keri-ts 2.1.0 → 2.2.0

package/esm/keri/npm/src/core/kel/eventing.js

@@ -175,10 +175,10 @@ export class Kevery {
             return false;
         const query = envelope.serder.ked?.q;
         const pre = typeof query?.i === "string" ? query.i : null;
-        if (!pre || queryRequester(envelope) !== pre)
+        if (!pre)
             return false;
         const recipient = this.db.getKever(pre, { refresh: true });
-        return !!recipient && authenticatesMailboxQuery(envelope, recipient);
+        return !!recipient && authenticatesMailboxQuery(envelope, recipient, this.db);
     }
     /**
      * Decide how one live query should be handled without mutating escrow state.
@@ -280,14 +280,11 @@ export class Kevery {
                     }]);
             }
             case "mbx": {
-                if (dest !== pre) {
-                    return dropQuery("unauthorizedMailboxRequester");
-                }
                 const recipient = this.db.getKever(pre, { refresh: true });
                 if (!recipient) {
                     return escrowQuery("missingKever");
                 }
-                if (!authenticatesMailboxQuery(envelope, recipient)) {
+                if (!authenticatesMailboxQuery(envelope, recipient, this.db)) {
                     return dropQuery("unauthorizedMailboxRequester");
                 }
                 return acceptQuery([{
@@ -2375,22 +2372,81 @@ function queryRequester(envelope) {
  * Mailbox reads authorize private recipient bytes, unlike public KEL queries.
  * Require the recipient's current signing threshold; merely naming its prefix
  * in endorsement material is not authentication. Repeated indices count once.
+ *
+ * Who may read a transferable recipient's mailbox on this host: the recipient itself, and, for a group, any
+ * signing member that signs the poll as itself (the shape KERIpy's `GroupHab.query` emits: `q.i` is the group,
+ * sender and signer are the member) when {@link provesGroupKeyControl} holds. Forwarded mail is plaintext CESR
+ * unless the sender used ESSR, so this check is the read protection. KERIpy hosts are open: they do no read
+ * authorization of `mbx` queries, so a poll KERIpy accepts can be refused here.
+ *
+ * Two refusals are by design. The host must hold the member's KEL: the keri-ts poller and `KelPublisher` submit it
+ * (see `collectKelSubmission`), but a KERIpy member's poller does not, so its KEL has to reach the host by OOBI or
+ * a mailbox add, and until then its poll is refused as unauthorized. And a rotation-only member (named in the
+ * group's `rmids` but not its `smids`) holds no current group key, so it is refused until a rotation makes it a
+ * signing member.
  */
-function authenticatesMailboxQuery(envelope, recipient) {
+function authenticatesMailboxQuery(envelope, recipient, db) {
     if (!recipient.transferable) {
         return (envelope.cigars ?? []).some((cigar) => cigar.verfer?.qb64 === recipient.pre
             && !cigar.verfer.transferable
             && cigar.verfer.verify(cigar.raw, envelope.serder.raw));
     }
-    if (envelope.source?.qb64 !== recipient.pre)
+    const requester = envelope.source?.qb64;
+    if (!requester)
+        return false;
+    if (requester === recipient.pre)
+        return satisfiesThreshold(envelope, recipient);
+    // A group's poll is signed by one of its local members (the poller cannot sign for the group alone). Accept a
+    // member whose own key state this host holds when its signatures meet its own current threshold and it provably
+    // controlled one of the group's current keys.
+    const member = db.getKever(requester, { refresh: true });
+    if (!member?.transferable || !satisfiesThreshold(envelope, member))
         return false;
+    return provesGroupKeyControl(envelope, member, recipient, db);
+}
+/**
+ * Whether `member` provably controlled a key in `group`'s current key list, by either of two proofs.
+ *
+ * Listing a group key is not control of it: anyone can incept an identifier whose key list names a victim's
+ * public key beside their own, so a key list or an event's `k` field proves nothing. Only a signature by that
+ * key does. The proofs are:
+ * - the poll itself carries a signature that verifies against a key at that index in `member`'s current key list
+ *   that is also in the group's current key list; or
+ * - some establishment event in `member`'s KEL, as this host holds it, lists a group-current key at index i and
+ *   the host holds a signature by that index-i key on that same event that verifies. That is proof of possession
+ *   at the time the member used the key, and the KEL chain ties that event to the member's current keys, so a
+ *   member that rotated its own identifier ahead of the group is still recognised.
+ */
+function provesGroupKeyControl(envelope, member, group, db) {
+    const groupKeys = new Set(group.verfers.map((verfer) => verfer.qb64));
+    const signedPoll = (envelope.sigers ?? []).some((siger) => {
+        const verfer = member.verfers[siger.index];
+        return !!verfer && groupKeys.has(verfer.qb64) && verfer.verify(siger.raw, envelope.serder.raw);
+    });
+    if (signedPoll)
+        return true;
+    for (const [, said] of db.getKelItemIter(member.pre)) {
+        const event = db.getEvtSerder(member.pre, said);
+        if (!event?.estive)
+            continue;
+        const verfers = event.verfers;
+        for (const siger of db.sigs.get(dgKey(member.pre, said))) {
+            const verfer = verfers[siger.index];
+            if (verfer && groupKeys.has(verfer.qb64) && verfer.verify(siger.raw, event.raw))
+                return true;
+        }
+    }
+    return false;
+}
+/** The indexed signatures on `envelope` that verify against `kever`'s current keys meet its signing threshold. */
+function satisfiesThreshold(envelope, kever) {
     const indices = new Set();
     for (const siger of envelope.sigers ?? []) {
-        const verfer = recipient.verfers[siger.index];
+        const verfer = kever.verfers[siger.index];
         if (verfer && verfer.verify(siger.raw, envelope.serder.raw))
             indices.add(siger.index);
     }
-    return recipient.tholder?.satisfy([...indices]) ?? false;
+    return kever.tholder?.satisfy([...indices]) ?? false;
 }
 /** Return the reply destination derived from one normalized query envelope. */
 function queryReplyDest(envelope) {

