keri-ts 2.0.1 → 2.2.0

package/esm/keri/npm/src/acdc/custody.js

@@ -0,0 +1,164 @@
+/**
+ * Registry blind derivation over the Keeper's registry root.
+ *
+ * Issuing a blinded (BUP) registry update needs a deterministic opening. The
+ * root salt stays in the Keeper; this core derives openings from it and keeps
+ * only the public, event-specific coordinates in a `DerivedUpdateStore`. A
+ * runtime defaults to {@link BaserDerivedUpdateStore}; a wallet backs the port
+ * with its own table. The core opens no database of its own.
+ */
+import { bytesEqual, makeBlindState, makeBoundState, MtrDex, Salter } from "cesr-ts";
+import { ValidationError } from "../core/errors.js";
+import { DerivedUpdateRecord } from "../core/records.js";
+import { vetBlind } from "./regeventing.js";
+/** Process-local store for a CLI or tests; a wallet backs the port with its own durable table. */
+export class MemoryDerivedUpdateStore {
+    constructor() {
+        Object.defineProperty(this, "rows", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+    }
+    get(event) {
+        return this.rows.get(event) ?? null;
+    }
+    pin(event, value) {
+        this.rows.set(event, structuredClone(value));
+    }
+}
+/**
+ * Derivation coordinates kept in a registry environment's own database (`RegBaser.dvus`). The default of a
+ * runtime that supplies no store, so a server agent keeps them durably beside the registry events they
+ * describe. A wallet with its own table still passes that instead.
+ */
+export class BaserDerivedUpdateStore {
+    constructor(baser) {
+        Object.defineProperty(this, "baser", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: baser
+        });
+    }
+    get(event) {
+        const row = this.baser.dvus.get([event]);
+        return row ? { credential: row.credential, state: row.state, bound: row.bound } : null;
+    }
+    pin(event, value) {
+        this.baser.dvus.pin([event], new DerivedUpdateRecord(structuredClone(value)));
+    }
+}
+/** Explicit capability over a local habitat's Keeper root and accepted public registry evidence. */
+export class RegistryCustody {
+    /** Borrow owners only; construction loads no encrypted row. */
+    constructor(options) {
+        Object.defineProperty(this, "options", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: options
+        });
+        this.owner();
+    }
+    /** Bind the actual local habitat and its key owners, never an AID label alone. */
+    owner() {
+        const { hby, hab } = this.options;
+        if (hby.habs.get(hab.pre) !== hab || hab.ks !== hby.ks || hab.mgr !== hby.mgr || hab.db !== hby.db) {
+            throw new ValidationError("Custody requires the actual local habitat and Keeper owners");
+        }
+    }
+    /** Load only this habitat's Keeper root; possession confers no protocol authority. */
+    load(registry) {
+        this.owner();
+        const root = this.options.hby.mgr.getRegistryRoot(this.options.hab.pre, registry);
+        if (!root)
+            throw new ValidationError("Registry custody is not provisioned");
+        return root;
+    }
+    /** Provision an issuer-selected root once, refusing replacement behind opaque accepted history. */
+    createCustody(registry) {
+        this.owner();
+        const { hby, hab } = this.options;
+        if (!hby.mgr.aeid || !hby.mgr.seed) {
+            throw new ValidationError("Private credential custody requires an authenticated encrypted Keeper");
+        }
+        if (hby.mgr.getRegistryRoot(hab.pre, registry))
+            return { registry };
+        const rip = this.options.registry.seqEvent(registry, 0);
+        if (!rip || rip.issuer !== hab.pre) {
+            throw new ValidationError("New custody requires the accepted registry issuer's actual local habitat");
+        }
+        // Existing clone validation authenticates public openings without another parser or proof algorithm.
