keri-ts 2.0.1 → 2.2.0

package/esm/keri/npm/src/app/transport/cesr-egress.js

@@ -5,15 +5,19 @@
  * caller consumes that body before leaving the enclosing scope. Neither path
  * implicitly feeds successful response bytes into protocol processing.
  *
- * Match KERIpy's detached-attachment POST contract while retaining the exact
- * signed body. Only the known pre-intake Falcon media refusal permits a second
- * request; authentication/application failures and network errors are not retries.
+ * Match KERIpy HTTPMessenger's two wire shapes. A JSON/CBOR/MGPK frame is one
+ * detached-attachment POST retaining the exact signed body; only the known
+ * pre-intake Falcon media refusal permits a second request, and
+ * authentication/application failures and network errors are not retries.
+ * A native CESR frame (counter-prefixed body, text or binary domain) is one
+ * whole opaque PUT of the serialized frame, as KERIpy sends since PR 1751,
+ * because a native body is not JSON and cannot travel in the detached form.
  */
-import { attachmentPayload, byteString, collectPayload, parse, } from "cesr-ts";
+import { attachmentPayload, byteString, collectPayload, framePayload, Kinds, parse, sniff, } from "cesr-ts";
 import { call, ensure, race, resource, scoped } from "effection";
 import { ValidationError } from "../../core/errors.js";
 import { abortable, cleanupFailures, throwOnAbort } from "../runtime/abortable.js";
-import { CESR_ATTACHMENT_HEADER, CESR_CONTENT_TYPE, CESR_DESTINATION_HEADER, KERIPY_CESR_JSON_CONTENT_TYPE, } from "./cesr-http.js";
+import { buildCesrStreamRequest, CESR_ATTACHMENT_HEADER, CESR_CONTENT_TYPE, CESR_DESTINATION_HEADER, KERIPY_CESR_JSON_CONTENT_TYPE, } from "./cesr-http.js";
 /** Positive remote HTTP refusal, distinct from source, transport, storage and cleanup failure. */
 export class CesrHttpRefusal extends ValidationError {
     /**
@@ -108,19 +112,79 @@ function openFrameResponse(url, frame, http, options) {
         }
     });
 }
+/**
+ * Recognize a frame whose body is native CESR rather than a JSON/CBOR/MGPK message.
+ * KERIpy HTTPMessenger decides by sniffing the message cold start for a counter in
+ * either domain; a hydrated native body carries kind CESR and its raw bytes begin
+ * with that fixed-field counter. Opaque fallback bodies without a counter stay ordinary.
+ *
+ * @param frame Parsed frame whose body kind and raw bytes decide the wire shape.
+ * @returns True when the frame must travel as one whole PUT instead of a detached POST.
+ */
+export function isNativeCesrFrame(frame) {
+    if (frame.body.kind !== Kinds.cesr)
+        return false;
+    const cold = sniff(frame.body.raw);
+    return cold === "txt" || cold === "bny";
+}
+/**
+ * Select the qualification domain for one native frame's PUT body.
+ * The parser hydrates native bodies as qualified text, so the admitted attachment
+ * wire is the remaining evidence of a binary source; a bare body stays text.
+ *
+ * @param frame Native frame whose attachments retain their admitted domain.
+ * @returns The source domain KERIpy would have forwarded unchanged.
+ */
+function nativeFrameDomain(frame) {
+    const evidence = frame.attachments[0]?.raw;
+    return evidence && sniff(evidence) === "bny" ? "bny" : "txt";
+}
+/**
+ * Prepare KERIpy HTTPMessenger's native-stream PUT for one frame.
+ * The shared serializer emits the frame's root genus selector, body and one
+ * attachment enclosure in the source domain, and that whole payload is the body
+ * with an explicit length, exactly as HTTPStreamMessenger sends a prepared stream.
+ * Detached CESR-ATTACHMENT/CESR-Genus headers do not apply and no legacy media
+ * fallback exists; caller authentication headers are retained.
+ *
+ * @param frame Native frame; its serialized bytes are the complete request body.
+ * @param options Destination, extra headers and optional cancellation.