package/esm/keri/npm/src/core/mailbox/kram-policy.js

@@ -1,8 +1,34 @@
 /** KRAM cache selection and safe, receiver-clocked configuration transitions. */
 import { intToB64 } from "cesr-ts";
 import { CacheTypeRecord } from "../records.js";
+/**
+ * Windows an enabled policy uses when no caches are configured: one catchall row, in milliseconds
+ * `[d, sl, ll, xl, psl, pll, pxl]` (1 s drift, 5 s single-key, 60 s multi-key and 5 min exchange acceptance,
+ * pruned no earlier than they expire). KERIpy defines no built-in windows and requires `kram.caches` in
+ * configuration; these are the values its own tests and the keri-ts interop suites use, so an unconfigured
+ * runtime behaves like a configured KERIpy peer.
+ */
+export const DEFAULT_KRAM_CACHES = Object.freeze({
+    "~": Object.freeze([1000, 5000, 60000, 300000, 5000, 60000, 300000]),
+});
 /** Only this key owns the policy transition metadata in the existing settings table. */
 const policyKey = "kram-policy";
+/** The stored cache type for exact route, then message type, then the catchall; null when none is configured. */
+function storedCacheType(db, ilk, route) {
+    const record = (route ? db.ctyp.get(`${ilk}.R.${route}`) : null) ?? db.ctyp.get(ilk) ?? db.ctyp.get("~");
+    if (!record)
+        return null;
+    const [d, sl, ll, xl, psl, pll, pxl] = values(record);
+    return { d, sl, ll, xl, psl, pll, pxl };
+}
+/**
+ * How long a single-key query on `route` stays timely under the windows this store was configured with, in
+ * milliseconds: the single-key lag. A sender uses its own windows as the estimate of its peer's, as KERIpy's
+ * `requery` does. Null when this store has no KRAM cache types (KRAM never ran on it).
+ */
+export function singleKeyQueryWindow(db, route) {
+    return storedCacheType(db, "qry", route)?.sl ?? null;
+}
 /** Validate caller configuration before any durable policy mutation. */
 function windows(value, transitional = false) {
     if (!Array.isArray(value) || value.length !== 7 || value.some((v) => !Number.isSafeInteger(v) || v < 0)) {
@@ -148,11 +174,20 @@ export class KramPolicy {
             return [intToB64(version[0], 1) + intToB64(version[1], 2), ...(type ? [type] : []), ...(route ? [route] : [])]
                 .join(".") + (route ? "" : ".");
         });
-        const requested = configuration(config.caches);
+        const requested = configuration(config.caches ?? (this.enabled ? DEFAULT_KRAM_CACHES : undefined));
         const stored = db.hbys.get(policyKey);
         this.storedState = stored;
         if (stored !== null) {
             this.state = policyState(stored, db);
+            if (!Object.keys(this.state.caches).length && Object.keys(requested).length) {
+                // A store first opened without caches (KRAM off) has no rows to protect: install the windows directly.
+                this.state = { caches: requested, pending: {} };
+                this.commit(() => {
+                    for (const [key, tuple] of Object.entries(requested))
+                        db.ctyp.pin(key, cacheRecord(tuple));
+                });
+                return;
+            }
             const identical = sameKeys(Object.keys(requested), Object.keys(this.state.caches))
                 && Object.keys(requested).every((key) => requested[key].every((v, i) => v === this.state.caches[key][i]));
             if (config.caches !== undefined && !identical)
@@ -173,12 +208,10 @@ export class KramPolicy {
     }
     /** Select exact route, message type, then catchall; absence is a configuration failure. */
     cacheType(ilk, route) {
-        const record = (route ? this.db.ctyp.get(`${ilk}.R.${route}`) : null) ?? this.db.ctyp.get(ilk)
-            ?? this.db.ctyp.get("~");
-        if (!record)
+        const type = storedCacheType(this.db, ilk, route);
+        if (!type)
             throw new Error("No KRAM cache type for message");
-        const [d, sl, ll, xl, psl, pll, pxl] = values(record);
-        return { d, sl, ll, xl, psl, pll, pxl };
+        return type;
     }
     /** Stage expansions and reject coverage holes before changing interoperable rows. */
     change(caches, override) {