+        for (const _ of this.options.registry.cloneTelIter(registry)) { /* consume the accepted public prefix */ }
+        const head = this.options.registry.headEvent(registry);
+        const last = head ? Number(BigInt(`0x${head.sad.n}`)) : 0;
+        if (!Number.isSafeInteger(last))
+            throw new ValidationError("Accepted registry ordinal is not representable");
+        for (let ordinal = 1; ordinal <= last; ordinal++) {
+            const event = this.options.registry.seqEvent(registry, ordinal);
+            if (!event)
+                throw new ValidationError("Accepted registry history is incomplete");
+            if (event.ilk === "bup" && !this.options.registry.opening(event.said)) {
+                throw new ValidationError("Local custody is missing for blinded registry history; salt cannot be recreated");
+            }
+        }
+        hby.mgr.putRegistryRoot(hab.pre, registry, new Salter({ code: MtrDex.Salt_128, raw: crypto.getRandomValues(new Uint8Array(16)) }));
+        return { registry };
+    }
+    /** Derive a candidate only; consumers still authenticate its exact accepted event and bound KEL reference. */
+    derive(registry, ordinal, credential, state, options = {}) {
+        if ((typeof ordinal !== "bigint" && (typeof ordinal !== "number" || !Number.isSafeInteger(ordinal))) || ordinal < 1) {
+            throw new ValidationError("Update ordinal must be a positive integer");
+        }
+        const root = this.load(registry);
+        const values = { salt: root.qb64, sn: ordinal, tier: "low", acdc: credential, state };
+        return options.bound
+            ? makeBoundState({ ...values, bsn: options.bsn ?? 0, bd: options.bd ?? "" })
+            : makeBlindState(values);
+    }
+    /** Persist exact nonsecret coordinates before processing/anchoring a newly derived BUP. */
+    retainDerivedUpdate(event, opening) {
+        if (event.ilk !== "bup" || !event.verify() || !vetBlind(opening, event.sad.b)) {
+            throw new ValidationError("Derived update requires its exact authenticated BUP opening");
+        }
+        const value = {
+            credential: opening.td.nonce,
+            state: opening.ts.label,
+            bound: "bn" in opening ? { bn: opening.bn.num.toString(16), bd: opening.bd.nonce } : null,
+        };
+        const old = this.options.store.get(event.said);
+        if (old && JSON.stringify(canonical(old)) !== JSON.stringify(value)) {
+            throw new ValidationError("Different derivation coordinates are already retained for this event");
+        }
+        this.options.store.pin(event.said, value);
+        return value;
+    }
+    /** Reproduce only the exact accepted event, never today's head or a later credential's coordinates. */
+    derivedOpening(event) {
+        if (event.ilk !== "bup" || !event.verify())
+            throw new ValidationError("Exact accepted blinded update is required");
+        const ordinal = BigInt(`0x${event.sad.n}`);
+        if (!Number.isSafeInteger(Number(ordinal))) {
+            throw new ValidationError("Accepted registry ordinal is not representable");
+        }
+        const stored = event.regid ? this.options.registry.seqEvent(event.regid, Number(ordinal)) : null;
+        if (!stored || !bytesEqual(stored.raw, event.raw)) {
+            throw new ValidationError("Exact accepted registry event is required");
+        }
+        const value = this.options.store.get(event.said);
+        if (!value)
+            throw new ValidationError("Exact derived update coordinates are unavailable");
+        const opening = this.derive(event.regid, ordinal, value.credential, value.state, value.bound ? { bound: true, bsn: BigInt(`0x${value.bound.bn}`), bd: value.bound.bd } : {});
+        if (!vetBlind(opening, event.sad.b)) {
+            throw new ValidationError("Derived opening does not match the exact accepted event");
+        }
+        return opening;
+    }
+}
+/** Fix field order so equality does not depend on how a store hydrated the record. */
+function canonical(value) {
+    const { credential, state, bound } = value;
+    return { credential, state, bound: bound ? { bn: bound.bn, bd: bound.bd } : null };
+}

package/esm/keri/npm/src/acdc/dhking.js

@@ -8,7 +8,7 @@ import { hkdf } from "@noble/hashes/hkdf";
 import { sha256 } from "@noble/hashes/sha2";
 import { Hab } from "../app/identity/habbing.js";
 import { groupWitnesserSelection, isLocalGroupHab, latestGroupContribution, localGroupMember, } from "../app/multisig/group-members.js";
-import { copyAuxiliaryQuery, envelopeFromFrame, } from "../app/protocol/parsering.js";
+import { auxiliaryQueryWire, copyAuxiliaryQuery, envelopeFromFrame, restoreAuxiliaryQuery, } from "../app/protocol/parsering.js";
 import { Deck } from "../core/deck.js";
 import { ValidationError } from "../core/errors.js";
 import { verifyQueryAttachments } from "../core/exchange/exchange-proofing.js";
@@ -85,6 +85,72 @@ export function deriveRoot(privateKey, context) {
         shared.fill(0);
     }
 }
+/**
+ * The DH transaction id of a Grant: its own SAID when it opens the exchange (`xip`), and otherwise the exchange it
+ * continues (`x`). The one definition, so the owner and any workflow that names the transaction agree.
