keri-ts 2.0.1 → 2.1.0

package/esm/keri/npm/src/cli/endpoints/oobi.js

@@ -3,7 +3,7 @@ import { OOBI_MAILBOX_TOPIC, OOBI_REQUEST_ROUTE, oobiRequestExn } from "../../ap
 import { sendExchangeMessage } from "../../app/exchanges/exchange-messaging.js";
 import { enqueueOobi, runAgentRuntimeUntil, runtimeOobiConverged } from "../../app/runtime/agent-runtime.js";
 import { systemClock } from "../../app/runtime/runtime-clock.js";
-import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { NodeHttpClient } from "../../app/transport/node-http-client.js";
 import { ValidationError } from "../../core/errors.js";
 import { EndpointRoles, isEndpointRole } from "../../core/roles.js";
 import { parseBooleanOption, parseStringOption } from "../common/parsing.js";
@@ -191,7 +191,7 @@ export function* oobiRequestCommand(args) {
         skipSignator: false,
     }, function* ({ hby, hab }) {
         const exn = oobiRequestExn(hab, recipient, url);
-        const { serder } = yield* sendExchangeMessage(hby, hab, new FetchHttpClient(), systemClock, {
+        const { serder } = yield* sendExchangeMessage(hby, hab, new NodeHttpClient(), systemClock, {
             dest: recipient,
             route: OOBI_REQUEST_ROUTE,
             topic: OOBI_MAILBOX_TOPIC,

package/esm/keri/npm/src/cli/identity/challenge.js

@@ -5,7 +5,7 @@ import { Organizer } from "../../app/identity/organizing.js";
 import { isLocalGroupHab } from "../../app/multisig/group-members.js";
 import { runAgentRuntime } from "../../app/runtime/agent-runtime.js";
 import { systemClock } from "../../app/runtime/runtime-clock.js";
-import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { NodeHttpClient } from "../../app/transport/node-http-client.js";
 import { ValidationError } from "../../core/errors.js";
 import { parseBooleanOption, parseIntegerOption, parseNumberOption, parseStringOption } from "../common/parsing.js";
 import { withAgentRuntime, withExistingHab } from "../common/context.js";
@@ -62,7 +62,7 @@ export function* challengeRespondCommand(args) {
             throw new ValidationError("Challenge respond does not coordinate group approval. Select the responding member alias.");
         }
         const payload = { words };
-        const { serder } = yield* sendExchangeMessage(hby, hab, new FetchHttpClient(), systemClock, {
+        const { serder } = yield* sendExchangeMessage(hby, hab, new NodeHttpClient(), systemClock, {
             dest: recipient,
             route: CHALLENGE_RESPONSE_ROUTE,
             topic: "challenge",

package/esm/keri/npm/src/cli/identity/incept.js

@@ -3,7 +3,7 @@ import { resolveBootstrap } from "../../app/bootstrap/bootstrapping.js";
 import { createProtocolProcessor } from "../../app/protocol/protocol-processing.js";
 import { createAgentRuntime, runAgentRuntimeUntil, } from "../../app/runtime/agent-runtime.js";
 import { systemClock } from "../../app/runtime/runtime-clock.js";
-import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { NodeHttpClient } from "../../app/transport/node-http-client.js";
 import { ValidationError } from "../../core/errors.js";
 import { assertBootstrapComplete } from "../common/bootstrap.js";
 import { createConfiger } from "../../app/identity/configing.js";
@@ -50,7 +50,7 @@ function mergeWithFile(args) {
  */
 export function* inceptCommand(args) {
     // Select one HTTP implementation for all work owned by this command.
-    const http = new FetchHttpClient();
+    const http = new NodeHttpClient();
     const inceptArgs = {
         name: parseStringOption(args.name, "name"),
         base: parseStringOption(args.base, "base"),

