keri-ts 2.0.1 → 2.2.0

package/esm/keri/npm/src/app/credentials/root-replicating.js

@@ -0,0 +1,131 @@
+/**
+ * Finite delivery of prepared `/registry/root` copies; transmission is never receipt.
+ *
+ * `replicateRootCopies` is the KERIpy `rootreplicating.replicate` happy path: a
+ * command calls it once a send is possible and reports each typed outcome. There
+ * is no acknowledgement or retry here (the runtime's `RootReplicator` derives
+ * what is owed and retries); receiving is idempotent, so duplicate copies are
+ * harmless.
+ */
+import { parseBytes } from "cesr-ts";
+import { action, race } from "effection";
+import { RootUnverified } from "../../acdc/salting.js";
+import { AppError, ValidationError } from "../../core/errors.js";
+import { CREDENTIAL_MAILBOX_TOPIC } from "../../core/mailbox/mailbox-topics.js";
+import { localGroupMember } from "../multisig/group-members.js";
+/**
+ * Send each copy from `sender` to its recipient's `credential` mailbox, in
+ * order, and return one outcome per copy. A failed copy does not stop later
+ * copies. The caller runs `postman.deliverDo` for the duration; Poster wait
+ * misuse or closure still throws.
+ */
+export function* deliverRegistryRoots(postman, sender, copies) {
+    const outcomes = [];
+    for (const copy of copies) {
+        const event = postman.send({ src: sender, dest: copy.recipient, topic: CREDENTIAL_MAILBOX_TOPIC, msg: copy.wire }, { notify: true });
+        const outcome = yield* postman.wait(event);
+        outcomes.push(outcome.kin === "sent"
+            ? { kin: "sent", copy, deliveries: outcome.deliveries }
+            : { kin: "failed", copy, error: outcome.error });
+    }
+    return outcomes;
+}
+/** Run `operation` for at most `milliseconds` of `clock` time; null when the budget ends first. */
+function* within(clock, milliseconds, operation) {
+    return yield* race([
+        operation,
+        action(resolve => {
+            const timer = clock.setTimeout(() => resolve(null), Math.max(milliseconds, 0));
+            return () => clock.clearTimeout(timer);
+        }),
+    ]);
+}
+/**
+ * Prepare and deliver one `/registry/root` copy for `gid` from its local member to
+ * `recipient`, before `deadline` (epoch ms of `clock`).
+ *
+ * The copy is sealed with `RegistryRoot.prepare` and a per-registry derived hint
+ * (`hinted`, so a copy that could never verify is reported, not sent). Any
+ * `AppError` ends in the result; any other exception is an invariant failure and
+ * escapes. The caller runs `postman.deliverDo` for the duration.
+ */
+export function* replicateRootCopy(root, postman, clock, gid, registry, recipient, deadline) {
+    const sender = localGroupMember(root.hby, gid);
+    const result = { kin: "failed", group: gid, registry, sender: sender.pre, recipient };
+    try {
+        if (clock.now() >= deadline) {
+            throw new ValidationError("registry root copies did not complete within their budget");
+        }
+        let wire;
+        try {
+            wire = root.prepare(sender, recipient, gid, registry, { hinted: true });
+        }
+        catch (error) {
+            result.kin = error instanceof RootUnverified ? "deferred" : "refused";
+            throw error;
+        }
+        result.exchange = parseBytes(wire)[0].body.said;
+        const outcome = yield* within(clock, deadline - clock.now(), deliverRegistryRoots(postman, sender.pre, [{ recipient, wire }]));
+        if (!outcome)
+            throw new ValidationError("registry root copies did not complete within their budget");
+        if (outcome[0].kin === "failed") {
+            result.error = outcome[0].error ?? "delivery failed";
+        }
+        else {
+            result.kin = "sent";
+            result.deliveries = outcome[0].deliveries;
+        }
+    }
+    catch (error) {
+        if (!(error instanceof AppError))
+            throw error;
+        result.error = error;
+    }
+    return result;
+}
+/**
+ * Send one copy of each of `registries`' held roots for group `ghab` to each
+ * recipient, signed by `ghab`'s local member, and return one result per copy.
