keri-ts 2.0.1 → 2.2.0

package/esm/keri/npm/src/core/kel/delegation-ancestry.js

@@ -0,0 +1,92 @@
+import { dgKey } from "../../db/core/keys.js";
+import { ValidationError } from "../errors.js";
+/** Whether one accepted delegator event carries the exact `{i,s,d}` seal of a delegated inception. */
+function approves(event, dip) {
+    return event.eventSeals.some((seal) => seal.i.qb64 === dip.pre && seal.s.numh === dip.snh && seal.d.qb64 === dip.said);
+}
+/**
+ * Find the delegator's accepted approval of `dip`.
+ *
+ * The aess source couple is a fast path only when it names a first-seen event
+ * that actually carries the dip seal; protected intake can retain an unverified
+ * hint, which neither grants authority nor vetoes a later genuine approval.
+ * Otherwise any first-seen delegator event carrying the seal is accepted,
+ * including one superseded since, so cached and uncached validators agree.
+ */
+function acceptedApproval(db, delegator, dip) {
+    const source = db.aess.get(dgKey(dip.pre, dip.said));
+    if (source) {
+        const digest = source[1].qb64;
+        if (db.fons.get(dgKey(delegator, digest))) {
+            const approval = db.getEvtSerder(delegator, digest);
+            if (!approval)
+                throw new ValidationError(`Missing first-seen delegation event ${delegator}:${digest}.`);
+            if (approves(approval, dip))
+                return approval;
+        }
+    }
+    for (const [, , said] of db.fels.getAllItemIter(delegator)) {
+        if (!db.fons.get(dgKey(delegator, said)))
+            continue;
+        const event = db.getEvtSerder(delegator, said);
+        if (event && approves(event, dip))
+            return event;
+    }
+    return null;
+}
+/**
+ * Resolve whether `pre` is an anchored delegated descendant of `ancestor`, at any depth.
+ *
+ * Every hop requires the delegate's fixed dip, the delegator's inception
+ * permission (DND is checked before the anchor) and an accepted delegator
+ * approval of that dip. Identity (`pre === ancestor`) is not delegation; the
+ * DI2I/DI1I callers own that widening.
+ *
+ * Security rationale, preserved from KERIpy's `relating.delegationRefusal`:
+ * - The delegate's own `di` (Kever.delpre) is a self-assertion. Local, member
+ *   or witness acceptance can admit a dip whose delegator never anchored it, so
+ *   only the delegator's anchored approval seal records actual authority.
+ * - DND is re-read from the delegator's accepted inception, not mutable state,
+ *   because that same exemption can admit dips a disinterested validator would
+ *   refuse; identical bytes must not get opposite verdicts by host topology.
+ * - Only the dip anchor matters. A delegation is settled at inception; later
+ *   delegate rotations, delegator rotations, witness changes and retirement do
+ *   not renew or revoke it.
+ * - No depth bound: a delegated prefix digests its own dip, so a cycle implies
+ *   a hash cycle. The visited set only terminates corrupt local state.
+ *
+ * Unlike KERIpy, lookup never repairs aess; accepted KEL intake owns those writes.
+ * An aess couple naming a first-seen event that is absent from `evts` is
+ * corrupt durable state and throws.
+ */
+export function delegationAncestry(db, pre, ancestor) {
+    const seen = new Set();
+    while (!seen.has(pre)) {
+        seen.add(pre);
+        const kever = db.getKever(pre);
+        if (!kever)
+            return { kind: "pending", reason: `Missing delegate KEL ${pre}.` };
+        const parent = kever.delpre;
+        if (!parent)
+            return { kind: "refused", reason: `Delegation chain ends at ${pre}.` };
+        if (!db.getKever(parent))
+            return { kind: "pending", reason: `Missing delegator KEL ${parent}.` };
+        // Configuration is fixed at inception, including after delegator rotations.
+        const inceptionSaid = db.kels.getLast(parent, 0);
+        const inception = inceptionSaid ? db.getEvtSerder(parent, inceptionSaid) : null;
+        if (!inception)
+            return { kind: "pending", reason: `Missing delegator inception ${parent}.` };
+        if (inception.traits.includes("DND"))
+            return { kind: "refused", reason: `Delegator ${parent} carries DND.` };
+        const dip = db.getEvtSerder(pre, pre);
+        if (!dip)
+            return { kind: "pending", reason: `Missing delegated inception ${pre}.` };
+        if (!acceptedApproval(db, parent, dip)) {
+            return { kind: "pending", reason: `Missing accepted delegation approval for ${pre} from ${parent}.` };
+        }
+        if (parent === ancestor)
+            return { kind: "valid" };
+        pre = parent;
+    }
+    return { kind: "refused", reason: `Delegation chain cycles at ${pre}.` };
+}