package/esm/keri/npm/src/core/mailbox/kraming.js

@@ -3,6 +3,8 @@ import { Deck } from "../deck.js";
 import { KramPolicy } from "./kram-policy.js";
 import { KramPruner } from "./kram-pruning.js";
 import { stageKram } from "./kram-staging.js";
+/** Explicit receiver-owned cache and exemption configuration. */
+export { DEFAULT_KRAM_CACHES } from "./kram-policy.js";
 /** Optional receiver intake returns ordinary decisions without owning parser input. */
 export class Kramer {
     constructor(db, { config = {}, cues = new Deck(), now = Date.now } = {}) {

package/esm/keri/npm/src/core/records.js

@@ -350,3 +350,26 @@ export class TxnMsgCacheRecord extends RawRecord {
  */
 export class WellKnownAuthN extends RawRecord {
 }
+/**
+ * A `/registry/root` copy the Poster reported sent: coordinates only, never the root.
+ *
+ * keri-ts only. Stored through `Komer` in `Baser.rrsn`, keyed (group, registry, recipient).
+ */
+export class RootSentRecord extends RawRecord {
+}
+/**
+ * The KEL a mailbox was last given for an identifier: coordinates only. A 2xx is not acceptance (the host may
+ * escrow), which is why the poller still repairs a 403.
+ *
+ * keri-ts only. Stored through `Komer` in `Baser.kpub`, keyed (identifier, mailbox).
+ */
+export class KelPublishedRecord extends RawRecord {
+}
+/**
+ * Public derivation coordinates of one blinded registry update: which credential, state and binding the
+ * update's opening is derived for. Never a salt or an opening.
+ *
+ * keri-ts only. Stored through `Komer` in `Baser.dvus`, keyed by the BUP SAID.
+ */
+export class DerivedUpdateRecord extends RawRecord {
+}

package/esm/keri/npm/src/core/routing.js

@@ -321,6 +321,17 @@ export class Revery {
             writable: true,
             value: void 0
         });
+        /**
+         * Told after an `/end/role` reply is accepted, with the controller, role, endpoint and whether the role is
+         * allowed. The runtime uses it to have the mailbox poller and KEL publisher look at a controller whose mailbox
+         * role just changed, rather than at their next sweep.
+         */
+        Object.defineProperty(this, "onEndRole", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         this.db = db;
         this.rtr = rtr ?? new Router();
         this.cues = cues ?? new Deck();
@@ -843,6 +854,8 @@ export class BasicReplyRouteHandler {
         });
         if (queryCues.length)
             this.rvy.cues.extend(queryCues);
+        if (decision.kind === "accept")
+            this.rvy.onEndRole?.(cid, role, eid, allowed);
         return decision;
     }
     /**