package/esm/keri/npm/src/cli/identity/init.js

@@ -1,8 +1,9 @@
 import { Encrypter } from "cesr-ts";
 import { resolveBootstrap } from "../../app/bootstrap/bootstrapping.js";
 import { createConfiger } from "../../app/identity/configing.js";
-import { branToSeedAeid, createHabery } from "../../app/identity/habbing.js";
-import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { branToSeedAeid } from "../../app/identity/habbing.js";
+import { createHabery } from "../../app/identity/lmdb-habery.js";
+import { NodeHttpClient } from "../../app/transport/node-http-client.js";
 import { ValidationError } from "../../core/errors.js";
 import { assertBootstrapComplete } from "../common/bootstrap.js";
 import { parseBooleanOption, parseStringOption } from "../common/parsing.js";
@@ -75,7 +76,7 @@ export function* initCommand(args) {
             seed,
             salt: initArgs.salt,
         });
-        assertBootstrapComplete(yield* resolveBootstrap(hby, new FetchHttpClient()));
+        assertBootstrapComplete(yield* resolveBootstrap(hby, new NodeHttpClient()));
         created = { keystore: hby.ks.path, database: hby.db.path, aeid: hby.mgr.aeid };
     }
     catch (error) {

package/esm/keri/npm/src/cli/identity/interact.js

@@ -1,6 +1,6 @@
 import { createProtocolProcessor } from "../../app/protocol/protocol-processing.js";
 import { systemClock } from "../../app/runtime/runtime-clock.js";
-import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { NodeHttpClient } from "../../app/transport/node-http-client.js";
 import { isLocalGroupHab } from "../../app/multisig/group-members.js";
 import { Receiptor, WitnessReceiptor } from "../../app/witness/receipting.js";
 import { ValidationError } from "../../core/errors.js";
@@ -19,7 +19,7 @@ import { resolveWitnessAuths } from "../common/witness-auth.js";
  */
 export function* interactCommand(args) {
     // Select one HTTP implementation for all work owned by this command.
-    const http = new FetchHttpClient();
+    const http = new NodeHttpClient();
     const interactArgs = {
         name: parseStringOption(args.name, "name"),
         base: parseStringOption(args.base, "base"),

package/esm/keri/npm/src/cli/identity/rotate.js

@@ -1,6 +1,6 @@
 import { createProtocolProcessor } from "../../app/protocol/protocol-processing.js";
 import { systemClock } from "../../app/runtime/runtime-clock.js";
-import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { NodeHttpClient } from "../../app/transport/node-http-client.js";
 import { createAgentRuntime, runAgentRuntimeUntil, } from "../../app/runtime/agent-runtime.js";
 import { ValidationError } from "../../core/errors.js";
 import { resolveDelegationCommunicationHab } from "../../app/identity/delegating.js";
@@ -59,7 +59,7 @@ function difference(left, right) {
  */
 export function* rotateCommand(args, { witnessAuths } = {}) {
     // Select one HTTP implementation for all work owned by this command.
-    const http = new FetchHttpClient();
+    const http = new NodeHttpClient();
     const rotateArgs = {
         name: parseStringOption(args.name, "name"),
         base: parseStringOption(args.base, "base"),

package/esm/keri/npm/src/cli/messaging/exchange.js

@@ -1,7 +1,7 @@
 import { sendExchangeMessage } from "../../app/exchanges/exchange-messaging.js";
 import { isLocalGroupHab } from "../../app/multisig/group-members.js";
 import { systemClock } from "../../app/runtime/runtime-clock.js";
-import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { NodeHttpClient } from "../../app/transport/node-http-client.js";
 import { ValidationError } from "../../core/errors.js";
 import { withExistingHab } from "../common/context.js";
 import { parseBooleanOption, parseExnDataItems, parseStringListOption, parseStringOption } from "../common/parsing.js";
@@ -53,7 +53,7 @@ export function* exchangeSendCommand(args) {
         if (isLocalGroupHab(hby, hab)) {
             throw new ValidationError("Generic exchange send does not coordinate group approval. Use a member alias or the matching group IPEX workflow.");
         }
-        const { serder } = yield* sendExchangeMessage(hby, hab, new FetchHttpClient(), systemClock, {
+        const { serder } = yield* sendExchangeMessage(hby, hab, new NodeHttpClient(), systemClock, {
             dest: recipient,
             route,
             topic: commandArgs.topic,