package/esm/keri/npm/src/core/kel/eventing.js

@@ -126,7 +126,6 @@ export class Kevery {
         return this.settleEventDecision(envelope);
     }
     settleEventDecision(input, escrow) {
-        const env = this.db.env;
         if (this.db.inWriteTransaction) {
             throw new Error("Kevery must own the KEL transaction; process events outside caller-owned writers");
         }
@@ -151,7 +150,7 @@ export class Kevery {
                 this.removeEscrow(escrow.kind, escrow.pre, escrow.on, escrow.said);
             return decision;
         };
-        const decision = env.transactionSync(write);
+        const decision = this.db.transaction(write);
         this.publishEventState(metadata?.accepted);
         if (metadata?.cues.length)
             this.cues.extend(metadata.cues);
@@ -176,10 +175,10 @@ export class Kevery {
             return false;
         const query = envelope.serder.ked?.q;
         const pre = typeof query?.i === "string" ? query.i : null;
-        if (!pre || queryRequester(envelope) !== pre)
+        if (!pre)
             return false;
         const recipient = this.db.getKever(pre, { refresh: true });
-        return !!recipient && authenticatesMailboxQuery(envelope, recipient);
+        return !!recipient && authenticatesMailboxQuery(envelope, recipient, this.db);
     }
     /**
      * Decide how one live query should be handled without mutating escrow state.
@@ -281,14 +280,11 @@ export class Kevery {
                     }]);
             }
             case "mbx": {
-                if (dest !== pre) {
-                    return dropQuery("unauthorizedMailboxRequester");
-                }
                 const recipient = this.db.getKever(pre, { refresh: true });
                 if (!recipient) {
                     return escrowQuery("missingKever");
                 }
-                if (!authenticatesMailboxQuery(envelope, recipient)) {
+                if (!authenticatesMailboxQuery(envelope, recipient, this.db)) {
                     return dropQuery("unauthorizedMailboxRequester");
                 }
                 return acceptQuery([{
@@ -2376,22 +2372,81 @@ function queryRequester(envelope) {
  * Mailbox reads authorize private recipient bytes, unlike public KEL queries.
  * Require the recipient's current signing threshold; merely naming its prefix
  * in endorsement material is not authentication. Repeated indices count once.
+ *
+ * Who may read a transferable recipient's mailbox on this host: the recipient itself, and, for a group, any
+ * signing member that signs the poll as itself (the shape KERIpy's `GroupHab.query` emits: `q.i` is the group,
+ * sender and signer are the member) when {@link provesGroupKeyControl} holds. Forwarded mail is plaintext CESR
+ * unless the sender used ESSR, so this check is the read protection. KERIpy hosts are open: they do no read
+ * authorization of `mbx` queries, so a poll KERIpy accepts can be refused here.
+ *
+ * Two refusals are by design. The host must hold the member's KEL: the keri-ts poller and `KelPublisher` submit it
+ * (see `collectKelSubmission`), but a KERIpy member's poller does not, so its KEL has to reach the host by OOBI or
+ * a mailbox add, and until then its poll is refused as unauthorized. And a rotation-only member (named in the
+ * group's `rmids` but not its `smids`) holds no current group key, so it is refused until a rotation makes it a
+ * signing member.
  */
-function authenticatesMailboxQuery(envelope, recipient) {
+function authenticatesMailboxQuery(envelope, recipient, db) {
     if (!recipient.transferable) {
         return (envelope.cigars ?? []).some((cigar) => cigar.verfer?.qb64 === recipient.pre
             && !cigar.verfer.transferable
             && cigar.verfer.verify(cigar.raw, envelope.serder.raw));
     }
-    if (envelope.source?.qb64 !== recipient.pre)
+    const requester = envelope.source?.qb64;
+    if (!requester)
+        return false;
+    if (requester === recipient.pre)
+        return satisfiesThreshold(envelope, recipient);
+    // A group's poll is signed by one of its local members (the poller cannot sign for the group alone). Accept a
+    // member whose own key state this host holds when its signatures meet its own current threshold and it provably
+    // controlled one of the group's current keys.
+    const member = db.getKever(requester, { refresh: true });
+    if (!member?.transferable || !satisfiesThreshold(envelope, member))
         return false;
+    return provesGroupKeyControl(envelope, member, recipient, db);
+}
+/**
+ * Whether `member` provably controlled a key in `group`'s current key list, by either of two proofs.
+ *
+ * Listing a group key is not control of it: anyone can incept an identifier whose key list names a victim's
+ * public key beside their own, so a key list or an event's `k` field proves nothing. Only a signature by that
+ * key does. The proofs are:
+ * - the poll itself carries a signature that verifies against a key at that index in `member`'s current key list
+ *   that is also in the group's current key list; or
+ * - some establishment event in `member`'s KEL, as this host holds it, lists a group-current key at index i and
+ *   the host holds a signature by that index-i key on that same event that verifies. That is proof of possession
+ *   at the time the member used the key, and the KEL chain ties that event to the member's current keys, so a
+ *   member that rotated its own identifier ahead of the group is still recognised.
+ */
+function provesGroupKeyControl(envelope, member, group, db) {
+    const groupKeys = new Set(group.verfers.map((verfer) => verfer.qb64));
+    const signedPoll = (envelope.sigers ?? []).some((siger) => {
+        const verfer = member.verfers[siger.index];
+        return !!verfer && groupKeys.has(verfer.qb64) && verfer.verify(siger.raw, envelope.serder.raw);
+    });
+    if (signedPoll)
+        return true;
+    for (const [, said] of db.getKelItemIter(member.pre)) {
+        const event = db.getEvtSerder(member.pre, said);
+        if (!event?.estive)
+            continue;
+        const verfers = event.verfers;
+        for (const siger of db.sigs.get(dgKey(member.pre, said))) {
+            const verfer = verfers[siger.index];
+            if (verfer && groupKeys.has(verfer.qb64) && verfer.verify(siger.raw, event.raw))
+                return true;
+        }
+    }
+    return false;
+}
+/** The indexed signatures on `envelope` that verify against `kever`'s current keys meet its signing threshold. */
+function satisfiesThreshold(envelope, kever) {
     const indices = new Set();
     for (const siger of envelope.sigers ?? []) {
-        const verfer = recipient.verfers[siger.index];
+        const verfer = kever.verfers[siger.index];
         if (verfer && verfer.verify(siger.raw, envelope.serder.raw))
             indices.add(siger.index);
     }
-    return recipient.tholder?.satisfy([...indices]) ?? false;
+    return kever.tholder?.satisfy([...indices]) ?? false;
 }
 /** Return the reply destination derived from one normalized query envelope. */
 function queryReplyDest(envelope) {

