keri-ts 2.0.1 → 2.2.0

package/esm/keri/npm/src/acdc/unblinding.js

@@ -1,13 +1,20 @@
 /**
- * Explicitly approved IPEX Unblind, following Python's local query/reply profile.
+ * IPEX Unblind, following Python's local query/reply profile.
  * Only event openings cross this boundary. Roots, application state vocabulary,
  * transport and final Admit remain with their existing owners.
+ *
+ * Consent: the disclosee explicitly approves (`approve`/`start`) the Grant it requests proofs for.
+ * The discloser has no separate approval step: it consented by signing the presentation Grant, so an
+ * authenticated query for a live Grant this identifier sent is answered automatically, bounded by that
+ * Grant's registry scope and original deadline. The rule is decided from stored state, so it survives a
+ * restart. KERIpy's `Unblind` keeps its own local approve gate; that is local policy and the wire is
+ * unchanged.
  */
 import { bytesEqual, concatBytes, Counter, Diger, Kinds, makeBlindUuid, NumberPrimitive, parseAttachmentGroup, parseBytes, SealSource, SerderACDC, unblindBlindState, Vrsn_2_0, } from "cesr-ts";
 import { Hab } from "../app/identity/habbing.js";
 import { IpexV2Handler } from "../app/ipex/ipex-v2.js";
 import { isLocalGroupHab, latestGroupContribution, localGroupMember } from "../app/multisig/group-members.js";
-import { copyAuxiliaryQuery, envelopeFromFrame, } from "../app/protocol/parsering.js";
+import { auxiliaryQueryWire, envelopeFromFrame, restoreAuxiliaryQuery, } from "../app/protocol/parsering.js";
 import { abortable } from "../app/runtime/abortable.js";
 import { Deck } from "../core/deck.js";
 import { TransIdxSigGroup } from "../core/dispatch.js";
@@ -18,9 +25,10 @@ import { query, reply } from "../core/protocol-eventing.js";
 import { messagize } from "../core/protocol-serialization.js";
 import { fetchStoredTsgs, unverifiedReplyDecision } from "../core/routing.js";
 import { prepareNests, publishNests } from "../db/exchange/exchange-nests.js";
-import { timestampMicros } from "../time/mod.js";
 import { validateUpdate, verifyRegistryAnchor, vet, vetBlind, vetBound, } from "./regeventing.js";
 import { publicOpeningAttachment } from "./registering.js";
+/** Ordinary registry states an Unblind operation may reveal unless its approval names others. */
+export const DEFAULT_UNBLIND_STATES = Object.freeze(["issued", "revoked", ""]);
 /** Compare registry selections without treating JSON dictionary order as authority. */
 function sameSelection(left, right) {
     return Object.keys(left).length === Object.keys(right).length
@@ -48,8 +56,8 @@ function ordinal(event) {
  * from the completed aggregate; neither contribution nor delivery requires a root.
  */
 export class Unblind {
-    /** Bind the exact Grant verifier's store and an explicit ordinary-state vocabulary. */
-    constructor({ hab, exc, registry, states, rvy = hab.rvy, now = Date.now }) {
+    /** Bind the exact Grant verifier's store; the state vocabulary is chosen per approved operation. */
+    constructor({ hab, exc, registry, rvy = hab.rvy, kram = true }) {
         Object.defineProperty(this, "resource", {
             enumerable: true,
             configurable: true,
@@ -62,23 +70,18 @@ export class Unblind {
             writable: true,
             value: new Deck()
         });
-        Object.defineProperty(this, "pendingQueries", {
+        Object.defineProperty(this, "operations", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: new Map()
         });
-        Object.defineProperty(this, "now", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "operations", {
+        /** Whether the persisted requests this identifier owes replies to were taken up by this owner. */
+        Object.defineProperty(this, "restored", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: new Map()
+            value: false
         });
         Object.defineProperty(this, "hab", {
             enumerable: true,
@@ -104,18 +107,19 @@ export class Unblind {
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "states", {
+        Object.defineProperty(this, "group", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "group", {
+        Object.defineProperty(this, "kram", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
+        this.kram = kram;
         if (!(hab instanceof Hab) || hab.db !== exc.hby.db || registry.db !== hab.db || rvy.db !== hab.db
             || exc.hby.habs.get(hab.pre) !== hab) {
             throw new ValidationError("Unblind requires a local signing habitat");
@@ -123,19 +127,24 @@ export class Unblind {
         this.group = isLocalGroupHab(exc.hby, hab);
         if (this.group)
             localGroupMember(exc.hby, hab.pre);
