keri-ts 2.0.1 → 2.1.0

package/esm/keri/npm/src/acdc/salting.js

@@ -1,8 +1,10 @@
 /**
- * Explicit encrypted copies of existing registry roots.
+ * Encrypted copies of existing registry roots.
  *
  * `RegistryRoot` replicates held roots to individual members with ESSR `exn`
  * messages, ported from KERIpy `keri.acdc.salting` (kentbull/keripy v2-spec).
+ * Operators send them explicitly; group issuance completion and accepted group
+ * rotations also send them, fire and forget (`app/credentials/root-replicating.ts`).
  *
  * Local profile, not a KERI, ACDC or #1740 standard. Upstream KERIpy uses ESSR
  * only as the v1 `/essr/req` transport envelope on direct sends.
@@ -19,9 +21,12 @@
  * dependency escrow (`Baser.rrpe`, no timeout) that `processEscrows` retries.
  */
 import { concatBytes, Counter, Dater, Diger, Encrypter, essrChunks, Kinds, LabelDex, makeBlindUuid, MtrDex, ParserError, Prefixer, Saider, Salter, Texter, unblindBlindState, unblindBoundState, Vrsn_2_0, } from "cesr-ts";
-import { groupWitnesserSelection, isLocalGroupHab } from "../app/multisig/group-members.js";
+import { groupWitnesserSelection, isLocalGroupHab, localGroupMember } from "../app/multisig/group-members.js";
 import { ValidationError } from "../core/errors.js";
+import { Kever } from "../core/kel/kever.js";
 import { exchange } from "../core/protocol-eventing.js";
+import { dgKey } from "../db/core/keys.js";
+import { hasNests, loadNests } from "../db/exchange/exchange-nests.js";
 import { makeNowIso8601 } from "../time/mod.js";
 import { validateRip, validateUpdate, verifyRegistryAnchor, vetBlind } from "./regeventing.js";
 /** A stored registry-root copy that can never be retained as received. */
@@ -65,9 +70,9 @@ function contribution(db, member, verfers) {
         const event = db.getEvtSerder(member, said);
         if (!event?.estive)
             continue;
-        const index = keys.indexOf(event.verfers[0]?.qb64 ?? "");
+        const key = event.verfers[0]?.qb64 ?? "", index = keys.indexOf(key);
         if (index >= 0)
-            return { sn, index };
+            return { sn, index, key };
     }
     return null;
 }
@@ -290,14 +295,8 @@ export class RegistryRoot {
         }
         return rip;
     }
-    /**
-     * Return current signing member AIDs added by one accepted group rotation.
-     *
-     * Members, not keys, are compared: a continuing member usually rotates its
-     * own key, so it contributes to both establishments. Candidates are the AIDs
-     * with accepted key state in this Habery.
-     */
-    newcomers(ghab, rotation) {
+    /** Return `ghab`'s accepted `rotation` and the establishment before it; ValidationError otherwise. */
+    rotation(ghab, rotation) {
         const db = this.hby.db, pre = ghab.pre;
         if (!pre || ghab.db !== db || !isLocalGroupHab(this.hby, ghab)) {
             throw new ValidationError("newcomers require a local group habitat");
@@ -306,29 +305,59 @@ export class RegistryRoot {
         if (!event || !["rot", "drt"].includes(event.ilk) || db.kels.getLast(pre, event.sn) !== rotation) {
             throw new ValidationError("newcomers require an accepted group rotation");
         }
-        let prior = null;
         for (const [, sn, said] of db.kels.getOnItemBackIter(pre, event.sn - 1)) {
             if (db.kels.getLast(pre, sn) !== said)
                 continue;
             const candidate = db.getEvtSerder(pre, said);
-            if (candidate?.estive) {
-                prior = candidate;
-                break;
-            }
+            if (candidate?.estive)
+                return [event, candidate];
         }
-        if (!prior)
-            throw new ValidationError("rotation has no accepted prior establishment");
+        throw new ValidationError("rotation has no accepted prior establishment");
+    }
+    /**
+     * Return current signing member AIDs added by one accepted group rotation.
+     *
+     * Members, not keys, are compared: a continuing member usually rotates its
+     * own key, so it contributes to both establishments. `rekeyed` also returns
+     * continuing members whose contributing key changed, the recipients a
+     * re-seal must reach under their new key. Candidates are the AIDs with
+     * accepted key state in this Habery.
+     */
+    newcomers(ghab, rotation, { rekeyed = false } = {}) {
+        const db = this.hby.db, pre = ghab.pre, [event, prior] = this.rotation(ghab, rotation);
         const found = [];
         for (const [keys] of db.states.getTopItemIter()) {
             const aid = keys.join(".");
             if (aid === pre || !db.getKever(aid))
                 continue;
-            const added = contribution(db, aid, event.verfers);
-            if (added && !contribution(db, aid, prior.verfers) && this.current(aid, pre))
+            const added = contribution(db, aid, event.verfers), before = contribution(db, aid, prior.verfers);
+            if (added && this.current(aid, pre) && (!before || rekeyed && before.key !== added.key)) {
                 found.push([added.index, aid]);
+            }
         }
         return found.sort((left, right) => left[0] - right[0]).map(([, aid]) => aid);
     }
+    /**
+     * Return the members `ghab`'s local member re-seals held roots to after `rotation`.
+     *
+     * Only a signer of the accepted rotation that held a key in the prior
+     * establishment sends, and it sends to each current signing member that is
+     * new in the rotation or whose contributing key changed (`newcomers` with
+     * `rekeyed`). Every such signer sends: copies are idempotent, so no single
