keri-ts 2.0.1 → 2.2.0

package/esm/keri/npm/src/runtime/web/output-barrier.js

@@ -0,0 +1,47 @@
+/**
+ * Output barrier for browser compositions (ADR-0015 durability rule 6).
+ *
+ * A browser store acknowledges a commit before it is durable, so a response,
+ * receipt or query that depends on that commit must not leave the page until
+ * the composition's persistence queue has flushed. Otherwise a crash or tab
+ * close could leave a peer holding evidence of state this wallet then forgot.
+ */
+import { call } from "effection";
+import { AppError } from "../../core/errors.js";
+/** The persistence queue failed, so the request was not sent. The queue's failure is the cause. */
+export class OutputBarrierError extends AppError {
+}
+/**
+ * Wrap `inner` so no request, finite or streaming, reaches it before `flushed` resolves.
+ *
+ * `flushed` is evaluated per request, so each request waits for everything
+ * committed before it was made. Pass `() => opener.queue.flushed()` from the
+ * composition's `WebStoreOpener`: the queue is shared by every store family, so
+ * it covers all commits, which one store's `flushed()` would not.
+ *
+ * A rejected flush fails the call with `OutputBarrierError` and sends nothing.
+ * Cancelling the caller cancels only the wait.
+ *
+ * The wrapper has no `tcp` dialer: a dialer would be a network path around the
+ * barrier, and browsers have none.
+ */
+export function barrierHttpClient(inner, flushed) {
+    function* barrier() {
+        try {
+            yield* call(() => flushed());
+        }
+        catch (error) {
+            throw new OutputBarrierError("Persistence did not flush; the request was not sent", { cause: error });
+        }
+    }
+    return {
+        *request(url, init) {
+            yield* barrier();
+            return yield* inner.request(url, init);
+        },
+        *open(url, init) {
+            yield* barrier();
+            return yield* inner.open(url, init);
+        },
+    };
+}

package/esm/keri/npm/src/runtime/web/persistent-storage.js

@@ -0,0 +1,37 @@
+/**
+ * Persistent-storage request for browser wallets.
+ *
+ * Keys live only in IndexedDB, and Safari may evict script-writable storage
+ * that was not granted persistence, so a wallet should ask and surface a refusal.
+ */
+/**
+ * Ask the engine to make this origin's storage persistent, then report the outcome.
+ * Never throws: an absent API reports `supported: false`, and a failing or
+ * refusing one reports `persisted: false`. Call it from a user gesture where the
+ * engine requires one.
+ *
+ * @param storage Defaults to `navigator.storage`.
+ */
+export async function requestPersistentStorage(storage = globalThis.navigator?.storage) {
+    if (typeof storage?.persist !== "function")
+        return { persisted: false, supported: false };
+    let persisted = await attempt(() => storage.persisted?.(), false);
+    if (!persisted)
+        persisted = await attempt(() => storage.persist(), false);
+    const estimate = await attempt(() => storage.estimate?.(), undefined);
+    return {
+        persisted,
+        supported: true,
+        ...(typeof estimate?.quota === "number" ? { quota: estimate.quota } : {}),
+        ...(typeof estimate?.usage === "number" ? { usage: estimate.usage } : {}),
+    };
+}
+/** Run one engine call, treating a throw or an absent method as the fallback. */
+async function attempt(fn, fallback) {
+    try {
+        return (await fn()) ?? fallback;
+    }
+    catch {
+        return fallback;
+    }
+}

package/esm/keri/npm/src/runtime/web.js

@@ -0,0 +1,10 @@
+/**
+ * Browser host surface: the output barrier, single-writer store lock and
+ * persistence request that any browser composition needs.
+ *
+ * Mirrors `keri-ts/runtime/node` for the browser. Nothing here may reach
+ * `node:` modules, sockets or the `Deno` global.
+ */
+export { acquireStoreLock, StoreLockHeldError, storeLockKey, StoreLockUnsupportedError, } from "../db/store-lock.js";
+export { barrierHttpClient, OutputBarrierError } from "./web/output-barrier.js";
+export { requestPersistentStorage, } from "./web/persistent-storage.js";

package/esm/keri/npm/src/vdr/eventing.js

@@ -783,7 +783,7 @@ export class Tevery {
         let publicationFailure;
         let decision;
         try {
-            decision = this.reger.env.transactionSync(() => {
+            decision = this.reger.transaction(() => {
                 const serder = args.serder;
                 const ilk = telIlk(serder);
                 const pre = okPre(serder);