+ * @returns One PUT request whose body is the serialized frame.
+ */
+function* nativeFrameRequest(frame, options) {
+    const domain = nativeFrameDomain(frame);
+    const bytes = yield* abortable((signal) => collectPayload(framePayload(frame, { domain }), signal), options.signal);
+    const prepared = buildCesrStreamRequest(bytes, { destination: options.destination });
+    const headers = new Headers(options.headers);
+    headers.delete(CESR_DESTINATION_HEADER);
+    headers.delete(CESR_ATTACHMENT_HEADER);
+    headers.delete("CESR-Genus");
+    for (const [key, value] of Object.entries(prepared.headers))
+        headers.set(key, value);
+    headers.set("Content-Length", String(bytes.byteLength));
+    return {
+        method: "PUT",
+        redirect: "manual",
+        headers,
+        signal: options.signal,
+        body: prepared.body,
+    };
+}
 /**
  * Prepare finite request bytes before opening any network attempt.
- * Ordinary POSTs put normalized text attachments in CESR-ATTACHMENT and send the
- * original body. CESR-Genus retains the observed counter context when stream framing is removed.
- * Requests retain
+ * A native frame yields exactly one whole PUT. Ordinary POSTs put normalized text
+ * attachments in CESR-ATTACHMENT and send the original body. CESR-Genus retains
+ * the observed counter context when stream framing is removed. Requests retain
  * caller authentication headers; sender-owned framing/destination headers replace
  * conflicting caller values. The fallback shares the prepared bytes.
  *
  * @param frame Parsed signed body and attachments; framing preserves the signed body bytes.
  * @param options Destination, extra headers and optional cancellation for ordinary signed-message POSTs.
- * @returns Current and legacy media choices sharing the same signed body.
+ * @returns One native PUT, or the current and legacy media choices sharing the same signed body.
  */
 function* frameRequests(frame, options) {
+    if (isNativeCesrFrame(frame))
+        return [yield* nativeFrameRequest(frame, options)];
     const header = byteString(yield* abortable((signal) => collectPayload(attachmentPayload(frame, { domain: "txt" }), signal), options.signal));
     const body = frame.body.raw;
     const types = [CESR_CONTENT_TYPE, KERIPY_CESR_JSON_CONTENT_TYPE];
@@ -202,8 +266,8 @@ function* sendFrame(url, frame, http, options) {
 }
 /**
  * Send a CESR source and throw on a completed peer refusal.
- * One parsed frame becomes one POST, and its request scope closes before the next
- * source pull. A refusal stops the sequence; prior frames may already be delivered.
+ * One parsed frame becomes one request (a detached POST, or one whole PUT for a
+ * native frame), and its request scope closes before the next source pull. A refusal stops the sequence; prior frames may already be delivered.
  * Cancellation aborts active work, joins any pending source pull and returns the
  * parser iterator before leaving. There is no automatic retry beyond media fallback.
  * A pending asynchronous source pull can finish after cancellation is requested;
@@ -224,8 +288,8 @@ export function* postCesr(url, source, http, options = {}) {
 }
 /**
  * Send frames sequentially and return a completed peer refusal as data.
- * One parsed frame becomes one POST, and its request scope closes before the next
- * source pull. A refusal stops the sequence; prior frames may already be delivered.
+ * One parsed frame becomes one request (a detached POST, or one whole PUT for a
+ * native frame), and its request scope closes before the next source pull. A refusal stops the sequence; prior frames may already be delivered.
  * Cancellation aborts active work, joins any pending source pull and returns the
  * parser iterator before leaving. There is no automatic retry beyond media fallback.
  *