+ *
+ * `recipients` defaults to every other current signing member. `timeoutMs` is this
+ * replication's own budget: a copy reached after it ends, or still sending when it
+ * ends, is `failed`. Nothing is retried or recorded and an `AppError` never
+ * escapes. The caller runs `postman.deliverDo` for the duration.
+ */
+export function* replicateRootCopies(root, postman, clock, ghab, registries, { recipients, timeoutMs }) {
+    const gid = ghab.pre, sender = localGroupMember(root.hby, gid), deadline = clock.now() + Math.max(timeoutMs, 0);
+    const targets = recipients ?? root.members(gid).filter(aid => aid !== sender.pre);
+    const results = [];
+    for (const registry of registries) {
+        for (const recipient of targets) {
+            results.push(yield* replicateRootCopy(root, postman, clock, gid, registry, recipient, deadline));
+        }
+    }
+    return results;
+}
+/** Budget for re-seal copies from a command without its own `--timeout`, as KERIpy `rootreplicating.Budget`. */
+export const RootResealBudgetMs = 30_000;
+/**
+ * After an accepted group rotation, send held roots to new or rekeyed members.
+ *
+ * Only a signer of the rotation that held a prior key sends (`RegistryRoot.resealed`),
+ * every such signer sends with no election, and a member holding no root for the
+ * group sends nothing. `examination` is set when the recipients could not be
+ * selected, and then nothing is sent. Fire and forget like `replicateRootCopies`.
+ */
+export function* resealRootCopies(root, postman, clock, ghab, rotation, { timeoutMs = RootResealBudgetMs } = {}) {
+    let recipients;
+    try {
+        recipients = root.resealed(ghab, rotation);
+    }
+    catch (error) {
+        if (!(error instanceof AppError))
+            throw error;
+        return { examination: { group: ghab.pre, rotation, error }, copies: [] };
+    }
+    const registries = root.held(ghab.pre);
+    if (!recipients.length || !registries.length)
+        return { examination: null, copies: [] };
+    const copies = yield* replicateRootCopies(root, postman, clock, ghab, registries, { recipients, timeoutMs });
+    return { examination: null, copies };
+}

package/esm/keri/npm/src/app/credentials/root-replicator.js

@@ -0,0 +1,198 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _RootReplicator_instances, _RootReplicator_deps, _RootReplicator_pending, _RootReplicator_inflight, _RootReplicator_seen, _RootReplicator_dirty, _RootReplicator_pruned, _RootReplicator_attempt, _RootReplicator_refreshDirty, _RootReplicator_derive;
+import { isLocalGroupHab, localGroupMember } from "../multisig/group-members.js";
+import { replicateRootCopy, RootResealBudgetMs } from "./root-replicating.js";
+/** Most copies one `processOnce` attempts, so a first pass over a large store cannot stall the runtime. */
+export const RootSendsPerPass = 4;
+/** Process-local retry delay after a copy's first failed attempt; doubles per attempt up to {@link RootRetryMaxMs}. */
+export const RootRetryBaseMs = 1_000;
+export const RootRetryMaxMs = 300_000;
+const idOf = (group, registry, recipient) => [group, registry, recipient].join("/");
+/**
+ * Derives, sends and records registry root copies for a wallet's local groups.
+ *
+ * Holds no durable state of its own beyond `Baser.rrsn`; what is pending and the
+ * backoff are process-local and rebuilt from state. A host calls `prompt` (or
+ * `replicate`) for each Dhke cue and `processOnce` on its loop; both are safe to repeat,
+ * and overlapping `processOnce` calls never send one copy twice.