package/esm/keri/npm/src/vdr/tel-publication.js

@@ -60,7 +60,7 @@ export class TelPublication {
     }
     /** Move accepted anchors forward; empty witness/publication cohorts need no I/O. */
     advance() {
-        this.reger.env.transactionSync(() => {
+        this.reger.transaction(() => {
             for (const [keys, seal] of [...this.reger.tmse.getTopItemIter()]) {
                 const target = this.target(keys, seal);
                 if (!target || target.said !== keys[2])
@@ -90,7 +90,7 @@ export class TelPublication {
         if (!this.allReceipts(target))
             throw new ValidationError("TEL anchor is missing required witness receipts.");
         const seal = this.seal(target);
-        this.reger.env.transactionSync(() => {
+        this.reger.transaction(() => {
             this.reger.tede.add(this.keys(target), [seal[0], seal[1], new Saider({ qb64: target.anchorSaid })]);
             this.reger.tpwe.rem(this.keys(target), seal);
         });
@@ -108,7 +108,7 @@ export class TelPublication {
             throw new ValidationError("TEL publication dependencies changed before completion.");
         }
         const seal = this.seal(target);
-        this.reger.env.transactionSync(() => {
+        this.reger.transaction(() => {
             this.reger.ctel.pin(this.keys(target), new Saider({ qb64: target.anchorSaid }));
             this.reger.tede.rem(this.keys(target), [seal[0], seal[1], new Saider({ qb64: target.anchorSaid })]);
         });
@@ -117,6 +117,22 @@ export class TelPublication {
     complete(pre, sn = 0) {
         return this.reger.ctel.get([pre, ordinal(sn).qb64]) !== null;
     }
+    /**
+     * Durable progress of one TEL event, read without side effects: waiting for the
+     * issuer's accepted anchor (`tmse.`), for the anchoring event's witness receipts
+     * (`tpwe.`), for local publication (`tede.`), complete (`ctel.`), or untracked.
+     */
+    progress(pre, sn = 0) {
+        if (this.complete(pre, sn))
+            return "complete";
+        const coordinates = [pre, ordinal(sn).qb64];
+        if (this.reger.tede.get(coordinates).length > 0)
+            return "awaitingPublication";
+        if (this.reger.tpwe.get(coordinates).length > 0)
+            return "awaitingReceipts";
+        const waiting = [...this.reger.tmse.getTopItemIter()].some(([keys]) => keys[0] === pre && keys[1] === coordinates[1]);
+        return waiting ? "awaitingAnchor" : null;
+    }
     /** Reverify by unique roster index; multiple signatures from one witness never fill another's slot. */
     allReceipts(target) {
         const current = this.target(this.keys(target), this.seal(target));