package/esm/keri/npm/src/db/basing.js

@@ -5,7 +5,7 @@ import { attachmentCounterPayloadQb64b, attachmentCounterQb64b, attachmentOrdina
 import { DatabaseOperationError, ValidationError } from "../core/errors.js";
 import { Kever } from "../core/kel/kever.js";
 import { consoleLogger } from "../core/logger.js";
-import { CacheTypeRecord, EndpointRecord, EventSourceRecord, HabitatRecord, KeyStateRecord, LocationRecord, MsgCacheRecord, ObservedRecord, OobiRecord, TopicsRecord, TxnMsgCacheRecord, WellKnownAuthN, } from "../core/records.js";
+import { CacheTypeRecord, EndpointRecord, EventSourceRecord, HabitatRecord, KelPublishedRecord, KeyStateRecord, LocationRecord, MsgCacheRecord, ObservedRecord, OobiRecord, RootSentRecord, TopicsRecord, TxnMsgCacheRecord, WellKnownAuthN, } from "../core/records.js";
 import { encodeDateTimeToDater, makeNowIso8601 } from "../time/mod.js";
 import { dgKey, splitOnKey } from "./core/keys.js";
 import { StoreOwner } from "./core/store-owner.js";
@@ -13,7 +13,7 @@ import { ExchangeRecord, ExchangeRegistryStateRecord } from "./exchange/exchange
 import { IoSetKomer, Komer } from "./koming.js";
 import { CapturedKelReplay } from "./replay/kel-replay.js";
 import { CapturedWitnessReplay } from "./replay/witness-replay.js";
-import { B64OnIoDupSuber, BytesIoSetSuber, CatCesrIoSetSuber, CatCesrSuber, CesrIoSetSuber, CesrOnSuber, CesrSuber, IoSetSuber, OnIoDupSuber, OnSuber, SchemerSuber, SerderSuber, Suber, } from "./subing.js";
+import { B64OnIoDupSuber, BytesIoSetSuber, BytesSuber, CatCesrIoSetSuber, CatCesrSuber, CesrIoSetSuber, CesrOnSuber, CesrSuber, IoSetSuber, OnIoDupSuber, OnSuber, SchemerSuber, SerderSuber, Suber, } from "./subing.js";
 function isMissingReloadEventError(error) {
     return error instanceof Error
         && error.message.startsWith("Missing accepted event for reloaded Kever state ");
@@ -510,6 +510,20 @@ export class Baser extends StoreOwner {
             writable: true,
             value: void 0
         });
+        /** keri-ts only. Sent `/registry/root` copies; (group, registry, recipient) -> recipient key sealed to and send time. Never a root. */
+        Object.defineProperty(this, "rrsn", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** keri-ts only. The KEL a mailbox was last given: (identifier, mailbox) -> establishment SAID, time and outcome. */
+        Object.defineProperty(this, "kpub", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "chas", {
             enumerable: true,
             configurable: true,
@@ -714,6 +728,18 @@ export class Baser extends StoreOwner {
             writable: true,
             value: void 0
         }); // Shared KRAM exchange opener time keyed by XID.
+        Object.defineProperty(this, "heldq", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        }); // Authenticated DH queries received before consent, keyed by XID.
+        Object.defineProperty(this, "heldu", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        }); // Authenticated Unblind queries a discloser owes a reply to, keyed by `(discloser, XID)`.
         Object.defineProperty(this, "tmsc", {
             enumerable: true,
             configurable: true,
@@ -1094,6 +1120,10 @@ export class Baser extends StoreOwner {
             });
             // Registry root copies awaiting automatic retention, keyed by exchange SAID.
             this.rrpe = new CesrSuber(this.store, { subkey: "rrpe.", ctor: Dater });
+            // Registry root copies sent, keyed by group, registry and recipient.
+            this.rrsn = new Komer(this.store, { subkey: "rrsn.", recordClass: RootSentRecord });
+            // KEL last given to each mailbox, keyed by identifier and mailbox.
+            this.kpub = new Komer(this.store, { subkey: "kpub.", recordClass: KelPublishedRecord });
             // Accepted signed challenge-response exchange-message SAIDs keyed by the
             // signer prefix.
             this.chas = new CesrIoSetSuber(this.store, {
@@ -1258,6 +1288,8 @@ export class Baser extends StoreOwner {
                 subkey: "tmsc.",
                 recordClass: TxnMsgCacheRecord,
             });
+            this.heldq = new BytesSuber(this.store, { subkey: "heldq." });
+            this.heldu = new BytesSuber(this.store, { subkey: "heldu." });
             this.ulgs = new CesrIoSetSuber(this.store, { subkey: "ulgs.", ctor: Prefixer });
             this.cigs = new CatCesrIoSetSuber(this.store, { subkey: "cigs.", ctor: [Verfer, Cigar] });
             // KRAM partially signed multi-key messages keyed by `(AID, MID)`.