package/esm/keri/npm/src/core/kel/kever.js

@@ -551,21 +551,23 @@ export class Kever {
         return indices;
     }
     /**
-     * Return indices contributed by keys also present in a locally controlled KEL.
+     * Return indices of keys contributed by this group's local members.
      *
-     * Current `keri-ts` scope:
-     * - approximates KERIpy's locally membered signature filtering by comparing
-     *   verfer qb64 values across locally accepted kevers
+     * KERIpy strips its one local member (`habord.mid`). A keri-ts Habery may hold
+     * several members of one group, so every locally controlled signing member
+     * counts. The group's own prefix is local too and must not: its keys are all
+     * of `verfers`.
      */
     locallyContributedIndices(verfers) {
+        const record = this.db.getHab(this.pre);
         const localKeys = new Set();
-        for (const pre of this.prefixes) {
-            const kever = this.db.getKever(pre);
-            if (!kever) {
+        for (const mid of new Set([record?.mid, ...(record?.smids ?? [])])) {
+            if (!mid || !this.locallyOwned(mid)) {
                 continue;
             }
-            for (const verfer of kever.verfers) {
-                localKeys.add(verfer.qb64);
+            const key = this.db.getKever(mid)?.verfers[0]?.qb64;
+            if (key) {
+                localKeys.add(key);
             }
         }
         const indices = [];