package/esm/keri/npm/src/cli/messaging/multisig.js

@@ -1,4 +1,5 @@
 import { action, spawn } from "effection";
+import { resealRegistryRoots, } from "../../app/credentials/root-replicating.js";
 import { resolveDelegationCommunicationHab } from "../../app/identity/delegating.js";
 import { endpointRoleAccepted, groupSigningMembers, isLocalGroupHab, localGroupMember, proposeGroupEndpointRole, } from "../../app/identity/endpoint-roleing.js";
 import { uniqueMembers } from "../../app/multisig/group-members.js";
@@ -7,12 +8,24 @@ import { approvePendingMultisigProposal, commitAcceptedGroupMembers, eventAccept
 import { runAgentRuntime } from "../../app/runtime/agent-runtime.js";
 import { Receiptor, WitnessReceiptor } from "../../app/witness/receipting.js";
 import { ValidationError } from "../../core/errors.js";
+import { isV2RegistryRoute } from "../../core/exchange/protocol-exchanging.js";
 import { Roles } from "../../core/roles.js";
 import { withAgentRuntime } from "../common/context.js";
 import { loadOptionObject, loadRotateFileOptions, parseBooleanOption, parseCountOption, parseDataItems, parseFileData, parseKeriVersionOption, parseNumberOption, parseStringListOption, parseStringOption, parseThresholdOption, } from "../common/parsing.js";
 import { waitForIssuedCredential, waitForTelPublication } from "../common/tel-completion.js";
 import { resolveWitnessAuths } from "../common/witness-auth.js";
 const MULTISIG_TOPIC = "multisig";
+/**
+ * Re-seal held registry roots to members an accepted group rotation added or
+ * rekeyed, as KERIpy `kli multisig rotate|join`. Runs while the command's
+ * runtime worker delivers; every outcome is returned, none fails the rotation.
+ */
+function* resealAfterRotation(hby, runtime, group, rotation) {
+    const ghab = hby.habs.get(group), root = runtime.registryRoot;
+    if (!ghab || !root)
+        return [];
+    return yield* resealRegistryRoots(root, runtime.postman, runtime.clock, ghab, rotation);
+}
 function requireText(value, label) {
     if (!value) {
         throw new ValidationError(`${label} is required and cannot be empty`);
@@ -132,6 +145,9 @@ export function* multisigJoinCommand(args) {
                 if (local.route === MULTISIG_ICP_ROUTE || local.route === MULTISIG_ROT_ROUTE) {
                     yield* completeDelegationIfNeeded(hby, runtime, local.group, commandArgs.proxy);
                 }
+                if (local.route === MULTISIG_ROT_ROUTE) {
+                    return { ...local, rootCopies: yield* resealAfterRotation(hby, runtime, local.group, local.embedded) };
+                }
             }
             return local;
         }
@@ -149,12 +165,19 @@ export function* multisigJoinCommand(args) {
             tel.publicationComplete = publication.complete(tel.pre, tel.sn);
             return result;
         }
+        if (isV2RegistryRoute(result.route)) {
+            result.accepted = yield* settleRegistryApproval(hby, runtime, result, commandArgs, approval.deadline);
+            return result;
+        }
         if (result.accepted) {
             yield* receiptAcceptedEvent(hby, result.group, commandArgs, runtime);
             if (result.route === MULTISIG_ICP_ROUTE
                 || result.route === MULTISIG_ROT_ROUTE) {
                 yield* completeDelegationIfNeeded(hby, runtime, result.group, commandArgs.proxy);
             }
+            if (result.route === MULTISIG_ROT_ROUTE) {
+                return { ...result, rootCopies: yield* resealAfterRotation(hby, runtime, result.group, result.embedded) };
+            }
         }
         return result;
     });
@@ -253,11 +276,13 @@ export function* multisigRotateCommand(args) {
             auto: true,
         }));
