keri-ts 0.10.0 → 0.10.1

package/esm/cesr/src/primitives/pwhash.js

@@ -0,0 +1,64 @@
+import sodium from "./sodium.ts";
+/** Derive Argon2id13 bytes with owned wasm32 buffers; caller owns the returned JS bytes.
+ * Tier policy belongs to Salter. WASM's high-water capacity is not reduced by free;
+ * this erases the owned input/output ranges, not arbitrary JS or native temporaries.
+ */
+export function deriveArgon2id(password, salt, size, operations, memoryBytes) {
+    const max = 0x7fffffff;
+    if (!Number.isSafeInteger(size) || size < 16 || size > max) {
+        throw new RangeError("Argon2id output size must be an integer from 16 through 2147483647");
+    }
+    if (!(password instanceof Uint8Array) || password.length > max
+        || !(salt instanceof Uint8Array) || salt.length !== 16
+        || !Number.isSafeInteger(operations) || operations < 1 || operations > max
+        || !Number.isSafeInteger(memoryBytes) || memoryBytes < 8192 || memoryBytes > max) {
+        throw new RangeError("Invalid Argon2id wasm32 input");
+    }
+    const native = sodium.libsodium;
+    const owned = [];
+    const allocate = (length) => {
+        // Empty paths still own one initialized byte, while the C password length stays zero.
+        const bytes = Math.max(1, length);
+        const address = native._malloc(bytes);
+        if (!address)
+            throw new Error("Argon2id allocation failed");
+        owned.push({ address, length: bytes });
+        return address;
+    };
+    let result;
+    let failed = false, failure;
+    try {
+        const output = allocate(size), path = allocate(password.length), saltAddress = allocate(salt.length);
+        // Any allocation, and crypto_pwhash itself, may grow memory and replace HEAPU8.
+        native.HEAPU8.fill(0, path, path + Math.max(1, password.length));
+        native.HEAPU8.set(password, path);
+        native.HEAPU8.set(salt, saltAddress);
+        const status = native._crypto_pwhash(output, size, 0, path, password.length, 0, saltAddress, operations, 0, memoryBytes, sodium.crypto_pwhash_ALG_ARGON2ID13);
+        if (status !== 0)
+            throw new Error("Argon2id derivation failed");
+        result = native.HEAPU8.slice(output, output + size);
+    }
+    catch (error) {
+        failed = true;
+        failure = error;
+    }
+    finally {
+        for (const { address, length } of owned.reverse()) {
+            try {
+                native.HEAPU8.fill(0, address, address + length);
+                native._free(address);
+            }
+            catch (error) {
+                // One failed release must not skip the other owned buffers.
+                if (!failed)
+                    failure = error;
+                failed = true;
+            }
+        }
+    }
+    if (failed) {
+        result?.fill(0);
+        throw failure;
+    }
+    return result;
+}

package/esm/cesr/src/primitives/salter.js

@@ -1,9 +1,9 @@
-import { argon2id } from "npm:@noble/hashes@1.8.0/argon2";
 import { UnknownCodeError } from "../core/errors.ts";
 import { Tiers } from "../core/vocabulary.ts";
 import { MtrDex } from "./codex.ts";
 import { SALTER_CODES } from "./codex.ts";
 import { Matter } from "./matter.ts";
+import { deriveArgon2id } from "./pwhash.ts";
 import { Signer } from "./signer.ts";
 /** Encode one KERI salty-derivation path string into bytes for Argon2id input. */
 function pathToBytes(path) {
@@ -49,9 +49,7 @@ export class Salter extends Matter {
         if (!SALTER_CODES.has(this.code)) {
             throw new UnknownCodeError(`Expected salt code, got ${this.code}`);
         }
-        this.tier = init instanceof Salter
-            ? init.tier
-            : init.tier ?? Tiers.low;
+        this.tier = init instanceof Salter ? init.tier : init.tier ?? Tiers.low;
     }
     /** Raw salt bytes used by key-derivation consumers. */
     get salt() {
@@ -70,13 +68,7 @@ export class Salter extends Matter {
      */
     stretch({ size = 32, path = "", tier = this.tier, temp = false, } = {}) {
         const params = tierParams(tier, temp);
-        return argon2id(pathToBytes(path), this.raw, {
-            p: 1,
-            t: params.t,
-            m: params.m,
-            dkLen: size,
-            version: 0x13,
-        });
+        return deriveArgon2id(pathToBytes(path), this.raw, size, params.t, params.m * 1024);
     }
     /**
      * Derive one deterministic executable signer from this salt and one path.

