keri-ts 1.0.0 → 2.0.1

package/esm/keri/npm/src/db/keeping.js

@@ -1,4 +1,4 @@
-import { Cipher, NumberPrimitive, Prefixer, Signer, Verfer, } from "cesr-ts";
+import { Cipher, MtrDex, NumberPrimitive, Prefixer, Salter, Signer, Verfer, } from "cesr-ts";
 import { DatabaseNotOpenError, DatabaseOperationError } from "../core/errors.js";
 import { consoleLogger } from "../core/logger.js";
 import { RawRecord } from "../core/records.js";
@@ -80,6 +80,13 @@ export class PubSet extends RawRecord {
         });
     }
 }
+/** Convert one stored salt between the current and replacement at-rest policy. */
+function reencryptSalt(salt, encrypter, decrypter) {
+    const salter = decrypter
+        ? decrypter.decrypt({ qb64: salt, ctor: Salter })
+        : new Salter({ qb64: salt });
+    return encrypter ? encrypter.encrypt({ prim: salter }).qb64 : salter.qb64;
+}
 /**
  * Keystore databaser for root parameters, per-prefix state, and secret-material
  * storage seams.
@@ -178,6 +185,13 @@ export class Keeper {
             writable: true,
             value: void 0
         });
+        /** Encrypted Salt128 roots scoped by canonical local AID and registry SAID. */
+        Object.defineProperty(this, "rroots", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         this.logger = options.logger ?? consoleLogger;
         const compat = options.compat ?? false;
         this.lmdber = new LMDBer(options, {
@@ -287,6 +301,7 @@ export class Keeper {
                 subkey: "nxts.",
                 ctor: Cipher,
             });
+            this.rroots = new CesrSuber(this.lmdber, { subkey: "rroots.", ctor: Cipher });
             return true;
         }
         catch (error) {
@@ -311,6 +326,92 @@ export class Keeper {
     pinGbls(key, value) {
         return this.gbls.pin(key, value);
     }
+    /**
+     * Commit one authenticated AEID change and every affected secret together.
+     * Manager validates the replacement credentials; this owner rechecks the old
+     * AEID under the native writer, migrates root/prefix salts, signer seeds and registry roots,
+     * and refuses false writes. A caller's outer writer cannot establish commit
+     * completion, so this operation must own its transaction. No live Manager
+     * crypto state is published here.
+     */
+    changeEncryption({ currentAeid, aeid, encrypter, decrypter }) {
+        if (this.readonly)
+            throw new DatabaseOperationError("Cannot change encryption in a read-only keeper");
+        const env = this.lmdber.env;
+        if (!env)
+            throw new DatabaseNotOpenError("Keeper environment is not open");
+        if (this.lmdber.inWriteTransaction) {
+            throw new DatabaseOperationError("Keeper encryption change must own its write transaction");
+        }
+        env.transactionSync(() => {
+            const storedAeid = this.getGbls("aeid");
+            if ((storedAeid ?? "") !== currentAeid) {
+                throw new DatabaseOperationError("Keeper AEID changed before encryption migration; reopen the manager");
+            }
+            if (storedAeid === aeid)
+                return;
+            const roots = [...this.rroots.getTopItemIter()];
+            if (roots.length && !encrypter) {
+                throw new DatabaseOperationError("Cannot disable encryption while registry roots are retained");
+            }
+            for (const [keys, cipher] of roots) {
+                const root = decrypter?.decrypt({ cipher, ctor: Salter });
+                if (!root || root.code !== MtrDex.Salt_128)
+                    throw new DatabaseOperationError("Invalid registry root");
+                if (!this.rroots.pin(keys, encrypter.encrypt({ prim: root }))) {
+                    throw new DatabaseOperationError("Keeper registry root write failed");
+                }
+            }
+            const root = this.getGbls("salt");
+            if (root !== null) {
+                const value = reencryptSalt(root, encrypter, decrypter);
+                if (!this.pinGbls("salt", value))
+                    throw new DatabaseOperationError("Keeper root salt write failed");
+            }
+            for (const [keys, data] of this.prms.getTopItemIter()) {
+                if (!data.salt)
+                    continue;
+                data.salt = reencryptSalt(data.salt, encrypter, decrypter);
+                if (!this.prms.pin(keys, data))
+                    throw new DatabaseOperationError("Keeper prefix salt write failed");
+            }
+            for (const [keys, signer] of this.pris.getTopItemIter("", decrypter ?? undefined)) {
+                if (!this.pris.pin(keys, signer, encrypter ?? undefined)) {
+                    throw new DatabaseOperationError("Keeper signer seed write failed");
+                }
+            }
+            if (!this.pinGbls("aeid", aeid))
+                throw new DatabaseOperationError("Keeper AEID write failed");
+        });
+    }
+    /** Retain an immutable root under the authenticated policy, owning its commit. */
+    retainRegistryRoot(keys, root, currentAeid, encrypter, decrypter) {
+        if (this.readonly)
+            throw new DatabaseOperationError("Cannot retain registry roots in a read-only keeper");
+        const env = this.lmdber.env;
+        if (!env)
+            throw new DatabaseNotOpenError("Keeper environment is not open");
+        if (this.lmdber.inWriteTransaction) {
+            throw new DatabaseOperationError("Registry root retention must own its write transaction");
+        }
+        return env.transactionSync(() => {
+            if (this.getGbls("aeid") !== currentAeid) {
+                throw new DatabaseOperationError("Keeper AEID changed before registry root retention; reopen the manager");
+            }
+            const old = this.rroots.get(keys);
+            if (old) {
+                const retained = decrypter.decrypt({ cipher: old, ctor: Salter });
+                if (retained.qb64 !== root.qb64) {
+                    throw new Error("A different root is already retained for this AID and registry");
+                }
+                return false;
+            }
+            if (!this.rroots.put(keys, encrypter.encrypt({ prim: root }))) {
+                throw new DatabaseOperationError("Keeper registry root write failed");
+            }
+            return true;
+        });
+    }
     /** Insert the first public-key to prefix mapping in `pres.` if absent. */
     putPres(pre, val) {
         return this.pres.put(pre, new Prefixer({ qb64: val }));
@@ -453,6 +554,7 @@ Object.defineProperty(Keeper, "MaxNamedDBs", {
 export function* createKeeper(options = {}) {
     const keeper = new Keeper(options);
     let delivered = false;
+    let failure;
     try {
         const opened = yield* keeper.reopen(options);
         if (!opened) {
@@ -461,8 +563,25 @@ export function* createKeeper(options = {}) {
         delivered = true;
         return keeper;
     }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
     finally {
-        if (!delivered)
-            yield* keeper.close();
+        if (!delivered) {
+            try {
+                yield* keeper.close();
+            }
+            catch (error) {
+                if (failure) {
+                    // deno-lint-ignore no-unsafe-finally -- Preserve the operation failure alongside shutdown failure.
+                    throw new AggregateError([failure.error, error], "Database acquisition and close failed", {
+                        cause: failure.error,
+                    });
+                }
+                // deno-lint-ignore no-unsafe-finally -- A shutdown failure must propagate.
+                throw error;
+            }
+        }
     }
 }