+     * sender is elected. An empty list means nothing is owed.
+     */
+    resealed(ghab, rotation) {
+        const recipients = this.newcomers(ghab, rotation, { rekeyed: true });
+        const db = this.hby.db, [event, prior] = this.rotation(ghab, rotation);
+        const member = localGroupMember(this.hby, ghab.pre).pre;
+        const own = contribution(db, member, event.verfers);
+        if (!own || !contribution(db, member, prior.verfers))
+            return [];
+        const { indices } = Kever.verifyIndexedSignatures(event.raw, db.sigs.get(dgKey(ghab.pre, rotation)), event.verfers);
+        if (!indices.includes(own.index))
+            return [];
+        return recipients.filter(aid => aid !== member);
+    }
     /** Return the current signing member AIDs of `gid` known to this Habery. */
     members(gid) {
         const db = this.hby.db, gkever = db.getKever(gid), found = [];
@@ -365,10 +394,17 @@ export class RegistryRoot {
     // sending
     /**
      * Return one authorized copy of a root held locally for `gid` or the issuer.
+     *
      * `hab` is the local individual sender. `event` defaults to the registry's
-     * accepted BUP head.
+     * accepted BUP head. `td` is the recipient's verification hint: omitted, it
+     * is derived for this registry (`hint`); `""` sends none; any other value is
+     * an override. Before sealing, a derived or override hint must let this
+     * sender's own root reproduce the BUP `b` commitment, so a copy never carries
+     * a hint that cannot verify it. `hinted` refuses with RootUnverified, instead
+     * of sending a copy without a hint, when no local evidence yields one;
+     * automatic sends set it.
      */
-    prepare(hab, recipient, gid, registry, { event, td } = {}) {
+    prepare(hab, recipient, gid, registry, { event, td, hinted = false } = {}) {
         const rip = this.authorize(hab.pre, recipient, gid, registry);
         let root = null;
         for (const holder of [gid, rip.issuer]) {
@@ -380,8 +416,74 @@ export class RegistryRoot {
         }
         if (!root)
             throw new ValidationError("no local root is held for this registry");
-        const [bup] = this.event(registry, event ?? this.rgy.store.headEvent(registry).said, rip);
-        return rootExn(hab, recipient, gid, registry, root, { event: bup.said, td });
+        const [bup, sn] = this.event(registry, event ?? this.rgy.store.headEvent(registry).said, rip);
+        const uuid = makeBlindUuid({ salt: root.qb64, sn }).qb64;
+        let hint = td;
+        if (hint === undefined) {
+            hint = this.hint(gid, registry, uuid, bup) ?? undefined;
+            if (hint === undefined && hinted) {
+                throw new RootUnverified(`no held opening or stored Grant ACDC lets this root reproduce registry ${registry} update ${bup.said}; `
+                    + "send it with an ACDC hint");
+            }
+        }
+        else if (hint && !this.reproduces(bup.sad.b, uuid, hint, gid)) {
+            throw new ValidationError(`the local root does not reproduce registry ${registry} update ${bup.said} with ACDC hint ${hint}`);
+        }
+        return rootExn(hab, recipient, gid, registry, root, { event: bup.said, td: hint });
+    }
+    /**
+     * Return the ACDC SAID by which `uuid` reproduces `bup`'s commitment, or null.
+     *
+     * Derived per registry, never shared across registries: the ACDC of the
+     * BUP's locally held opening first, then each ACDC of `registry` nested in a
+     * locally stored exchange. A candidate counts only when it reproduces the
+     * commitment, which is the sender self-check.
+     */
+    hint(gid, registry, uuid, bup) {
+        const held = this.rgy.store.publicOpening(bup.said)?.td.nonce;
+        const blid = bup.sad.b;
+        if (held && this.reproduces(blid, uuid, held, gid))
+            return held;
+        for (const td of this.acdcs(registry)) {
+            if (this.reproduces(blid, uuid, td, gid))
+                return td;
+        }
+        return null;
+    }
+    /**
+     * Yield SAIDs of ACDCs in `registry` nested in any locally stored exchange.
+     *
+     * A custodian finds them in its own `/ipex/grant`; a member holding only a
+     * received copy finds them nested in the `/multisig/exn` proposal it signed.
+     * Nests are walked recursively, so the wrapper depth does not matter, and no
+     * index table is needed. An exchange whose stored nests no longer decode is
+     * skipped: hint search is advisory and the self-check still guards the copy.
+     */
+    *acdcs(registry) {
+        const db = this.hby.db;
+        for (const [keys] of db.exns.getTopItemIter()) {
+            const said = keys.join(".");
+            if (!hasNests(db, said))
+                continue;
+            let nests;
+            try {
+                nests = loadNests(db, said);
+            }
+            catch (error) {
+                if (error instanceof ParserError || error instanceof ValidationError)
+                    continue;
+                throw error;
+            }
+            yield* RegistryRoot.nested(nests, registry);
+        }
+    }
+    /** Depth-first SAIDs of nested bodies whose `rd` is `registry`. */
+    static *nested(nests, registry) {
+        for (const nest of nests) {
+            if (nest.body.ked?.rd === registry && nest.body.said)
+                yield nest.body.said;
+            yield* RegistryRoot.nested(nest.nests ?? [], registry);
+        }
     }
     // receiving
     /** Recheck exact accepted BUP membership and issuer anchoring; return the BUP and its ordinal. */