package/esm/keri/npm/src/db/core/indexeddb-persistence.js

@@ -0,0 +1,221 @@
+/**
+ * IndexedDB `Persistence` for `WebDBer`.
+ *
+ * One database per store family and identity holds every logical table in a
+ * single `rows` object store, plus a `meta` store for the version marker and each table's
+ * dupsort flag. Tables are not object stores. Adding a table is therefore a
+ * plain write, never a schema `versionchange`, which another open connection
+ * could block indefinitely. This departs from the plan's "one object store per
+ * table", which ADR-0015 permits as the alternative to handling `versionchange`.
+ *
+ * Rows have out-of-line array keys `[table, keyBytes, valueOrEmpty]`. On a
+ * dupsort table the third part is the duplicate value, so each duplicate is its
+ * own row. On a plain table it is empty and the record holds the value. Empty
+ * dupsort values are rejected upstream, so an empty third part always means
+ * "plain". Binary parts are `ArrayBuffer`s. IndexedDB's key order is never
+ * relied on, because `WebDBer` sorts what it loads.
+ *
+ * The family is part of the database name because a composition's stores share
+ * one `name` and `base`; without it a Baser and Keeper would share a database,
+ * a version marker and a `clear`. A temp store is named apart from a durable one
+ * so clearing it cannot delete durable data of the same name.
+ *
+ * `write` is one `readwrite` transaction with strict durability and settles on
+ * the transaction's `complete` event, never on a request's `success`.
+ *
+ * Another tab's upgrade or delete fires `versionchange` here. The connection
+ * closes at once so that tab is never blocked, and this adapter is then lost:
+ * its next `load` or `write` rejects, which latches the queue, because writing
+ * on after another context deleted the database would break prefix durability.
+ * Recovery is a new open, whose `meta` reconnects. Single-writer exclusion is
+ * the composition's job, not this adapter's.
+ *
+ * A blocked `clear` rejects. Our own connection is already closed, and ours
+ * close on `versionchange`, so only a foreign connection can block. Reads settle on
+ * their transaction's `complete`, like writes: WebKit reports `blocked` for a
+ * connection whose close is still waiting on a finishing read transaction. The browser
+ * keeps the delete request pending and performs it once that connection closes,
+ * which is what `clear` asked for.
+ */
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _IndexedDbPersistence_instances, _IndexedDbPersistence_databaseName, _IndexedDbPersistence_factory, _IndexedDbPersistence_keyRange, _IndexedDbPersistence_dupsort, _IndexedDbPersistence_db, _IndexedDbPersistence_lost, _IndexedDbPersistence_connect, _IndexedDbPersistence_connection;
+import { DatabaseOperationError } from "../../core/errors.js";
+const ROWS = "rows";
+const META = "meta";
+const VERSION_KEY = "version";
+const TABLE_PREFIX = "table:";
+const EMPTY = new ArrayBuffer(0);
+/** An exact-length `ArrayBuffer` copy, since `.buffer` of a view may span more bytes. */
+const buffer = (bytes) => bytes.slice().buffer;
+/** Settle with a request's result. Only valid inside a transaction that is still open. */
+function result(request) {
+    return new Promise((resolve, reject) => {
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+    });
+}
+/** Settle on `complete` or fail with the real cause on `abort` or `error`. */
+function completion(transaction) {
+    return new Promise((resolve, reject) => {
+        let cause;
+        transaction.oncomplete = () => resolve();
+        transaction.onerror = (event) => cause ??= event.target?.error;
+        transaction.onabort = () => reject(new DatabaseOperationError("IndexedDB transaction aborted", {
+            cause: transaction.error ?? cause,
+        }));
+    });
+}
+/** `Persistence` over IndexedDB. Methods are called one at a time by `WebDBer`. */
+export class IndexedDbPersistence {
+    /**
+     * @param family Store family; with `identity` it chooses the database.
+     * @param identity Store identity; `name`, `base` and `temp` choose the database.