+ */
+export class RootReplicator {
+    constructor(deps) {
+        _RootReplicator_instances.add(this);
+        _RootReplicator_deps.set(this, void 0);
+        _RootReplicator_pending.set(this, new Map());
+        _RootReplicator_inflight.set(this, new Set());
+        _RootReplicator_seen.set(this, new Map());
+        _RootReplicator_dirty.set(this, new Set());
+        _RootReplicator_pruned.set(this, false);
+        __classPrivateFieldSet(this, _RootReplicator_deps, deps, "f");
+    }
+    /** Re-derive `group`'s owed copies on the next pass and retry its failed copies at once. */
+    prompt(group) {
+        __classPrivateFieldGet(this, _RootReplicator_dirty, "f").add(group);
+        for (const entry of __classPrivateFieldGet(this, _RootReplicator_pending, "f").values())
+            if (entry.group === group)
+                entry.retryAt = 0;
+    }
+    /** The Dhke completion cue: a prompt to run the pass now, not the source of truth. */
+    replicate(cue) {
+        this.prompt(cue.gid);
+    }
+    /**
+     * Derive what is owed, then send up to {@link RootSendsPerPass} due copies within
+     * `timeoutMs`. A copy is recorded when sent and kept for retry otherwise. Never throws
+     * on a remote failure; every attempt is returned. The host runs `postman.deliverDo`.
+     */
+    *processOnce({ timeoutMs = RootResealBudgetMs } = {}) {
+        this.sweep();
+        return yield* this.processDue({ timeoutMs });
+    }
+    /**
+     * The fixed-tock pass: re-derive only the groups that were prompted, then send up to {@link RootSendsPerPass}
+     * due copies. A rotation nobody prompted for waits for {@link RootReplicator.sweep}.
+     */
+    *processDue({ timeoutMs = RootResealBudgetMs } = {}) {
+        const { clock } = __classPrivateFieldGet(this, _RootReplicator_deps, "f"), deadline = clock.now() + Math.max(timeoutMs, 0);
+        __classPrivateFieldGet(this, _RootReplicator_instances, "m", _RootReplicator_refreshDirty).call(this);
+        const results = [];
+        for (const entry of [...__classPrivateFieldGet(this, _RootReplicator_pending, "f").values()]) {
+            if (results.length >= RootSendsPerPass)
+                break;
+            if (entry.retryAt > clock.now())
+                continue;
+            const result = yield* __classPrivateFieldGet(this, _RootReplicator_instances, "m", _RootReplicator_attempt).call(this, entry.group, entry.registry, entry.recipient, deadline);
+            if (!result)
+                continue;
+            results.push(result);
+            if (result.kin === "sent") {
+                __classPrivateFieldGet(this, _RootReplicator_pending, "f").delete(idOf(entry.group, entry.registry, entry.recipient));
+            }
+            else {
+                entry.attempts += 1;
+                entry.lastFailure = result.error;
+                entry.retryAt = clock.now() + Math.min(RootRetryBaseMs * 2 ** (entry.attempts - 1), RootRetryMaxMs);
+            }
+        }
+        return results;
+    }
+    /**
+     * Send each registry's root to each recipient now, whatever was sent before, as an
+     * explicit command does; a sent copy is recorded like any other. `recipients` defaults
+     * to every other current signing member.
+     */
+    *send(ghab, registries, { recipients, timeoutMs }) {
+        const { root, clock } = __classPrivateFieldGet(this, _RootReplicator_deps, "f"), gid = ghab.pre, deadline = clock.now() + Math.max(timeoutMs, 0);
+        const sender = localGroupMember(root.hby, gid).pre;
+        const targets = recipients ?? root.members(gid).filter(aid => aid !== sender);
+        const results = [];
+        for (const registry of registries) {
+            for (const recipient of targets) {
+                const result = yield* __classPrivateFieldGet(this, _RootReplicator_instances, "m", _RootReplicator_attempt).call(this, gid, registry, recipient, deadline);
+                if (result)
+                    results.push(result);
+            }
+        }
+        return results;
+    }
+    /** Whether a copy is owed or a group is waiting to be re-derived; in memory, reads no store. */
+    pending() {
+        return __classPrivateFieldGet(this, _RootReplicator_pending, "f").size > 0 || __classPrivateFieldGet(this, _RootReplicator_dirty, "f").size > 0;
+    }
+    /** Pure read: what is owed and why it has not gone yet. */
+    status() {
+        return {
+            owed: [...__classPrivateFieldGet(this, _RootReplicator_pending, "f").values()].map(({ retryAt: _retryAt, ...entry }) => ({ ...entry })),
+        };
+    }
+    /**
+     * The full check: drop markers of groups that are gone (once) and re-derive each local group that is new or
+     * whose establishment event changed. One keyed read per local identifier, so a host runs it every
+     * many tocks, not every tock.
