keri-ts 0.11.0 → 2.0.0

package/esm/keri/npm/src/app/{habbing.js → identity/habbing.js}

@@ -12,27 +12,25 @@
  * - local bootstrap replies and events still flow through the same accepted
  *   state machinery instead of being written directly to persistent state
  */
-import { concatBytes, Diger, Ilks, NumberPrimitive, Prefixer, SealLast, Tiers, Verfer, Vrsn_1_0, } from "cesr-ts";
-import { Deck } from "../core/deck.js";
-import { TransIdxSigGroup } from "../core/dispatch.js";
-import { ValidationError } from "../core/errors.js";
-import { Kevery } from "../core/eventing.js";
-import { incept as inceptEvent, interact as interactEvent, query as queryEvent, receipt as receiptEvent, reply as replyEvent, rotate as rotateEvent, } from "../core/protocol-eventing.js";
-import { messagize } from "../core/protocol-serialization.js";
-import { HabitatRecord } from "../core/records.js";
-import { Roles } from "../core/roles.js";
-import { BasicReplyRouteHandler, Revery, Router } from "../core/routing.js";
-import { Schemes } from "../core/schemes.js";
-import { createBaser } from "../db/basing.js";
-import { dgKey } from "../db/core/keys.js";
-import { createKeeper, PreSit } from "../db/keeping.js";
-import { createOutboxer, DisabledOutboxer } from "../db/outboxing.js";
-import { makeNowIso8601 } from "../time/mod.js";
-import { DEFAULT_CESR_BODY_MODE } from "./cesr-http.js";
+import { concatBytes, DigDex, Diger, Ilks, NumberPrimitive, Prefixer, SealLast, Tiers, Verfer, Vrsn_1_0, Vrsn_2_0, } from "cesr-ts";
+import { Deck } from "../../core/deck.js";
+import { TransIdxSigGroup } from "../../core/dispatch.js";
+import { ValidationError } from "../../core/errors.js";
+import { Kevery } from "../../core/kel/eventing.js";
+import { incept as inceptEvent, interact as interactEvent, query as queryEvent, receipt as receiptEvent, reply as replyEvent, rotate as rotateEvent, } from "../../core/protocol-eventing.js";
+import { messagize } from "../../core/protocol-serialization.js";
+import { HabitatRecord } from "../../core/records.js";
+import { Roles } from "../../core/roles.js";
+import { BasicReplyRouteHandler, Revery, Router } from "../../core/routing.js";
+import { Schemes } from "../../core/schemes.js";
+import { createBaser } from "../../db/basing.js";
+import { createKeeper, PreSit } from "../../db/keeping.js";
+import { makeNowIso8601 } from "../../time/mod.js";
+import { oobiReplyMessages } from "../bootstrap/oobi-replies.js";
+import { loadStoredReply } from "../delivery/stored-replies.js";
+import { acceptedGroupMembers, latestGroupContribution } from "../multisig/group-members.js";
 import { createConfiger } from "./configing.js";
 import { branToSaltQb64, encodeHugeNumber, ensureKeeperCryptoReady, Manager, normalizeSaltQb64, saltySigner, } from "./keeping.js";
-import { collectOobiReplies, oobiReplyMessages } from "./oobi-replies.js";
-import { loadStoredReply } from "./stored-replies.js";
 /** Reserved alias for the local signatory habitat record. */
 export const SIGNER = "__signatory__";
 /**
@@ -42,6 +40,21 @@ export const SIGNER = "__signatory__";
  * locally generated reply and inception messages.
  */
 const KERI_V1 = Object.freeze({ major: 1, minor: 0 });
+/**
+ * Select the KERI version for a new event on an existing identifier.
+ *
+ * An identifier keeps the KERI version of its accepted KEL, so rotation and
+ * interaction never mix versions within one KEL. An explicit selection that
+ * conflicts with the accepted KEL is refused rather than silently ignored.
+ */
+function acceptedKelVersion(kever, requested) {
+    const accepted = kever.serder.pvrsn.major === 1 ? Vrsn_1_0 : Vrsn_2_0;
+    if (requested && (requested.major !== accepted.major || requested.minor !== accepted.minor)) {
+        throw new ValidationError(`KEL of ${kever.prefixer.qb64} is KERI ${accepted.major}.${accepted.minor}; `
+            + `refusing a KERI ${requested.major}.${requested.minor} event.`);
+    }
+    return accepted;
+}
 /**
  * Produce the default simple numeric signing threshold for a key count.
  *
@@ -76,8 +89,20 @@ function ample(count, faults, weak = true) {
     }
     return weak ? Math.min(n, m1, m2) : Math.min(n, Math.max(m1, m2));
 }
-function loadConfigUrls(value) {
-    return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+/** Decode one bootstrap URL collection without normalizing its exact string keys. */
+function loadConfigUrls(value, field) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new ValidationError(`Config ${field} must be an array of URL strings.`);
+    const urls = [];
+    for (const [index, entry] of value.entries()) {
+        if (typeof entry !== "string" || entry.trim().length === 0) {
+            throw new ValidationError(`Config ${field}[${index}] must be a non-empty URL string.`);
+        }
+        urls.push(entry);
+    }
+    return urls;
 }
 function requireConfigDatetime(alias, value) {
     if (typeof value !== "string") {
@@ -111,7 +136,7 @@ function concatMessages(messages) {
  * storage: controller indexed signatures, witness indexed signatures,
  * authorizing seals, and receipts in KERIpy `cloneEvtMsg` order.
