keri-ts 2.2.0 → 2.2.2

package/esm/keri/npm/src/_dnt.polyfills.js

@@ -1,130 +1,3 @@
-/**
- * Based on [import-meta-ponyfill](https://github.com/gaubee/import-meta-ponyfill),
- * but instead of using npm to install additional dependencies,
- * this approach manually consolidates cjs/mjs/d.ts into a single file.
- *
- * Note that this code might be imported multiple times
- * (for example, both dnt.test.polyfills.ts and dnt.polyfills.ts contain this code;
- *  or Node.js might dynamically clear the cache and then force a require).
- * Therefore, it's important to avoid redundant writes to global objects.
- * Additionally, consider that commonjs is used alongside esm,
- * so the two ponyfill functions are stored independently in two separate global objects.
- */
-//@ts-ignore
-import { createRequire } from "node:module";
-//@ts-ignore
-import { fileURLToPath, pathToFileURL } from "node:url";
-//@ts-ignore
-import { dirname } from "node:path";
-const defineGlobalPonyfill = (symbolFor, fn) => {
-    if (!Reflect.has(globalThis, Symbol.for(symbolFor))) {
-        Object.defineProperty(globalThis, Symbol.for(symbolFor), {
-            configurable: true,
-            get() {
-                return fn;
-            },
-        });
-    }
-};
-export let import_meta_ponyfill_commonjs = (Reflect.get(globalThis, Symbol.for("import-meta-ponyfill-commonjs")) ??
-    (() => {
-        const moduleImportMetaWM = new WeakMap();
-        return (require, module) => {
-            let importMetaCache = moduleImportMetaWM.get(module);
-            if (importMetaCache == null) {
-                const importMeta = Object.assign(Object.create(null), {
-                    url: pathToFileURL(module.filename).href,
-                    main: require.main == module,
-                    resolve: (specifier, parentURL = importMeta.url) => {
-                        return pathToFileURL((importMeta.url === parentURL
-                            ? require
-                            : createRequire(parentURL))
-                            .resolve(specifier)).href;
-                    },
-                    filename: module.filename,
-                    dirname: module.path,
-                });
-                moduleImportMetaWM.set(module, importMeta);
-                importMetaCache = importMeta;
-            }
-            return importMetaCache;
-        };
-    })());
-defineGlobalPonyfill("import-meta-ponyfill-commonjs", import_meta_ponyfill_commonjs);
-export let import_meta_ponyfill_esmodule = (Reflect.get(globalThis, Symbol.for("import-meta-ponyfill-esmodule")) ??
-    ((importMeta) => {
-        const resolveFunStr = String(importMeta.resolve);
-        const shimWs = new WeakSet();
-        //@ts-ignore
-        const mainUrl = ("file:///" + process.argv[1].replace(/\\/g, "/"))
-            .replace(/\/{3,}/, "///");
-        const commonShim = (importMeta) => {
-            if (typeof importMeta.main !== "boolean") {
-                importMeta.main = importMeta.url === mainUrl;
-            }
-            if (typeof importMeta.filename !== "string") {
-                importMeta.filename = fileURLToPath(importMeta.url);
-                importMeta.dirname = dirname(importMeta.filename);
-            }
-        };
-        if (
-        // v16.2.0+, v14.18.0+: Add support for WHATWG URL object to parentURL parameter.
-        resolveFunStr === "undefined" ||
-            // v20.0.0+, v18.19.0+"" This API now returns a string synchronously instead of a Promise.
-            resolveFunStr.startsWith("async")
-        // enable by --experimental-import-meta-resolve flag
-        ) {
-            import_meta_ponyfill_esmodule = (importMeta) => {
-                if (!shimWs.has(importMeta)) {
-                    shimWs.add(importMeta);
-                    const importMetaUrlRequire = {
-                        url: importMeta.url,
-                        require: createRequire(importMeta.url),
-                    };
-                    importMeta.resolve = function resolve(specifier, parentURL = importMeta.url) {
-                        return pathToFileURL((importMetaUrlRequire.url === parentURL
-                            ? importMetaUrlRequire.require
-                            : createRequire(parentURL)).resolve(specifier)).href;
-                    };
-                    commonShim(importMeta);
-                }
-                return importMeta;
-            };
-        }
-        else {
-            /// native support
-            import_meta_ponyfill_esmodule = (importMeta) => {
-                if (!shimWs.has(importMeta)) {
-                    shimWs.add(importMeta);
-                    commonShim(importMeta);
-                }
-                return importMeta;
-            };
-        }
-        return import_meta_ponyfill_esmodule(importMeta);
-    }));
-defineGlobalPonyfill("import-meta-ponyfill-esmodule", import_meta_ponyfill_esmodule);
-export let import_meta_ponyfill = ((...args) => {
-    const _MODULE = (() => {
-        if (typeof require === "function" && typeof module === "object") {
-            return "commonjs";
-        }
-        else {
-            // eval("typeof import.meta");
-            return "esmodule";
-        }
-    })();
-    if (_MODULE === "commonjs") {
-        //@ts-ignore
-        import_meta_ponyfill = (r, m) => import_meta_ponyfill_commonjs(r, m);
-    }
-    else {
-        //@ts-ignore
-        import_meta_ponyfill = (im) => import_meta_ponyfill_esmodule(im);
-    }
-    //@ts-ignore
-    return import_meta_ponyfill(...args);
-});
 function findLastIndex(self, callbackfn, that) {
     const boundFunc = that === undefined ? callbackfn : callbackfn.bind(that);
     let index = self.length - 1;
@@ -175,3 +48,4 @@ if (!Object.hasOwn) {
         writable: true,
     });
 }
+export {};