package/esm/keri/npm/src/app/transport/file-bytes.js

@@ -0,0 +1,41 @@
+/** Local-file byte source. Host-only: it opens files through `Deno`. */
+import * as dntShim from "../../_dnt.shims.js";
+import { checkLimit } from "./byte-source.js";
+/**
+ * Stream a local file with fixed-size owned buffers and close it on break or abort.
+ *
+ * @param path Local filesystem path opened read-only for this iteration.
+ * @param options Optional cancellation and positive read buffer size in bytes; defaults to 65536.
+ * @yields Owned buffers up to the selected chunk size until file EOF.
+ * @throws Open/read failures or cancellation; the file closes on EOF, break or failure.
+ */
+export async function* fileBytes(path, { signal, maxChunkBytes = 64 * 1024 } = {}) {
+    checkLimit(maxChunkBytes);
+    signal?.throwIfAborted();
+    const file = await dntShim.Deno.open(path, { read: true });
+    let closed = false;
+    /** Interrupt a pending read and release the file exactly once. */
+    const close = () => {
+        if (!closed) {
+            closed = true;
+            file.close();
+        }
+    };
+    signal?.addEventListener("abort", close, { once: true });
+    try {
+        while (true) {
+            signal?.throwIfAborted();
+            const chunk = new Uint8Array(maxChunkBytes);
+            const size = await file.read(chunk);
+            signal?.throwIfAborted();
+            if (size === null)
+                return;
+            if (size > 0)
+                yield chunk.subarray(0, size);
+        }
+    }
+    finally {
+        signal?.removeEventListener("abort", close);
+        close();
+    }
+}

package/esm/keri/npm/src/app/transport/http-client.js

@@ -4,6 +4,21 @@ import { ValidationError } from "../../core/errors.js";
 import { abortable } from "../runtime/abortable.js";
 import { collectBytes } from "./byte-source.js";
 import { TransportError } from "./transport-error.js";
+/**
+ * Native requests and signals that a pending `fetch` still needs. WebKit links an in-flight fetch to
+ * its abort signal only weakly: once the `Request`, or an `AbortSignal.any` composite, is garbage
+ * collected, `abort()` neither rejects the fetch nor closes the connection, so a halted caller waits
+ * forever on a request that WebKit will never settle. A strong reference until the request scope
+ * ends keeps the link alive; engines that hold it themselves are unaffected.
+ */
+const inFlight = new Set();
+/**
+ * Whether `cause` is the rejection an abort of `signal` produces. Chromium rejects with `signal.reason`;
+ * Node 20 and WebKit reject with a fresh native `AbortError`, which is the same cancellation.
+ */
+function isAbort(cause, signal) {
+    return cause === signal.reason || (cause instanceof DOMException && cause.name === "AbortError");
+}
 /**
  * Own the native Request, fetch and response reader for one attempt.
  * Construction errors remain outside network classification. Native fetch/read
@@ -44,6 +59,7 @@ export class FetchHttpClient {
             const controller = new AbortController();
             const signal = init.signal ? AbortSignal.any([controller.signal, init.signal]) : controller.signal;
             // These handles let scope teardown join native work before releasing the reader.
+            let request;
             let fetching;
             let reader;
             let reading;
@@ -57,7 +73,9 @@ export class FetchHttpClient {
              * @param message Operation detail to combine with the endpoint URL.
              * @returns Original cancellation reason or a TransportError retaining cause.
              */
-            const transportFailure = (cause, message) => signal.aborted && cause === signal.reason ? cause : new TransportError(`${message} for ${url}`, { cause });
+            const transportFailure = (cause, message) => signal.aborted && isAbort(cause, signal)
+                ? signal.reason
+                : new TransportError(`${message} for ${url}`, { cause });
             try {
                 signal.throwIfAborted();
                 const endpoint = new URL(url);
@@ -65,7 +83,8 @@ export class FetchHttpClient {
                     throw new ValidationError("HTTP output requires an HTTP(S) URL without credentials");
                 }
                 // Construction errors are caller errors, before native network classification.
-                const request = new Request(url, { ...init, signal, body: init.body });
+                request = new Request(url, { ...init, signal, body: init.body });
+                inFlight.add(request).add(signal);
                 fetching = fetch(request).catch((cause) => {
                     throw transportFailure(cause, "HTTP request failed");
                 });
@@ -99,9 +118,6 @@ export class FetchHttpClient {
                                         signal.throwIfAborted();
                                         reading = reader.read().catch((cause) => {
                                             // Node 20 Fetch replaces the supplied reason with a native AbortError during body reads.
-                                            if (signal.aborted && cause instanceof DOMException && cause.name === "AbortError") {
-                                                throw signal.reason;
-                                            }
                                             throw transportFailure(cause, "HTTP response body failed");
                                         });
                                         let result;
@@ -144,7 +160,7 @@ export class FetchHttpClient {
                             await pending;
                         }
                         catch (error) {
-                            if (error !== signal.reason && error !== failure?.error)
+                            if (!isAbort(error, signal) && error !== failure?.error)
                                 cleanup.push(error);
                         }
                     }
@@ -156,6 +172,9 @@ export class FetchHttpClient {
                     }
                     bodySignal?.removeEventListener("abort", abortBody);
                 });
+                if (request)
+                    inFlight.delete(request);
+                inFlight.delete(signal);
                 // Throw outside the Promise leaf so Effection teardown preserves genuine cleanup failures.
                 if (cleanup.length) {
                     if (failure && failure.error !== signal.reason)