  */
-export function eventReplayMessage(hby, serder) {
+export function eventReplayMessage(hby, serder, gvrsn = Vrsn_1_0) {
     const pre = serder.pre;
     const said = serder.said;
     if (!pre || !said) {
@@ -121,7 +146,7 @@ export function eventReplayMessage(hby, serder) {
     if (fn === null) {
         throw new ValidationError(`Missing first-seen ordinal for accepted event ${pre}:${said}.`);
     }
-    return hby.db.cloneEvtMsg(pre, fn, said);
+    return hby.db.cloneEvtMsg(pre, fn, said, gvrsn);
 }
 /**
  * Return a stored KEL event payload with KERIpy `cloneEvtMsg` attachment order.
@@ -145,7 +170,7 @@ export function eventPayloadMessage(hby, serder) {
     return hby.db.cloneEvtMsg(pre, ordinal, said);
 }
 /** Return the exact accepted event replay message at `(pre, sn)`. */
-export function acceptedEventReplayMessage(hby, pre, sn) {
+export function acceptedEventReplayMessage(hby, pre, sn, gvrsn = Vrsn_1_0) {
     const said = hby.db.kels.getLast(pre, sn);
     if (!said) {
         throw new ValidationError(`Missing accepted event at ${pre}:${sn.toString(16)}.`);
@@ -154,7 +179,7 @@ export function acceptedEventReplayMessage(hby, pre, sn) {
     if (!serder) {
         throw new ValidationError(`Missing accepted event body for ${pre}:${said}.`);
     }
-    return { serder, message: eventReplayMessage(hby, serder) };
+    return { serder, message: eventReplayMessage(hby, serder, gvrsn) };
 }
 /**
  * Build one inception/delgated-inception serder from generated keys and config.
@@ -251,6 +276,19 @@ export class Hab {
     get kever() {
         return this.pre ? this.db.getKever(this.pre) : null;
     }
+    /**
+     * KERI version of this habitat's accepted KEL.
+     *
+     * Replies and queries this habitat authors use the same version, so a stream
+     * that carries the KEL followed by its endpoint replies never mixes protocol
+     * or attachment genera.
+     */
+    get kelVersion() {
+        const kever = this.kever;
+        if (!kever)
+            throw new ValidationError(`Missing accepted key state for ${this.pre}.`);
+        return acceptedKelVersion(kever);
+    }
     /**
      * Accept one locally generated event through the same `Kevery`/`Kever` path
      * used by remote processing.
@@ -270,7 +308,8 @@ export class Hab {
             local: true,
         });
         if (decision.kind !== "accept") {
-            throw new ValidationError(`Local event ${serder.said ?? "<unknown>"} was not accepted.`, { decision });
+            const detail = decision.kind === "duplicate" ? decision.duplicate : decision.message;
+            throw new ValidationError(`Local event ${serder.said ?? "<unknown>"} was not accepted: ${detail}`);
         }
         const kever = this.db.getKever(this.pre);
         if (!kever) {
@@ -280,7 +319,7 @@ export class Hab {
     }
     /** Sign one local bootstrap reply and submit it to normal signature and BADA validation. */
     acceptReply(route, data, stamp) {
-        const serder = replyEvent(route, data, { pre: this.pre, stamp });
+        const serder = replyEvent(route, data, { pre: this.pre, stamp, pvrsn: this.kelVersion });
         const kever = this.kever;
         if (!kever)
             throw new ValidationError(`Missing accepted key state for ${this.pre}.`);
@@ -330,7 +369,7 @@ export class Hab {
         }
         const dt = requireConfigDatetime(this.name, conf.dt);
         // Validate every configured URL before admitting any bootstrap reply.
-        const locations = loadConfigUrls(conf.curls).map((url) => {
+        const locations = loadConfigUrls(conf.curls, "curls").map((url) => {
             const parsed = new URL(url);
             const scheme = parsed.protocol.length > 0 ? parsed.protocol.slice(0, -1) : Schemes.http;
             return { eid: this.pre, scheme, url };
@@ -341,7 +380,8 @@ export class Hab {
         return true;
     }
     /**
-     * Incept this habitat through the shared accepted-state path.
+     * Incept this habitat through the shared accepted-state path, as KERI v2
+     * unless `version` selects KERI v1 for v1-only peers.