package/esm/keri/npm/src/acdc/custody.js

@@ -135,6 +135,29 @@ export class RegistryCustody {
         this.options.store.pin(event.said, value);
         return value;
     }
+    /**
+     * The opening of the accepted update that issued `credential`, for a holder of the registry root that did not
+     * author the update and so retained no coordinates (a group member that consented to it). The opening is derived
+     * from the credential and the `issued` state and must open the update's own commitment; it is then retained like
+     * an authored one. Only an unbound issuance update is derived here.
+     */
+    issuedOpening(event, credential) {
+        if (this.options.store.get(event.said))
+            return this.derivedOpening(event);
+        if (event.ilk !== "bup" || !event.verify())
+            throw new ValidationError("Exact accepted blinded update is required");
+        const ordinal = Number(BigInt(`0x${event.sad.n}`));
+        const stored = event.regid ? this.options.registry.seqEvent(event.regid, ordinal) : null;
+        if (!Number.isSafeInteger(ordinal) || !stored || !bytesEqual(stored.raw, event.raw)) {
+            throw new ValidationError("Exact accepted registry event is required");
+        }
+        const opening = this.derive(event.regid, ordinal, credential, "issued");
+        if (!vetBlind(opening, event.sad.b)) {
+            throw new ValidationError("The accepted update is not this credential's issuance");
+        }
+        this.retainDerivedUpdate(event, opening);
+        return opening;
+    }
     /** Reproduce only the exact accepted event, never today's head or a later credential's coordinates. */
     derivedOpening(event) {
         if (event.ilk !== "bup" || !event.verify())