-        if (!Array.isArray(states) || states.some((state) => typeof state !== "string")) {
-            throw new ValidationError("Unblind requires an explicit sequence of state strings");
-        }
-        this.now = now;
         this.hab = hab;
         this.exc = exc;
         this.rvy = rvy;
         this.registry = registry;
-        this.states = [...states];
     }
-    /** Freeze one authenticated live Grant's exact bodies, parties and authorized registry scope. */
-    approve(grant) {
-        this.pruneQueries();
+    /**
+     * Freeze one authenticated live Grant's exact bodies, parties, authorized registry scope and
+     * ordinary-state vocabulary. `states` defaults to the registry-root triple and applies to this
+     * operation only; approving the same Grant again with different explicit states is refused,
+     * while omitting `states` on a repeat approval keeps the frozen vocabulary.
+     */
+    approve(grant, options = {}) {
+        if (!this.kram)
+            throw new ValidationError("Unblind requires KRAM: enable it with the runtime's kram option");
+        const states = options.states ?? DEFAULT_UNBLIND_STATES;
+        if (!Array.isArray(states) || states.some((state) => typeof state !== "string")) {
+            throw new ValidationError("Unblind requires an explicit sequence of state strings");
+        }
         const input = this.exc.retainedInput(grant);
         if (!input)
             throw new ValidationError("Unblind requires an authenticated retained Grant");
@@ -152,6 +161,10 @@ export class Unblind {
         if (existing) {
             if (existing.grant !== grant)
                 throw new ValidationError("Another Grant is selected for this transaction");
+            if (options.states
+                && (existing.states.length !== states.length || existing.states.some((state, i) => state !== states[i]))) {
+                throw new ValidationError("Unblind operation already approved with different states");
+            }
             this.live(existing);
             return xid;
         }
@@ -171,18 +184,18 @@ export class Unblind {
             requested: null,
             selected: null,
             openings: new Map(),
+            states: [...states],
             requestedByPeer: false,
             received: false,
             abandoned: false,
             proposal: null,
             contribution: null,
         });
-        this.replayQuery(xid);
         return xid;
     }
     /** Freeze a signed disclosee query over the missing accepted public suffix. */
-    start(grant) {
-        const op = this.operation(this.approve(grant));
+    start(grant, options = {}) {
+        const op = this.operation(this.approve(grant, options));
         if (this.hab.pre !== op.recipient)
             throw new ValidationError("Only the disclosee starts Unblind");
         if (!op.query && !op.contribution) {
@@ -312,7 +325,6 @@ export class Unblind {
     }
     /** Authenticate the full peer threshold before public evidence intake or proof release. */
     processQuery(envelope) {
-        this.pruneQueries();
         try {
             const { serder } = envelope;
             if (serder.ilk !== "qry" || serder.sad.rr !== Unblind.Route)
@@ -321,8 +333,10 @@ export class Unblind {
             const own = this.group && serder.pre === this.hab.pre;
             const xid = serder.sad?.q?.x;
             if (!own && typeof xid === "string" && !this.operations.has(xid)) {
-                this.retainQuery(envelope);
-                return { kind: "accept" };
+                // The discloser consented by signing the Grant: answer an authenticated query for a live one it sent.
+                if (!verifyQueryAttachments(this.hab.db, envelope))
+                    return { kind: "drop", reason: "missingAuthentication" };
+                this.approve(this.sentGrant(serder.pre, xid));
             }
             const { op, selected } = this.preflight(serder, "q", own ? "recipient" : "sender", own);
             if (own && (!op.proposal || !bytesEqual(op.proposal, serder.raw))) {
@@ -354,6 +368,9 @@ export class Unblind {
             this.live(op);
             op.requested = selected;
             op.requestedByPeer = true;
+            // KRAM now holds this query as seen, so a resend of it is a replay and a group cannot re-date it: the
+            // owed reply must outlive this owner. The accepted request is the durable record; the operation is a cache.
+            this.hab.db.heldu.pin([this.hab.pre, op.xid], auxiliaryQueryWire(envelope, this.publicEvents(envelope.nests)));
             if (!this.group)
                 this.respond(op.xid);
             return { kind: "accept" };
@@ -364,6 +381,30 @@ export class Unblind {