      *
      * KERIpy correspondence:
      * - mirrors the pattern where local inception is signed in the habitat layer
@@ -349,7 +389,7 @@ export class Hab {
      *   `states.`/`kels.` directly
      */
     make(args = {}) {
-        const { code = "E", transferable = true, isith = undefined, icount = 1, icode = undefined, nsith = undefined, ncount = undefined, ncode = undefined, toad = 0, wits = [], delpre = undefined, estOnly = false, DnD = false, hidden = false, data = [], algo = undefined, salt = undefined, tier = undefined, } = args;
+        const { code = "E", transferable = true, isith = undefined, icount = 1, icode = undefined, nsith = undefined, ncount = undefined, ncode = undefined, toad = 0, wits = [], delpre = undefined, estOnly = false, DnD = false, hidden = false, data = [], algo = undefined, salt = undefined, tier = undefined, version = Vrsn_2_0, } = args;
         let nextCount = ncount ?? icount;
         let nextSith = nsith ?? isith;
         let prefixCode = code;
@@ -378,6 +418,7 @@ export class Hab {
         const currentSith = isith ?? defaultThreshold(keys.length, 1);
         const nextThreshold = nextSith ?? defaultThreshold(ndigs.length, 0);
         const serder = inceptEvent(keys, {
+            version,
             code: prefixCode,
             isith: currentSith,
             ndigs,
@@ -432,6 +473,7 @@ export class Hab {
         if (!kever) {
             throw new ValidationError(`Missing accepted key state for ${this.pre}.`);
         }
+        const version = acceptedKelVersion(kever, args.version);
         const priorSit = this.ks.getSits(this.pre);
         if (!priorSit) {
             throw new ValidationError(`Missing keeper state for ${this.pre}.`);
@@ -467,6 +509,7 @@ export class Hab {
         const ndigs = digers.map((diger) => diger.qb64);
         try {
             const serder = rotateEvent(this.pre, keys, kever.serder.said ?? kever.said, {
+                version,
                 ilk: kever.delpre !== null ? Ilks.drt : Ilks.rot,
                 sn: kever.sn + 1,
                 isith: currentSith,
@@ -486,7 +529,7 @@ export class Hab {
             for (const pub of new PreSit(priorSit).old.pubs) {
                 this.ks.pris.rem(pub);
             }
-            return messagize(serder, { sigers, pipelined: true });
+            return messagize(serder, { sigers, pipelined: true, gvrsn: version });
         }
         catch (error) {
             // Roll keeper state back if the event was not accepted locally. The
@@ -515,10 +558,26 @@ export class Hab {
         if (!kever) {
             throw new ValidationError(`Missing accepted key state for ${this.pre}.`);
         }
-        const serder = interactEvent(this.pre, kever.serder.said ?? kever.said, kever.sn + 1, args.data ?? []);
+        const version = acceptedKelVersion(kever, args.version);
+        const serder = interactEvent(this.pre, kever.serder.said ?? kever.said, kever.sn + 1, args.data ?? [], { version });
         const sigers = this.sign(serder.raw, true);
         this.acceptLocally(serder, sigers);
-        return messagize(serder, { sigers, pipelined: true });
+        return messagize(serder, { sigers, pipelined: true, gvrsn: version });
+    }
+    /**
+     * Decrypt `ser` (sealed-box ciphertext, qb64 or raw) with the private keys of
+     * `verfers`, defaulting to this habitat's current accepted keys.
+     *
+     * KERIpy correspondence: `BaseHab.decrypt` delegating to `Manager.decrypt`.
+     * As there, every selected key opens the ciphertext in turn, so a
+     * multi-key habitat passes the single verfer the ciphertext was sealed to.
+     */
+    decrypt(ser, verfers) {
+        const kever = this.kever;
+        if (!verfers && !kever) {
+            throw new ValidationError(`Missing accepted key state for ${this.pre}.`);
+        }
+        return this.mgr.decrypt(ser, { verfers: verfers ?? kever.verfers });
     }
     sign(ser, indexed = false) {
         if (!this.pre) {
@@ -536,32 +595,20 @@ export class Hab {
                 throw new ValidationError(`Missing accepted member key state for ${member}.`);
             // KERIpy GroupHab.sign/fetchLatestContribTo: a member may have rotated
             // ahead of its contribution to the group's currently accepted key list.
-            for (const [, sn, said] of this.db.kels.getOnItemBackIter(member, state.sn)) {
-                if (this.db.kels.getLast(member, sn) !== said)
-                    continue;
-                const event = this.db.getEvtSerder(member, said);
-                if (!event)
-                    throw new ValidationError(`Missing accepted member event ${member}:${said}.`);
-                if (!event.estive)
-                    continue;
-                const keys = event.verfers ?? [];
-                if (keys.length !== 1) {
-                    throw new ValidationError(`Group signing requires single-key member events for ${member}.`);
-                }
-                const index = pubs.indexOf(keys[0].qb64);
-                if (index < 0)
-                    continue;
+            const contribution = latestGroupContribution(this.db, member, kever.verfers);
+            if (contribution) {
+                const { index, verfer } = contribution;
                 if (indexed) {
                     // Endorsement proves current authority only. Rotation signatures have
                     // a separate prior-next commitment path in rotateGroupHab().
                     return this.mgr.sign(ser, {
-                        pubs: [keys[0].qb64],
+                        pubs: [verfer.qb64],
                         indexed: true,
                         indices: [index],
                         ondices: [null],
                     });
                 }
-                return this.mgr.sign(ser, [keys[0].qb64], false);
+                return this.mgr.sign(ser, [verfer.qb64], false);
             }
             throw new ValidationError(`Member ${member} has no contribution to group ${this.pre}.`);
         }
@@ -631,7 +678,7 @@ export class Hab {
         if (!this.pre) {
             throw new Error("Cannot build a reply before habitat inception.");
         }
-        return this.endorse(replyEvent(route, data, { pre: this.pre, stamp }));
+        return this.endorse(replyEvent(route, data, { pre: this.pre, stamp, pvrsn: this.kelVersion }));
     }
     /**
      * Create and sign one query message from this habitat.