package/esm/keri/npm/src/app/transport/http-messenger.js

@@ -1,15 +1,18 @@
 import { chunkBytes } from "./byte-source.js";
 import { attemptPostCesr } from "./cesr-egress.js";
 /**
- * Send ordinary signed messages as ordered HTTP POSTs and finish response cleanup.
+ * Send ordinary signed messages as ordered HTTP requests and finish response cleanup.
  * Producers own preparation and Poster owns queued work. This component needs no
  * Habery, protocol processor, parser state, timer or response history.
  *
- * Corresponds to the ordinary POST role of KERIpy HTTPMessenger. Complete CESR
- * frames become separate POSTs: original signed body in the request body, text
- * attachments in CESR-ATTACHMENT. Only the recognized pre-intake media refusal
- * permits a second attempt with legacy media metadata. Successful response bytes
- * are drained and discarded; protocol receiving belongs to independent intake.
+ * Corresponds to KERIpy HTTPMessenger. Each complete CESR frame is one request,
+ * shaped by its body: a JSON/CBOR/MGPK frame is a POST with the original signed
+ * body in the request body and text attachments in CESR-ATTACHMENT, where only
+ * the recognized pre-intake media refusal permits a second attempt with legacy
+ * media metadata; a native CESR frame (counter-prefixed body) is one whole PUT of
+ * the serialized frame with Content-Length and CESR-DESTINATION, matching KERIpy
+ * since PR 1751 and without detached headers or media fallback. Successful response
+ * bytes are drained and discarded; protocol receiving belongs to independent intake.
  */
 export class HTTPMessenger {
     /** Bind one endpoint and request metadata; construction performs no I/O. */
@@ -42,9 +45,11 @@ export class HTTPMessenger {
         return this.sendSource((signal) => chunkBytes(msg, { signal }), options);
     }
     /**
-     * Iterate ordinary messages into POSTs; this is not whole-stream PUT delivery.
-     * A later malformed message cannot prevent an earlier valid POST. Parser,
-     * transport, source and cleanup failures propagate; HTTP refusal is typed data.
+     * Iterate messages into one request each; this is not whole-stream PUT delivery.
+     * A multi-message native stream becomes successive per-frame PUTs, not KERIpy's
+     * single bulk PUT. A later malformed message cannot prevent an earlier valid
+     * request. Parser, transport, source and cleanup failures propagate; HTTP
+     * refusal is typed data.
      */
     sendSource(source, options = {}) {
         return attemptPostCesr(this.url, source, this.http, { ...this.options, ...options });