package/esm/keri/npm/src/core/mailbox/kram-policy.js

@@ -1,8 +1,34 @@
 /** KRAM cache selection and safe, receiver-clocked configuration transitions. */
 import { intToB64 } from "cesr-ts";
 import { CacheTypeRecord } from "../records.js";
+/**
+ * Windows an enabled policy uses when no caches are configured: one catchall row, in milliseconds
+ * `[d, sl, ll, xl, psl, pll, pxl]` (1 s drift, 5 s single-key, 60 s multi-key and 5 min exchange acceptance,
+ * pruned no earlier than they expire). KERIpy defines no built-in windows and requires `kram.caches` in
+ * configuration; these are the values its own tests and the keri-ts interop suites use, so an unconfigured
+ * runtime behaves like a configured KERIpy peer.
+ */
+export const DEFAULT_KRAM_CACHES = Object.freeze({
+    "~": Object.freeze([1000, 5000, 60000, 300000, 5000, 60000, 300000]),
+});
 /** Only this key owns the policy transition metadata in the existing settings table. */
 const policyKey = "kram-policy";
+/** The stored cache type for exact route, then message type, then the catchall; null when none is configured. */
+function storedCacheType(db, ilk, route) {
+    const record = (route ? db.ctyp.get(`${ilk}.R.${route}`) : null) ?? db.ctyp.get(ilk) ?? db.ctyp.get("~");
+    if (!record)
+        return null;
+    const [d, sl, ll, xl, psl, pll, pxl] = values(record);
+    return { d, sl, ll, xl, psl, pll, pxl };
+}
+/**
+ * How long a single-key query on `route` stays timely under the windows this store was configured with, in
+ * milliseconds: the single-key lag. A sender uses its own windows as the estimate of its peer's, as KERIpy's
+ * `requery` does. Null when this store has no KRAM cache types (KRAM never ran on it).
+ */
+export function singleKeyQueryWindow(db, route) {
+    return storedCacheType(db, "qry", route)?.sl ?? null;
+}
 /** Validate caller configuration before any durable policy mutation. */
 function windows(value, transitional = false) {
     if (!Array.isArray(value) || value.length !== 7 || value.some((v) => !Number.isSafeInteger(v) || v < 0)) {
@@ -148,11 +174,20 @@ export class KramPolicy {
             return [intToB64(version[0], 1) + intToB64(version[1], 2), ...(type ? [type] : []), ...(route ? [route] : [])]
                 .join(".") + (route ? "" : ".");
         });
-        const requested = configuration(config.caches);
+        const requested = configuration(config.caches ?? (this.enabled ? DEFAULT_KRAM_CACHES : undefined));
         const stored = db.hbys.get(policyKey);
         this.storedState = stored;
         if (stored !== null) {
             this.state = policyState(stored, db);
+            if (!Object.keys(this.state.caches).length && Object.keys(requested).length) {
+                // A store first opened without caches (KRAM off) has no rows to protect: install the windows directly.
+                this.state = { caches: requested, pending: {} };
+                this.commit(() => {
+                    for (const [key, tuple] of Object.entries(requested))
+                        db.ctyp.pin(key, cacheRecord(tuple));
+                });
+                return;
+            }
             const identical = sameKeys(Object.keys(requested), Object.keys(this.state.caches))
                 && Object.keys(requested).every((key) => requested[key].every((v, i) => v === this.state.caches[key][i]));
             if (config.caches !== undefined && !identical)
@@ -173,12 +208,10 @@ export class KramPolicy {
     }
     /** Select exact route, message type, then catchall; absence is a configuration failure. */
     cacheType(ilk, route) {
-        const record = (route ? this.db.ctyp.get(`${ilk}.R.${route}`) : null) ?? this.db.ctyp.get(ilk)
-            ?? this.db.ctyp.get("~");
-        if (!record)
+        const type = storedCacheType(this.db, ilk, route);
+        if (!type)
             throw new Error("No KRAM cache type for message");
-        const [d, sl, ll, xl, psl, pll, pxl] = values(record);
-        return { d, sl, ll, xl, psl, pll, pxl };
+        return type;
     }
     /** Stage expansions and reject coverage holes before changing interoperable rows. */
     change(caches, override) {
@@ -298,11 +331,10 @@ export class KramPolicy {
     }
     /** Publish policy rows and their restart-safe transition metadata atomically. */
     commit(mutate) {
-        const env = this.db.env;
-        if (!env)
+        if (!this.db.opened)
             throw new Error("KRAM policy database is closed");
         const next = JSON.stringify(this.state);
-        env.transactionSync(() => {
+        this.db.transaction(() => {
             if (this.db.hbys.get(policyKey) !== this.storedState)
                 throw new Error("KRAM policy changed during transition");
             mutate();