package/esm/cesr/src/primitives/sealed-box.js

@@ -1,5 +1,4 @@
-import sodium from "npm:libsodium-wrappers@0.8.4";
-await sodium.ready;
+import sodium from "./sodium.ts";
 /**
  * Internal libsodium-backed sealed-box seam for KERIpy cipher parity.
  *

package/esm/cesr/src/primitives/sodium.js

@@ -0,0 +1,5 @@
+import sodium from "npm:libsodium-wrappers-sumo@0.8.4";
+// One initialized backend serves derivation and sealed boxes; no JS derived-secret cache is kept here.
+// Existing primitive APIs remain synchronous after their module dependency has initialized.
+await sodium.ready;
+export default sodium;

package/esm/cesr/src/version.js

@@ -6,9 +6,9 @@
  * `src/version.ts` files by hand; edit this template instead.
  */
 /** Package semantic version copied from the owning package manifest. */
-export const PACKAGE_VERSION = "0.9.1";
+export const PACKAGE_VERSION = "0.9.2";
 /** Optional build metadata stamp injected by release/CI workflows. */
-export const BUILD_METADATA = "build.17.7138073e961abaff39463d54a03483c60b18b3aa";
+export const BUILD_METADATA = "build.19.51e9c431fea67e90c7cec2be7f1e9a9cd2c3e4e4";
 /** User-facing version string with build metadata appended when present. */
 export const DISPLAY_VERSION = BUILD_METADATA
     ? `${PACKAGE_VERSION}+${BUILD_METADATA}`

package/esm/keri/npm/src/_dnt.polyfills.js

@@ -125,3 +125,17 @@ export let import_meta_ponyfill = ((...args) => {
     //@ts-ignore
     return import_meta_ponyfill(...args);
 });
+// https://github.com/tc39/proposal-accessible-object-hasownproperty/blob/main/polyfill.js
+if (!Object.hasOwn) {
+    Object.defineProperty(Object, "hasOwn", {
+        value: function (object, property) {
+            if (object == null) {
+                throw new TypeError("Cannot convert undefined or null to object");
+            }
+            return Object.prototype.hasOwnProperty.call(Object(object), property);
+        },
+        configurable: true,
+        enumerable: false,
+        writable: true,
+    });
+}

package/esm/keri/npm/src/cesr/src/primitives/pwhash.js

@@ -0,0 +1,64 @@
+import sodium from "./sodium.js";
+/** Derive Argon2id13 bytes with owned wasm32 buffers; caller owns the returned JS bytes.
+ * Tier policy belongs to Salter. WASM's high-water capacity is not reduced by free;
+ * this erases the owned input/output ranges, not arbitrary JS or native temporaries.
+ */
+export function deriveArgon2id(password, salt, size, operations, memoryBytes) {
+    const max = 0x7fffffff;
+    if (!Number.isSafeInteger(size) || size < 16 || size > max) {
+        throw new RangeError("Argon2id output size must be an integer from 16 through 2147483647");
+    }
+    if (!(password instanceof Uint8Array) || password.length > max
+        || !(salt instanceof Uint8Array) || salt.length !== 16
+        || !Number.isSafeInteger(operations) || operations < 1 || operations > max
+        || !Number.isSafeInteger(memoryBytes) || memoryBytes < 8192 || memoryBytes > max) {
+        throw new RangeError("Invalid Argon2id wasm32 input");
+    }
+    const native = sodium.libsodium;
+    const owned = [];
+    const allocate = (length) => {
+        // Empty paths still own one initialized byte, while the C password length stays zero.
+        const bytes = Math.max(1, length);
+        const address = native._malloc(bytes);
+        if (!address)
+            throw new Error("Argon2id allocation failed");
+        owned.push({ address, length: bytes });
+        return address;
+    };
+    let result;
+    let failed = false, failure;
+    try {
+        const output = allocate(size), path = allocate(password.length), saltAddress = allocate(salt.length);
+        // Any allocation, and crypto_pwhash itself, may grow memory and replace HEAPU8.
+        native.HEAPU8.fill(0, path, path + Math.max(1, password.length));
+        native.HEAPU8.set(password, path);
+        native.HEAPU8.set(salt, saltAddress);
+        const status = native._crypto_pwhash(output, size, 0, path, password.length, 0, saltAddress, operations, 0, memoryBytes, sodium.crypto_pwhash_ALG_ARGON2ID13);
+        if (status !== 0)
+            throw new Error("Argon2id derivation failed");
+        result = native.HEAPU8.slice(output, output + size);
+    }
+    catch (error) {
+        failed = true;
+        failure = error;
+    }
+    finally {
+        for (const { address, length } of owned.reverse()) {
+            try {
+                native.HEAPU8.fill(0, address, address + length);
+                native._free(address);
+            }
+            catch (error) {
+                // One failed release must not skip the other owned buffers.
+                if (!failed)
+                    failure = error;
+                failed = true;
+            }
+        }
+    }
+    if (failed) {
+        result?.fill(0);
+        throw failure;
+    }
+    return result;
+}

