: hby.db, reger: this.reger, cues: this.cues });
         this.vry = options.vry ?? new Verifier(hby, { reger: this.reger, cues: this.cues });
@@ -209,6 +212,7 @@ export class Regery {
                 continue;
             }
             this.registries.set(name, new Registry({
+                publication: this.publication,
                 name,
                 hab,
                 reger: this.reger,
@@ -220,6 +224,7 @@ export class Regery {
     }
     makeRegistry(name, hab, options = {}) {
         const registry = new Registry({
+            publication: this.publication,
             name,
             hab,
             reger: this.reger,
@@ -236,11 +241,18 @@ export class Regery {
     processEscrows() {
         this.tvy.processEscrows();
         this.vry.processEscrows();
+        this.publication.advance();
     }
 }
-/** One credential registry controlled by one issuer habitat. */
+/** Local NoBackers registry authoring; externally backed state remains available for observation. */
 export class Registry {
     constructor(options) {
+        Object.defineProperty(this, "publication", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "name", {
             enumerable: true,
             configurable: true,
@@ -277,105 +289,91 @@ export class Registry {
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "noBackers", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
         Object.defineProperty(this, "estOnly", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
+        if (options.publication.db !== options.hab.db || options.publication.reger !== options.reger) {
+            throw new TypeError("Registry publication must use its issuer KEL and TEL stores.");
+        }
+        this.publication = options.publication;
         this.name = options.name;
         this.hab = options.hab;
         this.reger = options.reger;
         this.tvy = options.tvy;
         this.cues = options.cues ?? new Deck();
         this.regk = options.regk ?? null;
-        this.noBackers = options.noBackers ?? true;
-        this.estOnly = options.estOnly ?? false;
+        const config = this.regk ? this.reger.states.get(this.regk)?.c ?? [] : [];
+        this.estOnly = options.estOnly ?? config.includes(TraitDex.EstOnly);
     }
     incept(options = {}) {
         const cnfg = [
-            ...((options.noBackers ?? true) ? [TraitDex.NoBackers] : []),
+            TraitDex.NoBackers,
             ...(options.estOnly ? [TraitDex.EstOnly] : []),
         ];
         const serder = inceptRegistryEvent(requireHabPrefix(this.hab), {
             cnfg,
-            baks: options.baks,
-            toad: options.toad,
             nonce: options.nonce,
         });
-        const seal = anchorTelEvent(this.hab, serder);
+        const seal = anchorTelEvent(this.hab, serder, options.estOnly ?? this.estOnly);
         const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
         if (decision.kind !== "accept") {
             throw new ValidationError(`Registry inception failed: ${decision.kind}`);
         }
         this.regk = said(serder);
-        this.noBackers = cnfg.includes(TraitDex.NoBackers);
         this.estOnly = cnfg.includes(TraitDex.EstOnly);
         this.reger.registries.add(this.regk);
         this.reger.regs.pin(this.name, new RegistryRecord({
             registryKey: this.regk,
             prefix: requireHabPrefix(this.hab),
         }));
-        this.markComplete(this.regk, 0, said(serder));
-        return decision;
-    }
-    rotate(options = {}) {
-        const tever = this.currentTever();
-        const serder = rotateRegistryEvent(this.requireRegk(), said(tever.serder), {
-            sn: tever.sn + 1,
-            toad: options.toad,
-            baks: [...tever.baks],
-            cuts: options.cuts,
-            adds: options.adds,
-        });
-        const seal = anchorTelEvent(this.hab, serder);
-        const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
-        if (decision.kind === "accept") {
-            this.markComplete(this.requireRegk(), serder.sn ?? tever.sn + 1, said(serder));
-        }
+        this.trackPublication(serder, seal);
         return decision;
     }
     issue(creder) {
-        const tever = this.currentTever();