package/esm/keri/npm/src/core/mailbox/kram-pruning.js

@@ -19,7 +19,7 @@ export class KramPruner {
             writable: true,
             value: policy
         });
-        Object.defineProperty(this, "env", {
+        Object.defineProperty(this, "bound", {
             enumerable: true,
             configurable: true,
             writable: true,
@@ -46,24 +46,18 @@ export class KramPruner {
         if (policy.db !== db)
             throw new Error("KRAM pruning policy must use its backing store");
     }
-    /** Use committed environment state, never assume transaction IDs increment by one. */
-    version() {
-        const version = this.db.env.getStats().lastTxnId;
-        if (!Number.isSafeInteger(version) || version < 0)
-            throw new Error("Invalid KRAM pruning transaction ID");
-        return version;
-    }
     /** Capture a finite horizon and release each tail/next iterator before returning. */
     next(family, scan) {
         const table = [this.db.msgc, this.db.tmsc, this.db.xdt][family];
         if (!scan.initialized) {
-            for (const key of table.sdb.getKeys({ reverse: true, limit: 1 }))
+            for (const key of this.db.scanKeys(table.sdb, { reverse: true, limit: 1 }))
                 scan.end = this.after(key);
             scan.initialized = true;
         }
         if (scan.end) {
-            for (const key of table.sdb.getKeys({ start: scan.start, end: scan.end, limit: 1 }))
+            for (const key of this.db.scanKeys(table.sdb, { start: scan.start, end: scan.end, limit: 1 })) {
                 return key.slice();
+            }
         }
     }
     /** Qualified cache components contain no NUL, so this seeks strictly after a complete key. */
@@ -102,17 +96,16 @@ export class KramPruner {
         if (!Number.isSafeInteger(maxRows) || maxRows < 1)
             throw new RangeError("Invalid KRAM pruning batch");
         const result = { kind: "pruned", visited: 0, removed: 0, openers: 0, passComplete: false };
-        const env = this.db.env;
-        if (!env)
+        if (!this.db.opened)
             throw new Error("KRAM pruning database is closed");
-        if (this.env !== env) {
-            this.env = env;
+        if (this.bound !== this.db.msgc.sdb) {
+            this.bound = this.db.msgc.sdb;
             this.phase = 0;
             this.scans = [{}, {}, {}];
             this.orphan = undefined;
         }
         this.policy.reconcile();
-        env.resetReadTxn();
+        this.db.refreshRead();
         while (result.visited < maxRows) {
             if (this.phase < 2) {
                 const scan = this.scans[this.phase], physical = this.next(this.phase, scan);
@@ -121,7 +114,7 @@ export class KramPruner {
                     continue;
                 }
                 const keys = this.keys(physical, this.phase + 2), table = this.phase ? this.db.tmsc : this.db.msgc;
-                env.transactionSync(() => {
+                this.db.transaction(() => {
                     const record = table.get(keys);
                     if (!record || !this.expired(record, when))
                         return;
@@ -144,17 +137,17 @@ export class KramPruner {
                 }
                 const [xid] = this.keys(physical, 1);
                 this.db.xdt.get(xid); // Deserialization failures remain corruption, not an absent opener.
-                this.orphan = { xid, physical, scan: {}, version: this.version() };
+                this.orphan = { xid, physical, scan: {}, version: this.db.writeVersion };
                 result.visited++;
                 continue;
             }
-            const candidate = this.orphan, version = this.version();
+            const candidate = this.orphan, version = this.db.writeVersion;
             if (candidate.version !== version) {
                 candidate.scan = {};
                 candidate.version = version;
             }
             // Capture committed version before opening a fresh read snapshot, including other-process writes.
-            env.resetReadTxn();
+            this.db.refreshRead();
             const physical = this.next(1, candidate.scan);
             if (physical) {
                 const keys = this.keys(physical, 3);
@@ -165,8 +158,8 @@ export class KramPruner {
             }
             else {
                 result.visited++;
-                const removed = env.transactionSync(() => {
-                    if (candidate.version !== this.version())
+                const removed = this.db.transaction(() => {
+                    if (candidate.version !== this.db.writeVersion)
                         return false;
                     if (this.db.xdt.rem(candidate.xid))
                         result.openers++;
@@ -174,7 +167,7 @@ export class KramPruner {
                 });
                 if (!removed) {
                     candidate.scan = {};
-                    candidate.version = this.version();
+                    candidate.version = this.db.writeVersion;
                     continue;
                 }
             }