package/esm/keri/npm/src/db/{kram-factors.js → mailbox/kram-factors.js}

@@ -1,6 +1,6 @@
 /** Durable KRAM factors preserve proof ownership; callers own authentication and atomic publication. */
 import { BlindState, BoundState, byteString, Cigar, Diger, FirstSeen, NumberPrimitive, SealEvent, SealKind, TypeMedia, } from "cesr-ts";
-import { KeriDispatchEnvelope, PathedMaterialGroup, TransIdxSigGroup, TransReceiptQuadruple, } from "../core/dispatch.js";
+import { KeriDispatchEnvelope, PathedMaterialGroup, TransIdxSigGroup, TransReceiptQuadruple, } from "../../core/dispatch.js";
 /** Normalize historical ordinals before durable tuple identity is compared. */
 function number(value) {
     return NumberPrimitive.fromNum(value instanceof NumberPrimitive ? value.num : value.sn);

package/esm/keri/npm/src/db/{mailboxing.js → mailbox/mailboxing.js}

@@ -14,9 +14,9 @@
  *   they all treat this module as the single source of mailbox payload truth
  */
 import { Diger, MtrDex } from "cesr-ts";
-import { DatabaseNotOpenError } from "../core/errors.js";
-import { LMDBer } from "./core/lmdber.js";
-import { CesrOnSuber, Suber } from "./subing.js";
+import { DatabaseNotOpenError } from "../../core/errors.js";
+import { LMDBer } from "../core/lmdber.js";
+import { CesrOnSuber, Suber } from "../subing.js";
 /** Raw-byte value family used for stored mailbox message bodies. */
 class BytesSuber extends Suber {
     _ser(val) {