+     */
+    sweep() {
+        const { root } = __classPrivateFieldGet(this, _RootReplicator_deps, "f"), hby = root.hby;
+        if (!__classPrivateFieldGet(this, _RootReplicator_pruned, "f")) {
+            __classPrivateFieldSet(this, _RootReplicator_pruned, true, "f");
+            for (const [[group]] of [...hby.db.rrsn.getTopItemIter()]) {
+                if (!hby.db.getHab(group)?.mid)
+                    hby.db.rrsn.trim(group, { topive: true });
+            }
+        }
+        for (const hab of hby.habs.values()) {
+            const established = hab.pre && isLocalGroupHab(hby, hab) ? hab.kever?.lastEst.d : null;
+            if (!established || (__classPrivateFieldGet(this, _RootReplicator_seen, "f").get(hab.pre) === established && !__classPrivateFieldGet(this, _RootReplicator_dirty, "f").has(hab.pre)))
+                continue;
+            __classPrivateFieldGet(this, _RootReplicator_seen, "f").set(hab.pre, established);
+            __classPrivateFieldGet(this, _RootReplicator_dirty, "f").delete(hab.pre);
+            __classPrivateFieldGet(this, _RootReplicator_instances, "m", _RootReplicator_derive).call(this, hab.pre);
+        }
+    }
+}
+_RootReplicator_deps = new WeakMap(), _RootReplicator_pending = new WeakMap(), _RootReplicator_inflight = new WeakMap(), _RootReplicator_seen = new WeakMap(), _RootReplicator_dirty = new WeakMap(), _RootReplicator_pruned = new WeakMap(), _RootReplicator_instances = new WeakSet(), _RootReplicator_attempt = function
+/** Deliver one copy unless an overlapping call already is; record it when sent. */
+* _RootReplicator_attempt(group, registry, recipient, deadline) {
+    const { root, postman, clock, changes } = __classPrivateFieldGet(this, _RootReplicator_deps, "f"), id = idOf(group, registry, recipient);
+    if (__classPrivateFieldGet(this, _RootReplicator_inflight, "f").has(id))
+        return null;
+    __classPrivateFieldGet(this, _RootReplicator_inflight, "f").add(id);
+    try {
+        const key = root.contributor(group, recipient);
+        const result = yield* replicateRootCopy(root, postman, clock, group, registry, recipient, deadline);
+        if (result.kin === "sent" && key) {
+            root.hby.db.rrsn.pin([group, registry, recipient], { key, dt: new Date(clock.now()).toISOString() });
+        }
+        changes?.push({ kind: "group", id: group });
+        return result;
+    }
+    finally {
+        __classPrivateFieldGet(this, _RootReplicator_inflight, "f").delete(id);
+    }
+}, _RootReplicator_refreshDirty = function _RootReplicator_refreshDirty() {
+    const hby = __classPrivateFieldGet(this, _RootReplicator_deps, "f").root.hby;
+    for (const group of [...__classPrivateFieldGet(this, _RootReplicator_dirty, "f")]) {
+        const hab = hby.habs.get(group);
+        const established = hab && isLocalGroupHab(hby, hab) ? hab.kever?.lastEst.d : null;
+        __classPrivateFieldGet(this, _RootReplicator_dirty, "f").delete(group);
+        if (!established)
+            continue;
+        __classPrivateFieldGet(this, _RootReplicator_seen, "f").set(group, established);
+        __classPrivateFieldGet(this, _RootReplicator_instances, "m", _RootReplicator_derive).call(this, group);
+    }
+}, _RootReplicator_derive = function _RootReplicator_derive(group) {
+    const { root, changes } = __classPrivateFieldGet(this, _RootReplicator_deps, "f"), db = root.hby.db;
+    const sender = localGroupMember(root.hby, group).pre, registries = root.held(group);
+    const members = root.members(group).filter(aid => aid !== sender);
+    const wanted = new Set();
+    for (const registry of registries) {
+        for (const recipient of members) {
+            const id = idOf(group, registry, recipient);
+            wanted.add(id);