         let delegationPhase = null;
+        let rootCopies = [];
         if (accepted) {
             // The proposer's own acceptance must commit the rotated membership as a joiner's does.
             commitAcceptedGroupMembers(hby, rotated.serder, smids, rmids);
             yield* receiptAcceptedEvent(hby, rotated.hab.pre, commandArgs, runtime);
             delegationPhase = yield* completeDelegationIfNeeded(hby, runtime, rotated.hab.pre, commandArgs.proxy);
+            rootCopies = yield* resealAfterRotation(hby, runtime, rotated.hab.pre, rotated.serder.said);
         }
         return {
             route: MULTISIG_ROT_ROUTE,
@@ -267,6 +292,7 @@ export function* multisigRotateCommand(args) {
             deliveries,
             state: hby.db.getState(rotated.hab.pre),
             delegationPhase: delegationPhase,
+            rootCopies,
         };
     });
 }
@@ -432,8 +458,9 @@ function approvePrompt(args, context) {
  * @param pre Accepted group event subject.
  * @param args Witness authentication and HTTP endpoint mode choices.
  * @param runtime Borrowed composed runtime; caller owns its worker and store lifetime.
+ * @param sn Accepted event ordinal to receipt; defaults to the current event.
  */
-function* receiptAcceptedEvent(hby, pre, args, runtime) {
+function* receiptAcceptedEvent(hby, pre, args, runtime, sn) {
     const kever = hby.db.getKever(pre);
     if (!kever || kever.wits.length === 0) {
         return;
@@ -444,11 +471,42 @@ function* receiptAcceptedEvent(hby, pre, args, runtime) {
     });
     if (args.endpoint) {
         const receiptor = new Receiptor(hby, runtime.protocol, runtime.http, runtime.clock);
-        yield* receiptor.receipt(pre, { sn: kever.sn, auths });
+        yield* receiptor.receipt(pre, { sn: sn ?? kever.sn, auths });
     }
     else {
         const witDoer = new WitnessReceiptor(hby, runtime.protocol, runtime.http, runtime.clock);
-        yield* witDoer.submit(pre, { sn: kever.sn, auths });
+        yield* witDoer.submit(pre, { sn: sn ?? kever.sn, auths });
+    }
+}
+/**
+ * Settle one approved v2 RIP/BUP as KERIpy's join Counselor does: wait for the group's KEL acceptance of
+ * the exact anchor, converge that anchor's witness receipts, and let the anchor escrow accept the TEL event.
+ * The TEL event needs a fully witnessed anchor, so receipting only after TEL acceptance would never accept it.
+ *
+ * @returns Whether the approved TEL event is accepted before the approval deadline.
+ */
+function* settleRegistryApproval(hby, runtime, result, args, deadline) {
+    const store = runtime.acdc?.store, tel = store?.event(result.embedded);
+    const anc = hby.db.exns.get([result.said])?.sad?.a?.anc;
+    if (!store || !tel || typeof tel.sad?.n !== "string" || typeof anc !== "string")
+        return result.accepted;
+    const regid = tel.ilk === "rip" ? tel.said : tel.regid, sn = Number(BigInt(`0x${tel.sad.n}`));
+    let receipted = false;
+    while (true) {
+        if (store.seqEvent(regid, sn)?.said === tel.said)
+            return true;
+        const anchor = hby.db.getEvtSerder(result.group, anc);
+        if (!receipted && anchor && hby.db.kels.getLast(result.group, anchor.sn) === anc) {
+            if (!hby.db.fullyWitnessed(anchor))
+                yield* receiptAcceptedEvent(hby, result.group, args, runtime, anchor.sn);
+            receipted = true;
+        }
+        yield* runtime.protocol.processEscrowsOnce();
+        if (store.seqEvent(regid, sn)?.said === tel.said)
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        yield* sleep(Math.min(250, deadline - Date.now()));
     }
 }
 /** Approval waits allow fractional seconds and zero, but never coerce absence or overflow a deadline. */