@@ -641,14 +688,15 @@ export class Hab {
      * local contribution may be only a partial signature; the receiver must still
      * enforce the group's current threshold. This is not a member-query fallback.
      */
-    query(pre, src, query = {}, route = "", stamp = makeNowIso8601()) {
-        return this.endorse(queryEvent(route, {
-            ...query,
-            i: (route === "tels" || route === "tsn") && typeof query.i === "string" ? query.i : pre,
+    query(pre, src, instruction, stamp = makeNowIso8601()) {
+        return this.endorse(queryEvent(instruction.route, {
+            ...instruction.q,
+            i: instruction.route === "tels" || instruction.route === "tsn" ? instruction.q.i : pre,
             src,
         }, {
             pre: this.pre,
             stamp,
+            pvrsn: this.kelVersion,
         }));
     }
     /**
@@ -671,7 +719,7 @@ export class Hab {
         if (!kever) {
             throw new ValidationError(`Missing accepted key state for ${this.pre}.`);
         }
-        const reserder = receiptEvent(pre, sn, said);
+        const reserder = receiptEvent(pre, sn, said, { pvrsn: serder.pvrsn, gvrsn: serder.pvrsn });
         if (!kever.transferable) {
             const cigars = this.sign(serder.raw, false);
             this.kvy.processReceipt({
@@ -681,7 +729,7 @@ export class Hab {
                 tsgs: [],
                 local: true,
             });
-            return messagize(reserder, { cigars, pipelined: true });
+            return messagize(reserder, { cigars, pipelined: true, gvrsn: serder.pvrsn });
         }
         const estSaid = kever.lastEst.d || kever.said;
         const estEvent = estSaid ? this.db.getEvtSerder(this.pre, estSaid) : null;
@@ -702,6 +750,7 @@ export class Hab {
             sigers: tsg.sigers,
             seal: { i: tsg.prefixer, s: tsg.seqner, d: tsg.diger },
             pipelined: true,
+            gvrsn: serder.pvrsn,
         });
     }
     /**
@@ -724,12 +773,12 @@ export class Hab {
         if (kever.transferable) {
             throw new ValidationError(`Witness receipts require a non-transferable witness habitat, got ${this.pre}.`);
         }
-        const wits = this.receiptedWitnesses(serder);
+        const wits = this.db.acceptedEventWitnesses(serder) ?? [];
         const index = wits.indexOf(this.pre);
         if (index < 0) {
             throw new ValidationError(`${this.pre} is not an authorized witness for ${pre}:${said}.`);
         }
-        const reserder = receiptEvent(pre, sn, said);
+        const reserder = receiptEvent(pre, sn, said, { pvrsn: serder.pvrsn, gvrsn: serder.pvrsn });
         const wigers = this.mgr.sign(serder.raw, {
             pubs: [this.pre],
             indexed: true,
@@ -742,7 +791,7 @@ export class Hab {
             tsgs: [],
             local: true,
         });
-        return messagize(reserder, { wigers, pipelined: true });
+        return messagize(reserder, { wigers, pipelined: true, gvrsn: serder.pvrsn });
     }
     /**
      * Create one signed endpoint-role authorization reply for this habitat.
@@ -790,7 +839,12 @@ export class Hab {
      *
      * Witnesses are derived from current key state as well as stored location
      * replies because witness membership is partly a KEL concern, not just an
-     * endpoint-authorization concern.
+     * endpoint-authorization concern. Empty location maps retain endpoint identity
+     * so routing can report missing locations rather than select a lower role.
+     * Unlike KERIpy 71438328, stored roles without allowed or enabled approval are excluded.
+     *
+     * @param pre Controller AID whose accepted roles and current witnesses are projected.
+     * @returns Role to endpoint AID to scheme/URL map, including empty location maps.