+            if (db.rrsn.get([group, registry, recipient])?.key === root.contributor(group, recipient)) {
+                __classPrivateFieldGet(this, _RootReplicator_pending, "f").delete(id);
+            }
+            else if (!__classPrivateFieldGet(this, _RootReplicator_pending, "f").has(id)) {
+                __classPrivateFieldGet(this, _RootReplicator_pending, "f").set(id, { group, registry, recipient, attempts: 0, lastFailure: null, retryAt: 0 });
+            }
+        }
+    }
+    for (const [id, entry] of [...__classPrivateFieldGet(this, _RootReplicator_pending, "f")]) {
+        if (entry.group === group && !wanted.has(id))
+            __classPrivateFieldGet(this, _RootReplicator_pending, "f").delete(id);
+    }
+    for (const [[, registry, recipient]] of [...db.rrsn.getTopItemIter(group, { topive: true })]) {
+        if (!wanted.has(idOf(group, registry, recipient)))
+            db.rrsn.rem([group, registry, recipient]);
+    }
+    if (wanted.size)
+        changes?.push({ kind: "group", id: group });
+};

package/esm/keri/npm/src/app/credentials/tel-completion.js

@@ -0,0 +1,36 @@
+import { systemClock } from "../runtime/runtime-clock.js";
+import { observeUntil } from "../runtime/workflow-contract.js";
+/** Elapsed milliseconds between reads of a TEL wait. */
+export const TEL_WAIT_POLL_MS = 50;
+/** Read the status of the TEL event `pre` at `sn`; mutates nothing. */
+export function telEventStatus(deps, pre, sn = 0) {
+    const progress = deps.publication.progress(pre, sn);
+    if (progress === null)
+        return { state: "unknown", reason: "not-tracked" };
+    return progress === "complete" ? { state: "complete" } : { state: "active", phase: progress };
+}
+/** Status of an issued credential: its TEL issuance event plus saved credential evidence. */
+export function issuedCredentialStatus(deps, said) {
+    const status = telEventStatus(deps, said, 0);
+    if (status.state === "complete" && deps.publication.reger.saved.get(said) === null) {
+        return { state: "active", phase: "awaitingCredentialSave" };
+    }
+    return status;
+}
+function* observe(read, { deadline, clock = systemClock }) {
+    const done = yield* observeUntil(() => read().state === "complete", {
+        timeoutMs: Math.max(0, deadline - clock.now()),
+        clock,
+        pollMs: TEL_WAIT_POLL_MS,
+    });
+    const status = read();
+    return done ? { outcome: "settled", status } : { outcome: "timed-out", status, deadline };
+}
+/** Observe one exact TEL coordinate until complete or the deadline passes. Starts no worker. */
+export function* waitForTelEvent(deps, pre, sn, options) {
+    return yield* observe(() => telEventStatus(deps, pre, sn), options);
+}
+/** Observe an issuance until its TEL event is complete and the credential is saved. Starts no worker. */
+export function* waitForIssuedCredential(deps, said, options) {
+    return yield* observe(() => issuedCredentialStatus(deps, said), options);
+}

package/esm/keri/npm/src/app/credentials/verifying.js

@@ -7,7 +7,8 @@
  *
  * TypeScript divergence:
  * - ordinary outcomes are explicit decisions instead of exception-only control
- *   flow; durable corruption and unsupported `DI2I` still fail explicitly
+ *   flow; durable corruption and unsupported delegated `DI2I`/`DI1I` still
+ *   fail explicitly
  */
 import { Dater, Ilks, Saider, } from "cesr-ts";
 import { Deck } from "../../core/deck.js";
@@ -268,10 +269,18 @@ export class Verifier {
         }
         const attrib = creder.attrib;
         let operator = op;
-        if (operator !== "I2I" && operator !== "DI2I" && operator !== "NI2I") {
+        if (operator === "I1I" || operator === "DI1I") {
+            // Issuer identity suppresses the issuee default and never reads issuees.