package/esm/keri/npm/src/cli/tools/annotate.js

@@ -1,7 +1,8 @@
 import * as dntShim from "../../_dnt.shims.js";
 import { annotate } from "cesr-ts";
 import { abortable } from "../../app/runtime/abortable.js";
-import { collectBytes, fileBytes, streamBytes } from "../../app/transport/byte-source.js";
+import { collectBytes, streamBytes } from "../../app/transport/byte-source.js";
+import { fileBytes } from "../../app/transport/file-bytes.js";
 import { parseBooleanOption, parseStringOption } from "../common/parsing.js";
 import { writeStdout } from "../output.js";
 import { colorizeAnnotatedOutput } from "./annotate-color.js";

package/esm/keri/npm/src/cli/tools/benchmark.js

@@ -1,7 +1,8 @@
 import * as dntShim from "../../_dnt.shims.js";
 import { benchmarkParser, } from "cesr-ts";
 import { abortable } from "../../app/runtime/abortable.js";
-import { collectBytes, fileBytes, streamBytes } from "../../app/transport/byte-source.js";
+import { collectBytes, streamBytes } from "../../app/transport/byte-source.js";
+import { fileBytes } from "../../app/transport/file-bytes.js";
 import { ValidationError } from "../../core/errors.js";
 import { parseBooleanOption, parseCountOption, parseStringOption } from "../common/parsing.js";
 import { writeStdout } from "../output.js";

package/esm/keri/npm/src/cli/tools/db-dump.js

@@ -1,10 +1,7 @@
 import { displayStr } from "../../core/bytes.js";
 import { DatabaseOperationError, ValidationError } from "../../core/errors.js";
 import { RawRecord } from "../../core/records.js";
-import { createBaser } from "../../db/basing.js";
-import { createKeeper } from "../../db/keeping.js";
-import { createMailboxer } from "../../db/mailbox/mailboxing.js";
-import { createNoter } from "../../db/noting.js";
+import { createBaser, createKeeper, createMailboxer, createNoter } from "../../db/lmdb-stores.js";
 import { parseBooleanOption, parseIntegerOption, parseStringOption } from "../common/parsing.js";
 const DOMAIN_FACTORIES = {
     baser: {

package/esm/keri/npm/src/core/bytes.js

@@ -1,3 +1,12 @@
+/** Unsigned bytewise order, shorter first on a shared prefix, as LMDB orders keys. */
+export function compareBytes(left, right) {
+    const shared = Math.min(left.length, right.length);
+    for (let i = 0; i < shared; i++) {
+        if (left[i] !== right[i])
+            return left[i] - right[i];
+    }
+    return left.length - right.length;
+}
 /**
  * Check if keyBytes starts with prefixBytes
  */