package/esm/keri/npm/src/version.js

@@ -6,9 +6,9 @@
  * `src/version.ts` files by hand; edit this template instead.
  */
 /** Package semantic version copied from the owning package manifest. */
-export const PACKAGE_VERSION = "2.0.1";
+export const PACKAGE_VERSION = "2.2.0";
 /** Optional build metadata stamp injected by release/CI workflows. */
-export const BUILD_METADATA = "build.28.a12ad3cd8a7ed98328dc17124bfc8146c4a97b7e";
+export const BUILD_METADATA = "build.30.f1b0e618d5d1dd02f57fc0b4b3447acfe0535799";
 /** User-facing version string with build metadata appended when present. */
 export const DISPLAY_VERSION = BUILD_METADATA
     ? `${PACKAGE_VERSION}+${BUILD_METADATA}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keri-ts",
-  "version": "2.0.1",
+  "version": "2.2.0",
   "description": "KERI TypeScript protocol and runtime library",
   "homepage": "https://github.com/kentbull/keri-ts",
   "repository": {
@@ -17,6 +17,7 @@
   "types": "./types/npm/index.d.ts",
   "exports": {
     ".": {
+      "browser": "./esm/keri/npm/src/npm/index.browser.js",
       "import": "./esm/keri/npm/src/npm/index.js",
       "types": "./types/npm/index.d.ts"
     },
@@ -25,12 +26,32 @@
       "types": "./types/npm/cli.d.ts"
     },
     "./runtime": {
+      "browser": "./esm/keri/npm/src/npm/runtime.browser.js",
       "import": "./esm/keri/npm/src/npm/runtime.js",
       "types": "./types/npm/runtime.d.ts"
     },
+    "./runtime/node": {
+      "import": "./esm/keri/npm/src/npm/runtime-node.js",
+      "types": "./types/npm/runtime-node.d.ts"
+    },
+    "./runtime/web": {
+      "browser": "./esm/keri/npm/src/npm/runtime-web.browser.js",
+      "import": "./esm/keri/npm/src/npm/runtime-web.js",
+      "types": "./types/npm/runtime-web.d.ts"
+    },
     "./db": {
+      "browser": "./esm/keri/npm/src/npm/db.browser.js",
       "import": "./esm/keri/npm/src/npm/db.js",
       "types": "./types/npm/db.d.ts"
+    },
+    "./db/lmdb": {
+      "import": "./esm/keri/npm/src/npm/db-lmdb.js",
+      "types": "./types/npm/db-lmdb.d.ts"
+    },
+    "./db/indexeddb": {
+      "browser": "./esm/keri/npm/src/npm/db-indexeddb.browser.js",
+      "import": "./esm/keri/npm/src/npm/db-indexeddb.js",
+      "types": "./types/npm/db-indexeddb.d.ts"
     }
   },
   "scripts": {
@@ -55,12 +76,11 @@
     "@inquirer/password": "3.0.1",
     "@noble/hashes": "1.8.0",
     "ajv": "8.18.0",
-    "cesr-ts": ">=2.0.0 <2.1.0",
+    "cesr-ts": ">=2.2.0 <2.3.0",
     "effection": "^3.6.0",
     "lmdb": "3.5.3",
     "@msgpack/msgpack": "3.1.3",
-    "cbor-x": "1.6.0",
-    "libsodium-wrappers-sumo": "0.8.4"
+    "cbor-x": "1.6.0"
   },
   "_generatedBy": "dnt@dev"
 }

package/types/acdc/authoring.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Finite ACDC v2 registry authoring: stage, anchor and update protocol cores.
+ *
+ * Existing engines own acceptance and receipt authentication; this class only
+ * sequences them for one local individual issuer. It reads and writes no
+ * credential inventory: embedders that keep issued or held records wrap it
+ * (the wallet's `WalletAuthor` adds `issue` and `revoke`). Private derivation
+ * requires a `RegistryCustody`, whose coordinate store the embedder supplies.
+ */
+import { type SerderACDC } from "cesr-ts";
+import type { Operation } from "effection";
+import type { Receiptor, WitnessAuthMap } from "../app/witness/receipting.js";
+import type { RegistryCustody } from "./custody.js";
+import { type AcdcMapOptions } from "./messaging.js";
+import { type RegistryDisclosure } from "./regeventing.js";
+import type { Regery, Registry } from "./registraring.js";
+/** Public means deliberate opening publication; private derivation requires supplied custody. */
+export interface AcdcV2UpdateOptions {
+    public?: boolean;
+    stamp?: string;
+    boundEvent?: string;
+    /** Transient witness codes for this operation; never retained with registry evidence. */
+    auths?: WitnessAuthMap;
+}
+/** Borrow the actual registry environment and receipt collector; acquire no handles or workers. */
+export declare class RegistryAuthor {
+    readonly rgy: Regery;
+    readonly receiptor: Receiptor;
+    readonly custody?: RegistryCustody | undefined;
+    constructor(rgy: Regery, receiptor: Receiptor, custody?: RegistryCustody | undefined);
+    /** Resolve the actual local registry; staging supports groups while signing methods enforce their owner. */
+    registry(name: string, controller: string): Registry;
+    /** Signing belongs either to this individual owner or to explicit group approval, never a staging flag. */
+    protected individual(reg: Registry): void;
+    /** Idempotently stage an alias, then return only its exact accepted inception. */
+    incept(name: string, controller: string, auths?: WitnessAuthMap): Operation<SerderACDC>;
+    /** Construct the issuer's credential using the existing ACDC v2 finite builder. */
+    create(reg: Registry, options: Omit<AcdcMapOptions, "regid">): SerderACDC;
+    /** Stage one BUP state advance, preserving an exact pending retry and its opening. Never author historical upd. */
+    stage(reg: Registry, acdc: SerderACDC, state: string, options?: AcdcV2UpdateOptions): {
+        event: SerderACDC;
+        opening: RegistryDisclosure;
+    };
+    /** Share validation and exact pending-next reuse; only the concrete revocation ensure operation can reuse an accepted head. */
+    protected stageState(reg: Registry, acdc: SerderACDC, state: string, options: AcdcV2UpdateOptions, ensureRevoked?: boolean): {
+        event: SerderACDC;
+        opening: RegistryDisclosure;
+    };
+    /** Advance one explicit state through real anchoring; staging is never reported as accepted. */
+    update(reg: Registry, acdc: SerderACDC, state: string, options?: AcdcV2UpdateOptions): Operation<SerderACDC>;
+    /** Reuse the current branch's already signed seal even before receipts; no extra anchor merely to poll. */
+    anchor(reg: Registry, event: SerderACDC, auths?: WitnessAuthMap): Operation<void>;
+}
+//# sourceMappingURL=authoring.d.ts.map