             throw error;
         }
     }
+    /**
+     * Take up the requests this identifier owes a reply to after its owner was lost: each persisted request is
+     * processed again as when first accepted, and one that no longer holds (the Grant ended, its evidence changed)
+     * is dropped. Done once per owner, before the first look at what is owed.
+     */
+    restoreHeld() {
+        if (this.restored)
+            return;
+        this.restored = true;
+        for (const [[, xid], wire] of [...this.hab.db.heldu.getTopItemIter([this.hab.pre])]) {
+            if (this.operations.has(xid))
+                continue;
+            let decision;
+            try {
+                decision = this.processQuery(restoreAuxiliaryQuery(wire));
+            }
+            catch (error) {
+                if (!(error instanceof ValidationError))
+                    throw error;
+            }
+            if (decision?.kind !== "accept")
+                this.hab.db.heldu.rem([this.hab.pre, xid]);
+        }
+    }
     /** Schedule responder work only after the selected live operation authenticates its peer query. */
     hasPeerQuery(xid) {
         const op = this.operation(xid);
@@ -537,7 +578,7 @@ export class Unblind {
         // Serialization may suspend; repeat all authority and snapshot checks inside
         // the single writer. This does not rewrite another Grant or any Admit.
         const wires = yield* abortable((signal) => prepareNests(nests, signal));
-        const result = db.env.transactionSync(() => {
+        const result = db.transaction(() => {
             this.live(op);
             this.current(op);
             const retained = db.enst.get([op.grant]);
@@ -553,16 +594,16 @@ export class Unblind {
                 db.exrs.pin([op.grant, node], record);
             return { kind: "accept", said: op.grant };
         });
-        yield* abortable(async () => {
-            await db.env.flushed;
-        });
+        yield* db.flushed();
         return result;
     }
     /** Discard approved work and unsent replies; delivered bytes remain caller-owned. */
     abandon(xid) {
-        const retained = this.pendingQueries.delete(xid);
-        if (retained && !this.operations.has(xid))
-            return;
+        this.forget(xid);
+        this.hab.db.heldu.rem([this.hab.pre, xid]);
+    }
+    /** Drop an operation's process-local approval, messages and openings; a persisted request stays. */
+    forget(xid) {
         const op = this.operation(xid);
         const keep = [...this.outgoing].filter(item => ![op.query, op.reply, op.contribution]
             .some(wire => wire && bytesEqual(item.msg, wire)));
@@ -610,75 +651,55 @@ export class Unblind {
             throw new ValidationError("Grant already carries the current openings");
         return { requested, children };
     }
+    /**
+     * Whether this local habitat is the party of Unblind transaction `xid` with `sender`.
+     *
+     * Messages carry no recipient, so a per-identifier registry selects the owner by transaction:
+     * an approved operation here, a stored Grant from this habitat addressed to `sender`, or, for a
+     * group, its own members' contributions, which KRAM must pool before this owner consents.
+     */
+    inTransaction(sender, xid) {
+        return this.operations.has(xid) || (this.group && sender === this.hab.pre)
+            || Unblind.recipients(this.hab.db, this.hab.pre, xid).includes(sender);
+    }
+    /** Recipients of the Grants `pre` sent in transaction `xid`, from KRAM-accepted store rows. */
+    static recipients(db, pre, xid) {
+        const recipients = [];
+        for (const [key] of db.tmsc.getTopItemIter([pre, xid])) {
+            const grant = db.exns.get([key[2]]) ?? db.epse.get([key[2]]);
+            if (grant?.pre === pre && typeof grant.sad?.ri === "string")
+                recipients.push(grant.sad.ri);
+        }
+        return recipients;
+    }
     /** Release all process-local approvals, opening references and retry bytes without changing stores. */
     close() {
         for (const xid of this.operations.keys())
-            this.abandon(xid);
+            this.forget(xid);
         this.operations.clear();
-        this.pendingQueries.clear();
         this.outgoing.clear();
     }
-    /** Hold one authenticated public suffix for explicit release consent; never import events here. */
-    retainQuery(envelope) {
-        const query = envelope.serder, data = this.parameters(query, "q");
-        if (!verifyQueryAttachments(this.hab.db, envelope))
-            throw new ValidationError("Unauthenticated Unblind query");
-        const candidates = [...this.hab.db.tmsc.getTopItemIter([this.hab.pre, data.x])]