+ */
+export function grantTransactionId(grant) {
+    return grant.ilk === "xip" ? grant.said : grant.sad.x;
+}
+/** The parties and transaction of a Grant `hab` takes part in, or null when it is not a DH party of it. */
+function grantParties(hab, input) {
+    const message = input.serder, issuer = message.pre, issuee = message.sad.ri;
+    const xid = grantTransactionId(message);
+    return typeof xid === "string" && typeof issuee === "string" && issuer !== issuee
+        && [issuer, issuee].includes(hab.pre)
+        ? { issuer, issuee, xid }
+        : null;
+}
+/** Resolve the pending Grant `hab` may start DH for, or the reason it cannot. Reads only; creates no approval. */
+function freshScope(hab, exc, grant) {
+    const input = exc.retainedInput(grant, { pending: true });
+    if (!input)
+        return "DH requires an authenticated pending Grant";
+    const parties = grantParties(hab, input);
+    if (!parties)
+        return "Local habitat is not a DH party";
+    const context = exc.pendingGrant(grant, { ...parties, sender: parties.issuer, recipient: parties.issuee });
+    if (!context)
+        return "DH requires authenticated fresh registry scope";
+    return { input, ...parties, registries: [...context.registries] };
+}
+/**
+ * The scope of a completed exchange that can finish without new key exchange: the Grant is still pending
+ * inside its original deadline and `hab` holds a root for the registries it discloses. The scope is those
+ * registries; a registry that is still fresh must hold one. No fresh registry is required, because the
+ * issuer's update may already be accepted: {@link Dhke.finish} proves the held root against that update, so
+ * a root from any other exchange is rejected there. Pure read of stores. Null when nothing can resume.
+ */
+export function resumableExchange({ hab, exc }, grant) {
+    const input = exc.retainedInput(grant, { pending: true });
+    const parties = input && grantParties(hab, input);
+    if (!input || !parties)
+        return null;
+    const disclosed = (input.nests ?? []).map((nest) => nest.body.ked?.rd);
+    const held = [...new Set(disclosed)].filter((registry) => typeof registry === "string" && hab.mgr.hasRegistryRoot(hab.pre, registry));
+    const fresh = exc.pendingGrant(grant, { ...parties, sender: parties.issuer, recipient: parties.issuee });
+    if (!held.length || fresh?.registries.some((registry) => !held.includes(registry)))
+        return null;
+    return { input, ...parties, registries: held };
+}
+/**
+ * Whether `registry` has no committed state: its head is still the inception and no update is escrowed.
+ * A staged update waits in the missing-anchor or out-of-order escrow under its registry until the issuer's
+ * anchor is accepted, and an accepted one moves the head, so two keyed reads bounded by this registry
+ * decide it. Only then can a retained root be unused, because every derivation from a root, and every copy
+ * of it to another member (which `RegistryRoot` authorizes only for an accepted, issuer-anchored update),
+ * starts from a staged or accepted update. A remote update escrowed for this registry also counts, which
+ * is the conservative side.