package/esm/keri/npm/src/cesr/src/primitives/salter.js

@@ -1,9 +1,9 @@
-import { argon2id } from "@noble/hashes/argon2";
 import { UnknownCodeError } from "../core/errors.js";
 import { Tiers } from "../core/vocabulary.js";
 import { MtrDex } from "./codex.js";
 import { SALTER_CODES } from "./codex.js";
 import { Matter } from "./matter.js";
+import { deriveArgon2id } from "./pwhash.js";
 import { Signer } from "./signer.js";
 /** Encode one KERI salty-derivation path string into bytes for Argon2id input. */
 function pathToBytes(path) {
@@ -49,9 +49,7 @@ export class Salter extends Matter {
         if (!SALTER_CODES.has(this.code)) {
             throw new UnknownCodeError(`Expected salt code, got ${this.code}`);
         }
-        this.tier = init instanceof Salter
-            ? init.tier
-            : init.tier ?? Tiers.low;
+        this.tier = init instanceof Salter ? init.tier : init.tier ?? Tiers.low;
     }
     /** Raw salt bytes used by key-derivation consumers. */
     get salt() {
@@ -70,13 +68,7 @@ export class Salter extends Matter {
      */
     stretch({ size = 32, path = "", tier = this.tier, temp = false, } = {}) {
         const params = tierParams(tier, temp);
-        return argon2id(pathToBytes(path), this.raw, {
-            p: 1,
-            t: params.t,
-            m: params.m,
-            dkLen: size,
-            version: 0x13,
-        });
+        return deriveArgon2id(pathToBytes(path), this.raw, size, params.t, params.m * 1024);
     }
     /**
      * Derive one deterministic executable signer from this salt and one path.

package/esm/keri/npm/src/cesr/src/primitives/sealed-box.js

@@ -1,5 +1,4 @@
-import sodium from "libsodium-wrappers";
-await sodium.ready;
+import sodium from "./sodium.js";
 /**
  * Internal libsodium-backed sealed-box seam for KERIpy cipher parity.
  *

package/esm/keri/npm/src/cesr/src/primitives/sodium.js

@@ -0,0 +1,5 @@
+import sodium from "libsodium-wrappers-sumo";
+// One initialized backend serves derivation and sealed boxes; no JS derived-secret cache is kept here.
+// Existing primitive APIs remain synchronous after their module dependency has initialized.
+await sodium.ready;
+export default sodium;

package/esm/keri/npm/src/cesr/src/version.js

@@ -6,9 +6,9 @@
  * `src/version.ts` files by hand; edit this template instead.
  */
 /** Package semantic version copied from the owning package manifest. */
-export const PACKAGE_VERSION = "0.9.1";
+export const PACKAGE_VERSION = "0.9.2";
 /** Optional build metadata stamp injected by release/CI workflows. */
-export const BUILD_METADATA = "build.17.7138073e961abaff39463d54a03483c60b18b3aa";
+export const BUILD_METADATA = "build.19.51e9c431fea67e90c7cec2be7f1e9a9cd2c3e4e4";
 /** User-facing version string with build metadata appended when present. */
 export const DISPLAY_VERSION = BUILD_METADATA
     ? `${PACKAGE_VERSION}+${BUILD_METADATA}`

package/esm/keri/npm/src/deps/jsr.io/@std/path/{1.1.5 → 1.1.6}/posix/to_file_url.js