package/esm/keri/npm/src/app/transport/message-source.js

@@ -12,7 +12,7 @@ import { rethrowCleanupFailure } from "../runtime/abortable.js";
  * @param protocol Borrowed dispatcher over synchronous domain commits and correlated cue publication.
  * @param kvy Input-owned KEL processor bound to the same store, reply verifier and cue flow.
  * @param options Dispatch policy and optional upstream cancellation; defaults follow the shared processor.
- * @throws Parsing, dispatch and cleanup failures propagate after the pending pull and iterator cleanup join.
+ * @throws Parsing, infrastructure dispatch and cleanup failures propagate after the pending pull and iterator cleanup join; one invalid message does not.
  */
 export function* processMessages(source, protocol, kvy, options = {}) {
     const input = call(function* () {

package/esm/keri/npm/src/app/transport/messengering.js

@@ -9,8 +9,7 @@
 import { ValidationError } from "../../core/errors.js";
 import { HTTPMessenger } from "./http-messenger.js";
 import { HTTPStreamMessenger } from "./http-stream-messenger.js";
-import { TCPMessenger } from "./tcp-messenger.js";
-import { TCPStreamMessenger } from "./tcp-stream-messenger.js";
+import { requireTcpDialer } from "./tcp-dialer.js";
 /** Choose HTTPS, HTTP, then TCP and reject a mismatched advertised scheme before I/O. */
 function endpointFrom(urls) {
     for (const scheme of ["https", "http", "tcp"]) {
@@ -43,7 +42,7 @@ function endpointFrom(urls) {
 export function messengerFrom(destination, urls, http, clock, headers) {
     const endpoint = endpointFrom(urls);
     if (endpoint.protocol === "tcp:")
-        return new TCPMessenger(endpoint.href, clock);
+        return requireTcpDialer(http).messenger(endpoint.href, clock);
     return new HTTPMessenger(endpoint.href, http, { destination, headers });
 }
 /**
@@ -63,6 +62,6 @@ export function messengerFrom(destination, urls, http, clock, headers) {
 export function streamMessengerFrom(destination, urls, payload, http, clock, headers) {
     const endpoint = endpointFrom(urls);
     if (endpoint.protocol === "tcp:")
-        return new TCPStreamMessenger(endpoint.href, clock, payload);
+        return requireTcpDialer(http).streamMessenger(endpoint.href, clock, payload);
     return new HTTPStreamMessenger(endpoint.href, http, payload, { destination, headers });
 }

package/esm/keri/npm/src/app/transport/node-http-client.js

@@ -0,0 +1,21 @@
+/** HTTP client plus TCP egress, for hosts with sockets. */
+import { FetchHttpClient } from "./http-client.js";
+import { TCPMessenger } from "./tcp-messenger.js";
+import { TCPStreamMessenger } from "./tcp-stream-messenger.js";
+/** Dials TCP endpoints through `node:net`. */
+export const nodeTcpDialer = {
+    messenger: (url, clock, protocol = null) => new TCPMessenger(url, clock, protocol),
+    streamMessenger: (url, clock, payload) => new TCPStreamMessenger(url, clock, payload),
+};
+/** A `FetchHttpClient` that can also reach `tcp:` endpoints. */
+export class NodeHttpClient extends FetchHttpClient {
+    constructor() {
+        super(...arguments);
+        Object.defineProperty(this, "tcp", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: nodeTcpDialer
+        });
+    }
+}

package/esm/keri/npm/src/app/transport/tcp-dialer.js

@@ -0,0 +1,14 @@
+/**
+ * Host seam for TCP egress.
+ *
+ * Browsers have no TCP, so `HttpClient` carries an optional dialer supplied by
+ * hosts that do. Code that reaches a `tcp:` endpoint asks for it here and fails
+ * clearly when this host cannot dial.
+ */
+import { ValidationError } from "../../core/errors.js";
+/** Return the host's dialer, or fail for a `tcp:` endpoint this host cannot reach. */
+export function requireTcpDialer(http) {
+    if (!http.tcp)
+        throw new ValidationError("TCP endpoints are unavailable on this host.");
+    return http.tcp;
+}