package/esm/keri/npm/src/core/kel/delegation-ancestry.js

@@ -0,0 +1,92 @@
+import { dgKey } from "../../db/core/keys.js";
+import { ValidationError } from "../errors.js";
+/** Whether one accepted delegator event carries the exact `{i,s,d}` seal of a delegated inception. */
+function approves(event, dip) {
+    return event.eventSeals.some((seal) => seal.i.qb64 === dip.pre && seal.s.numh === dip.snh && seal.d.qb64 === dip.said);
+}
+/**
+ * Find the delegator's accepted approval of `dip`.
+ *
+ * The aess source couple is a fast path only when it names a first-seen event
+ * that actually carries the dip seal; protected intake can retain an unverified
+ * hint, which neither grants authority nor vetoes a later genuine approval.
+ * Otherwise any first-seen delegator event carrying the seal is accepted,
+ * including one superseded since, so cached and uncached validators agree.
+ */
+function acceptedApproval(db, delegator, dip) {
+    const source = db.aess.get(dgKey(dip.pre, dip.said));
+    if (source) {
+        const digest = source[1].qb64;
+        if (db.fons.get(dgKey(delegator, digest))) {
+            const approval = db.getEvtSerder(delegator, digest);
+            if (!approval)
+                throw new ValidationError(`Missing first-seen delegation event ${delegator}:${digest}.`);
+            if (approves(approval, dip))
+                return approval;
+        }
+    }
+    for (const [, , said] of db.fels.getAllItemIter(delegator)) {
+        if (!db.fons.get(dgKey(delegator, said)))
+            continue;
+        const event = db.getEvtSerder(delegator, said);
+        if (event && approves(event, dip))
+            return event;
+    }
+    return null;
+}
+/**
+ * Resolve whether `pre` is an anchored delegated descendant of `ancestor`, at any depth.
+ *
+ * Every hop requires the delegate's fixed dip, the delegator's inception
+ * permission (DND is checked before the anchor) and an accepted delegator
+ * approval of that dip. Identity (`pre === ancestor`) is not delegation; the
+ * DI2I/DI1I callers own that widening.
+ *
+ * Security rationale, preserved from KERIpy's `relating.delegationRefusal`:
+ * - The delegate's own `di` (Kever.delpre) is a self-assertion. Local, member
+ *   or witness acceptance can admit a dip whose delegator never anchored it, so
+ *   only the delegator's anchored approval seal records actual authority.
+ * - DND is re-read from the delegator's accepted inception, not mutable state,
+ *   because that same exemption can admit dips a disinterested validator would
+ *   refuse; identical bytes must not get opposite verdicts by host topology.
+ * - Only the dip anchor matters. A delegation is settled at inception; later
+ *   delegate rotations, delegator rotations, witness changes and retirement do
+ *   not renew or revoke it.
+ * - No depth bound: a delegated prefix digests its own dip, so a cycle implies
+ *   a hash cycle. The visited set only terminates corrupt local state.
+ *
+ * Unlike KERIpy, lookup never repairs aess; accepted KEL intake owns those writes.
+ * An aess couple naming a first-seen event that is absent from `evts` is
+ * corrupt durable state and throws.
+ */
+export function delegationAncestry(db, pre, ancestor) {
+    const seen = new Set();
+    while (!seen.has(pre)) {
+        seen.add(pre);
+        const kever = db.getKever(pre);
+        if (!kever)
+            return { kind: "pending", reason: `Missing delegate KEL ${pre}.` };
+        const parent = kever.delpre;
+        if (!parent)
+            return { kind: "refused", reason: `Delegation chain ends at ${pre}.` };
+        if (!db.getKever(parent))
+            return { kind: "pending", reason: `Missing delegator KEL ${parent}.` };
+        // Configuration is fixed at inception, including after delegator rotations.
+        const inceptionSaid = db.kels.getLast(parent, 0);
+        const inception = inceptionSaid ? db.getEvtSerder(parent, inceptionSaid) : null;
+        if (!inception)
+            return { kind: "pending", reason: `Missing delegator inception ${parent}.` };
+        if (inception.traits.includes("DND"))
+            return { kind: "refused", reason: `Delegator ${parent} carries DND.` };
+        const dip = db.getEvtSerder(pre, pre);
+        if (!dip)
+            return { kind: "pending", reason: `Missing delegated inception ${pre}.` };
+        if (!acceptedApproval(db, parent, dip)) {
+            return { kind: "pending", reason: `Missing accepted delegation approval for ${pre} from ${parent}.` };
+        }
+        if (parent === ancestor)
+            return { kind: "valid" };
+        pre = parent;
+    }
+    return { kind: "refused", reason: `Delegation chain cycles at ${pre}.` };
+}

package/esm/keri/npm/src/core/kel/eventing.js

@@ -126,7 +126,6 @@ export class Kevery {
         return this.settleEventDecision(envelope);
     }
     settleEventDecision(input, escrow) {
-        const env = this.db.env;
         if (this.db.inWriteTransaction) {
             throw new Error("Kevery must own the KEL transaction; process events outside caller-owned writers");
         }
@@ -151,7 +150,7 @@ export class Kevery {
                 this.removeEscrow(escrow.kind, escrow.pre, escrow.on, escrow.said);
             return decision;
         };
-        const decision = env.transactionSync(write);
+        const decision = this.db.transaction(write);
         this.publishEventState(metadata?.accepted);
         if (metadata?.cues.length)
             this.cues.extend(metadata.cues);