package/esm/keri/npm/src/db/reger.js

@@ -9,16 +9,16 @@
  * - TEL state machines, registry orchestration, credential issuance, and
  *   verifier policy live in later VDR runtime modules
  */
-import { b, Cigar, concatBytes, Counter, Dater, Diger, NumberPrimitive, NumDex, Prefixer, Saider, Seqner, SerderACDC, SerderKERI, Siger, t, Verfer, Vrsn_1_0, } from "cesr-ts";
-import { attachmentCounterPayloadQb64b, attachmentCounterQb64b, resolveAttachmentGvrsn, } from "../core/attachment-countering.js";
+import { b, Cigar, concatBytes, Counter, Dater, Diger, NumberPrimitive, Prefixer, Saider, SerderACDC, SerderKERI, Siger, t, Verfer, Vrsn_1_0, } from "cesr-ts";
+import { attachmentCounterPayloadQb64b, attachmentCounterQb64b, attachmentOrdinal, resolveAttachmentGvrsn, } from "../core/attachment-countering.js";
 import { DatabaseNotOpenError, DatabaseOperationError, ValidationError } from "../core/errors.js";
 import { RegistryRecord, RegStateRecord } from "../core/records.js";
 import { dgKey, splitOnKey } from "./core/keys.js";
 import { LMDBer } from "./core/lmdber.js";
 import { Broker } from "./escrowing.js";
 import { Komer } from "./koming.js";
+import { CapturedTelReplay, UnsupportedTelReplayError, } from "./replay/tel-replay.js";
 import { BytesSuber, CatCesrIoSetSuber, CatCesrSuber, CesrDupSuber, CesrIoSetSuber, CesrOnSuber, CesrSuber, IoDupSuber, OnIoDupSuber, SerderSuber, } from "./subing.js";
-import { CapturedTelReplay } from "./tel-replay.js";
 function keyText(value) {
     return typeof value === "string" ? value : t(value);
 }
@@ -28,19 +28,6 @@ function digestText(value) {
     }
     return keyText(value);
 }
-function fixedOrdinalRaw(num, size = 16) {
-    const raw = new Uint8Array(size);
-    let value = num;
-    for (let i = raw.length - 1; i >= 0; i--) {
-        raw[i] = Number(value & 0xffn);
-        value >>= 8n;
-    }
-    return raw;
-}
-/** Widen the ordinal value to the fixed v1 seal encoding. */
-function seqnerFromNumber(number) {
-    return new Seqner({ code: NumDex.Huge, raw: fixedOrdinalRaw(number.num) });
-}
 function saiderFromDigest(diger) {
     return new Saider({ qb64: diger.qb64 });
 }
@@ -50,8 +37,8 @@ function isRecord(value) {
 /**
  * VDR/TEL credential database owner.
  *
- * Bound stores are literal KERIpy `Reger` subkeys. Keeping this class thin
- * lets higher VDR processors share one storage contract with KERIpy fixtures.
+ * Protocol evidence uses literal KERIpy `Reger` subkeys; observer receipt
+ * evidence remains separate from local issuer publication state.
  */
 export class Reger extends LMDBer {
     constructor(options = {}) {
@@ -100,12 +87,13 @@ export class Reger extends LMDBer {
             writable: true,
             value: void 0
         }); // Backer AIDs at one TEL management state.
+        /** Indexed backer proofs; out-of-order candidates are reverified against accepted cohorts before admission. */
         Object.defineProperty(this, "tibs", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
-        }); // Indexed backer receipt signatures.
+        });
         Object.defineProperty(this, "oots", {
             enumerable: true,
             configurable: true,
@@ -237,7 +225,7 @@ export class Reger extends LMDBer {
             configurable: true,
             writable: true,
             value: void 0
-        }); // Completed TEL event marker.
+        }); // Completed local TEL publication, valued by issuer anchor SAID.
         Object.defineProperty(this, "cmse", {
             enumerable: true,
             configurable: true,
@@ -375,7 +363,7 @@ export class Reger extends LMDBer {
         const [prefixer, number, diger] = anchor;
         return [creder, prefixer, number, diger];
     }
-    /** Iterate TEL events from ordinal `fn`, honoring the requested attachment genus floor. */
+    /** Iterate TEL events from ordinal `fn`, using the requested attachment genus exactly. */
     *clonePreIter(pre, fn = 0, gvrsn = Vrsn_1_0) {
         for (const [, , diger] of this.tels.getAllItemIter(pre, fn)) {
             yield this.cloneTvt(pre, diger, gvrsn);
@@ -422,7 +410,7 @@ export class Reger extends LMDBer {
             yield this.cloneTvt(pre, diger, gvrsn, genusify);
         }
     }