package/esm/keri/npm/src/acdc/dhking.js

@@ -639,6 +639,9 @@ export class Dhke {
         }
         if (found.size !== op.registries.length)
             throw new ValidationError("Approved registry scope is absent");
+        // The Grant is already accepted when the other party of this Habery finished first: nothing is left to accept.
+        if (this.exc.complete(op.grant))
+            return { kind: "accept", said: op.grant };
         for (const { nest, opening } of openings) {
             nest.attachments.push(parseAttachmentGroup(publicOpeningAttachment(opening), Vrsn_2_0, "txt").group);
         }
@@ -786,7 +789,9 @@ export class Dhke {
     pending(op) {
         this.hab.mgr.requireRegistryRootAccess();
         this.custody(op);
-        const input = this.exc.retainedInput(op.grant, { pending: true });
+        // A Habery that holds both parties may have accepted the Grant through the other party's exchange already.
+        const input = this.exc.retainedInput(op.grant, { pending: true })
+            ?? (this.exc.complete(op.grant) ? this.exc.retainedInput(op.grant) : undefined);
         if (op.abandoned || !input || !bytesEqual(input.serder.raw, op.raw)) {
             throw new ValidationError("DH operation is unavailable, terminated or expired");
         }

package/esm/keri/npm/src/acdc/salting.js

@@ -31,9 +31,27 @@ import { makeNowIso8601 } from "../time/mod.js";
 import { validateRip, validateUpdate, verifyRegistryAnchor, vetBlind } from "./regeventing.js";
 /** A stored registry-root copy that can never be retained as received. */
 export class RootRefused extends ValidationError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "RootRefused"
+        });
+    }
 }
 /** A stored registry-root copy whose root cannot yet be verified locally. */
 export class RootUnverified extends ValidationError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "RootUnverified"
+        });
+    }
 }
 /** A registry-root copy whose authorization needs KEL, TEL or group state not yet local. */
 export class RootDeferred extends RootUnverified {

package/esm/keri/npm/src/acdc/scheming.js

@@ -1,7 +1,7 @@
 /** Authenticated local ACDC schema validation and static resource lookups; no network resolution. */
 import { Diger, dumps, ParserError } from "cesr-ts";
-import Ajv2020 from "ajv/dist/2020.js";
 import { ValidationError } from "../core/errors.js";
+import { checkSchemaDocument, prepareSchemas } from "../core/json-schema.js";
 import { Schemer } from "../core/scheming.js";
 /** Local issuance caller must supply this dependency before a disclosure can be derived. */
 export class MissingSchemaError extends ValidationError {
@@ -13,15 +13,29 @@ export class MissingSchemaError extends ValidationError {
             writable: true,
             value: schema
         });
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "MissingSchemaError"
+        });
     }
 }
 /** Invalid schema or credential content cannot be staged as an issuance commitment. */
 export class FailedSchemaValidationError extends ValidationError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "FailedSchemaValidationError"
+        });
+    }
 }
 /** Only explicit input/profile refusals are caught; arbitrary failures are not recategorized. */
 class InvalidSchema extends Error {
 }
-const ValidatorCtor = Ajv2020;
 const dialect = "https://json-schema.org/draft/2020-12/schema";
 const dynamic = ["$dynamicAnchor", "$dynamicRef", "$recursiveAnchor", "$recursiveRef"];
 const singles = [
@@ -300,7 +314,7 @@ export function schemaCompilationCount() {
     return compilations;
 }
 function isCompiled(value) {
-    return "validate" in value;
+    return "prepared" in value;
 }
 /** Compile an admitted closure once; regular-expression and duplicate-id refusals are normal invalid outcomes. */
 function compileClosure(resources, root) {
@@ -334,31 +348,31 @@ function compileClosure(resources, root) {
             delete result[key];
         return result;
     };
-    const validator = new ValidatorCtor({ strict: false, validateFormats: false });
     for (const schema of scopes.keys()) {
-        if (!validator.validateSchema(schema))
+        try {
+            checkSchemaDocument(schema, "2020-12");
+        }
+        catch {
             throw new InvalidSchema("Invalid Draft 2020-12 schema");
+        }
     }
     const copies = roots.map(copy);
-    let validate;
+    const head = copies.find((schema) => schema.$id === uri(root.said));
+    if (!head)
+        throw new Error("Admitted schema was not registered");
+    let prepared;
     try {
-        for (const schema of copies)
-            validator.addSchema(schema);
-        validate = validator.getSchema(uri(root.said));
+        prepared = prepareSchemas([head, ...copies.filter((schema) => schema !== head)], "2020-12");
     }
     catch (error) {
+        // A regular expression the engine refuses is a normal invalid outcome, reported with its own message.
         if (error instanceof SyntaxError && error.message.includes("regular expression")) {
             return { kind: "invalid", subject: "schema", reason: error.message };
         }
-        if (error instanceof Error && /^reference "urn:said:[^"]+" resolves to more than one schema$/.test(error.message)) {
-            return { kind: "invalid", subject: "schema", reason: error.message };
-        }
         throw error;
     }
-    if (!validate)
-        throw new Error("Admitted schema was not registered");
     compilations++;
-    return { validator, validate };
+    return { prepared };
 }
 /** Local static schema closure plus a synchronous Draft 2020-12 validator; legacy Schemer behavior is unchanged. */
 export function validateSchema(acdc, db, override) {
@@ -388,9 +402,8 @@ export function validateSchema(acdc, db, override) {
                 store.set(root.said, compiled);
             }
         }
-        return compiled.validate(acdc.sad)
-            ? { kind: "valid" }
-            : { kind: "invalid", subject: "credential", reason: compiled.validator.errorsText(compiled.validate.errors) };
+        const outcome = compiled.prepared.validate(acdc.sad);
+        return outcome.valid ? { kind: "valid" } : { kind: "invalid", subject: "credential", reason: outcome.errors };
     }
     catch (error) {
         if (error instanceof InvalidSchema)