package/esm/keri/npm/src/core/kel/kever.js

@@ -551,21 +551,23 @@ export class Kever {
         return indices;
     }
     /**
-     * Return indices contributed by keys also present in a locally controlled KEL.
+     * Return indices of keys contributed by this group's local members.
      *
-     * Current `keri-ts` scope:
-     * - approximates KERIpy's locally membered signature filtering by comparing
-     *   verfer qb64 values across locally accepted kevers
+     * KERIpy strips its one local member (`habord.mid`). A keri-ts Habery may hold
+     * several members of one group, so every locally controlled signing member
+     * counts. The group's own prefix is local too and must not: its keys are all
+     * of `verfers`.
      */
     locallyContributedIndices(verfers) {
+        const record = this.db.getHab(this.pre);
         const localKeys = new Set();
-        for (const pre of this.prefixes) {
-            const kever = this.db.getKever(pre);
-            if (!kever) {
+        for (const mid of new Set([record?.mid, ...(record?.smids ?? [])])) {
+            if (!mid || !this.locallyOwned(mid)) {
                 continue;
             }
-            for (const verfer of kever.verfers) {
-                localKeys.add(verfer.qb64);
+            const key = this.db.getKever(mid)?.verfers[0]?.qb64;
+            if (key) {
+                localKeys.add(key);
             }
         }
         const indices = [];

package/esm/keri/npm/src/core/mailbox/kram-policy.js

@@ -298,11 +298,10 @@ export class KramPolicy {
     }
     /** Publish policy rows and their restart-safe transition metadata atomically. */
     commit(mutate) {
-        const env = this.db.env;
-        if (!env)
+        if (!this.db.opened)
             throw new Error("KRAM policy database is closed");
         const next = JSON.stringify(this.state);
-        env.transactionSync(() => {
+        this.db.transaction(() => {
             if (this.db.hbys.get(policyKey) !== this.storedState)
                 throw new Error("KRAM policy changed during transition");
             mutate();