package/types/acdc/authoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring.d.ts","sourceRoot":"","sources":["../../src/acdc/authoring.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAW,KAAK,cAAc,EAAY,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG1D,iGAAiG;AACjG,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED,mGAAmG;AACnG,qBAAa,cAAc;IAEvB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe;gBAFzB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,EACpB,OAAO,CAAC,EAAE,eAAe,YAAA;IAUpC,4GAA4G;IAC5G,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,QAAQ;IAQpD,2GAA2G;IAC3G,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAMzC,kFAAkF;IACjF,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC,UAAU,CAAC;IAYxF,mFAAmF;IACnF,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,UAAU;IAKzE,mHAAmH;IACnH,KAAK,CACH,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,mBAAwB,GAChC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,kBAAkB,CAAA;KAAE;IAIrD,+HAA+H;IAC/H,SAAS,CAAC,UAAU,CAClB,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mBAAmB,EAC5B,aAAa,UAAQ,GACpB;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,kBAAkB,CAAA;KAAE;IA2ErD,gGAAgG;IAC/F,MAAM,CACL,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,mBAAwB,GAChC,SAAS,CAAC,UAAU,CAAC;IAOxB,2GAA2G;IAC1G,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC;CA4BnF"}

package/types/acdc/chaining.d.ts

@@ -1,14 +1,34 @@
-/** Read-only ACDC chaining over caller-owned node verdicts; authentication and application state policy stay separate. */
+/**
+ * Read-only ACDC chaining over caller-owned node verdicts; authentication and application state policy stay separate.
+ *
+ * KERIpy correspondence: the graph walk and Edge evaluation of upstream PR 1757's
+ * `acdc.evaluating.EdgeEvaluator`. keri-ts keeps a functional seam: protocols
+ * (IPEX) own node authentication and frame admission, then call `walkAcdcGraph`
+ * and `evaluateChain` without this module knowing any disclosure protocol.
+ */
 import { type SerderACDC } from "cesr-ts";
 import type { Baser } from "../db/basing.js";
-/** Borrow a complete reachable DAG of verified credential views, with its origin first, without projecting frames. */
+/**
+ * How a walk treats an expanded Edge leaf whose far node is not disclosed.
+ *
+ * `closed` refuses the whole graph. `open` skips the leaf in the walk, and
+ * `evaluateChain` then reads it as a non-retryable unknown: disclosed nodes are
+ * fixed bytes, so nothing can supply the far node later. An OR group with a
+ * valid sibling still holds; an AND group or a sole Edge refuses without escrow.
+ */
+export type AcdcWalkPolicy = "open" | "closed";
+/** Every Grant-side caller defaults to `open`, matching KERIpy's Grant walk default. */
+export declare const DEFAULT_GRANT_WALK: AcdcWalkPolicy;
+/** Borrow a reachable DAG of verified credential views, with its origin first, without projecting frames. */
 export interface AcdcGraph {
     nodes: ReadonlyMap<string, {
         readonly body: SerderACDC;
     }>;
     order: readonly string[];
+    /** The policy the walk enforced; evaluation of undisclosed far nodes follows it. */
+    walk: AcdcWalkPolicy;
 }
-/** Reserved section/group labels include a pin at every level. */
+/** Reserved Edge-group labels include a pin at every level. The top-level Edge Section additionally forbids `w`. */
 export declare const acdcGroupLabels: ReadonlySet<string>;
 /** A truth verdict cannot absorb malformed input; callers represent that separately as null. */
 export type ChainVerdict = {
@@ -21,15 +41,45 @@ export type ChainVerdict = {
     reason: string;
     schemas: readonly string[];
 };
-/** Empty section containers carry no disclosed edge semantics; malformed nonempty values refuse. */
-export declare function acdcEdgeBlocks(value: unknown): Record<string, unknown>[] | null;
+/** One node's Edge Section: absent or empty, an opaque compact commitment, or one expanded top-level Edge-group. */
+export type AcdcEdgeSection = {
+    kind: "none";
+} | {
+    kind: "compact";
+    said: string;
+} | {
+    kind: "expanded";
+    section: Record<string, unknown>;
+};
+/**
+ * Classify a node's `e` field; null is malformed.
+ * Lists, falsy non-map values, non-SAID strings and a top-level `n` or `w` are
+ * malformed. A compact SAID is a valid opaque terminal that names no far nodes.
+ */
+export declare function acdcEdgeSection(sad: Readonly<Record<string, unknown>>): AcdcEdgeSection | null;
 /** Compact Edge strings name blocks, never far ACDCs. Expanded leaves have exact labels. */
 export declare function acdcEdgeTarget(value: unknown): string | null | false;
+/**
+ * Walk a disclosed graph of credential views from `origin` in BFS order.
+ *
+ * Every view must verify (including its carried section SAIDs) under its own
+ * SAID key, every Edge Section must be well shaped, every disclosed node must be
+ * reachable and the reachable graph must be acyclic. Closed walks also require
+ * every expanded leaf target to be disclosed; open walks skip undisclosed ones
+ * (see `AcdcWalkPolicy`).
+ * Compact Edge Sections and compact Edge members are opaque terminals.
+ * Protocol frame admission (ilks, nests, duplicates) belongs to the caller.
+ */
+export declare function walkAcdcGraph(origin: string, nodes: ReadonlyMap<string, {
+    readonly body: SerderACDC;
+}>, walk: AcdcWalkPolicy): string[] | null;
 /**
  * Validate every own schema, then conjoin each caller verdict with its complete edge expression.
  * Every branch is inspected for malformed shape, even when its truth value is unused.
+ * Under an open walk an undisclosed far node is a non-retryable unknown for its leaf.
  * Protocol callers supply issuer authentication; applications supply their state policy.
- * This helper reads schemas but writes no records and publishes no cues.
+ * The graph must come from `walkAcdcGraph` (directly or through a protocol walk).
+ * This helper reads schemas and KEL state but writes no records and publishes no cues.
  */
 export declare function evaluateChain(graph: AcdcGraph, verdicts: ReadonlyMap<string, ChainVerdict>, db: Baser): ChainVerdict | null;
 //# sourceMappingURL=chaining.d.ts.map