package/esm/keri/npm/src/acdc/unblinding.js

@@ -18,7 +18,7 @@ import { auxiliaryQueryWire, envelopeFromFrame, restoreAuxiliaryQuery, } from ".
 import { abortable } from "../app/runtime/abortable.js";
 import { Deck } from "../core/deck.js";
 import { TransIdxSigGroup } from "../core/dispatch.js";
-import { ValidationError } from "../core/errors.js";
+import { PresentationClosedError, ValidationError } from "../core/errors.js";
 import { verifyExchangeProofs, verifyQueryAttachments } from "../core/exchange/exchange-proofing.js";
 import { Kever } from "../core/kel/kever.js";
 import { query, reply } from "../core/protocol-eventing.js";
@@ -55,6 +55,38 @@ function ordinal(event) {
  * sign exact proposals under that approval. Ordinary thresholds elect delivery
  * from the completed aggregate; neither contribution nor delivery requires a root.
  */
+/** A query's source event is not known here yet: the issuer's KEL has not reached the anchoring event. */
+class SourceNotYetKnown extends ValidationError {
+    constructor(issuer, sn) {
+        super(`Query event has an unverified source: the anchoring event ${sn} of ${issuer} is not known`);
+        Object.defineProperty(this, "issuer", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: issuer
+        });
+        Object.defineProperty(this, "sn", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: sn
+        });
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "SourceNotYetKnown"
+        });
+    }
+}
+/** Milliseconds between requests for the issuer's KEL while a query waits for its anchoring event. */
+const KEL_ASK_MS = 5000;
+/**
+ * Auxiliary query processor for `/ipex/unblind`: the discloser answers an authenticated query for a live Grant it
+ * sent, and the disclosee, once it approved a Grant, sends the query and receives the openings. It keeps its
+ * operations in the registry database so a restart resumes them, and queues outgoing queries and answers in
+ * `outgoing` for the transport owner. See the module comment for the consent rules.
+ */
 export class Unblind {
     /** Bind the exact Grant verifier's store; the state vocabulary is chosen per approved operation. */
     constructor({ hab, exc, registry, rvy = hab.rvy, kram = true }) {
@@ -83,6 +115,17 @@ export class Unblind {
             writable: true,
             value: false
         });
+        /**
+         * Queries held until the issuer's anchoring event is known here, by transaction. The wire is already in `heldu`; this
+         * only says which are still waiting and when the issuer's KEL was last asked for. Memory only: a reopened owner
+         * processes `heldu` again and the query waits again.
+         */
+        Object.defineProperty(this, "waiting", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         Object.defineProperty(this, "hab", {
             enumerable: true,
             configurable: true,
@@ -169,6 +212,10 @@ export class Unblind {
             return xid;
         }
         const context = this.exc.presentationContext(grant, { xid, sender, recipient });
+        if (!context && this.hab.db.erpy.get([grant])) {
+            throw new PresentationClosedError("Presentation is closed: its terminal response (Admit or Spurn) ended the discloser's authority to answer "
+                + "queries about it, so an Unblind must be requested before the response is made");
+        }
         if (!context)
             throw new ValidationError("Presentation is unavailable, terminated or expired");
         this.operations.set(xid, {
@@ -364,7 +411,19 @@ export class Unblind {
                 this.groupMessage(op, "query", serder, groups, extra);
                 return { kind: "accept" };
             }
-            this.receiveEvents(selected, envelope.nests);
+            try {
+                this.receiveEvents(selected, envelope.nests);
+            }
+            catch (error) {
+                if (!(error instanceof SourceNotYetKnown))
+                    throw error;
+                // Not invalid, only early: keep the query durably, ask for the issuer's KEL, and take it up when it arrives.
+                this.hab.db.heldu.pin([this.hab.pre, op.xid], auxiliaryQueryWire(envelope, this.publicEvents(envelope.nests)));
+                this.waiting.set(op.xid, { issuer: error.issuer, sn: error.sn, askedAt: 0 });
+                this.askForKel(op.xid);
+                return { kind: "accept" };
+            }
+            this.waiting.delete(op.xid);
             this.live(op);
             op.requested = selected;