      */
     endsFor(pre) {
         const ends = {};
@@ -801,9 +855,6 @@ export class Hab {
                 continue;
             }
             const urls = this.fetchUrls(eid);
-            if (Object.keys(urls).length === 0) {
-                continue;
-            }
             ends[role] ??= {};
             ends[role][eid] = urls;
         }
@@ -812,9 +863,6 @@ export class Hab {
             const witnessUrls = {};
             for (const eid of kever.wits) {
                 const urls = this.fetchUrls(eid);
-                if (Object.keys(urls).length === 0) {
-                    continue;
-                }
                 witnessUrls[eid] = urls;
             }
             if (Object.keys(witnessUrls).length > 0) {
@@ -866,116 +914,59 @@ export class Hab {
         return concatMessages(messages);
     }
     /** Borrow this Hab/store through lazy role output; metadata capture starts only on iterator acquisition. */
-    replyEndRoleMessages(cid, role, eids = [], scheme = "", limits = {}) {
-        return oobiReplyMessages(this, cid, role, eids, scheme, false, limits);
+    replyEndRoleMessages(cid, role, eids = [], scheme = "") {
+        return oobiReplyMessages(this, cid, role, eids, scheme, false);
     }
-    /** Finite role output admits each message before retaining it; large callers use the lazy source. */
+    /** Collect finite role output; large callers use the lazy source. */
     replyEndRole(cid, role, eids = [], scheme = "") {
-        return collectOobiReplies(this.replyEndRoleMessages(cid, role, eids, scheme));
+        return concatMessages([...this.replyEndRoleMessages(cid, role, eids, scheme)]);
     }
     /** Lazy OOBI output preserves the top-level delegated readiness guard under the consuming owner. */
-    replyToOobiMessages(aid, role, eids = [], limits = {}) {
-        return oobiReplyMessages(this, aid, role, eids, "", true, limits);
+    replyToOobiMessages(aid, role, eids = []) {
+        return oobiReplyMessages(this, aid, role, eids, "", true);
     }
     /** Collect explicitly finite OOBI output; incomplete delegated state still returns empty bytes. */
     replyToOobi(aid, role, eids = []) {
-        return collectOobiReplies(this.replyToOobiMessages(aid, role, eids));
+        return concatMessages([...this.replyToOobiMessages(aid, role, eids)]);
     }
     /**
-     * Resolve the witness list that governs receipts for one event.
+     * Yield signed wire messages for one finite cue pass, like KERIpy's BaseHab.
      *
-     * Preference order:
-     * - the durable event-level `wits.` projection when present
-     * - the event body's own backer list for inception events
-     * - the current accepted kever witness list as a last resort
-     */
-    receiptedWitnesses(serder) {
-        const pre = serder.pre;
-        const said = serder.said;
-        if (!pre || !said) {
-            return [];
-        }
-        const stored = this.db.wits.get(dgKey(pre, said)).map((wit) => wit.qb64);
-        if (stored.length > 0) {
-            return stored;
-        }
-        if (serder.ilk === Ilks.icp || serder.ilk === Ilks.dip) {
-            return [...serder.backs];
-        }
-        return [...(this.db.getKever(pre)?.wits ?? [])];
-    }
-    /**
-     * Process KERI-style cues and yield structured runtime cue emissions.
-     *
-     * KERIpy correspondence:
-     * - this is the `keri-ts` equivalent of `BaseHab.processCuesIter()`
-     *
-     * `keri-ts` difference:
-     * - the cue identity is preserved in the yielded `CueEmission` instead of
-     *   collapsing everything immediately to raw bytes
+     * A Deck is consumed through its initial extent. Other iterables are copied to
+     * a local Deck, so callers can borrow an array while retaining their source.
+     * Query, stream, and notification ownership stays with the caller; only
+     * complete query instructions produce wire output here.
      *
-     * Current support:
-     * - `receipt`, `witness`, `replay`, `reply`, and complete `query` cues emit
-     *   wire messages
-     * - `stream` emits transport requests without flattening them into bytes
-     * - observer/runtime cues remain visible as notify emissions
+     * @param cues Deck to consume through its initial extent, or borrowed iterable copied into a local Deck.
+     * @returns A synchronous generator of signed wire messages, not delivery outcomes.
+     * @throws Signing/replay construction failures propagate; a supplied Deck head is already pulled when construction begins.
      */
     *processCuesIter(cues) {
         const queue = cues instanceof Deck ? cues : new Deck(cues);
-        // One pass owns only its initial batch; producers may append while a consumer awaits delivery.