package/types/acdc/chaining.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chaining.d.ts","sourceRoot":"","sources":["../../src/acdc/chaining.ts"],"names":[],"mappings":"AAAA,0HAA0H;AAC1H,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAI7C,sHAAsH;AACtH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IAC1D,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,kEAAkE;AAClE,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAKvF,gGAAgG;AAChG,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAMxF,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAI/E;AAUD,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,KAAK,CAGpE;AAoBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAC3C,EAAE,EAAE,KAAK,GACR,YAAY,GAAG,IAAI,CA6HrB"}
+{"version":3,"file":"chaining.d.ts","sourceRoot":"","sources":["../../src/acdc/chaining.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAG7C;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,CAAC;AAC/C,wFAAwF;AACxF,eAAO,MAAM,kBAAkB,EAAE,cAAuB,CAAC;AAEzD,6GAA6G;AAC7G,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IAC1D,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,oFAAoF;IACpF,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,oHAAoH;AACpH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AASvF,gGAAgG;AAChG,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GACjB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAgBxF,oHAAoH;AACpH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,eAAe,GAAG,IAAI,CAU9F;AACD,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,KAAK,CAGpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,EACzD,IAAI,EAAE,cAAc,GACnB,MAAM,EAAE,GAAG,IAAI,CAwDjB;AAiED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAC3C,EAAE,EAAE,KAAK,GACR,YAAY,GAAG,IAAI,CA4GrB"}