-    /** Clone one TEL event at sequence `sn`, preserving its body and honoring the genus floor. */
+    /** Clone one TEL event at sequence `sn`, preserving its body and using the requested genus exactly. */
     cloneTvtAt(pre, sn = 0, gvrsn = Vrsn_1_0) {
         const diger = this.tels.getOn(pre, sn);
         if (diger === null) {
@@ -430,7 +418,7 @@ export class Reger extends LMDBer {
         }
         return this.cloneTvt(pre, diger, gvrsn);
     }
-    /** Clone one TEL body and its stored proofs, preserving its minimum/requested genus. */
+    /** Clone a TEL body/proof in the requested genus, refusing evidence that requires a newer version. */
     cloneTvt(pre, dig, gvrsn = Vrsn_1_0, genusify = false) {
         const preText = keyText(pre);
         const digText = digestText(dig);
@@ -439,6 +427,11 @@ export class Reger extends LMDBer {
         if (raw === null) {
             throw new ValidationError(`Missing event for dig=${digText}.`);
         }
+        const serder = new SerderKERI({ raw });
+        const required = resolveAttachmentGvrsn(serder, serder.pvrsn);
+        if (gvrsn.major < required.major || (gvrsn.major === required.major && gvrsn.minor < required.minor)) {
+            throw new UnsupportedTelReplayError(preText, digText, gvrsn, required);
+        }
         // Native dupsort yields one fixed signature record at a time, without collecting its bucket.
         const tibPayload = [];
         for (const tib of this.tibs.getIter([preText, digText])) {
@@ -447,8 +440,6 @@ export class Reger extends LMDBer {
         const couple = this.ancs.get(dgkey);
         if (tibPayload.length === 0 && couple === null && !genusify)
             return raw;
-        // A requested genus is a floor; retain the body bytes and honor its declared minimum.
-        gvrsn = resolveAttachmentGvrsn(new SerderKERI({ raw }), gvrsn);
         const selector = genusify ? Counter.makeGVC(gvrsn) : new Uint8Array();
         if (tibPayload.length === 0 && couple === null) {
             return concatBytes(selector, raw);
@@ -462,7 +453,7 @@ export class Reger extends LMDBer {
         if (couple !== null) {
             const [number, diger] = couple;
             const sealPayload = [
-                gvrsn.major === 1 ? seqnerFromNumber(number).qb64b : number.qb64b,
+                attachmentOrdinal(number, gvrsn).qb64b,
                 saiderFromDigest(diger).qb64b,
             ];
             attachments.push(attachmentCounterPayloadQb64b("SealSourceCouples", 1, sealPayload, gvrsn), ...sealPayload);
@@ -496,7 +487,7 @@ export class Reger extends LMDBer {
             const selected = resolveAttachmentGvrsn(sourceCreder, gvrsn);
             const sealPayload = [
                 prefixer.qb64b,
-                selected.major === 1 ? seqnerFromNumber(number).qb64b : number.qb64b,
+                attachmentOrdinal(number, selected).qb64b,
                 saiderFromDigest(diger).qb64b,
             ];
             const atc = concatBytes(attachmentCounterPayloadQb64b("SealSourceTriples", 1, sealPayload, selected), ...sealPayload);
@@ -540,6 +531,7 @@ Object.defineProperty(Reger, "MaxNamedDBs", {
 export function* createReger(options = {}) {
     const reger = new Reger(options);
     let delivered = false;
+    let failure;
     try {
         const opened = yield* reger.reopen(options);
         if (!opened) {
@@ -548,8 +540,25 @@ export function* createReger(options = {}) {
         delivered = true;
         return reger;
     }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
     finally {
-        if (!delivered)
-            yield* reger.close();
+        if (!delivered) {
+            try {
+                yield* reger.close();
+            }
+            catch (error) {
+                if (failure) {
+                    // deno-lint-ignore no-unsafe-finally -- Preserve the operation failure alongside shutdown failure.
+                    throw new AggregateError([failure.error, error], "Database acquisition and close failed", {
+                        cause: failure.error,
+                    });
+                }
+                // deno-lint-ignore no-unsafe-finally -- A shutdown failure must propagate.
+                throw error;
+            }
+        }
     }
 }