+ */
+export function registryUncommitted(registryStore, registry) {
+    if (registryStore.headEvent(registry)?.ilk !== "rip")
+        return false;
+    for (const table of [registryStore.baser.maes, registryStore.baser.ooes]) {
+        for (const _ of table.getTopItemIter(registry))
+            return false;
+    }
+    return true;
+}
 /**
  * Issuer/issuee DH for an explicitly approved pending Grant. Wire
  * intake cannot approve work. Inject as ProtocolProcessor.qvy and register on
@@ -95,7 +161,7 @@ export function deriveRoot(privateKey, context) {
  */
 export class Dhke {
     /** Bind concrete local owners; construction grants no consent and writes nothing. */
-    constructor({ hab, exc, registryStore, rvy = hab.rvy, now = Date.now }) {
+    constructor({ hab, exc, registryStore, rvy = hab.rvy, now = Date.now, kram = true }) {
         Object.defineProperty(this, "resource", {
             enumerable: true,
             configurable: true,
@@ -108,6 +174,13 @@ export class Dhke {
             writable: true,
             value: new Deck()
         });
+        /** Completion cues for roots just retained by this group's custodian; feed `RootReplicator.replicate`. */
+        Object.defineProperty(this, "replicated", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Deck()
+        });
         Object.defineProperty(this, "pendingQueries", {
             enumerable: true,
             configurable: true,
@@ -156,6 +229,13 @@ export class Dhke {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, "kram", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.kram = kram;
         if (!(hab instanceof Hab) || hab.db !== exc.hby.db || rvy.db !== hab.db
             || exc.hby.habs.get(hab.pre) !== hab)
             throw new ValidationError("DH requires a local signing habitat");
@@ -169,8 +249,20 @@ export class Dhke {
             throw new ValidationError("DH requires a local signing member");
         }
     }
-    /** Select one live fresh issuance and freeze its exact bodies, parties and registry order. */
+    /**
+     * Select one live fresh issuance and freeze its exact bodies, parties and registry order.
+     *
+     * A registry that already holds a root refuses (`Registry root conflicts with this live DH operation`)
+     * unless it has no committed state ({@link registryUncommitted}): then the held root was never used and
+     * this exchange, whose Grant is from the registry's issuer, overwrites it when it retains its own root,
+     * never at approval, so an interruption before retention leaves the old root. Once any update is staged
+     * or accepted the refusal is unchanged. A KERIpy peer keeps the old rule and refuses such a second
+     * exchange: with a KERIpy holder the issuer needs a fresh registry. One process also refuses a second
+     * live operation on a registry, so two pending Grants cannot clobber each other's root.
+     */
     approve(grant, { coordinator, custodian } = {}) {
+        if (!this.kram)
+            throw new ValidationError("DH requires KRAM: enable it with the runtime's kram option");
         this.pruneQueries();
         this.hab.mgr.requireRegistryRootAccess();
         for (const op of this.operations.values()) {
@@ -184,27 +276,68 @@ export class Dhke {
                 return op.xid;
             }
         }
-        const input = this.exc.retainedInput(grant, { pending: true });
-        if (!input)
-            throw new ValidationError("DH requires an authenticated pending Grant");
-        const message = input.serder, issuer = message.pre, issuee = message.sad.ri;
-        const xid = message.ilk === "xip" ? message.said : message.sad.x;
-        if (typeof xid !== "string" || typeof issuee !== "string" || issuer === issuee
-            || ![issuer, issuee].includes(this.hab.pre))
-            throw new ValidationError("Local habitat is not a DH party");
+        const scope = freshScope(this.hab, this.exc, grant);
+        if (typeof scope === "string")
+            throw new ValidationError(scope);
+        const op = this.frozen(scope, grant, { coordinator, custodian }, false);
+        for (const other of this.operations.values()) {
+            if (!other.abandoned && other.registries.some((registry) => op.registries.includes(registry))) {
+                throw new ValidationError("Another live DH operation uses this registry");
+            }
+        }
+        for (const registry of op.registries) {
+            if (this.hab.mgr.hasRegistryRoot(this.hab.pre, registry) && registryUncommitted(this.registryStore, registry)) {
+                op.replaces.add(registry);
+            }
+        }
+        this.roots(op);
+        this.operations.set(op.xid, op);
+        this.replayQuery(op.xid);
+        return op.xid;
+    }
+    /**
+     * Resume a completed exchange after a process restart, without new key exchange: rebuild the operation as
+     * completed from the roots held for the Grant's registries ({@link resumableExchange}). It holds no
+     * ephemeral key, so it cannot start, answer or renew a query; it can only {@link complete} and
+     * {@link finish}, which signs nothing and verifies the issuer's update against the held root. Needs an
+     * unlocked Keeper; wire intake never calls it. Repeating it returns the same transaction.