+            if (creder.issuer !== issuer) {
+                if (operator === "I1I")
+                    return null;
+                throw new ValidationError("DI1I credential chain verification is not implemented.");
+            }
+        }
+        else if (operator !== "I2I" && operator !== "DI2I" && operator !== "NI2I") {
             operator = isRecord(attrib) && typeof attrib.i === "string" ? "I2I" : "NI2I";
         }
-        if (operator !== "NI2I") {
+        if (operator === "I2I" || operator === "DI2I") {
             if (!isRecord(attrib) || typeof attrib.i !== "string") {
                 return null;
             }

package/esm/keri/npm/src/app/delivery/forwarding.js

@@ -7,13 +7,36 @@ import { exchange } from "../../core/exchange/protocol-exchanging.js";
 import { Roles } from "../../core/roles.js";
 import { mailboxTopicKey, preferredUrl } from "../mailbox/mailboxing.js";
 import { transportMailboxTopic } from "../mailbox/topic-routing.js";
+import { localGroupMember } from "../multisig/group-members.js";
 import { abortable } from "../runtime/abortable.js";
 import { runtimeTurn } from "../runtime/runtime-turn.js";
 import { CesrHttpRefusal } from "../transport/cesr-egress.js";
 import { messengerFrom, streamMessengerFrom } from "../transport/messengering.js";
-import { TCPMessenger } from "../transport/tcp-messenger.js";
+import { requireTcpDialer } from "../transport/tcp-dialer.js";
 import { TransportError } from "../transport/transport-error.js";
 import { introduce } from "./introducing.js";
+/**
+ * A v2 message refused for a peer this node must treat as v1.
+ *
+ * A v1 parser treats a v2 version string as an extraction failure and discards the rest of
+ * its stream, so sending would lose more than this one message.
+ */
+export class PeerVersionError extends ValidationError {
+}
+/**
+ * Whether an AID's own accepted KEL ends in a v1 event, which is the only evidence of a v1 reader.
+ *
+ * An AID with no accepted KEL is not refused. A delegate awaiting approval has only an escrowed
+ * inception, and refusing its approval traffic would stop the delegation from ever completing.
+ */
+function knownV1Peer(hby, aid) {
+    const kever = hby.db.getKever(aid);
+    return kever !== null && kever !== undefined && kever.serder.pvrsn.major < 2;
+}
+/** Whether any frame of this complete signed wire needs a v2 reader. */
+function wireNeedsV2(message) {
+    return parseBytes(message).some(frame => frame.body.pvrsn.major >= 2 || (frame.gvrsn?.major ?? 1) >= 2);
+}
 /**
  * Preserve resolved endpoint schemes and signed bytes for concrete transport construction.
  *
@@ -374,11 +397,20 @@ export class Poster {
                         failed.push(new ValidationError(`No supported endpoint URL for ${endpoint.eid}.`));
                         continue;
                     }
-                    const target = yield* this.prepareBytesTarget(hab, route, {
-                        eid: endpoint.eid,
-                        url: endpoint.url,
-                        urls: endpoint.urls,
-                    }, evt);
+                    let target;
+                    try {
+                        target = yield* this.prepareBytesTarget(hab, route, {
+                            eid: endpoint.eid,
+                            url: endpoint.url,
+                            urls: endpoint.urls,
+                        }, evt);
+                    }
+                    catch (error) {
+                        if (!(error instanceof PeerVersionError))
+                            throw error;
+                        failed.push(error);
+                        continue;
+                    }
                     try {
                         if (target.kind !== "stored") {
                             const refusal = yield* this.sendPreparedTarget(target, evt, signal);
@@ -416,7 +448,7 @@ export class Poster {
     *sendPreparedTarget(target, evt, signal) {
         if (target.kind === "tcp" && evt.replies) {
             // Explicit duplex work retains its receive owner; send-only factories need none.
-            yield* new TCPMessenger(target.url, this.clock, this.protocol).send(target.message, {
+            yield* requireTcpDialer(this.http).messenger(target.url, this.clock, this.protocol).send(target.message, {
                 signal,
                 replies: true,
             });
@@ -474,6 +506,15 @@ export class Poster {
             };
         });
     }
+    /**
+     * Whether `src` has any eligible role (controller, agent, mailbox or witness) from which to reach `dest`, as
+     * delivery would find it now. A pure read of accepted endpoint state: it says nothing about whether the
+     * endpoint answers. A proposer uses it to refuse before it creates anything it could not publish.