@@ -12,6 +12,7 @@ import { isAbsolute } from "./is_absolute.js";
  *
  * assertEquals(toFileUrl("/home/foo"), new URL("file:///home/foo"));
  * assertEquals(toFileUrl("/home/foo bar"), new URL("file:///home/foo%20bar"));
+ * assertEquals(toFileUrl("//foo/bar"), new URL("file:///foo/bar"));
  * ```
  *
  * @param path The path to convert.
@@ -22,6 +23,6 @@ export function toFileUrl(path) {
         throw new TypeError(`Path must be absolute: received "${path}"`);
     }
     const url = new URL("file:///");
-    url.pathname = encodeWhitespace(path.replace(/%/g, "%25").replace(/\\/g, "%5C"));
+    url.pathname = encodeWhitespace(path.replace(/^\/+/, "/").replace(/%/g, "%25").replace(/\\/g, "%5C"));
     return url;
 }

package/esm/keri/npm/src/keri/src/app/agent-runtime.js

@@ -101,6 +101,7 @@ export function* createAgentRuntime(hby, options = {}) {
     const mailboxPoller = new MailboxPoller(hby, mailboxDirector, {
         services,
         pollTransport: options.mailboxPollTransport,
+        mailboxAdmission: options.mailboxAdmission,
     });
     for (const topic of [
         DELEGATE_MAILBOX_TOPIC,

package/esm/keri/npm/src/keri/src/app/cli/db-dump.js

@@ -213,11 +213,21 @@ function buildOptions(args) {
         headDirPath: args.headDirPath,
         temp: args.temp,
         compat: args.compat,
+        mapSize: args.mapSize,
         reopen: true,
         readonly: true,
         dupsort: false,
     };
 }
+function resolveMapSize(rawMapSize) {
+    if (rawMapSize === undefined) {
+        return undefined;
+    }
+    if (!Number.isInteger(rawMapSize) || rawMapSize <= 0) {
+        throw new ValidationError("`--map-size` must be a positive integer byte count");
+    }
+    return rawMapSize;
+}
 function resolveLimit(rawLimit) {
     if (rawLimit === undefined) {
         return DEFAULT_LIMIT;
@@ -243,6 +253,7 @@ export function* dumpDatabase(args) {
     const headDirPath = args.headDirPath;
     const temp = args.temp;
     const compat = args.compat;
+    const mapSize = resolveMapSize(args.mapSize);
     const target = args.target;
     const prefix = args.prefix;
     const limit = resolveLimit(args.limit);
@@ -259,12 +270,13 @@ export function* dumpDatabase(args) {
         headDirPath,
         temp,
         compat,
+        mapSize,
     }));
     try {
         console.log(`Dumping ${parsedTarget.storeName
             ? `${parsedTarget.domain}.${parsedTarget.storeName}`
             : parsedTarget.domain} from ${domain.path ?? "(unknown path)"}`);
-        console.log(`Mode: readonly compat=${compat ? "true" : "false"} temp=${temp ? "true" : "false"}`);
+        console.log(`Mode: readonly compat=${compat ? "true" : "false"} temp=${temp ? "true" : "false"}${mapSize !== undefined ? ` mapSize=${mapSize}` : ""}`);
         console.log("");
         if (!parsedTarget.storeName) {
             printStoreSummary(parsedTarget.domain, domain);

package/esm/keri/npm/src/keri/src/app/cli/multisig.js

@@ -31,6 +31,8 @@ function loadMultisigInceptFile(path) {
         ...loaded,
         aids: Array.isArray(loaded.aids) ? loaded.aids.filter(isString) : loaded.aids,
         rmids: Array.isArray(loaded.rmids) ? loaded.rmids.filter(isString) : loaded.rmids,
+        isith: parseThresholdOption(loaded.isith),
+        nsith: parseThresholdOption(loaded.nsith),
         wits: Array.isArray(loaded.wits) ? loaded.wits.filter(isString) : loaded.wits,
     };
 }

package/esm/keri/npm/src/keri/src/app/configing.js

@@ -1,5 +1,5 @@
 import * as dntShim from "../../../_dnt.shims.js";
-import { basename, dirname, join } from "../../../deps/jsr.io/@std/path/1.1.5/mod.js";
+import { basename, dirname, join } from "../../../deps/jsr.io/@std/path/1.1.6/mod.js";
 import { ValidationError } from "../core/errors.js";
 import { PathManager } from "../db/core/path-manager.js";
 const CONFIGER_DEFAULTS = {

package/esm/keri/npm/src/keri/src/app/exchanging.js

@@ -145,7 +145,7 @@ export class Exchanger {