package/types/acdc/custody.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Registry blind derivation over the Keeper's registry root.
+ *
+ * Issuing a blinded (BUP) registry update needs a deterministic opening. The
+ * root salt stays in the Keeper; this core derives openings from it and keeps
+ * only the public, event-specific coordinates in a `DerivedUpdateStore`. A
+ * runtime defaults to {@link BaserDerivedUpdateStore}; a wallet backs the port
+ * with its own table. The core opens no database of its own.
+ */
+import { type SerderACDC } from "cesr-ts";
+import type { Hab, Habery } from "../app/identity/habbing.js";
+import type { RegBaser } from "./regbasing.js";
+import { type RegistryDisclosure } from "./regeventing.js";
+import type { RegistryStore } from "./registering.js";
+/** Public event-specific inputs; neither a salt nor a derived opening is retained here. */
+export interface DerivedUpdate {
+    credential: string;
+    state: string;
+    bound: {
+        bn: string;
+        bd: string;
+    } | null;
+}
+/** Durable, non-secret derivation coordinates keyed by BUP SAID; `pin` overwrites. */
+export interface DerivedUpdateStore {
+    get(event: string): DerivedUpdate | null;
+    pin(event: string, value: DerivedUpdate): void;
+}
+/** Process-local store for a CLI or tests; a wallet backs the port with its own durable table. */
+export declare class MemoryDerivedUpdateStore implements DerivedUpdateStore {
+    private readonly rows;
+    get(event: string): DerivedUpdate | null;
+    pin(event: string, value: DerivedUpdate): void;
+}
+/**
+ * Derivation coordinates kept in a registry environment's own database (`RegBaser.dvus`). The default of a
+ * runtime that supplies no store, so a server agent keeps them durably beside the registry events they
+ * describe. A wallet with its own table still passes that instead.
+ */
+export declare class BaserDerivedUpdateStore implements DerivedUpdateStore {
+    private readonly baser;
+    constructor(baser: RegBaser);
+    get(event: string): DerivedUpdate | null;
+    pin(event: string, value: DerivedUpdate): void;
+}
+/** Owners a custody borrows; construction opens nothing. */
+export interface RegistryCustodyOptions {
+    hby: Habery;
+    hab: Hab;
+    registry: RegistryStore;
+    store: DerivedUpdateStore;
+}
+/** Explicit capability over a local habitat's Keeper root and accepted public registry evidence. */
+export declare class RegistryCustody {
+    readonly options: RegistryCustodyOptions;
+    /** Borrow owners only; construction loads no encrypted row. */
+    constructor(options: RegistryCustodyOptions);
+    /** Bind the actual local habitat and its key owners, never an AID label alone. */
+    private owner;
+    /** Load only this habitat's Keeper root; possession confers no protocol authority. */
+    private load;
+    /** Provision an issuer-selected root once, refusing replacement behind opaque accepted history. */
+    createCustody(registry: string): {
+        registry: string;
+    };
+    /** Derive a candidate only; consumers still authenticate its exact accepted event and bound KEL reference. */
+    derive(registry: string, ordinal: number | bigint, credential: string, state: string, options?: {
+        bound?: boolean;
+        bsn?: number | bigint;
+        bd?: string;
+    }): RegistryDisclosure;
+    /** Persist exact nonsecret coordinates before processing/anchoring a newly derived BUP. */
+    retainDerivedUpdate(event: SerderACDC, opening: RegistryDisclosure): DerivedUpdate;
+    /** Reproduce only the exact accepted event, never today's head or a later credential's coordinates. */
+    derivedOpening(event: SerderACDC): RegistryDisclosure;
+}
+//# sourceMappingURL=custody.d.ts.map

package/types/acdc/custody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custody.d.ts","sourceRoot":"","sources":["../../src/acdc/custody.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAA8D,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAG9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,KAAK,kBAAkB,EAAY,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1C;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;CAChD;AAED,kGAAkG;AAClG,qBAAa,wBAAyB,YAAW,kBAAkB;IACjE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoC;IACzD,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAGxC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;CAG/C;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,kBAAkB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,QAAQ;IAC5C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAIxC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;CAG/C;AAED,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED,oGAAoG;AACpG,qBAAa,eAAe;IAEd,QAAQ,CAAC,OAAO,EAAE,sBAAsB;IADpD,+DAA+D;gBAC1C,OAAO,EAAE,sBAAsB;IAIpD,kFAAkF;IAClF,OAAO,CAAC,KAAK;IAOb,sFAAsF;IACtF,OAAO,CAAC,IAAI;IAOZ,mGAAmG;IACnG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE;IAiCrD,8GAA8G;IAC9G,MAAM,CACJ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAO,GACpE,kBAAkB;IAarB,2FAA2F;IAC3F,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,kBAAkB,GAAG,aAAa;IAiBlF,uGAAuG;IACvG,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB;CAwBtD"}