             op.requestedByPeer = true;
@@ -386,6 +445,42 @@ export class Unblind {
      * processed again as when first accepted, and one that no longer holds (the Grant ended, its evidence changed)
      * is dropped. Done once per owner, before the first look at what is owed.
      */
+    /** Ask, through the ordinary missing-state query cue, for the issuer's events up to the anchoring one; at most every few seconds. */
+    askForKel(xid) {
+        const held = this.waiting.get(xid), now = Date.now();
+        if (!held || now - held.askedAt < KEL_ASK_MS)
+            return;
+        held.askedAt = now;
+        this.rvy.cues.push({ kin: "query", pre: held.issuer, route: "logs", q: { s: held.sn.toString(16) } });
+    }
+    /** Take up the held queries whose anchoring event has since arrived; the rest ask for it again in due time. */
+    retryWaiting() {
+        for (const [xid, held] of [...this.waiting]) {
+            if (this.hab.db.kels.getLast(held.issuer, held.sn) === null) {
+                this.askForKel(xid);
+                continue;
+            }
+            const wire = this.hab.db.heldu.get([this.hab.pre, xid]);
+            this.waiting.delete(xid);
+            if (!wire)
+                continue;
+            let decision;
+            try {
+                decision = this.processQuery(restoreAuxiliaryQuery(wire));
+            }
+            catch (error) {
+                if (!(error instanceof ValidationError))
+                    throw error;
+            }
+            if (decision?.kind !== "accept")
+                this.hab.db.heldu.rem([this.hab.pre, xid]);
+        }
+    }
+    /** Why the query of `xid` has not been answered, when it is waiting for the issuer's anchoring event. */
+    missingSource(xid) {
+        const held = this.waiting.get(xid);
+        return held ? `the anchoring event ${held.sn} of the issuer ${held.issuer} was never received` : null;
+    }
     restoreHeld() {
         if (this.restored)
             return;
@@ -695,10 +790,11 @@ export class Unblind {
      */
     awaitingReply() {
         this.restoreHeld();
+        this.retryWaiting();
         if (this.group)
             return [];
         return [...this.operations.values()]
-            .filter((op) => op.sender === this.hab.pre && op.requestedByPeer && !op.abandoned)
+            .filter((op) => op.sender === this.hab.pre && (op.requestedByPeer || this.waiting.has(op.xid)) && !op.abandoned)
             .map(({ xid, grant }) => ({ xid, grant }));
     }
     operation(xid) {
@@ -910,9 +1006,16 @@ export class Unblind {
                     ...envelope.ssts.map((seal) => ({ issuer: seal.i.qb64, number: seal.s, diger: seal.d })),
                 ];
                 for (const source of sources) {
-                    if (source.issuer !== rip.issuer || !verifyRegistryAnchor(checked.event, { db: this.hab.db, ...source })) {
+                    if (source.issuer !== rip.issuer)
                         throw new ValidationError("Query event has an unverified source");
+                    if (verifyRegistryAnchor(checked.event, { db: this.hab.db, ...source }))
+                        continue;
+                    const sn = Number(source.number.num);
+                    // An anchoring event the issuer's KEL here has not reached is early; one that is known and does not seal is wrong.
+                    if (Number.isSafeInteger(sn) && this.hab.db.kels.getLast(source.issuer, sn) === null) {
+                        throw new SourceNotYetKnown(source.issuer, sn);
                     }
+                    throw new ValidationError("Query event has an unverified source");
                 }
                 const accepted = this.registry.store.seqEvent(regid, first + i);
                 if (accepted && !bytesEqual(accepted.raw, event.raw)) {
@@ -995,8 +1098,11 @@ export class Unblind {
                 }
             }
         }
-        if (!opening)
-            throw new ValidationError("Required exact event opening is unavailable");
+        if (!opening) {
+            throw new ValidationError("Required exact event opening is unavailable: this identifier holds no public or carried opening and cannot "
+                + "derive one from its registry root (an update blinded with a random blinder, as `Registry.blind` does "
+                + "without custody, can be opened only by its author or from an opening its author published)");
+        }
         this.checkOpening(op, event, opening, nests);
         return opening;
     }