package/esm/keri/npm/src/acdc/unblinding.js

@@ -537,7 +537,7 @@ export class Unblind {
         // Serialization may suspend; repeat all authority and snapshot checks inside
         // the single writer. This does not rewrite another Grant or any Admit.
         const wires = yield* abortable((signal) => prepareNests(nests, signal));
-        const result = db.env.transactionSync(() => {
+        const result = db.transaction(() => {
             this.live(op);
             this.current(op);
             const retained = db.enst.get([op.grant]);
@@ -553,9 +553,7 @@ export class Unblind {
                 db.exrs.pin([op.grant, node], record);
             return { kind: "accept", said: op.grant };
         });
-        yield* abortable(async () => {
-            await db.env.flushed;
-        });
+        yield* db.flushed();
         return result;
     }
     /** Discard approved work and unsent replies; delivered bytes remain caller-owned. */

package/esm/keri/npm/src/app/bootstrap/oobiery.js

@@ -266,7 +266,7 @@ export class Oobiery {
         };
         // A new or resumed attempt supersedes old terminal facts, but keeps its
         // queued row until intake succeeds. Cancellation can therefore retry it.
-        this.hby.db.env.transactionSync(() => {
+        this.hby.db.transaction(() => {
             this.pinQueueStore(kind, url, queuedRecord);
             this.hby.db.eoobi.rem(url);
             this.hby.db.roobi.rem(url);

package/esm/keri/npm/src/app/credentials/root-replicating.js

@@ -0,0 +1,123 @@
+/**
+ * Finite delivery of prepared `/registry/root` copies; transmission is never receipt.
+ *
+ * `replicateRegistryRoots` is the KERIpy `rootreplicating.replicate` happy path:
+ * group commands call it once a send is possible and report each outcome. There
+ * is no acknowledgement, sent-copies record or retry; receiving is idempotent,
+ * so duplicate copies are harmless, and `tufa vc registry root send` is the
+ * recovery path for a copy that was not sent.
+ */
+import { parseBytes } from "cesr-ts";
+import { action, race } from "effection";
+import { AppError, ValidationError } from "../../core/errors.js";
+import { CREDENTIAL_MAILBOX_TOPIC } from "../../core/mailbox/mailbox-topics.js";
+import { localGroupMember } from "../multisig/group-members.js";
+/** The operator command that resends a copy automatic replication did not send. */
+export const RootCopyRecovery = "tufa vc registry root send";
+/**
+ * Send each copy from `sender` to its recipient's `credential` mailbox, in
+ * order, and return one outcome per copy. A failed copy does not stop later
+ * copies. The caller runs `postman.deliverDo` for the duration; Poster wait
+ * misuse or closure still throws.
+ */
+export function* deliverRegistryRoots(postman, sender, copies) {
+    const outcomes = [];
+    for (const copy of copies) {
+        const event = postman.send({ src: sender, dest: copy.recipient, topic: CREDENTIAL_MAILBOX_TOPIC, msg: copy.wire }, { notify: true });
+        const outcome = yield* postman.wait(event);
+        outcomes.push(outcome.kin === "sent"
+            ? { kin: "sent", copy, deliveries: outcome.deliveries }
+            : { kin: "failed", copy, error: outcome.error });
+    }
+    return outcomes;
+}
+/** Run `operation` for at most `milliseconds` of `clock` time; null when the budget ends first. */
+function* within(clock, milliseconds, operation) {
+    return yield* race([
+        operation,
+        action(resolve => {
+            const timer = clock.setTimeout(() => resolve(null), Math.max(milliseconds, 0));
+            return () => clock.clearTimeout(timer);
+        }),
+    ]);
+}
+/**
+ * Fire and forget one copy of each of `registries`' held roots for group
+ * `ghab` to each recipient, signed by `ghab`'s local member.