package/types/acdc/dhking.d.ts

@@ -5,13 +5,14 @@
  */
 import { type Cigar, type Diger, Salter, type SerderKERI } from "cesr-ts";
 import type { Operation } from "effection";
-import type { ExchangeDecision, Exchanger } from "../app/exchanges/exchanging.js";
+import type { ExchangeDecision, ExchangeInput, Exchanger } from "../app/exchanges/exchanging.js";
 import { Hab } from "../app/identity/habbing.js";
 import { type GroupCoordinator } from "../app/multisig/group-members.js";
 import { type AuxiliaryQueryProcessor, type MessageDropDecision } from "../app/protocol/parsering.js";
 import { Deck } from "../core/deck.js";
 import type { KeriDispatchEnvelope, TransIdxSigGroup } from "../core/dispatch.js";
 import { type ReplyProcessDecision, type Revery } from "../core/routing.js";
+import type { Baser } from "../db/basing.js";
 import { type RegistryStore } from "./registering.js";
 /** Exact context bound by the Python HKDF profile. XID can differ from Grant SAID. */
 export interface DhkeContext {
@@ -33,6 +34,40 @@ export declare function generateKeyPair(): {
 };
 /** Derive one Salt128; malformed context, wrong local keys and low-order peers refuse. */
 export declare function deriveRoot(privateKey: Uint8Array, context: DhkeContext): Salter;
+/** The Grant `hab` takes part in, with its parties, transaction and registry scope. */
+interface GrantScope {
+    input: ExchangeInput;
+    issuer: string;
+    issuee: string;
+    xid: string;
+    registries: readonly string[];
+}
+/**
+ * The DH transaction id of a Grant: its own SAID when it opens the exchange (`xip`), and otherwise the exchange it
+ * continues (`x`). The one definition, so the owner and any workflow that names the transaction agree.
+ */
+export declare function grantTransactionId(grant: SerderKERI): string;
+/**
+ * The scope of a completed exchange that can finish without new key exchange: the Grant is still pending
+ * inside its original deadline and `hab` holds a root for the registries it discloses. The scope is those
+ * registries; a registry that is still fresh must hold one. No fresh registry is required, because the
+ * issuer's update may already be accepted: {@link Dhke.finish} proves the held root against that update, so
+ * a root from any other exchange is rejected there. Pure read of stores. Null when nothing can resume.
+ */
+export declare function resumableExchange({ hab, exc }: {
+    hab: Hab;
+    exc: Exchanger;
+}, grant: string): GrantScope | null;
+/**
+ * Whether `registry` has no committed state: its head is still the inception and no update is escrowed.
+ * A staged update waits in the missing-anchor or out-of-order escrow under its registry until the issuer's
+ * anchor is accepted, and an accepted one moves the head, so two keyed reads bounded by this registry
+ * decide it. Only then can a retained root be unused, because every derivation from a root, and every copy
+ * of it to another member (which `RegistryRoot` authorizes only for an accepted, issuer-anchored update),
+ * starts from a staged or accepted update. A remote update escrowed for this registry also counts, which
+ * is the conservative side.
+ */
+export declare function registryUncommitted(registryStore: RegistryStore, registry: string): boolean;
 /** Group consent names its own accepted coordinator and elected member; individuals omit both. */
 export interface DhkeApproval {
     coordinator?: GroupCoordinator;
@@ -44,6 +79,16 @@ export interface DhkeOutgoing {
     dest: string;
     msg: Uint8Array;
 }
+/**
+ * The group custodian just retained these registries' roots for `gid`; every other
+ * current member should receive a sealed copy (KERIpy's `replicate` cue). It carries
+ * coordinates only, never a root. It is a separate deck from `outgoing` because it is
+ * not wire: a drainer that sends every `outgoing` item would send it.
+ */
+export interface DhkeReplicate {
+    gid: string;
+    registries: string[];
+}
 /**
  * Issuer/issuee DH for an explicitly approved pending Grant. Wire
  * intake cannot approve work. Inject as ProtocolProcessor.qvy and register on
@@ -56,6 +101,8 @@ export declare class Dhke implements AuxiliaryQueryProcessor {
     static readonly Route = "/ipex/dhke";
     readonly resource = "/ipex/dhke";
     readonly outgoing: Deck<DhkeOutgoing>;
+    /** Completion cues for roots just retained by this group's custodian; feed `RootReplicator.replicate`. */
+    readonly replicated: Deck<DhkeReplicate>;
     private readonly pendingQueries;
     private readonly now;
     private readonly operations;
@@ -64,16 +111,46 @@ export declare class Dhke implements AuxiliaryQueryProcessor {
     readonly rvy: Revery;
     readonly registryStore: RegistryStore;
     readonly group: boolean;
+    private readonly kram;