package/esm/keri/npm/src/db/{kel-replay.js → replay/kel-replay.js}

@@ -9,11 +9,14 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
-var _CapturedKelReplay_db;
+var _CapturedKelReplay_instances, _CapturedKelReplay_db, _CapturedKelReplay_ranges;
+/** Inspectable KEL replay metadata; event bytes and read cursors remain consumption-owned. */
+import { genusFramed } from "../../core/genus-framing.js";
 /** A reopenable captured extent borrowing one runtime-owned Baser, never its event cache. */
 export class CapturedKelReplay {
     /** Copy primitive ranges into plain frozen containers; caller keeps the borrowed store alive. */
     constructor(db, ranges) {
+        _CapturedKelReplay_instances.add(this);
         Object.defineProperty(this, "ranges", {
             enumerable: true,
             configurable: true,
@@ -36,8 +39,12 @@ export class CapturedKelReplay {
         Object.freeze(this);
     }
     /** Open no cursor until requested; each range reader joins its cursor before yielding an event. */
-    *[(_CapturedKelReplay_db = new WeakMap(), Symbol.iterator)]() {
-        for (const range of this.ranges)
-            yield* __classPrivateFieldGet(this, _CapturedKelReplay_db, "f").replayRange(range);
+    *[(_CapturedKelReplay_db = new WeakMap(), _CapturedKelReplay_instances = new WeakSet(), Symbol.iterator)]() {
+        // A delegator's KEL may use a different KERI version than the queried log.
+        yield* genusFramed(__classPrivateFieldGet(this, _CapturedKelReplay_instances, "m", _CapturedKelReplay_ranges).call(this));
     }
 }
+_CapturedKelReplay_ranges = function* _CapturedKelReplay_ranges() {
+    for (const range of this.ranges)
+        yield* __classPrivateFieldGet(this, _CapturedKelReplay_db, "f").replayRange(range);
+};

package/esm/keri/npm/src/db/{tel-replay.js → replay/tel-replay.js}

@@ -10,6 +10,40 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
 var _CapturedTelReplay_db;
+import { ValidationError } from "../../core/errors.js";
+/** Requested replay cannot represent this stored body/proof; its signed bytes are never rewritten. */
+export class UnsupportedTelReplayError extends ValidationError {
+    /** Retain the refused event and owned version values for a local caller or transport boundary. */
+    constructor(pre, said, requested, required) {
+        super(`TEL replay ${pre}/${said} requires version ${required.major}.${required.minor}; requested ${requested.major}.${requested.minor}.`);
+        Object.defineProperty(this, "pre", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: pre
+        });
+        Object.defineProperty(this, "said", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: said
+        });
+        Object.defineProperty(this, "requested", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "required", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.requested = Object.freeze({ ...requested });
+        this.required = Object.freeze({ ...required });
+    }
+}
 /** A captured TEL source; readers borrow the store without retaining event bytes. */
 export class CapturedTelReplay {
     /** Copy range tuples and wire settings; caller keeps the store alive through consumption. */