+ *
+ * `recipients` defaults to every other current signing member. Each copy is
+ * prepared with `RegistryRoot.prepare` and a per-registry derived hint
+ * (`hinted`, so a copy that could never verify is reported, not sent) and
+ * delivered through `deliverRegistryRoots`, as `tufa vc registry root send`
+ * does. `timeoutMs` is this replication's own budget: a copy reached after it
+ * ends, or still sending when it ends, is reported unsent. Nothing is retried
+ * or recorded and an `AppError` never escapes: every outcome is returned for
+ * display. The caller runs `postman.deliverDo` for the duration.
+ */
+export function* replicateRegistryRoots(root, postman, clock, ghab, registries, { recipients, timeoutMs }) {
+    const gid = ghab.pre, sender = localGroupMember(root.hby, gid), deadline = clock.now() + Math.max(timeoutMs, 0);
+    const targets = recipients ?? root.members(gid).filter(aid => aid !== sender.pre);
+    const reports = [];
+    for (const registry of registries) {
+        for (const recipient of targets) {
+            const result = {
+                phase: "root_copy",
+                gid,
+                registry,
+                sender: sender.pre,
+                recipient,
+                transmitted: false,
+            };
+            let failure = null;
+            try {
+                if (clock.now() >= deadline) {
+                    throw new ValidationError("registry root copies did not complete within their budget");
+                }
+                const wire = root.prepare(sender, recipient, gid, registry, { hinted: true });
+                result.exchange = parseBytes(wire)[0].body.said;
+                const outcome = yield* within(clock, deadline - clock.now(), deliverRegistryRoots(postman, sender.pre, [{ recipient, wire }]));
+                if (!outcome)
+                    failure = new ValidationError("registry root copies did not complete within their budget");
+                else if (outcome[0].kin === "failed")
+                    failure = outcome[0].error ?? "delivery failed";
+            }
+            catch (error) {
+                if (!(error instanceof AppError))
+                    throw error;
+                failure = error;
+            }
+            reports.push(failure === null ? { ...result, transmitted: true } : {
+                ...result,
+                error: failure instanceof Error ? failure.message : String(failure),
+                recovery: RootCopyRecovery,
+            });
+        }
+    }
+    return reports;
+}
+/** Budget for re-seal copies from a command without its own `--timeout`, as KERIpy `rootreplicating.Budget`. */
+export const RootResealBudgetMs = 30_000;
+/**
+ * After an accepted group rotation, send held roots to new or rekeyed members.
+ *
+ * Fire and forget like `replicateRegistryRoots`: only a signer of the rotation
+ * that held a prior key sends (`RegistryRoot.resealed`), every such signer
+ * sends with no election, a member holding no root for the group sends
+ * nothing, and no failure ever fails the rotation. The caller runs
+ * `postman.deliverDo` for the duration.
+ */
+export function* resealRegistryRoots(root, postman, clock, ghab, rotation, { timeoutMs = RootResealBudgetMs } = {}) {
+    let recipients;
+    try {
+        recipients = root.resealed(ghab, rotation);
+    }
+    catch (error) {
+        if (!(error instanceof AppError))
+            throw error;
+        return [{ phase: "root_copy", gid: ghab.pre, rotation, transmitted: false, error: error.message }];
+    }
+    const registries = root.held(ghab.pre);
+    if (!recipients.length || !registries.length)
+        return [];
+    return yield* replicateRegistryRoots(root, postman, clock, ghab, registries, { recipients, timeoutMs });
+}