package/esm/keri/npm/src/core/mailbox/kram-pruning.js

@@ -19,7 +19,7 @@ export class KramPruner {
             writable: true,
             value: policy
         });
-        Object.defineProperty(this, "env", {
+        Object.defineProperty(this, "bound", {
             enumerable: true,
             configurable: true,
             writable: true,
@@ -46,24 +46,18 @@ export class KramPruner {
         if (policy.db !== db)
             throw new Error("KRAM pruning policy must use its backing store");
     }
-    /** Use committed environment state, never assume transaction IDs increment by one. */
-    version() {
-        const version = this.db.env.getStats().lastTxnId;
-        if (!Number.isSafeInteger(version) || version < 0)
-            throw new Error("Invalid KRAM pruning transaction ID");
-        return version;
-    }
     /** Capture a finite horizon and release each tail/next iterator before returning. */
     next(family, scan) {
         const table = [this.db.msgc, this.db.tmsc, this.db.xdt][family];
         if (!scan.initialized) {
-            for (const key of table.sdb.getKeys({ reverse: true, limit: 1 }))
+            for (const key of this.db.scanKeys(table.sdb, { reverse: true, limit: 1 }))
                 scan.end = this.after(key);
             scan.initialized = true;
         }
         if (scan.end) {
-            for (const key of table.sdb.getKeys({ start: scan.start, end: scan.end, limit: 1 }))
+            for (const key of this.db.scanKeys(table.sdb, { start: scan.start, end: scan.end, limit: 1 })) {
                 return key.slice();
+            }
         }
     }
     /** Qualified cache components contain no NUL, so this seeks strictly after a complete key. */
@@ -102,17 +96,16 @@ export class KramPruner {
         if (!Number.isSafeInteger(maxRows) || maxRows < 1)
             throw new RangeError("Invalid KRAM pruning batch");
         const result = { kind: "pruned", visited: 0, removed: 0, openers: 0, passComplete: false };
-        const env = this.db.env;
-        if (!env)
+        if (!this.db.opened)
             throw new Error("KRAM pruning database is closed");
-        if (this.env !== env) {
-            this.env = env;
+        if (this.bound !== this.db.msgc.sdb) {
+            this.bound = this.db.msgc.sdb;
             this.phase = 0;
             this.scans = [{}, {}, {}];
             this.orphan = undefined;
         }
         this.policy.reconcile();
-        env.resetReadTxn();
+        this.db.refreshRead();
         while (result.visited < maxRows) {
             if (this.phase < 2) {
                 const scan = this.scans[this.phase], physical = this.next(this.phase, scan);
@@ -121,7 +114,7 @@ export class KramPruner {
                     continue;
                 }
                 const keys = this.keys(physical, this.phase + 2), table = this.phase ? this.db.tmsc : this.db.msgc;
-                env.transactionSync(() => {
+                this.db.transaction(() => {
                     const record = table.get(keys);
                     if (!record || !this.expired(record, when))
                         return;
@@ -144,17 +137,17 @@ export class KramPruner {
                 }
                 const [xid] = this.keys(physical, 1);
                 this.db.xdt.get(xid); // Deserialization failures remain corruption, not an absent opener.
-                this.orphan = { xid, physical, scan: {}, version: this.version() };
+                this.orphan = { xid, physical, scan: {}, version: this.db.writeVersion };
                 result.visited++;
                 continue;
             }
-            const candidate = this.orphan, version = this.version();
+            const candidate = this.orphan, version = this.db.writeVersion;
             if (candidate.version !== version) {
                 candidate.scan = {};
                 candidate.version = version;
             }
             // Capture committed version before opening a fresh read snapshot, including other-process writes.
-            env.resetReadTxn();
+            this.db.refreshRead();
             const physical = this.next(1, candidate.scan);
             if (physical) {
                 const keys = this.keys(physical, 3);
@@ -165,8 +158,8 @@ export class KramPruner {
             }
             else {
                 result.visited++;
-                const removed = env.transactionSync(() => {
-                    if (candidate.version !== this.version())
+                const removed = this.db.transaction(() => {
+                    if (candidate.version !== this.db.writeVersion)
                         return false;
                     if (this.db.xdt.rem(candidate.xid))
                         result.openers++;
@@ -174,7 +167,7 @@ export class KramPruner {
                 });
                 if (!removed) {
                     candidate.scan = {};
-                    candidate.version = this.version();
+                    candidate.version = this.db.writeVersion;
                     continue;
                 }
             }

package/esm/keri/npm/src/core/mailbox/kram-staging.js

@@ -98,9 +98,9 @@ function candidate(db, policy, incoming, receiverTime) {
  * borrowed from the current input and are never read or disposed by KRAM.
  */
 export function stageKram(db, policy, incoming, receiverTime) {
-    if (!db.env)
+    if (!db.opened)
         throw new Error("KRAM staging database is closed");
-    return db.env.transactionSync(() => {
+    return db.transaction(() => {
         const fresh = candidate(db, policy, incoming, receiverTime);
         if (fresh.kind === "rotated") {
             removeKramFactors(db, fresh.key);

package/esm/keri/npm/src/core/routing.js

@@ -820,7 +820,7 @@ export class BasicReplyRouteHandler {
             throw new Error("Endpoint handler must own the reply transaction; process replies outside caller-owned writers");
         }
         let queryCues = [];
-        const decision = this.rvy.db.env.transactionSync(() => {
+        const decision = this.rvy.db.transaction(() => {
             let osaider = this.rvy.db.eans.get(keys);
             if (osaider?.qb64 === args.diger.qb64)
                 osaider = null;
@@ -881,7 +881,7 @@ export class BasicReplyRouteHandler {
             throw new Error("Endpoint handler must own the reply transaction; process replies outside caller-owned writers");
         }
         let queryCues = [];
-        const decision = this.rvy.db.env.transactionSync(() => {
+        const decision = this.rvy.db.transaction(() => {
             let osaider = this.rvy.db.lans.get(keys);
             if (osaider?.qb64 === args.diger.qb64)
                 osaider = null;