package/esm/keri/npm/src/core/mailbox/kram-staging.js

@@ -98,9 +98,9 @@ function candidate(db, policy, incoming, receiverTime) {
  * borrowed from the current input and are never read or disposed by KRAM.
  */
 export function stageKram(db, policy, incoming, receiverTime) {
-    if (!db.env)
+    if (!db.opened)
         throw new Error("KRAM staging database is closed");
-    return db.env.transactionSync(() => {
+    return db.transaction(() => {
         const fresh = candidate(db, policy, incoming, receiverTime);
         if (fresh.kind === "rotated") {
             removeKramFactors(db, fresh.key);

package/esm/keri/npm/src/core/mailbox/kraming.js

@@ -3,6 +3,8 @@ import { Deck } from "../deck.js";
 import { KramPolicy } from "./kram-policy.js";
 import { KramPruner } from "./kram-pruning.js";
 import { stageKram } from "./kram-staging.js";
+/** Explicit receiver-owned cache and exemption configuration. */
+export { DEFAULT_KRAM_CACHES } from "./kram-policy.js";
 /** Optional receiver intake returns ordinary decisions without owning parser input. */
 export class Kramer {
     constructor(db, { config = {}, cues = new Deck(), now = Date.now } = {}) {

package/esm/keri/npm/src/core/records.js

@@ -350,3 +350,26 @@ export class TxnMsgCacheRecord extends RawRecord {
  */
 export class WellKnownAuthN extends RawRecord {
 }
+/**
+ * A `/registry/root` copy the Poster reported sent: coordinates only, never the root.
+ *
+ * keri-ts only. Stored through `Komer` in `Baser.rrsn`, keyed (group, registry, recipient).
+ */
+export class RootSentRecord extends RawRecord {
+}
+/**
+ * The KEL a mailbox was last given for an identifier: coordinates only. A 2xx is not acceptance (the host may
+ * escrow), which is why the poller still repairs a 403.
+ *
+ * keri-ts only. Stored through `Komer` in `Baser.kpub`, keyed (identifier, mailbox).
+ */
+export class KelPublishedRecord extends RawRecord {
+}
+/**
+ * Public derivation coordinates of one blinded registry update: which credential, state and binding the
+ * update's opening is derived for. Never a salt or an opening.
+ *
+ * keri-ts only. Stored through `Komer` in `Baser.dvus`, keyed by the BUP SAID.
+ */
+export class DerivedUpdateRecord extends RawRecord {
+}

package/esm/keri/npm/src/core/routing.js

@@ -321,6 +321,17 @@ export class Revery {
             writable: true,
             value: void 0
         });
+        /**
+         * Told after an `/end/role` reply is accepted, with the controller, role, endpoint and whether the role is
+         * allowed. The runtime uses it to have the mailbox poller and KEL publisher look at a controller whose mailbox
+         * role just changed, rather than at their next sweep.
+         */
+        Object.defineProperty(this, "onEndRole", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         this.db = db;
         this.rtr = rtr ?? new Router();
         this.cues = cues ?? new Deck();
@@ -820,7 +831,7 @@ export class BasicReplyRouteHandler {
             throw new Error("Endpoint handler must own the reply transaction; process replies outside caller-owned writers");
         }
         let queryCues = [];
-        const decision = this.rvy.db.env.transactionSync(() => {
+        const decision = this.rvy.db.transaction(() => {
             let osaider = this.rvy.db.eans.get(keys);
             if (osaider?.qb64 === args.diger.qb64)
                 osaider = null;
@@ -843,6 +854,8 @@ export class BasicReplyRouteHandler {
         });
         if (queryCues.length)
             this.rvy.cues.extend(queryCues);
+        if (decision.kind === "accept")
+            this.rvy.onEndRole?.(cid, role, eid, allowed);
         return decision;
     }
     /**
@@ -881,7 +894,7 @@ export class BasicReplyRouteHandler {
             throw new Error("Endpoint handler must own the reply transaction; process replies outside caller-owned writers");
         }
         let queryCues = [];
-        const decision = this.rvy.db.env.transactionSync(() => {
+        const decision = this.rvy.db.transaction(() => {
             let osaider = this.rvy.db.lans.get(keys);
             if (osaider?.qb64 === args.diger.qb64)
                 osaider = null;