+    /** The one live Grant this identifier sent to `recipient` in exchange `xid`, from KRAM-accepted store rows. */
+    sentGrant(recipient, xid) {
+        const said = [...this.hab.db.tmsc.getTopItemIter([this.hab.pre, xid])]
             .map(([key]) => this.hab.db.exns.get([key[2]]) ?? this.hab.db.epse.get([key[2]]))
-            .filter(grant => grant && grant.pre === this.hab.pre && grant.sad.ri === query.pre
-            && this.exc.presentationContext(grant.said, { xid: data.x, sender: this.hab.pre, recipient: query.pre }));
-        if (candidates.length !== 1)
-            throw new ValidationError("Unblind query has no unique authenticated Grant");
-        const grant = candidates[0];
-        const context = this.exc.presentationContext(grant.said, {
-            xid: data.x,
-            sender: this.hab.pre,
-            recipient: query.pre,
-        });
-        const selected = this.selection(data.re, context.registries, "q");
-        this.validateEvents(selected, envelope.nests);
-        const expires = this.retainUntil(envelope, grant);
-        const prior = this.pendingQueries.get(data.x);
-        if (prior && !bytesEqual(prior.envelope.serder.raw, query.raw)) {
-            throw new ValidationError("Conflicting Unblind query");
-        }
-        if (!prior) {
-            this.pendingQueries.set(data.x, { envelope: copyAuxiliaryQuery(envelope), expires, grant: grant.said });
-        }
-    }
-    /** Expired evidence cannot survive another owner interaction. */
-    pruneQueries() {
-        const now = BigInt(this.now()) * 1000n;
-        for (const [xid, query] of this.pendingQueries)
-            if (now >= query.expires)
-                this.pendingQueries.delete(xid);
-        return now;
+            .filter((grant) => grant && grant.pre === this.hab.pre && grant.sad.ri === recipient
+            && this.exc.presentationContext(grant.said, { xid, sender: this.hab.pre, recipient }));
+        if (said.length !== 1)
+            throw new ValidationError("Unblind query has no unique live Grant sent by this identifier");
+        return said[0].said;
     }
-    /** Consume the first authenticated request only after explicit approval; never renew either clock. */
-    replayQuery(xid) {
-        const pending = this.pendingQueries.get(xid);
-        this.pendingQueries.delete(xid);
-        if (pending && pending.grant === this.operations.get(xid)?.grant
-            && BigInt(this.now()) * 1000n < pending.expires)
-            this.processQuery(pending.envelope);
-    }
-    /** Bound process-local public evidence by the original query and accepted Grant lifetimes. */
-    retainUntil(envelope, grant) {
-        const now = this.pruneQueries();
-        const cache = this.hab.db.msgc.get([envelope.serder.pre, envelope.serder.said]);
-        const messageTime = cache && timestampMicros(cache.mdt);
-        const grantTime = timestampMicros(this.exc.exchangeDeadline(grant) ?? undefined);
-        if (!cache || this.hab.db.pmkm.get([envelope.serder.pre, envelope.serder.said]) || messageTime === null
-            || messageTime === undefined || grantTime === null
-            || !Number.isSafeInteger(cache.d) || !Number.isSafeInteger(cache.ml)
-            || cache.d < 0 || cache.ml < 0 || !Number.isSafeInteger(cache.d + cache.ml)) {
-            throw new ValidationError("Query has no accepted original lifetime");
-        }
-        const queryTime = messageTime + BigInt(cache.d + cache.ml) * 1000n;
-        const expires = queryTime < grantTime ? queryTime : grantTime;
-        if (now >= expires)
-            throw new ValidationError("Query or Grant has expired");
-        return expires;
+    /**
+     * Individual discloser operations whose authenticated peer query is waiting for a delivered reply.
+     * Hosts adopt these to deliver the reply; a group discloser's replies need member contributions instead.
+     */
+    awaitingReply() {
+        this.restoreHeld();
+        if (this.group)
+            return [];
+        return [...this.operations.values()]
+            .filter((op) => op.sender === this.hab.pre && op.requestedByPeer && !op.abandoned)
+            .map(({ xid, grant }) => ({ xid, grant }));
     }
     operation(xid) {
         const op = this.operations.get(xid);
@@ -967,7 +988,7 @@ export class Unblind {
                         said: String(event.sad.b),
                         uuid: makeBlindUuid({ salt: root.qb64, sn: BigInt(ordinal(event)) }),
                         acdc: target,
-                        states: this.states,
+                        states: op.states,
                     });
                     if (opening)
                         break;