+     * @param factory Defaults to the global `indexedDB`.
+     * @param keyRange Defaults to the global `IDBKeyRange`; inject it with `factory` outside a browser.
+     */
+    constructor(family, identity, factory = globalThis.indexedDB, keyRange = globalThis.IDBKeyRange) {
+        _IndexedDbPersistence_instances.add(this);
+        _IndexedDbPersistence_databaseName.set(this, void 0);
+        _IndexedDbPersistence_factory.set(this, void 0);
+        _IndexedDbPersistence_keyRange.set(this, void 0);
+        /** Dupsort flag per table, learned from `meta` and from each batch that creates one. */
+        _IndexedDbPersistence_dupsort.set(this, new Map());
+        _IndexedDbPersistence_db.set(this, null);
+        _IndexedDbPersistence_lost.set(this, null);
+        const place = [identity.base ?? "", identity.name ?? "", family.tail, identity.temp ? "temp" : "durable"];
+        __classPrivateFieldSet(this, _IndexedDbPersistence_databaseName, `keri-ts:${JSON.stringify(place)}`, "f");
+        __classPrivateFieldSet(this, _IndexedDbPersistence_factory, factory, "f");
+        __classPrivateFieldSet(this, _IndexedDbPersistence_keyRange, keyRange, "f");
+    }
+    async meta() {
+        const db = await __classPrivateFieldGet(this, _IndexedDbPersistence_instances, "m", _IndexedDbPersistence_connect).call(this);
+        const transaction = db.transaction(META, "readonly");
+        const store = transaction.objectStore(META);
+        const range = __classPrivateFieldGet(this, _IndexedDbPersistence_keyRange, "f").bound(TABLE_PREFIX, `${TABLE_PREFIX}￿`);
+        // Settle on `complete`: a connection with a transaction still finishing is not yet closed.
+        const [, version, names, flags] = await Promise.all([
+            completion(transaction),
+            result(store.get(VERSION_KEY)),
+            result(store.getAllKeys(range)),
+            result(store.getAll(range)),
+        ]);
+        __classPrivateFieldGet(this, _IndexedDbPersistence_dupsort, "f").clear();
+        const tables = names.map((key, index) => {
+            const name = String(key).slice(TABLE_PREFIX.length);
+            const dupsort = flags[index] === true;
+            __classPrivateFieldGet(this, _IndexedDbPersistence_dupsort, "f").set(name, dupsort);
+            return { name, dupsort };
+        });
+        return { version: typeof version === "string" ? version : null, tables };
+    }
+    async load(table) {
+        const transaction = __classPrivateFieldGet(this, _IndexedDbPersistence_instances, "m", _IndexedDbPersistence_connection).call(this).transaction(ROWS, "readonly");
+        const store = transaction.objectStore(ROWS);
+        // Binary sorts below array, so `[table, []]` bounds every `[table, key, value]`.
+        const range = __classPrivateFieldGet(this, _IndexedDbPersistence_keyRange, "f").bound([table], [table, []]);
+        const [, keys, records] = await Promise.all([
+            completion(transaction),
+            result(store.getAllKeys(range)),
+            result(store.getAll(range)),
+        ]);
+        return keys.map((row, index) => {
+            const [, key, duplicate] = row;
+            const value = duplicate.byteLength > 0 ? duplicate : records[index];
+            return { key: new Uint8Array(key), value: new Uint8Array(value) };
+        });
+    }
+    write(batch) {
+        let transaction;
+        try {
+            transaction = __classPrivateFieldGet(this, _IndexedDbPersistence_instances, "m", _IndexedDbPersistence_connection).call(this).transaction([ROWS, META], "readwrite", { durability: "strict" });
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        const done = completion(transaction);
+        try {
+            const meta = transaction.objectStore(META);
+            const rows = transaction.objectStore(ROWS);
+            for (const { name, dupsort } of batch.tables) {
+                __classPrivateFieldGet(this, _IndexedDbPersistence_dupsort, "f").set(name, dupsort);
+                meta.put(dupsort, `${TABLE_PREFIX}${name}`);
+            }
+            if (batch.version !== undefined)
+                meta.put(batch.version, VERSION_KEY);