         const count = queue.length;
         for (let index = 0; index < count; index++) {
             const cue = queue.pull();
-            if (!cue) {
+            if (!cue)
                 continue;
+            switch (cue.kin) {
+                case "receipt":
+                    yield this.receipt(cue.serder);
+                    break;
+                case "witness":
+                    yield this.witness(cue.serder);
+                    break;
+                case "replay":
+                    yield* cue.msgs;
+                    break;
+                case "reply":
+                    yield cue.serder ? this.endorse(cue.serder) : this.reply(`${cue.route}/${this.pre}`, cue.data.asDict());
+                    break;
+                case "query":
+                    if (cue.route && cue.pre && cue.src && (cue.signer === undefined || cue.signer === this.pre)) {
+                        yield this.query(cue.pre, cue.src, cue);
+                    }
+                    break;
             }
-            const emission = this.interpretCue(cue);
-            if (emission)
-                yield emission;
-        }
-    }
-    /** Interpret one borrowed cue synchronously; callers own queue removal and retained output. */
-    interpretCue(cue) {
-        switch (cue.kin) {
-            case "receipt":
-                return { cue, messages: [this.receipt(cue.serder)], kind: "wire" };
-            case "witness":
-                return { cue, messages: [this.witness(cue.serder)], kind: "wire" };
-            case "replay":
-                return { cue, messages: cue.messages, kind: "wire" };
-            case "reply":
-                return {
-                    cue,
-                    messages: [
-                        cue.serder ? this.endorse(cue.serder) : this.reply(["/tsn/registry", "/tsn/credential"].includes(cue.route) ? `${cue.route}/${this.pre}` : cue.route, cue.data ?? {}),
-                    ],
-                    kind: "wire",
-                };
-            case "query": {
-                const query = cue.query ?? cue.q ?? {};
-                if (cue.pre && cue.src) {
-                    return {
-                        cue,
-                        messages: [this.query(cue.pre, cue.src, query, cue.route ?? "")],
-                        kind: "wire",
-                    };
-                }
-                return { cue, messages: [], kind: "notify" };
-            }
-            case "stream":
-                return { cue, messages: [], kind: "transport" };
-            case "notice":
-            case "noticeBadCloneFN":
-            case "keyStateSaved":
-            case "txnStateSaved":
-            case "invalid":
-            case "psUnescrow":
-            case "remoteMemberedSig":
-            case "oobiQueued":
-            case "oobiResolved":
-            case "oobiFailed":
-                return { cue, messages: [], kind: "notify" };
-            default:
         }
     }
 }
@@ -1086,7 +1077,7 @@ export class Signator {
  */
 export class Habery {
     /** Compose one habery from already-opened storage, manager, and config surfaces. */
-    constructor(name, base, temp, headDirPath, compat, readonly, db, ks, obx, cesrBodyMode, mgr, cf, skipSignator = false) {
+    constructor(name, base, temp, headDirPath, compat, readonly, db, ks, mgr, cf, skipSignator = false) {
         Object.defineProperty(this, "name", {
             enumerable: true,
             configurable: true,
@@ -1135,18 +1126,6 @@ export class Habery {
             writable: true,
             value: void 0
         });
-        Object.defineProperty(this, "obx", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
-        Object.defineProperty(this, "cesrBodyMode", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: void 0
-        });
         Object.defineProperty(this, "mgr", {
             enumerable: true,
             configurable: true,
@@ -1203,8 +1182,6 @@ export class Habery {
         this.readonly = readonly;
         this.db = db;
         this.ks = ks;
-        this.obx = obx;
-        this.cesrBodyMode = cesrBodyMode;
         this.mgr = mgr;
         this.cf = cf;
         this.rtr = new Router();
@@ -1215,7 +1192,7 @@ export class Habery {
             lax: false,
             local: true,
         });
-        this.replyRoutes = new BasicReplyRouteHandler(this.db, this.rvy);
+        this.replyRoutes = new BasicReplyRouteHandler(this.rvy);
         this.replyRoutes.registerReplyRoutes(this.rtr);
         this.kevery = new Kevery(this.db, {
             cues: localCues,
@@ -1265,6 +1242,42 @@ export class Habery {
         for (const hab of this.habs.values()) {
             hab.reconfigure();
         }
+        // Restart recovery: commit members of an accepted establishment event
+        // whose live commit was interrupted. Read-only openings never write.
+        for (const pre of this.readonly ? [] : this.habs.keys()) {
+            this.recoverAcceptedGroupMembers(pre);
+        }
+    }
+    /**
+     * Commit the members of a local group's latest accepted establishment event
+     * when the stored record is stale (KERIpy `GroupHab.recoverAcceptedMembers`).
+     *
+     * A process that stopped after a rotation was accepted but before its live
+     * `commitAcceptedGroupMembers` leaves `smids`/`rmids` stale. Members are
+     * derived from local KELs, trying the stored members first and every AID
+     * with local key state only when they do not account for every key. They
+     * are committed only when they differ from the stored record and the local
+     * member contributes to that event; a record that does not yet include the
+     * local member is a pending join, not a stale commit. Only the latest
+     * accepted event is committed, so this never rolls members back, and
+     * repeating it changes nothing. Returns whether stale members were committed.
+     */
+    recoverAcceptedGroupMembers(pre) {
+        const record = this.db.getHab(pre);
+        if (!record?.mid || record.sid || !this.habs.has(record.mid))
+            return false;
+        const smids = [...(record.smids ?? [])], rmids = [...(record.rmids ?? [])];
+        const accepted = acceptedGroupMembers(this.db, pre, new Set([...smids, ...rmids]))
+            ?? acceptedGroupMembers(this.db, pre, [...this.db.states.getTopItemIter()].map(([keys]) => keys.join(".")));
+        if (!accepted)
+            return false;
+        const same = (left, right) => left.length === right.length && left.every((aid, index) => aid === right[index]);
+        if (same(accepted.smids, smids) && same(accepted.rmids, rmids))
+            return false;
+        if (!accepted.smids.includes(record.mid) && !accepted.rmids.includes(record.mid))
+            return false;
+        this.commitGroupHabMembers(pre, accepted.smids, accepted.rmids);
+        return true;
     }
     /** Local AID prefixes currently managed by this habery. */
     get prefixes() {
@@ -1282,15 +1295,16 @@ export class Habery {
      */
     reconfigure() {
         const conf = this.config;
+        // Validate every collection before the first pin, including when dt is absent.