+     *
+     * @throws ValidationError unless the Grant is pending and holds a root for each registry in its scope.
+     */
+    resume(grant, { coordinator, custodian } = {}) {
+        this.pruneQueries();
+        this.hab.mgr.requireRegistryRootAccess();
+        for (const op of this.operations.values()) {
+            if (op.grant !== grant)
+                continue;
+            if (!op.completed)
+                throw new ValidationError("DH is still exchanging keys for this Grant; nothing to resume");
+            this.pending(op);
+            return op.xid;
+        }
+        const scope = resumableExchange(this, grant);
+        if (!scope)
+            throw new ValidationError("No root is held for this pending Grant's registries");
+        const op = this.frozen(scope, grant, { coordinator, custodian }, true);
+        this.roots(op);
+        this.operations.set(op.xid, op);
+        this.pendingQueries.delete(op.xid);
+        this.dropHeld(op.xid);
+        return op.xid;
+    }
+    /** Freeze the exact pending Grant, parties and registry order into an operation; registers nothing. */
+    frozen(scope, grant, { coordinator, custodian }, completed) {
+        const { input, issuer, issuee, xid, registries } = scope;
         if (this.operations.has(xid))
             throw new ValidationError("Another Grant is selected for this transaction");
-        const context = this.exc.pendingGrant(grant, { xid, sender: issuer, recipient: issuee });
-        if (!context)
-            throw new ValidationError("DH requires authenticated fresh registry scope");
         const op = {
             xid,
             grant,
             issuer,
             issuee,
-            raw: message.raw.slice(),
+            raw: input.serder.raw.slice(),
             bodies: (input.nests ?? []).map((nest) => nest.body.raw.slice()),
-            registries: [...context.registries],
+            registries,
             privateKeys: new Map(),
             publicKeys: {},
             peer: null,
@@ -213,7 +346,8 @@ export class Dhke {
             proposal: null,
             contribution: null,
             custody: null,
-            completed: false,
+            replaces: new Set(),
+            completed,
             abandoned: false,
         };
         if (this.group) {
@@ -235,10 +369,17 @@ export class Dhke {
         else if (coordinator !== undefined || custodian !== undefined) {
             throw new ValidationError("Individual DH has no group coordinator");
         }
-        this.roots(op);
-        this.operations.set(xid, op);
-        this.replayQuery(xid);
-        return xid;
+        return op;
+    }
+    /**
+     * Whether this owner already holds a live operation for `grant`. Two operation tables over one runtime
+     * (the host's and a command's own) use it so only the first to reach a Grant drives it.
+     */
+    holds(grant) {
+        for (const op of this.operations.values())
+            if (op.grant === grant && !op.abandoned)
+                return true;
+        return false;
     }
     /** Return the stable issuer proposal until own threshold intake supplies the complete query. */
     start(grant) {
@@ -506,12 +647,34 @@ export class Dhke {
     /** Drop local ephemeral key references and permanently refuse this operation. */
     abandon(xid) {
         const retained = this.pendingQueries.delete(xid);
+        this.dropHeld(xid);
         if (retained && !this.operations.has(xid))
             return;
         const op = this.operation(xid);
         this.clearPrivate(op);
         op.abandoned = true;
     }
+    /**
+     * Whether this local habitat is the party of DH transaction `xid` with `sender`.