package/esm/keri/npm/src/app/witness/http-endpoints.js

@@ -1,5 +1,5 @@
 /** Witness HTTP semantic policies for receipts, log queries and endorsed key state; adapters format decisions. */
-import { Ilks, Vrsn_2_0 } from "cesr-ts";
+import { Ilks } from "cesr-ts";
 import { receipt as receiptEvent, reply as replyEvent } from "../../core/protocol-eventing.js";
 import { dgKey } from "../../db/core/keys.js";
 import { inspectCesrRequest } from "../transport/cesr-http.js";
@@ -178,8 +178,8 @@ export function witnessKeyStateGet(serviceHab, query) {
         status: 200,
         body: serviceHab.endorse(replyEvent(`/ksn/${serviceHab.pre}`, kever.state().asDict(), {
             pre: serviceHab.pre,
-            pvrsn: Vrsn_2_0,
-            gvrsn: Vrsn_2_0,
-        }), { gvrsn: Vrsn_2_0 }),
+            pvrsn: serviceHab.kelVersion,
+            gvrsn: serviceHab.kelVersion,
+        }), { gvrsn: serviceHab.kelVersion }),
     };
 }

package/esm/keri/npm/src/app/witness/receipt-client.js

@@ -7,7 +7,7 @@ import { abortable } from "../runtime/abortable.js";
 import { collectBytes } from "../transport/byte-source.js";
 import { buildCesrRequest, CESR_CONTENT_TYPE, KERIPY_CESR_JSON_CONTENT_TYPE } from "../transport/cesr-http.js";
 import { HTTPMessenger } from "../transport/http-messenger.js";
-import { TCPMessenger } from "../transport/tcp-messenger.js";
+import { requireTcpDialer } from "../transport/tcp-dialer.js";
 import { inspectReceiptMessage } from "./receipt-messages.js";
 const WitnessReceiptPollAttempts = 20;
 const WitnessReceiptPollDelayMs = 100;
@@ -71,7 +71,7 @@ export function* sendWitnessMessage(hab, witness, bytes, http, clock, protocol,
     }
     const parsed = new URL(url);
     if (parsed.protocol === "tcp:") {
-        yield* new TCPMessenger(url, clock, protocol).send(bytes, {
+        yield* requireTcpDialer(http).messenger(url, clock, protocol).send(bytes, {
             replies: Boolean(protocol),
             local: true,
         });

package/esm/keri/npm/src/cli/common/context.js

@@ -1,6 +1,6 @@
 import { createAgentRuntime } from "../../app/runtime/agent-runtime.js";
 import { systemClock } from "../../app/runtime/runtime-clock.js";
-import { FetchHttpClient } from "../../app/transport/http-client.js";
+import { NodeHttpClient } from "../../app/transport/node-http-client.js";
 import { ValidationError } from "../../core/errors.js";
 import { setupHby } from "./existing.js";
 /** Open an existing Habery for one CLI command and close it after the callback. */
@@ -54,7 +54,7 @@ export function* withExistingHab(args, alias, options, use) {
  */
 export function* withAgentRuntime(args, options, use) {
     return yield* withExistingHabery(args, options, function* ({ hby }) {
-        const runtime = yield* (options.dependencies?.createAgentRuntime ?? createAgentRuntime)(hby, new FetchHttpClient(), systemClock, { kram: hby.cf?.get().kram });
+        const runtime = yield* (options.dependencies?.createAgentRuntime ?? createAgentRuntime)(hby, new NodeHttpClient(), systemClock, { kram: hby.cf?.get().kram });
         let failure;
         try {
             return yield* use({ hby, runtime });