+     */
+    canReach(src, dest, topic = "multisig") {
+        const hab = this.hby.habs.get(src);
+        return !!hab && this.findBytesRoutes(hab, dest, topic).length > 0;
+    }
     /**
      * Prepare a target using the supplied wire and selected endpoint.
      *
@@ -482,11 +523,18 @@ export class Poster {
      * @param endpoint One selected endpoint AID and URL from the route.
      * @param evt Original signed source and concrete ordinary/stream operation.
      * @returns A prepared remote target, or stored after authorized local mailbox publication.
+     * @throws PeerVersionError when the wire needs a v2 reader that this peer is known not to be.
      */
     *prepareBytesTarget(hab, route, endpoint, evt) {
+        if (wireNeedsV2(evt.msg) && knownV1Peer(this.hby, evt.dest)) {
+            throw new PeerVersionError(`Refusing a v2 message for ${evt.dest}, whose latest accepted event is v1.`);
+        }
         if (route.kind !== "direct") {
             return yield* this.prepareForwardedTarget(hab, evt.dest, evt.topic, evt, endpoint);
         }
+        if (wireNeedsV2(evt.msg) && knownV1Peer(this.hby, endpoint.eid)) {
+            throw new PeerVersionError(`Refusing a v2 message for endpoint ${endpoint.eid}, whose latest accepted event is v1.`);
+        }
         return remoteCesrTarget(endpoint, evt.msg);
     }
     /**
@@ -506,6 +554,9 @@ export class Poster {
                 throw new Error("Mailbox publication did not complete");
             return { kind: "stored" };
         }
+        // A group cannot sign the wrapper alone: one member's signature does not meet a threshold above one, and the
+        // host would escrow the wrapper. The local member wraps; the payload keeps whatever signatures it carries.
+        const signer = this.hby.db.groups.has(hab.pre) ? localGroupMember(this.hby, hab.pre) : hab;
         const msgs = [];
         if (evt.kin === "stream") {
             // Prepare every frame before opening the one selected relay attempt.
@@ -516,10 +567,14 @@ export class Poster {
         else {
             msgs.push(evt.msg);
         }
+        // The provider reads the envelope, so it must read v2 whenever the envelope or child is v2.
+        if ((signer.kelVersion.major >= 2 || msgs.some(wireNeedsV2)) && knownV1Peer(this.hby, endpoint.eid)) {
+            throw new PeerVersionError(`Refusing a v2 envelope for provider ${endpoint.eid}, whose latest accepted event is v1.`);
+        }
         const forwarded = [];
         for (const message of msgs)
-            forwarded.push(yield* buildForwardedDelivery(hab, { recipient, topic, message }));
-        const intro = introduce(hab, endpoint.eid);
+            forwarded.push(yield* buildForwardedDelivery(signer, { recipient, topic, message }));
+        const intro = introduce(signer, endpoint.eid);
         let message = concatBytes(intro, ...forwarded);
         if (evt.kin === "stream") {
             const frames = parseBytes(message);

package/esm/keri/npm/src/app/exchanges/exchanging.js

@@ -13,6 +13,7 @@ import { hasNests, loadNests, prepareNests, publishNests } from "../../db/exchan
 import { encodeDateTimeToDater, makeNowIso8601, timestampMicros } from "../../time/mod.js";
 import { groupMemberHasKey } from "../multisig/group-members.js";
 import { abortable } from "../runtime/abortable.js";
+import { runtimeTurn } from "../runtime/runtime-turn.js";
 const textDecoder = new TextDecoder();
 const EXCHANGE_ESCROW_TIMEOUT_MS = 10_000;
 /** CESR syntax failures identify malformed evidence; I/O, limits, and hashing failures do not. */
@@ -142,8 +143,11 @@ export class Exchanger {
     }
     /** Resolve the configured body-version route owner without dispatching or changing evidence. */
     handlerFor(serder) {
-        const route = serder.route ?? "";
-        return this.versionedRoutes.get(route)?.get(serder.pvrsn.major) ?? this.routes.get(route);
+        return this.routeHandler(serder.route ?? "", serder.pvrsn.major);
+    }
+    /** Resolve the owner one route and protocol major would dispatch to, without a message body. */
+    routeHandler(route, major) {
+        return this.versionedRoutes.get(route)?.get(major) ?? this.routes.get(route);
     }
     /**
      * Verify, persist, and dispatch one inbound `exn`.