package/esm/keri/npm/src/app/bootstrap/authenticating.js

@@ -1,6 +1,7 @@
 import { call, scoped } from "effection";
 import { persistResolvedContact } from "../identity/organizing.js";
-import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { doEvery, PROTOCOL_PACING } from "../runtime/doing.js";
+import { systemClock } from "../runtime/runtime-clock.js";
 import { isWellKnownOobiUrl, parseOobiUrl } from "./oobiery.js";
 /**
  * Return true when a well-known URL has been authorized into `wkas.`.
@@ -68,11 +69,8 @@ export class Authenticator {
         yield* call(() => this.processPendingAuth(url, record));
     }
     /** Continuous auth doer for long-lived runtime hosts. */
-    *authDo() {
-        while (true) {
-            yield* this.processOnce();
-            yield* runtimeTurn();
-        }
+    *authDo(clock = systemClock, pacing = PROTOCOL_PACING) {
+        return yield* doEvery(clock, pacing.tockMs, () => this.processOnce());
     }
     /** Promote one eligible `woobi.` record into the fetchable `mfa.` queue. */
     promoteQueuedWellKnown() {

package/esm/keri/npm/src/app/bootstrap/oobi-resolving.js

@@ -0,0 +1,41 @@
+import { observeUntil } from "../runtime/workflow-contract.js";
+import { oobiTerminalState } from "./oobiery.js";
+/** Default wall-clock budget for one blocking resolution. */
+export const OOBI_RESOLVE_TIMEOUT_MS = 30_000;
+/**
+ * Queue one URL with the durable Oobiery. Returns after the job is queued.
+ *
+ * @param url Exact OOBI or well-known URL; it is also the key of the status record.
+ */
+export function beginOobi(deps, url, options = {}) {
+    deps.oobiery.resolve(url, options.alias);
+    deps.changes?.push({ kind: "oobi", id: url });
+}
+/** Read the durable status of one requested URL. Pure: no worker, no I/O beyond the Baser. */
+export function oobiStatus(deps, url) {
+    const terminal = oobiTerminalState(deps.db, url);
+    if (terminal.status === "pending" || !terminal.record)
+        return { state: "pending" };
+    if (terminal.status === "resolved")
+        return { state: "resolved", record: terminal.record };
+    return { state: "failed", reason: terminal.record.state ?? "failed", record: terminal.record };
+}
+/**
+ * Observe a queued URL until it is terminal (and `deps.settled`, when given) or
+ * the budget expires. Starts no worker.
+ *
+ * @returns `settled` with a `resolved` or `failed` status (reason recorded), or `timed-out`.
+ */
+export function* waitForOobi(deps, url, { timeoutMs = OOBI_RESOLVE_TIMEOUT_MS } = {}) {
+    const done = yield* observeUntil(() => oobiStatus(deps, url).state !== "pending" && (deps.settled?.() ?? true), { timeoutMs });
+    const status = oobiStatus(deps, url);
+    if (!done || status.state === "pending")
+        return { outcome: "timed-out", status, timeoutMs };
+    deps.changes?.push({ kind: "oobi", id: url });
+    return { outcome: "settled", status };
+}
+/** `beginOobi` then `waitForOobi`. The host must be running the Oobiery for the wait to end in a terminal state. */
+export function* resolveOobi(deps, url, options = {}) {
+    beginOobi(deps, url, options);
+    return yield* waitForOobi(deps, url, options);
+}

package/esm/keri/npm/src/app/bootstrap/oobiery.js

@@ -8,7 +8,8 @@ import { acceptReplyDecision, unverifiedReplyDecision } from "../../core/routing
 import { Schemer } from "../../core/scheming.js";
 import { persistResolvedContact } from "../identity/organizing.js";
 import { abortable } from "../runtime/abortable.js";
-import { runtimeTurn } from "../runtime/runtime-turn.js";
+import { doEvery, PROTOCOL_PACING } from "../runtime/doing.js";
+import { systemClock } from "../runtime/runtime-clock.js";
 import { collectBytes } from "../transport/byte-source.js";
 import { processMessages } from "../transport/message-source.js";
 export const OOBI_REQUEST_ROUTE = "/oobis";
@@ -205,11 +206,8 @@ export class Oobiery {
      * This mirrors the KERIpy model where OOBI resolution is its own long-running
      * doer rather than root-owned queue plumbing.
      */
-    *oobiDo() {
-        while (true) {
-            yield* this.processOnce();
-            yield* runtimeTurn();
-        }
+    *oobiDo(clock = systemClock, pacing = PROTOCOL_PACING) {
+        return yield* doEvery(clock, pacing.tockMs, () => this.processOnce());
     }
     /** Select queued work, including a surviving in-flight row whose former process is gone. */
     nextQueued() {
@@ -266,7 +264,7 @@ export class Oobiery {
         };
         // A new or resumed attempt supersedes old terminal facts, but keeps its
         // queued row until intake succeeds. Cancellation can therefore retry it.
-        this.hby.db.env.transactionSync(() => {
+        this.hby.db.transaction(() => {
             this.pinQueueStore(kind, url, queuedRecord);
             this.hby.db.eoobi.rem(url);
             this.hby.db.roobi.rem(url);