package/esm/keri/npm/src/cli/common/event-completion.js

@@ -0,0 +1,49 @@
+import { completeEvent } from "../../app/identity/event-completion.js";
+import { KelPublisher } from "../../app/mailbox/kel-publisher.js";
+import { createProtocolProcessor } from "../../app/protocol/protocol-processing.js";
+import { createAgentRuntime } from "../../app/runtime/agent-runtime.js";
+import { systemClock } from "../../app/runtime/runtime-clock.js";
+import { withRuntimeWorkers } from "./runtime-workers.js";
+/**
+ * Compose event-completion dependencies for one CLI command.
+ *
+ * A short-lived runtime is created only when a delegated event needs workers.
+ * It is lent to the library for that one scope with its workers running around
+ * the library's observe-only wait, and closed on every exit path.
+ */
+export function cliEventCompletionDeps(hby, http) {
+    // A command has no running runtime, so it carries the publisher whose pass `completeEventOrThrow` runs.
+    const publisher = new KelPublisher({ hby, http, clock: systemClock });
+    return {
+        hby,
+        publisher,
+        rotated: publisher.rotated,
+        protocol: createProtocolProcessor(hby),
+        http,
+        clock: systemClock,
+        *withDelegation(hab, use) {
+            const runtime = yield* createAgentRuntime(hby, http, systemClock);
+            try {
+                return yield* withRuntimeWorkers(runtime, { hab, pollMailbox: true }, () => use({ anchorer: runtime.delegating }));
+            }
+            finally {
+                yield* runtime.close();
+            }
+        },
+    };
+}
+/**
+ * `completeEvent` for commands: an expired delegation wait fails the command with
+ * the text the CLI has always printed, then the caller sees the usual result.
+ */
+export function* completeEventOrThrow(deps, ...args) {
+    const completion = yield* completeEvent(deps, ...args);
+    if (completion.outcome === "timed-out") {
+        throw new Error(`Runtime did not converge within ${completion.timeoutMs}ms.`);
+    }
+    // No fiber runs the publisher in a one-shot command: tell the mailboxes of a completed rotation now. A
+    // mailbox that cannot be reached stays owed in the marker and the poller repairs it.
+    if (!deps.publisher.rotated.empty)
+        yield* deps.publisher.processOnce();
+    return completion;
+}

package/esm/keri/npm/src/cli/common/existing.js

@@ -1,6 +1,6 @@
 import * as dntShim from "../../_dnt.shims.js";
-import { createHabery } from "../../app/identity/habbing.js";
-import { createKeeper, Keeper } from "../../db/keeping.js";
+import { createHabery } from "../../app/identity/lmdb-habery.js";
+import { createKeeper, lmdbKeeper } from "../../db/lmdb-stores.js";
 import { readPasscode } from "./passcode.js";
 /**
  * Return true when the named keeper already exists and contains keeper globals.
@@ -10,7 +10,7 @@ import { readPasscode } from "./passcode.js";
  * keystore" without mutating on-disk state during the probe.
  */
 function* keeperExists(name, base = "", temp = false, headDirPath, compat = false) {
-    const keeper = new Keeper({
+    const keeper = lmdbKeeper({
         name,
         base,
         temp,
@@ -22,8 +22,6 @@ function* keeperExists(name, base = "", temp = false, headDirPath, compat = fals
             name,
             base,
             temp,
-            headDirPath,
-            compat,
             reopen: true,
             readonly: true,
         });

package/esm/keri/npm/src/cli/common/runtime-workers.js

@@ -0,0 +1,23 @@
+import { spawn } from "effection";
+import { runAgentRuntime } from "../../app/runtime/agent-runtime.js";
+/**
+ * Run the runtime workers around one observe-only library call.
+ *
+ * Library workflows only observe (see `app/runtime/workflow-contract.ts`); a
+ * one-shot CLI command has no running runtime, so it supplies the workers here.
+ * The worker is halted and joined on success, failure and cancellation before
+ * the caller can release stores.
+ *
+ * @param runtime Borrowed composed runtime; the command owns its lifetime.
+ * @param options Signer, mailbox polling and command-owned query cue Deck.
+ * @param use Observe-only operation that depends on the workers' progress.
+ */
+export function* withRuntimeWorkers(runtime, options, use) {
+    const worker = yield* spawn(() => runAgentRuntime(runtime, options));
+    try {
+        return yield* use();
+    }
+    finally {
+        yield* worker.halt();
+    }
+}