+     *
+     * Messages carry no recipient, so a per-identifier registry selects the owner by transaction:
+     * an approved operation here, a stored Grant from `sender` addressed to this habitat, or, for a
+     * group, its own members' contributions, which KRAM must pool before this owner consents.
+     */
+    inTransaction(sender, xid) {
+        return this.operations.has(xid) || (this.group && sender === this.hab.pre)
+            || Dhke.recipients(this.hab.db, sender, xid).includes(this.hab.pre);
+    }
+    /** Recipients of the pending Grants `sender` opened in DH transaction `xid`, from KRAM-accepted store rows. */
+    static recipients(db, sender, xid) {
+        const recipients = [];
+        for (const [key] of db.tmsc.getTopItemIter([sender, xid])) {
+            const recipient = db.epse.get([key[2]])?.sad?.ri;
+            if (typeof recipient === "string")
+                recipients.push(recipient);
+        }
+        return recipients;
+    }
     /** Release all process-local approvals and retry bytes; zero owned ephemeral scalar arrays. */
     close() {
         for (const op of this.operations.values())
@@ -519,6 +682,7 @@ export class Dhke {
         this.operations.clear();
         this.pendingQueries.clear();
         this.outgoing.clear();
+        this.replicated.clear();
     }
     /** Retain public query evidence against one exact pending Grant, without creating keys or consent. */
     retainQuery(envelope) {
@@ -540,11 +704,22 @@ export class Dhke {
         for (const [, key] of entries)
             decodePublicKey(key);
         const expires = this.retainUntil(envelope, grant);
-        const prior = this.pendingQueries.get(data.x);
-        if (prior && !bytesEqual(prior.envelope.serder.raw, query.raw))
-            throw new ValidationError("Conflicting DH query");
-        if (!prior) {
+        // After a restart the persisted copy is the prior one, so a successor is judged as it is before one.
+        const prior = this.pendingQueries.get(data.x) ?? this.loadHeld(data.x, grant.said);
+        if (prior && !bytesEqual(prior.envelope.serder.raw, query.raw)) {
+            // The issuer re-dates a query that aged before this side consented (`requery`): same sender, keys and
+            // Grant under a new date. It replaces the held one; any other difference is a conflict.
+            const held = this.parameters(prior.envelope.serder, "q");
+            const same = prior.envelope.serder.pre === query.pre && prior.grant === grant.said
+                && JSON.stringify(Object.entries(held.pk).sort()) === JSON.stringify(entries.sort());
+            if (!same)
+                throw new ValidationError("Conflicting DH query");
+        }
+        if (!prior || !bytesEqual(prior.envelope.serder.raw, query.raw)) {
             this.pendingQueries.set(data.x, { envelope: copyAuxiliaryQuery(envelope), expires, grant: grant.said });
+            // KRAM now holds this query as seen, so a resend of it is a replay: the held copy must outlive this process.