package/esm/keri/npm/src/app/credentials/credential-revoking.js

@@ -47,6 +47,7 @@ export function* revokeCredential(rgy, input, postman, options) {
         rgy.publication.track(event, anchor.serder);
         group = {
             route: MULTISIG_REV_ROUTE,
+            event: { pre: anchor.serder.pre, sn: anchor.serder.sn, said: anchor.serder.said },
             ...(yield* publishGroupVcProposal(hby, input, postman, registry.hab, {
                 route: MULTISIG_REV_ROUTE,
                 attrs: { gid: registry.hab.pre, said: options.credentialSaid },

package/esm/keri/npm/src/app/credentials/credential-workflows.js

@@ -193,6 +193,7 @@ function* proposeGroupRegistryIncept(rgy, input, postman, hab, options) {
         issuer: hab.pre,
         group: {
             route: MULTISIG_VCP_ROUTE,
+            event: { pre: anchor.serder.pre, sn: anchor.serder.sn, said: anchor.serder.said },
             status: decision.kind,
             accepted: telAccepted(reger, regk, 0, requireSerderSaid(vcp, "registry inception")),
             ...publication,
@@ -257,6 +258,7 @@ function* proposeGroupCredentialIssue(rgy, input, postman, registry, creder, rec
         status: verifierDecision.kind,
         group: {
             route: MULTISIG_ISS_ROUTE,
+            event: { pre: anchor.serder.pre, sn: anchor.serder.sn, said: anchor.serder.said },
             telStatus: telDecision.kind,
             saved: credentialSaved(reger, creder),
             ...publication,

package/esm/keri/npm/src/app/credentials/registry-settling.js

@@ -0,0 +1,44 @@
+import { systemClock } from "../runtime/runtime-clock.js";
+import { observeUntil } from "../runtime/workflow-contract.js";
+/** Elapsed milliseconds between reads of a registry wait. */
+export const REGISTRY_WAIT_POLL_MS = 50;
+/** Reference for a TEL event sealed by a known anchor. */
+export function registryEventRef(tel, anchor) {
+    return {
+        regid: tel.ilk === "rip" ? tel.said : tel.regid,
+        sn: Number(BigInt(`0x${tel.sad.n}`)),
+        said: tel.said,
+        anchor,
+    };
+}
+/** Read the status of one registry event; mutates nothing. */
+export function registryEventStatus(deps, ref) {
+    if (deps.store.seqEvent(ref.regid, ref.sn)?.said === ref.said)
+        return { state: "accepted" };
+    const { pre, said } = ref.anchor;
+    const anchor = deps.db.getEvtSerder(pre, said);
+    if (!anchor || deps.db.kels.getLast(pre, anchor.sn) !== said)
+        return { state: "awaiting-anchor" };
+    return deps.db.fullyWitnessed(anchor) ? { state: "awaiting-tel" } : { state: "awaiting-receipts" };
+}
+/**
+ * Local settle step: reprocess the escrows once. That accepts the anchor when
+ * the last member signature has arrived and, once the anchor is complete, the
+ * sealed TEL event. Does nothing for an event already accepted.
+ */
+export function* settleRegistryEvent(deps, ref) {
+    if (registryEventStatus(deps, ref).state === "accepted")
+        return { state: "accepted" };
+    yield* deps.protocol.processEscrowsOnce();
+    return registryEventStatus(deps, ref);
+}
+/** Observe the event until `accepted` or the deadline passes. Starts no worker; the host settles. */
+export function* waitForRegistryEvent(deps, ref, { deadline, clock = systemClock }) {
+    const done = yield* observeUntil(() => registryEventStatus(deps, ref).state === "accepted", {
+        timeoutMs: Math.max(0, deadline - clock.now()),
+        clock,
+        pollMs: REGISTRY_WAIT_POLL_MS,
+    });
+    const status = registryEventStatus(deps, ref);
+    return done ? { outcome: "settled", status } : { outcome: "timed-out", status, deadline };
+}