package/esm/keri/npm/src/db/{witness-replay.js → replay/witness-replay.js}

@@ -12,8 +12,8 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 var _CapturedWitnessReplay_db;
 /** Witness sequence replay borrows its Baser without retaining event bytes or read cursors. */
 import { b, bytesEqual, t } from "cesr-ts";
-import { DatabaseOperationError } from "../core/errors.js";
-import { onKey, splitOnKey } from "./core/keys.js";
+import { DatabaseOperationError } from "../../core/errors.js";
+import { onKey, splitOnKey } from "../core/keys.js";
 /** Captured KEL/FEL horizons; duplicate order and current proofs are read only during consumption. */
 export class CapturedWitnessReplay {
     /** Fixed primitive metadata only; the caller keeps the borrowed store open through response disposal. */

package/esm/keri/npm/src/db/subing.js

@@ -1,4 +1,4 @@
-import { b, Cipher, Matter, parseSerder, SerderKERI, Signer, smell, t, Verfer, } from "cesr-ts";
+import { b, Cipher, Matter, parseSerder, reapSerder, SerderKERI, Signer, smell, t, Verfer, } from "cesr-ts";
 import { Schemer } from "../core/scheming.js";
 function isKeysIterable(value) {
     return typeof value !== "string" && !(value instanceof Uint8Array);
@@ -899,8 +899,7 @@ export class SerderSuberBase extends Suber {
         if (val === null) {
             return null;
         }
-        const { smellage } = smell(val);
-        const serder = parseSerder(val, smellage);
+        const { serder } = reapSerder(val);
         if (!(serder instanceof this.ctor)) {
             throw new TypeError(`Expected ${this.ctor.name}, got ${serder.constructor.name}.`);
         }

package/esm/keri/npm/src/did/webs/artifacts.js

@@ -5,7 +5,6 @@
  * resolver needs to rebuild the same DID document from KERI/VDR state.
  */
 import { concatBytes } from "cesr-ts";
-import { requireRegery } from "../../app/credential-workflows.js";
 import { ValidationError } from "../../core/errors.js";
 import { Roles } from "../../core/roles.js";
 import { serializeCredential } from "../../vdr/credentialing.js";
@@ -13,27 +12,27 @@ import { listActiveDesignatedAliasCredentials, pinDesignatedAliasesSchema } from
 import { parseDidWebs } from "./dids.js";
 import { generateDidDocument } from "./documenting.js";
 /** Generate both hosted artifacts for one local AID. */
-export function generateDidWebsArtifacts(runtime, options) {
-    const { aid, hab, didJson } = prepareHostedJson(runtime, options);
-    return { aid, didJson, keriCesr: generateDidWebsCesr(runtime, aid, { hab }) };
+export function generateDidWebsArtifacts(rgy, options) {
+    const { aid, hab, didJson } = prepareHostedJson(rgy, options);
+    return { aid, didJson, keriCesr: generateDidWebsCesr(rgy, aid, { hab }) };
 }
 /** Generate only the hosted JSON artifact; never open the CESR replay history. */
-export function generateDidWebsJson(runtime, options) {
-    const { aid, didJson } = prepareHostedJson(runtime, options);
+export function generateDidWebsJson(rgy, options) {
+    const { aid, didJson } = prepareHostedJson(rgy, options);
     return { aid, didJson };
 }
 /** Preserve local-AID validation and document projection for both artifact entry points. */
-function prepareHostedJson(runtime, options) {
+function prepareHostedJson(rgy, options) {
     const parsed = parseDidWebs(options.did);
-    const hab = options.alias ? requireHab(runtime.hby, options.alias) : runtime.hby.habs.get(parsed.aid);
+    const hab = options.alias ? requireHab(rgy.hby, options.alias) : rgy.hby.habs.get(parsed.aid);
     if (!hab?.pre) {
         throw new ValidationError(`No local AID found for did:webs AID ${parsed.aid}.`);
     }
     if (hab.pre !== parsed.aid) {
         throw new ValidationError(`DID ${options.did} embeds AID ${parsed.aid}, but alias ${hab.name} is ${hab.pre}.`);
     }
-    pinDesignatedAliasesSchema(runtime.hby.db);
-    const document = generateDidDocument(runtime.hby, requireRegery(runtime), options.did, {
+    pinDesignatedAliasesSchema(rgy.hby.db);
+    const document = generateDidDocument(rgy.hby, rgy, options.did, {
         hosted: true,
         metadata: options.metadata ?? false,
     });
@@ -44,24 +43,22 @@ function prepareHostedJson(runtime, options) {
     };
 }
 /** Generate the replay CESR stream for one local AID. */
-export function generateDidWebsCesr(runtime, aid, options = {}) {
-    const hab = options.hab ?? runtime.hby.habs.get(aid);
+export function generateDidWebsCesr(rgy, aid, options = {}) {
+    const hab = options.hab ?? rgy.hby.habs.get(aid);
     if (!hab?.pre) {
         throw new ValidationError(`No local AID found for ${aid}.`);
     }
-    const kever = runtime.hby.db.getKever(aid, { refresh: true });
+    const kever = rgy.hby.db.getKever(aid, { refresh: true });
     if (!kever) {
         throw new ValidationError(`No accepted key state for ${aid}.`);
     }
     const messages = [];
     if (kever.delegated) {
-        messages.push(...runtime.hby.db.cloneDelegation(kever));
+        messages.push(...rgy.hby.db.cloneDelegation(kever));
     }
-    messages.push(...runtime.hby.db.clonePreIter(aid));
+    messages.push(...rgy.hby.db.clonePreIter(aid));
     messages.push(...endpointMessages(hab, aid));
-    const regery = runtime.vdr;
-    if (!regery)
-        throw new ValidationError("VDR runtime did not open Reger.");
+    const regery = rgy;
     messages.push(...designatedAliasMessages(regery, aid));
     return concatBytes(...messages.filter((message) => message.length > 0));
 }