package/esm/keri/npm/src/app/credentials/verifying.js

@@ -7,7 +7,8 @@
  *
  * TypeScript divergence:
  * - ordinary outcomes are explicit decisions instead of exception-only control
- *   flow; durable corruption and unsupported `DI2I` still fail explicitly
+ *   flow; durable corruption and unsupported delegated `DI2I`/`DI1I` still
+ *   fail explicitly
  */
 import { Dater, Ilks, Saider, } from "cesr-ts";
 import { Deck } from "../../core/deck.js";
@@ -268,10 +269,18 @@ export class Verifier {
         }
         const attrib = creder.attrib;
         let operator = op;
-        if (operator !== "I2I" && operator !== "DI2I" && operator !== "NI2I") {
+        if (operator === "I1I" || operator === "DI1I") {
+            // Issuer identity suppresses the issuee default and never reads issuees.
+            if (creder.issuer !== issuer) {
+                if (operator === "I1I")
+                    return null;
+                throw new ValidationError("DI1I credential chain verification is not implemented.");
+            }
+        }
+        else if (operator !== "I2I" && operator !== "DI2I" && operator !== "NI2I") {
             operator = isRecord(attrib) && typeof attrib.i === "string" ? "I2I" : "NI2I";
         }
-        if (operator !== "NI2I") {
+        if (operator === "I2I" || operator === "DI2I") {
             if (!isRecord(attrib) || typeof attrib.i !== "string") {
                 return null;
             }