+        this.authoringState();
         const regk = this.requireRegk();
-        const serder = tever.noBackers
-            ? issueEvent(said(creder), regk)
-            : backerIssue(said(creder), regk, tever.sn, said(tever.serder));
-        const seal = anchorTelEvent(this.hab, serder);
+        const serder = issueEvent(said(creder), regk);
+        const seal = anchorTelEvent(this.hab, serder, this.estOnly);
         const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
-        if (decision.kind === "accept") {
-            this.markComplete(said(creder), serder.sn ?? 0, said(serder));
-        }
+        this.trackPublication(serder, seal);
         return { serder, decision, seal };
     }
+    /** Select the original REV or prepare one after read-only credential/registry authority checks. */
+    prepareRevocation(credentialSaid) {
+        this.authoringState();
+        return prepareCredentialRevocation(this.reger, requireHabPrefix(this.hab), this.requireRegk(), credentialSaid);
+    }
+    /** Revoke once; explicit retries reuse the retained TEL body and original issuer anchor. */
     revoke(credentialSaid) {
-        const tever = this.currentTever();
-        const prior = this.reger.tels.getOn(credentialSaid, tever.vcSn(credentialSaid) ?? 0);
-        if (!prior) {
-            throw new ValidationError(`Cannot revoke unknown credential ${credentialSaid}.`);
+        const serder = this.prepareRevocation(credentialSaid);
+        const couple = this.reger.ancs.get(dgKey(credentialSaid, serder.said));
+        let seal;
+        if (couple) {
+            const anchor = this.hab.db.getEvtSerder(requireHabPrefix(this.hab), couple[1].qb64);
+            if (!anchor || anchor.sner?.num !== couple[0].num || !telAnchorMatches(this.hab.pre, serder, anchor)) {
+                throw new DatabaseOperationError("Stored revocation issuer anchor is missing or inconsistent.");
+            }
+            seal = { prefixer: new Prefixer({ qb64: this.hab.pre }), seqner: couple[0], saider: couple[1] };
         }
-        const regk = this.requireRegk();
-        const serder = tever.noBackers
-            ? revokeEvent(credentialSaid, regk, prior.qb64)
-            : backerRevoke(credentialSaid, regk, tever.sn, said(tever.serder), prior.qb64);
-        const seal = anchorTelEvent(this.hab, serder);
-        const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
-        if (decision.kind === "accept") {
-            this.markComplete(credentialSaid, serder.sn ?? 1, said(serder));
+        else {
+            seal = anchorTelEvent(this.hab, serder, this.estOnly);
         }
+        const decision = this.tvy.processEvent({ serder, seqner: seal.seqner, saider: seal.saider });
+        this.trackPublication(serder, seal);
         return { serder, decision, seal };
     }
     complete(pre, sn = 0) {
-        return this.reger.ctel.get([pre, seqner(sn).qb64]) !== null;
+        return this.publication.complete(pre, sn);
     }
-    markComplete(pre, sn, eventSaid) {
-        this.reger.ctel.pin([pre, seqner(sn).qb64], new Saider({ qb64: eventSaid }));
+    /** Keep publication progress with the original accepted issuer anchor. */
+    trackPublication(event, seal) {
+        const anchor = this.hab.db.getEvtSerder(requireHabPrefix(this.hab), seal.saider.qb64);
+        if (!anchor)
+            throw new ValidationError("Missing locally authored TEL anchor.");
+        this.publication.track(event, anchor);
     }
     requireRegk() {
         if (!this.regk) {
@@ -383,11 +381,15 @@ export class Registry {
         }
         return this.regk;
     }
-    currentTever() {
-        const tever = this.reger.tevers.get(this.requireRegk());
-        if (!(tever instanceof Object) || !("serder" in tever)) {
+    /** Foreign backed registries remain readable, but cannot authorize local TEL authoring. */
+    authoringState() {
+        const tever = this.tvy.tevers.get(this.requireRegk());
+        if (!tever) {
             throw new ValidationError(`Missing TEL state for registry ${this.requireRegk()}.`);
         }
+        if (!tever.noBackers) {
+            throw new ValidationError("Local credential authoring requires a NoBackers registry.");
+        }
         return tever;
     }
 }