package/esm/keri/npm/src/did/webs/designated-aliases.js

@@ -7,7 +7,6 @@
  * - expose one active-state query shared by DID documents and CESR artifacts
  */
 import { DigDex, Ilks, Kinds, Saider, } from "cesr-ts";
-import { requireRegery } from "../../app/credential-workflows.js";
 import { ValidationError } from "../../core/errors.js";
 import { Schemer } from "../../core/scheming.js";
 import { Credentialer, CredentialWallet } from "../../vdr/credentialing.js";
@@ -32,8 +31,8 @@ export function pinDesignatedAliasesSchema(db) {
  * Existing active DA credentials from the same issuer/schema are revoked before
  * the replacement credential is issued.
  */
-export function bindDesignatedAliases(runtime, options) {
-    const hab = requireHab(runtime.hby, options.alias);
+export function bindDesignatedAliases(rgy, options) {
+    const hab = requireHab(rgy.hby, options.alias);
     const aid = hab.pre;
     const aliases = normalizeAliasList(options.dids);
     if (aliases.length === 0) {
@@ -42,8 +41,7 @@ export function bindDesignatedAliases(runtime, options) {
     for (const did of aliases) {
         validateAliasDidForAid(did, aid, options.allowExternalDid ?? false);
     }
-    pinDesignatedAliasesSchema(runtime.hby.db);
-    const rgy = requireRegery(runtime);
+    pinDesignatedAliasesSchema(rgy.hby.db);
     const reger = rgy.reger;
     const registryName = options.registryName ?? DEFAULT_DESIGNATED_ALIASES_REGISTRY_NAME;
     const registry = designatedAliasRegistry(rgy, registryName, hab, options.createRegistry ?? true);
@@ -54,7 +52,7 @@ export function bindDesignatedAliases(runtime, options) {
         registryForCredential(rgy, item.creder).revoke(said);
         revoked.push(said);
     }
-    const credentialer = new Credentialer(runtime.hby, {
+    const credentialer = new Credentialer(rgy.hby, {
         reger,
         vry: rgy.vry,
     });
@@ -184,7 +182,7 @@ function designatedAliasRegistry(rgy, registryName, hab, createRegistry) {
     if (!createRegistry) {
         throw new ValidationError(`Registry ${registryName} not found.`);
     }
-    return rgy.makeRegistry(registryName, hab, { noBackers: true });
+    return rgy.makeRegistry(registryName, hab);
 }
 function credentialSaid(creder) {
     if (!creder.said) {