+        const iurls = loadConfigUrls(conf.iurls, "iurls");
+        const durls = loadConfigUrls(conf.durls, "durls");
+        const wurls = loadConfigUrls(conf.wurls, "wurls");
         if (typeof conf.dt === "string") {
             const date = conf.dt;
-            for (const url of [
-                ...loadConfigUrls(conf.iurls),
-                ...loadConfigUrls(conf.durls),
-            ]) {
+            for (const url of [...iurls, ...durls]) {
                 this.db.oobis.pin(url, { date, state: "queued" });
             }
-            for (const url of loadConfigUrls(conf.wurls)) {
+            for (const url of wurls) {
                 this.db.woobi.pin(url, { date, state: "queued" });
             }
         }
@@ -1332,6 +1346,10 @@ export class Habery {
         const keys = this.extractGroupMemberKeys(signingMembers);
         const ndigs = this.extractGroupMemberNextDigests(rotationMembers);
         const serder = inceptEvent(keys, {
+            // A group identifier is always self-addressing, even with a single signing
+            // key, matching KERIpy's GroupHab.make (code defaults to Blake3_256).
+            version: args.version ?? Vrsn_2_0,
+            code: DigDex.Blake3_256,
             isith: args.isith,
             ndigs,
             nsith: args.nsith,
@@ -1350,6 +1368,8 @@ export class Habery {
             this.persistGroupHabRecord(pre, group, mhab.pre, signingMembers, rotationMembers, ns);
         }
         this.habs.set(pre, hab);
+        // Membership is local intent, needed to accept before collecting witness receipts.
+        this.db.groups.add(pre);
         const decision = this.kevery.processEvent({
             serder,
             sigers,
@@ -1363,8 +1383,10 @@ export class Habery {
             if (!args.hidden) {
                 this.removeGroupHabRecord(pre, group, ns);
             }
+            else
+                this.db.groups.delete(pre);
             this.habs.delete(pre);
-            throw new ValidationError(decision.message, decision.context);
+            throw new ValidationError(decision.message);
         }
         if (hab.accepted) {
             this.markAcceptedGroupHab(pre);
@@ -1374,7 +1396,7 @@ export class Habery {
             hab,
             serder,
             sigers,
-            message: messagize(serder, { sigers, pipelined: true }),
+            message: messagize(serder, { sigers, pipelined: true, gvrsn: args.version ?? Vrsn_2_0 }),
         };
     }
     /**
@@ -1446,6 +1468,8 @@ export class Habery {
      * - member AIDs should already be in the key state intended for the new
      *   group key list, matching KLI's operator workflow of rotating members
      *   before rotating the group
+     * Body and returned proof framing follow the group's accepted KEL version;
+     * a conflicting explicit `version` is refused.
      */
     rotateGroupHab(group, smids, rmids, args = {}) {
         const hab = this.habByName(group);
@@ -1464,6 +1488,7 @@ export class Habery {
         const keys = this.extractGroupMemberKeys(signingMembers);
         const ndigs = this.extractGroupMemberNextDigests(rotationMembers);
         const kever = hab.kever;
+        const version = acceptedKelVersion(kever, args.version);
         const serder = rotateEvent(hab.pre, keys, kever.serder.said ?? kever.said, {
             ilk: kever.delpre !== null ? Ilks.drt : Ilks.rot,
             sn: kever.sn + 1,
@@ -1475,6 +1500,7 @@ export class Habery {
             cuts: args.cuts,
             adds: args.adds,
             data: args.data,
+            version,
         });
         const sigers = this.signGroupEventWithLocalMembers(serder, signingMembers, keys, kever.ndigers);
         const decision = this.kevery.processEvent({
@@ -1487,7 +1513,7 @@ export class Habery {
             local: true,
         });
         if (decision.kind === "reject") {
-            throw new ValidationError(decision.message, decision.context);
+            throw new ValidationError(decision.message);
         }
         if (serder.sn !== null && serder.said && this.db.kels.getLast(hab.pre, serder.sn) === serder.said) {
             this.commitGroupHabMembers(hab.pre, signingMembers, rotationMembers);
@@ -1496,10 +1522,10 @@ export class Habery {
             hab,
             serder,
             sigers,
-            message: messagize(serder, { sigers, pipelined: true }),
+            message: messagize(serder, { sigers, pipelined: true, gvrsn: serder.gvrsn ?? version }),
         };
     }
-    /** Create a locally signed group interaction event. */
+    /** Create a locally signed group interaction in the group's accepted KEL version; conflicts are refused. */
     interactGroupHab(group, smids, args = {}) {
         const hab = this.habByName(group);
         if (!hab?.pre || !hab.kever) {
@@ -1514,7 +1540,8 @@ export class Habery {
             throw new ValidationError(`Local member identifier ${record.mid} must be a group signing member.`);
         }
         const kever = hab.kever;
-        const serder = interactEvent(hab.pre, kever.serder.said ?? kever.said, kever.sn + 1, args.data ?? []);
+        const version = acceptedKelVersion(kever, args.version);
+        const serder = interactEvent(hab.pre, kever.serder.said ?? kever.said, kever.sn + 1, args.data ?? [], { version });
         const keys = kever.verfers.map((verfer) => verfer.qb64);
         const sigers = this.signGroupEventWithLocalMembers(serder, signingMembers, keys);
         const decision = this.kevery.processEvent({