@@ -209,7 +213,8 @@ export class Exchanger {
         const nests = args.nests?.length
             ? yield* abortable((signal) => prepareNests(args.nests, signal))
             : undefined;
-        const result = this.hby.db.env.transactionSync(() => {
+        const written = this.hby.db.writeVersion;
+        const result = this.hby.db.transaction(() => {
             if (selectedGrant) {
                 const db = this.hby.db;
                 const stored = selectedGrant === "proof" ? db.epse.get([said]) : db.exns.get([said]) ?? db.epse.get([said]);
@@ -267,10 +272,9 @@ export class Exchanger {
             }
             return admission;
         });
-        // Durable completion joins the actual LMDB flush; no external file lifetime remains.
-        yield* abortable(async () => {
-            await this.hby.db.env.flushed;
-        });
+        // Durable completion joins the actual LMDB flush; a transaction that wrote nothing has nothing to wait for.
+        if (this.hby.db.writeVersion !== written)
+            yield* this.hby.db.flushed();
         if (!result)
             return undefined;
         for (const cue of result.cues)
@@ -405,11 +409,16 @@ export class Exchanger {
         // False means an existing qualified member, not a failed write. Exceptions abort the writer.
         for (const texter of args.essrs ?? [])
             this.hby.db.essrs.add([said], texter);
-        this.hby.db.exchangeMeta.pin([said], {
+        const meta = {
             mailboxAid,
             ...(receiverTime !== undefined ? { receiverTime } : {}),
             gvrsn: previous?.gvrsn ?? args.gvrsn ?? args.serder.gvrsn ?? args.serder.pvrsn,
-        });
+        };
+        // A retry that learns nothing new leaves the stored record as it is rather than committing it again.
+        if (!previous || previous.mailboxAid !== meta.mailboxAid || previous.receiverTime !== meta.receiverTime
+            || JSON.stringify(previous.gvrsn) !== JSON.stringify(meta.gvrsn)) {
+            this.hby.db.exchangeMeta.pin([said], meta);
+        }
         if (pending) {
             if (newEscrow) {
                 if (senderQuery)
@@ -448,7 +457,7 @@ export class Exchanger {
         const table = schema ? this.hby.db.emse : this.hby.db.epse;
         let end;
         // Capture a finite key horizon without retaining bodies or holding a cursor across mutations.
-        for (const key of table.sdb.getKeys({ reverse: true, limit: 1 })) {
+        for (const key of this.hby.db.scanKeys(table.sdb, { reverse: true, limit: 1 })) {
             end = b(`${textDecoder.decode(key)}\0`);
         }
         if (!end) {
@@ -457,7 +466,7 @@ export class Exchanger {
         let start;
         for (;;) {
             let physical;
-            for (const key of table.sdb.getKeys({ start, end, limit: 1 })) {
+            for (const key of this.hby.db.scanKeys(table.sdb, { start, end, limit: 1 })) {
                 physical = textDecoder.decode(key);
             }
             if (!physical)
@@ -491,6 +500,8 @@ export class Exchanger {
                     ...attempt.ejection,
                 });
             }
+            // Deliveries and I/O take a slot between escrowed messages; none is skipped.
+            yield* runtimeTurn();
         }
     }
     /**
@@ -1291,7 +1302,7 @@ export class Exchanger {
     /** Decide expiry and remove pending rows in the same native transaction. */
     *expirePending(serder) {
         const said = serder.said;
-        const result = this.hby.db.env.transactionSync(() => {
+        const result = this.hby.db.transaction(() => {
             const status = this.escrowStatus(said);
             if (status.kind === "accepted") {
                 this.clearPending(serder);
@@ -1301,9 +1312,7 @@ export class Exchanger {
                 return undefined;
             return this.retireCurrent(serder, this.expiryReport(status));
         });
-        yield* abortable(async () => {
-            await this.hby.db.env.flushed;
-        });
+        yield* this.hby.db.flushed();
         return result;
     }
     /** Clear only dependency markers, keeping all accepted evidence and metadata intact. */