package/esm/keri/npm/src/app/delivery/forwarding.js

@@ -22,6 +22,15 @@ import { introduce } from "./introducing.js";
  * its stream, so sending would lose more than this one message.
  */
 export class PeerVersionError extends ValidationError {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "PeerVersionError"
+        });
+    }
 }
 /**
  * Whether an AID's own accepted KEL ends in a v1 event, which is the only evidence of a v1 reader.

package/esm/keri/npm/src/app/delivery/respondant.js

@@ -1,3 +1,4 @@
+import { isLocalGroupHab } from "../multisig/group-members.js";
 /**
  * Shared host-side responder for indirect and witness runtimes.
  *
@@ -55,6 +56,10 @@ export class Respondant {
             return false;
         const dest = recipientForCue(cue), topic = topicForCue(cue);
         const src = senderHabForCue(this.hby, cue, hint);
+        if (this.nothingToSend(cue, dest, topic, src)) {
+            cues.pull();
+            return true;
+        }
         if (!dest || !topic || !src)
             return false;
         const msgs = [...hab.processCuesIter([cue])];
@@ -62,6 +67,20 @@ export class Respondant {
         cues.pull();
         return true;
     }
+    /**
+     * Whether a receipt cue has nothing to send to. A receipt goes to the controller of the event it receipts, so it
+     * has nowhere to go when that controller is a group this runtime is a member of (the group's own event: its
+     * members are the Counselor's business) or when the controller has no end role to deliver to. Deciding that here
+     * keeps an attempt that could only fail from being made, and logged, for every event of a group.
+     */
+    nothingToSend(cue, dest, topic, src) {
+        if ((cue.kin !== "receipt" && cue.kin !== "witness") || !dest || !topic)
+            return false;
+        const subject = this.hby.habs.get(dest);
+        if (subject && isLocalGroupHab(this.hby, subject))
+            return true;
+        return !!src && !this.postman.canReach(src.pre, dest, topic);
+    }
     /**
      * Admit already produced witness messages without signing them again.
      *
@@ -72,6 +91,8 @@ export class Respondant {
     enqueueMsgs(hab, cue, msgs) {
         const dest = recipientForCue(cue), topic = topicForCue(cue);
         const src = senderHabForCue(this.hby, cue, hab);
+        if (this.nothingToSend(cue, dest, topic, src))
+            return;
         if (!dest || !topic || !src)
             return;
         this.postman.sendAll(msgs.map((msg) => ({ src: src.pre, dest, topic, msg, replies: true })));