@@ -1527,7 +1554,7 @@ export class Habery {
             local: true,
         });
         if (decision.kind === "reject") {
-            throw new ValidationError(decision.message, decision.context);
+            throw new ValidationError(decision.message);
         }
         if (hab.accepted) {
             this.markAcceptedGroupHab(hab.pre);
@@ -1536,7 +1563,7 @@ export class Habery {
             hab,
             serder,
             sigers,
-            message: messagize(serder, { sigers, pipelined: true }),
+            message: messagize(serder, { sigers, pipelined: true, gvrsn: serder.gvrsn ?? version }),
         };
     }
     /** Extract the single current verifier from each group signing member. */
@@ -1663,12 +1690,22 @@ export class Habery {
     }
     /** Closes backing databases and optionally clears temp storage. */
     *close(clear = false) {
-        yield* this.db.close(clear);
-        yield* this.ks.close(clear);
-        yield* this.obx.close(clear);
-        if (this.cf) {
-            yield* this.cf.close(clear && this.temp);
+        const failures = [];
+        const closing = [this.db.close(clear), this.ks.close(clear)];
+        if (this.cf)
+            closing.push(this.cf.close(clear && this.temp));
+        for (const operation of closing) {
+            try {
+                yield* operation;
+            }
+            catch (error) {
+                failures.push(error);
+            }
         }
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1)
+            throw new AggregateError(failures, "Habery resource close failed", { cause: failures[0] });
     }
 }
 /**
@@ -1690,16 +1727,15 @@ export function branToSeedAeid(bran) {
  * durable DB state rather than depending on process-local creation history.
  */
 export function* createHabery(args) {
-    const { name, resources, base = "", temp = false, headDirPath, compat = false, readonly = false, cf: providedCf, skipConfig = false, skipSignator = false, bran, seed, aeid, salt, algo, outboxer = "disabled", cesrBodyMode = DEFAULT_CESR_BODY_MODE, } = args;
+    const { name, base = "", temp = false, headDirPath, compat = false, readonly = false, cf: providedCf, skipConfig = false, skipSignator = false, bran, seed, aeid, salt, algo, } = args;
     let db;
     let ks;
-    let obx;
     let cf;
     let delivered = false;
+    let failure;
     try {
         db = yield* createBaser({
             name,
-            resources,
             base,
             temp,
             headDirPath,
@@ -1716,19 +1752,6 @@ export function* createHabery(args) {
             reopen: true,
             readonly,
         });
-        if (compat && outboxer !== "disabled") {
-            throw new ValidationError("Outboxer is a tufa-only sidecar and is unavailable in compat mode.");
-        }
-        obx = outboxer === "disabled" ? new DisabledOutboxer() : (yield* createOutboxer({
-            name,
-            base,
-            temp,
-            headDirPath,
-            compat,
-            reopen: true,
-            readonly,
-            mustExist: outboxer === "open",
-        }));
         cf = providedCf
             ?? (skipConfig ? undefined : (yield* createConfiger({
                 name,
@@ -1756,33 +1779,42 @@ export function* createHabery(args) {
             algo,
             salt: normalizeSaltQb64(salt),
         });
-        const hby = new Habery(name, base, temp, headDirPath, compat, readonly, db, ks, obx, cesrBodyMode, mgr, cf, skipSignator);
+        const hby = new Habery(name, base, temp, headDirPath, compat, readonly, db, ks, mgr, cf, skipSignator);
         delivered = true;
         return hby;
     }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
     finally {
         if (!delivered) {
-            // Failed acquisition retains ownership; never clear persistent data or caller config.
-            try {
-                if (cf && cf !== providedCf)
-                    yield* cf.close();
-            }
-            finally {
+            // Failed acquisition still owns these resources; attempt every close.
+            const failures = [];
+            if (failure)
+                failures.push(failure.error);
+            const closing = [];
+            if (cf && cf !== providedCf)
+                closing.push(cf.close());
+            if (ks)
+                closing.push(ks.close());
+            if (db)
+                closing.push(db.close());
+            for (const operation of closing) {
                 try {
-                    if (obx)
-                        yield* obx.close();
+                    yield* operation;
                 }
-                finally {
-                    try {
-                        if (ks)
-                            yield* ks.close();
-                    }
-                    finally {
-                        if (db)
-                            yield* db.close();
-                    }
+                catch (error) {
+                    failures.push(error);
                 }
             }
+            if (failures.length > (failure ? 1 : 0)) {
+                // deno-lint-ignore no-unsafe-finally -- Cancellation must also report cleanup failure.
+                if (failures.length === 1)
+                    throw failures[0];
+                // deno-lint-ignore no-unsafe-finally -- Preserve acquisition and every failed cleanup.
+                throw new AggregateError(failures, "Habery acquisition and close failed", { cause: failures[0] });
+            }
         }
     }
 }