                 ptds: this.hby.db.epath.get([said]).map((text) => PathedMaterialGroup.fromRaw(new TextEncoder().encode(text))),
                 essrs: this.hby.db.essrs.get([said]),
             });
-            if (decision.kind === "accept" || decision.kind === "reject") {
+            if (decision.kind === "reject") {
                 this.removeEscrow(said);
             }
         }

package/esm/keri/npm/src/keri/src/app/forwarding.js

@@ -19,6 +19,7 @@ import { CREDENTIAL_MAILBOX_TOPIC, DELEGATE_MAILBOX_TOPIC, OOBI_MAILBOX_TOPIC }
 import { exchange } from "../core/protocol-exchanging.js";
 import { Roles } from "../core/roles.js";
 import { dgKey } from "../db/core/keys.js";
+import { DEFAULT_MAILBOX_INBOX_LIMITS } from "../db/mailbox-inbox.js";
 import { makeNowIso8601 } from "../time/mod.js";
 import { buildCesrRequest, CESR_CONTENT_TYPE, KERIPY_CESR_JSON_CONTENT_TYPE, splitCesrStream } from "./cesr-http.js";
 import { closeResponseBody, fetchResponseHandle, fetchResponseHandleOrNull } from "./httping.js";
@@ -485,6 +486,24 @@ export class MailboxPoller {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, "delivered", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Set()
+        });
+        Object.defineProperty(this, "inboxLimits", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "durableAdmission", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "localCursors", {
             enumerable: true,
             configurable: true,
@@ -493,6 +512,11 @@ export class MailboxPoller {
         });
         const { timeouts, services = defaultRuntimeServices, pollTransport = defaultMailboxPollTransport, } = options;
         this.hby = hby;
+        if (options.mailboxAdmission && options.mailboxAdmission.mode !== "durable") {
+            throw new Error("Unsupported mailbox admission mode");
+        }
+        this.durableAdmission = options.mailboxAdmission?.mode === "durable";
+        this.inboxLimits = { ...DEFAULT_MAILBOX_INBOX_LIMITS, ...options.mailboxAdmission?.limits };
         this.mailboxDirector = mailboxDirector;
         this.timeoutPolicy = normalizeMailboxPollingTimeoutPolicy(timeouts);
         this.services = services;
@@ -520,7 +544,7 @@ export class MailboxPoller {
         if (topics.length === 0) {
             return [];
         }
-        const batches = [];
+        const batches = this.replayRetained();
         const deadline = this.services.clock.now() + positiveTimeoutMs(budgetMs, this.timeoutPolicy.commandLocalBudgetMs);
         for (const pre of this.hby.prefixes) {
             const local = this.readLocalMailbox(pre, topics);
@@ -533,7 +557,7 @@ export class MailboxPoller {
             for (const endpoint of remoteEndpoints) {
                 const remainingBudgetMs = deadline - this.services.clock.now();
                 if (remainingBudgetMs <= 0) {
-                    return batches;
+                    return this.handOff(batches);
                 }
                 const batch = yield* this.pollRemoteEndpointOnce(target, endpoint, remainingBudgetMs);
                 if (batch) {
@@ -541,7 +565,7 @@ export class MailboxPoller {
                 }
             }
         }
-        return batches;
+        return this.handOff(batches);
     }
     /**
      * Poll forever, streaming typed batches into one sink.
@@ -553,6 +577,10 @@ export class MailboxPoller {
         const remoteWorkers = new Map();
         try {
             while (true) {
+                for (const batch of this.replayRetained()) {
+                    onBatch(batch);
+                    this.handOff([batch]);
+                }
                 const topics = this.mailboxDirector.registeredTopics();
                 yield* this.syncRemoteWorkers(remoteWorkers, onBatch, topics);
                 if (topics.length > 0) {
@@ -623,15 +651,71 @@ export class MailboxPoller {
         if (messages.length === 0) {