package/esm/keri/npm/src/app/identity/habbing.js

@@ -1878,7 +1878,7 @@ export function branToSeedAeid(bran) {
  * durable DB state rather than depending on process-local creation history.
  */
 export function* openHabery(args) {
-    const { name, base = "", temp = false, headDirPath, compat = false, readonly = false, cf: providedCf, createConfig, skipConfig = false, skipSignator = false, opener, stores, bran, seed, aeid, salt, algo, } = args;
+    const { name, base = "", temp = false, headDirPath, compat = false, readonly = false, cf: providedCf, createConfig, skipConfig = false, skipSignator = false, opener, stores, bran, seed, aeid, salt, algo, heldSigners, } = args;
     let db;
     let ks;
     let cf;
@@ -1921,6 +1921,9 @@ export function* openHabery(args) {
             algo,
             salt: normalizeSaltQb64(salt),
         });
+        // Before the Habery exists, so before any runtime built on it can sign. A bad entry fails the open.
+        if (heldSigners)
+            mgr.hold(heldSigners);
         const hby = new Habery(name, base, temp, headDirPath, compat, readonly, db, ks, mgr, cf, skipSignator, opener, !!stores);
         delivered = true;
         return hby;

package/esm/keri/npm/src/app/identity/keeping.js

@@ -193,6 +193,25 @@ function resolveSuiteCodes(codes, count, code, { label, allowZero = false, }) {
 function emptyLot(dt = "") {
     return new PubLot({ pubs: [], ridx: 0, kidx: 0, dt });
 }
+/**
+ * No private key for `pub`: neither held (`Manager.hold`) nor stored in the Keeper. A custodial host releases
+ * its signers on purpose, so a background loop that needs one treats this as a condition to wait out, not as a
+ * failure of the runtime. The message is the one the Keeper has always used.
+ */
+export class SignerNotHeldError extends Error {
+    constructor(pub) {
+        super(`Missing prikey in db for pubkey=${pub}`);
+        /** The qualified public key whose private key is missing. */
+        Object.defineProperty(this, "pub", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.name = "SignerNotHeldError";
+        this.pub = pub;
+    }
+}
 /**
  * Key-management coordinator backed by `Keeper` state.
  *
@@ -251,6 +270,13 @@ export class Manager {
             writable: true,
             value: new Map()
         });
+        /** Told after `hold()` borrows signers; a loop that waited for a missing signer resumes on it. */
+        Object.defineProperty(this, "holdListeners", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Set()
+        });
         const { ks, seed = "", aeid = "", pidx = 0, algo = Algos.salty, salt = randomSaltQb64(), tier = Tiers.low, } = args;
         this._ks = ks;
         this._seed = seed;
@@ -496,6 +522,17 @@ export class Manager {
         }
         for (const [pub, signer] of batch)
             this.held.set(pub, signer);
+        for (const listener of [...this.holdListeners])
+            listener();
+    }
+    /**
+     * Be told after each `hold()`, so a background loop whose signer was released can resume at once.
+     *
+     * @returns A function that stops the notifications.
+     */
+    onHold(listener) {
+        this.holdListeners.add(listener);
+        return () => this.holdListeners.delete(listener);
     }
     /**
      * Drop held signer references: all of them, or only those for `pubs`.
@@ -519,7 +556,7 @@ export class Manager {
             return held;
         const signer = this.ks.pris.get(pub, this.signerDecrypter());
         if (!signer) {
-            throw new Error(`Missing prikey in db for pubkey=${pub}`);
+            throw new SignerNotHeldError(pub);
         }
         return signer;
     }