+            for (const { table, key, value } of batch.puts) {
+                const dupsort = __classPrivateFieldGet(this, _IndexedDbPersistence_dupsort, "f").get(table);
+                if (dupsort === undefined)
+                    throw new DatabaseOperationError(`Unknown table ${table}`);
+                rows.put(dupsort ? null : buffer(value), [table, buffer(key), dupsort ? buffer(value) : EMPTY]);
+            }
+            for (const { table, key, value } of batch.deletes) {
+                rows.delete([table, buffer(key), value ? buffer(value) : EMPTY]);
+            }
+        }
+        catch (error) {
+            transaction.abort();
+            return done.catch(() => {
+                throw error;
+            });
+        }
+        return done;
+    }
+    async clear() {
+        await this.close();
+        await new Promise((resolve, reject) => {
+            const request = __classPrivateFieldGet(this, _IndexedDbPersistence_factory, "f").deleteDatabase(__classPrivateFieldGet(this, _IndexedDbPersistence_databaseName, "f"));
+            request.onsuccess = () => resolve();
+            request.onerror = () => reject(request.error);
+            request.onblocked = () => reject(new DatabaseOperationError(`Cannot clear ${__classPrivateFieldGet(this, _IndexedDbPersistence_databaseName, "f")}: another connection holds it open; the delete stays pending until it closes`));
+        });
+        __classPrivateFieldGet(this, _IndexedDbPersistence_dupsort, "f").clear();
+    }
+    close() {
+        __classPrivateFieldGet(this, _IndexedDbPersistence_db, "f")?.close();
+        __classPrivateFieldSet(this, _IndexedDbPersistence_db, null, "f");
+        __classPrivateFieldSet(this, _IndexedDbPersistence_lost, null, "f");
+        return Promise.resolve();
+    }
+}
+_IndexedDbPersistence_databaseName = new WeakMap(), _IndexedDbPersistence_factory = new WeakMap(), _IndexedDbPersistence_keyRange = new WeakMap(), _IndexedDbPersistence_dupsort = new WeakMap(), _IndexedDbPersistence_db = new WeakMap(), _IndexedDbPersistence_lost = new WeakMap(), _IndexedDbPersistence_instances = new WeakSet(), _IndexedDbPersistence_connect = function _IndexedDbPersistence_connect() {
+    if (__classPrivateFieldGet(this, _IndexedDbPersistence_db, "f"))
+        return Promise.resolve(__classPrivateFieldGet(this, _IndexedDbPersistence_db, "f"));
+    if (!__classPrivateFieldGet(this, _IndexedDbPersistence_factory, "f"))
+        throw new DatabaseOperationError("IndexedDB is not available in this environment");
+    return new Promise((resolve, reject) => {
+        const request = __classPrivateFieldGet(this, _IndexedDbPersistence_factory, "f").open(__classPrivateFieldGet(this, _IndexedDbPersistence_databaseName, "f"), 1);
+        request.onupgradeneeded = () => {
+            const db = request.result;
+            db.createObjectStore(ROWS);
+            db.createObjectStore(META);
+        };
+        request.onerror = () => reject(request.error);
+        request.onsuccess = () => {
+            const db = request.result;
+            db.onversionchange = () => {
+                db.close();
+                if (__classPrivateFieldGet(this, _IndexedDbPersistence_db, "f") === db) {
+                    __classPrivateFieldSet(this, _IndexedDbPersistence_db, null, "f");
+                    __classPrivateFieldSet(this, _IndexedDbPersistence_lost, new DatabaseOperationError("IndexedDB connection closed by another context's versionchange"), "f");
+                }
+            };
+            __classPrivateFieldSet(this, _IndexedDbPersistence_lost, null, "f");
+            __classPrivateFieldSet(this, _IndexedDbPersistence_db, db, "f");
+            resolve(db);
+        };
+    });
+}, _IndexedDbPersistence_connection = function _IndexedDbPersistence_connection() {
+    if (__classPrivateFieldGet(this, _IndexedDbPersistence_db, "f"))
+        return __classPrivateFieldGet(this, _IndexedDbPersistence_db, "f");
+    throw __classPrivateFieldGet(this, _IndexedDbPersistence_lost, "f") ?? new DatabaseOperationError("IndexedDB persistence is not connected");
+};