package/esm/keri/npm/src/app/delivery/forwarding.js

@@ -11,9 +11,31 @@ import { abortable } from "../runtime/abortable.js";
 import { runtimeTurn } from "../runtime/runtime-turn.js";
 import { CesrHttpRefusal } from "../transport/cesr-egress.js";
 import { messengerFrom, streamMessengerFrom } from "../transport/messengering.js";
-import { TCPMessenger } from "../transport/tcp-messenger.js";
+import { requireTcpDialer } from "../transport/tcp-dialer.js";
 import { TransportError } from "../transport/transport-error.js";
 import { introduce } from "./introducing.js";
+/**
+ * A v2 message refused for a peer this node must treat as v1.
+ *
+ * A v1 parser treats a v2 version string as an extraction failure and discards the rest of
+ * its stream, so sending would lose more than this one message.
+ */
+export class PeerVersionError extends ValidationError {
+}
+/**
+ * Whether an AID's own accepted KEL ends in a v1 event, which is the only evidence of a v1 reader.
+ *
+ * An AID with no accepted KEL is not refused. A delegate awaiting approval has only an escrowed
+ * inception, and refusing its approval traffic would stop the delegation from ever completing.
+ */
+function knownV1Peer(hby, aid) {
+    const kever = hby.db.getKever(aid);
+    return kever !== null && kever !== undefined && kever.serder.pvrsn.major < 2;
+}
+/** Whether any frame of this complete signed wire needs a v2 reader. */
+function wireNeedsV2(message) {
+    return parseBytes(message).some(frame => frame.body.pvrsn.major >= 2 || (frame.gvrsn?.major ?? 1) >= 2);
+}
 /**
  * Preserve resolved endpoint schemes and signed bytes for concrete transport construction.
  *
@@ -374,11 +396,20 @@ export class Poster {
                         failed.push(new ValidationError(`No supported endpoint URL for ${endpoint.eid}.`));
                         continue;
                     }
-                    const target = yield* this.prepareBytesTarget(hab, route, {
-                        eid: endpoint.eid,
-                        url: endpoint.url,
-                        urls: endpoint.urls,
-                    }, evt);
+                    let target;
+                    try {
+                        target = yield* this.prepareBytesTarget(hab, route, {
+                            eid: endpoint.eid,
+                            url: endpoint.url,
+                            urls: endpoint.urls,
+                        }, evt);
+                    }
+                    catch (error) {
+                        if (!(error instanceof PeerVersionError))
+                            throw error;
+                        failed.push(error);
+                        continue;
+                    }
                     try {
                         if (target.kind !== "stored") {
                             const refusal = yield* this.sendPreparedTarget(target, evt, signal);
@@ -416,7 +447,7 @@ export class Poster {
     *sendPreparedTarget(target, evt, signal) {
         if (target.kind === "tcp" && evt.replies) {
             // Explicit duplex work retains its receive owner; send-only factories need none.
-            yield* new TCPMessenger(target.url, this.clock, this.protocol).send(target.message, {
+            yield* requireTcpDialer(this.http).messenger(target.url, this.clock, this.protocol).send(target.message, {
                 signal,
                 replies: true,
             });
@@ -482,11 +513,18 @@ export class Poster {
      * @param endpoint One selected endpoint AID and URL from the route.
      * @param evt Original signed source and concrete ordinary/stream operation.
      * @returns A prepared remote target, or stored after authorized local mailbox publication.
+     * @throws PeerVersionError when the wire needs a v2 reader that this peer is known not to be.
      */
     *prepareBytesTarget(hab, route, endpoint, evt) {
+        if (wireNeedsV2(evt.msg) && knownV1Peer(this.hby, evt.dest)) {
+            throw new PeerVersionError(`Refusing a v2 message for ${evt.dest}, whose latest accepted event is v1.`);
+        }
         if (route.kind !== "direct") {
             return yield* this.prepareForwardedTarget(hab, evt.dest, evt.topic, evt, endpoint);
         }
+        if (wireNeedsV2(evt.msg) && knownV1Peer(this.hby, endpoint.eid)) {
+            throw new PeerVersionError(`Refusing a v2 message for endpoint ${endpoint.eid}, whose latest accepted event is v1.`);
+        }
         return remoteCesrTarget(endpoint, evt.msg);
     }
     /**
@@ -516,6 +554,10 @@ export class Poster {
         else {
             msgs.push(evt.msg);
         }
+        // The provider reads the envelope, so it must read v2 whenever the envelope or child is v2.
+        if ((hab.kelVersion.major >= 2 || msgs.some(wireNeedsV2)) && knownV1Peer(this.hby, endpoint.eid)) {
+            throw new PeerVersionError(`Refusing a v2 envelope for provider ${endpoint.eid}, whose latest accepted event is v1.`);
+        }
         const forwarded = [];
         for (const message of msgs)
             forwarded.push(yield* buildForwardedDelivery(hab, { recipient, topic, message }));