     /** Bind concrete local owners; construction grants no consent and writes nothing. */
-    constructor({ hab, exc, registryStore, rvy, now }: {
+    constructor({ hab, exc, registryStore, rvy, now, kram }: {
         hab: Hab;
         exc: Exchanger;
         registryStore: RegistryStore;
         rvy?: Revery;
         now?: () => number;
+        /** False when the runtime has KRAM off: its `tmsc`/`msgc` rows never exist, so `approve` refuses. */
+        kram?: boolean;
     });
-    /** Select one live fresh issuance and freeze its exact bodies, parties and registry order. */
+    /**
+     * Select one live fresh issuance and freeze its exact bodies, parties and registry order.
+     *
+     * A registry that already holds a root refuses (`Registry root conflicts with this live DH operation`)
+     * unless it has no committed state ({@link registryUncommitted}): then the held root was never used and
+     * this exchange, whose Grant is from the registry's issuer, overwrites it when it retains its own root,
+     * never at approval, so an interruption before retention leaves the old root. Once any update is staged
+     * or accepted the refusal is unchanged. A KERIpy peer keeps the old rule and refuses such a second
+     * exchange: with a KERIpy holder the issuer needs a fresh registry. One process also refuses a second
+     * live operation on a registry, so two pending Grants cannot clobber each other's root.
+     */
     approve(grant: string, { coordinator, custodian }?: DhkeApproval): string;
+    /**
+     * Resume a completed exchange after a process restart, without new key exchange: rebuild the operation as
+     * completed from the roots held for the Grant's registries ({@link resumableExchange}). It holds no
+     * ephemeral key, so it cannot start, answer or renew a query; it can only {@link complete} and
+     * {@link finish}, which signs nothing and verifies the issuer's update against the held root. Needs an
+     * unlocked Keeper; wire intake never calls it. Repeating it returns the same transaction.
+     *
+     * @throws ValidationError unless the Grant is pending and holds a root for each registry in its scope.
+     */
+    resume(grant: string, { coordinator, custodian }?: DhkeApproval): string;
+    /** Freeze the exact pending Grant, parties and registry order into an operation; registers nothing. */
+    private frozen;
+    /**
+     * Whether this owner already holds a live operation for `grant`. Two operation tables over one runtime
+     * (the host's and a command's own) use it so only the first to reach a Grant drives it.
+     */
+    holds(grant: string): boolean;
     /** Return the stable issuer proposal until own threshold intake supplies the complete query. */
     start(grant: string): Uint8Array;
     /**
@@ -109,6 +186,16 @@ export declare class Dhke implements AuxiliaryQueryProcessor {
     finish(xid: string): Operation<ExchangeDecision>;
     /** Drop local ephemeral key references and permanently refuse this operation. */
     abandon(xid: string): void;
+    /**
+     * Whether this local habitat is the party of DH transaction `xid` with `sender`.
+     *
+     * Messages carry no recipient, so a per-identifier registry selects the owner by transaction:
+     * an approved operation here, a stored Grant from `sender` addressed to this habitat, or, for a
+     * group, its own members' contributions, which KRAM must pool before this owner consents.
+     */
+    inTransaction(sender: string, xid: string): boolean;
+    /** Recipients of the pending Grants `sender` opened in DH transaction `xid`, from KRAM-accepted store rows. */
+    static recipients(db: Baser, sender: string, xid: string): string[];
     /** Release all process-local approvals and retry bytes; zero owned ephemeral scalar arrays. */
     close(): void;
     /** Retain public query evidence against one exact pending Grant, without creating keys or consent. */
@@ -117,6 +204,9 @@ export declare class Dhke implements AuxiliaryQueryProcessor {
     private pruneQueries;
     /** Consume the first authenticated request only after explicit approval; never renew either clock. */
     private replayQuery;
+    /** The persisted query for `xid` after a restart, with its lifetime recomputed from KRAM's durable records. */
+    private loadHeld;
+    private dropHeld;
     /** Bound process-local public evidence by the original query and accepted Grant lifetimes. */
     private retainUntil;
     private operation;
@@ -133,4 +223,5 @@ export declare class Dhke implements AuxiliaryQueryProcessor {
     /** Recheck exact frozen election evidence and current membership without choosing a replacement. */
     private custody;
 }
+export {};
 //# sourceMappingURL=dhking.d.ts.map