             return null;
         }
-        for (const message of messages) {
-            this.mailboxDirector.updateRemoteCursor(target.targetPre, endpoint.eid, message.topic, message.idx);
+        if (!this.durableAdmission) {
+            for (const message of messages) {
+                this.mailboxDirector.updateRemoteCursor(target.targetPre, endpoint.eid, message.topic, message.idx);
+            }
+            return {
+                source: "remote",
+                pre: target.targetPre,
+                eid: endpoint.eid,
+                messages: messages.map((message) => message.msg),
+            };
+        }
+        this.hby.db.mailboxInbox.admit(target.targetPre, endpoint.eid, messages, this.inboxLimits);
+        return this.replayRetained(target.targetPre, endpoint.eid)[0] ?? null;
+    }
+    /** Deliver retained ingress once per poller lifetime; consumers explicitly dispose durable outcomes. */
+    replayRetained(pre, eid) {
+        if (!this.durableAdmission)
+            return [];
+        const topics = new Set(this.mailboxDirector.registeredTopics());
+        if (topics.size === 0)
+            return [];
+        const retained = this.hby.db.mailboxInbox.pending({ pre, eid, topics, exclude: this.delivered });
+        const batches = new Map();
+        for (const { delivery, msg } of retained) {
+            if (this.delivered.has(delivery.id) || (pre && delivery.pre !== pre) || (eid && delivery.eid !== eid))
+                continue;
+            const key = JSON.stringify([delivery.pre, delivery.eid]);
+            let batch = batches.get(key);
+            if (!batch) {
+                batch = { source: "remote", pre: delivery.pre, eid: delivery.eid, messages: [], deliveries: [] };
+                batches.set(key, batch);
+            }
+            batch.messages.push(msg);
+            batch.deliveries.push(delivery);
+        }
+        return [...batches.values()];
+    }
+    /** Mark successful handoff only, never selection before later network work or a throwing sink. */
+    handOff(batches) {
+        // Validate/prune before marking new IDs: a corrupt retained row must not lose this handoff.
+        if (this.delivered.size + batches.reduce((n, batch) => n + (batch.deliveries?.length ?? 0), 0)
+            > this.inboxLimits.maxRetainedRecords) {
+            const retained = new Set(this.hby.db.mailboxInbox.retained().map((row) => row.id));
+            for (const id of this.delivered)
+                if (!retained.has(id))
+                    this.delivered.delete(id);
+        }
+        const output = [];
+        for (const batch of batches) {
+            if (!batch.deliveries) {
+                output.push(batch);
+                continue;
+            }
+            const messages = [], deliveries = [];
+            for (const [index, delivery] of batch.deliveries.entries()) {
+                if (this.delivered.has(delivery.id))
+                    continue;
+                this.delivered.add(delivery.id);
+                messages.push(batch.messages[index]);
+                deliveries.push(delivery);
+            }
+            if (messages.length)
+                output.push({ ...batch, messages, deliveries });
         }
-        return {
-            source: "remote",
-            pre: target.targetPre,
-            eid: endpoint.eid,
-            messages: messages.map((message) => message.msg),
-        };
+        return output;
     }
     /** Keep one long-lived worker running for each currently configured remote endpoint. */
     *syncRemoteWorkers(remoteWorkers, onBatch, topics) {
@@ -668,6 +752,7 @@ export class MailboxPoller {
             const batch = yield* this.pollRemoteEndpointOnce(target, endpoint, this.timeoutPolicy.maxPollDurationMs);
             if (batch) {
                 onBatch(batch);
+                this.handOff([batch]);
             }
             yield* runtimeTurn();
         }