package/esm/keri/npm/src/app/exchanges/exchanging.js

@@ -142,8 +142,11 @@ export class Exchanger {
     }
     /** Resolve the configured body-version route owner without dispatching or changing evidence. */
     handlerFor(serder) {
-        const route = serder.route ?? "";
-        return this.versionedRoutes.get(route)?.get(serder.pvrsn.major) ?? this.routes.get(route);
+        return this.routeHandler(serder.route ?? "", serder.pvrsn.major);
+    }
+    /** Resolve the owner one route and protocol major would dispatch to, without a message body. */
+    routeHandler(route, major) {
+        return this.versionedRoutes.get(route)?.get(major) ?? this.routes.get(route);
     }
     /**
      * Verify, persist, and dispatch one inbound `exn`.
@@ -209,7 +212,7 @@ export class Exchanger {
         const nests = args.nests?.length
             ? yield* abortable((signal) => prepareNests(args.nests, signal))
             : undefined;
-        const result = this.hby.db.env.transactionSync(() => {
+        const result = this.hby.db.transaction(() => {
             if (selectedGrant) {
                 const db = this.hby.db;
                 const stored = selectedGrant === "proof" ? db.epse.get([said]) : db.exns.get([said]) ?? db.epse.get([said]);
@@ -268,9 +271,7 @@ export class Exchanger {
             return admission;
         });
         // Durable completion joins the actual LMDB flush; no external file lifetime remains.
-        yield* abortable(async () => {
-            await this.hby.db.env.flushed;
-        });
+        yield* this.hby.db.flushed();
         if (!result)
             return undefined;
         for (const cue of result.cues)
@@ -448,7 +449,7 @@ export class Exchanger {
         const table = schema ? this.hby.db.emse : this.hby.db.epse;
         let end;
         // Capture a finite key horizon without retaining bodies or holding a cursor across mutations.
-        for (const key of table.sdb.getKeys({ reverse: true, limit: 1 })) {
+        for (const key of this.hby.db.scanKeys(table.sdb, { reverse: true, limit: 1 })) {
             end = b(`${textDecoder.decode(key)}\0`);
         }
         if (!end) {
@@ -457,7 +458,7 @@ export class Exchanger {
         let start;
         for (;;) {
             let physical;
-            for (const key of table.sdb.getKeys({ start, end, limit: 1 })) {
+            for (const key of this.hby.db.scanKeys(table.sdb, { start, end, limit: 1 })) {
                 physical = textDecoder.decode(key);
             }
             if (!physical)
@@ -1291,7 +1292,7 @@ export class Exchanger {
     /** Decide expiry and remove pending rows in the same native transaction. */
     *expirePending(serder) {
         const said = serder.said;
-        const result = this.hby.db.env.transactionSync(() => {
+        const result = this.hby.db.transaction(() => {
             const status = this.escrowStatus(said);
             if (status.kind === "accepted") {
                 this.clearPending(serder);
@@ -1301,9 +1302,7 @@ export class Exchanger {
                 return undefined;
             return this.retireCurrent(serder, this.expiryReport(status));
         });
-        yield* abortable(async () => {
-            await this.hby.db.env.flushed;
-        });
+        yield* this.hby.db.flushed();
         return result;
     }
     /** Clear only dependency markers, keeping all accepted evidence and metadata intact. */