+            if (!envelope.nests.length)
+                this.hab.db.heldq.pin([data.x], auxiliaryQueryWire(envelope));
         }
     }
     /** Expired evidence cannot survive another owner interaction. */
@@ -557,11 +732,32 @@ export class Dhke {
     }
     /** Consume the first authenticated request only after explicit approval; never renew either clock. */
     replayQuery(xid) {
-        const pending = this.pendingQueries.get(xid);
+        const grant = this.operations.get(xid)?.grant;
+        const pending = this.pendingQueries.get(xid) ?? (grant ? this.loadHeld(xid, grant) : undefined);
         this.pendingQueries.delete(xid);
-        if (pending && pending.grant === this.operations.get(xid)?.grant
-            && BigInt(this.now()) * 1000n < pending.expires)
+        this.dropHeld(xid);
+        if (pending && pending.grant === grant && BigInt(this.now()) * 1000n < pending.expires) {
             this.processQuery(pending.envelope);
+        }
+    }
+    /** The persisted query for `xid` after a restart, with its lifetime recomputed from KRAM's durable records. */
+    loadHeld(xid, grant) {
+        const wire = this.hab.db.heldq.get([xid]);
+        const input = this.exc.retainedInput(grant, { pending: true });
+        if (!wire || !input)
+            return undefined;
+        try {
+            const envelope = restoreAuxiliaryQuery(wire);
+            return { envelope, expires: this.retainUntil(envelope, input.serder), grant };
+        }
+        catch (error) {
+            if (error instanceof ValidationError)
+                return undefined;
+            throw error;
+        }
+    }
+    dropHeld(xid) {
+        this.hab.db.heldq.rem([xid]);
     }
     /** Bound process-local public evidence by the original query and accepted Grant lifetimes. */
     retainUntil(envelope, grant) {
@@ -610,8 +806,12 @@ export class Dhke {
     }
     roots(op) {
         for (const registry of op.registries) {
-            if ((this.hab.mgr.getRegistryRoot(this.hab.pre, registry) !== null) !== op.completed) {
-                throw new ValidationError("Registry root conflicts with this live DH operation");
+            const held = this.hab.mgr.hasRegistryRoot(this.hab.pre, registry);
+            if (held !== op.completed && !(held && op.replaces.has(registry))) {
+                throw new ValidationError(held
+                    ? "Registry root conflicts with this live DH operation: a DH-issued registry must not have a custody root, "
+                        + "so do not call createCustody for it before issuance (use a registry without custody)"
+                    : "Registry root conflicts with this live DH operation");
             }
         }
     }
@@ -648,6 +848,9 @@ export class Dhke {
         return { op, peer };
     }
     generate(op) {
+        // A completed operation, including a resumed one, never holds or makes ephemeral keys again.
+        if (op.completed)
+            throw new ValidationError("DH operation has already completed");
         this.custody(op, true);
         if (op.privateKeys.size)
             return;
@@ -675,11 +878,20 @@ export class Dhke {
         ]));
     }
     retain(op, peer, roots) {
-        for (const [registry, root] of roots)
-            this.hab.mgr.putRegistryRoot(this.hab.pre, registry, root);
+        for (const [registry, root] of roots) {
+            const replacing = op.replaces.has(registry);
+            // Recheck at commit time, from stores: the held root must still be unused.
+            if (replacing && !registryUncommitted(this.registryStore, registry)) {
+                throw new ValidationError("Registry root conflicts with this live DH operation");
+            }
+            this.hab.mgr.putRegistryRoot(this.hab.pre, registry, root, replacing);
+        }
         op.peer = { ...peer };
         op.completed = true;
         this.clearPrivate(op);
+        // Every current member must hold every root; the custodian replicates.
+        if (this.group)
+            this.replicated.push({ gid: this.hab.pre, registries: [...roots.keys()] });
     }
     clearPrivate(op) {
         for (const key of op.privateKeys.values())

package/esm/keri/npm/src/acdc/observing.js

@@ -76,7 +76,7 @@ export class RegistryObserver {
         const baser = this.store.baser;
         if (baser.readonly)
             throw new DatabaseOperationError("Cannot write readonly registry storage.");
-        return baser.env.transactionSync(() => {
+        return baser.transaction(() => {
             this.store.putEvent(serder);
             this.store.escrowMissingAnchor(event.regid, Number(event.sn), event.said);
             if (opening)
@@ -106,7 +106,7 @@ export class RegistryObserver {
     }
     /** Stored inception is durable issuer identity, including while its anchor is still absent. */
     engine(regid) {
-        if (!this.store.baser.env)
+        if (!this.store.baser.opened)
             throw new DatabaseNotOpenError("Registry observer store is closed.");
         const rip = this.store.event(regid);
         if (!rip) {