package/esm/keri/npm/src/db/indexeddb.js

@@ -0,0 +1,98 @@
+/**
+ * Browser IndexedDB backend surface for `keri-ts/db/indexeddb`.
+ *
+ * Kept off `keri-ts/db` because `IndexedDbPersistence` names DOM types
+ * (`IDBFactory`, `IDBKeyRange`) that Node consumers should not have to type-check.
+ */
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _LockedWebDBer_instances, _LockedWebDBer_group, _LockedWebDBer_identity, _LockedWebDBer_ref, _LockedWebDBer_reopening, _LockedWebDBer_letGo, _LockedStoreOpener_group;
+import { call } from "effection";
+import { IndexedDbPersistence } from "./core/indexeddb-persistence.js";
+import { WebDBer, WebStoreOpener } from "./core/webdber.js";
+import { acquireStoreLock, StoreLockGroup, StoreLockHeldError, storeLockKey, StoreLockUnsupportedError, } from "./store-lock.js";
+export { acquireStoreLock, IndexedDbPersistence, StoreLockHeldError, storeLockKey, StoreLockUnsupportedError, };
+/** A `WebDBer` that holds a reference on its opener's lock for as long as it is open. */
+class LockedWebDBer extends WebDBer {
+    constructor(identity, persistence, queue, group) {
+        super(identity, persistence, queue);
+        _LockedWebDBer_instances.add(this);
+        _LockedWebDBer_group.set(this, void 0);
+        _LockedWebDBer_identity.set(this, void 0);
+        _LockedWebDBer_ref.set(this, void 0);
+        _LockedWebDBer_reopening.set(this, false);
+        __classPrivateFieldSet(this, _LockedWebDBer_group, group, "f");
+        __classPrivateFieldSet(this, _LockedWebDBer_identity, identity, "f");
+    }
+    /** Take the lock before `WebDBer.reopen` loads anything; any failure or refusal to open lets it go. */
+    *reopen(options = {}) {
+        // Assigned inside the promise so a halt while waiting cannot orphan the reference.
+        yield* call(async () => {
+            __classPrivateFieldSet(this, _LockedWebDBer_ref, __classPrivateFieldGet(this, _LockedWebDBer_ref, "f") ?? await __classPrivateFieldGet(this, _LockedWebDBer_group, "f").acquire(__classPrivateFieldGet(this, _LockedWebDBer_identity, "f")), "f");
+        });
+        __classPrivateFieldSet(this, _LockedWebDBer_reopening, true, "f");
+        let opened = false;
+        try {
+            opened = yield* super.reopen(options);
+            return opened;
+        }
+        finally {
+            __classPrivateFieldSet(this, _LockedWebDBer_reopening, false, "f");
+            if (!opened)
+                yield* __classPrivateFieldGet(this, _LockedWebDBer_instances, "m", _LockedWebDBer_letGo).call(this);
+        }
+    }
+    /** Close, then release the lock even when closing fails. `reopen`'s own inner close keeps it. */
+    *close(clear = false) {
+        try {
+            return yield* super.close(clear);
+        }
+        finally {
+            if (!__classPrivateFieldGet(this, _LockedWebDBer_reopening, "f"))
+                yield* __classPrivateFieldGet(this, _LockedWebDBer_instances, "m", _LockedWebDBer_letGo).call(this);
+        }
+    }
+}
+_LockedWebDBer_group = new WeakMap(), _LockedWebDBer_identity = new WeakMap(), _LockedWebDBer_ref = new WeakMap(), _LockedWebDBer_reopening = new WeakMap(), _LockedWebDBer_instances = new WeakSet(), _LockedWebDBer_letGo = function* _LockedWebDBer_letGo() {
+    const ref = __classPrivateFieldGet(this, _LockedWebDBer_ref, "f");
+    __classPrivateFieldSet(this, _LockedWebDBer_ref, undefined, "f");
+    if (ref)
+        yield* call(() => ref.release());
+};
+/** `WebStoreOpener` whose stores share one reference-counted lock per store identity. */
+class LockedStoreOpener extends WebStoreOpener {
+    constructor(persistenceFor, locks) {
+        super(persistenceFor);
+        _LockedStoreOpener_group.set(this, void 0);
+        __classPrivateFieldSet(this, _LockedStoreOpener_group, new StoreLockGroup(locks), "f");
+    }
+    create(family, identity) {
+        return new LockedWebDBer(identity, this.persistenceFor(family, identity), this.queue, __classPrivateFieldGet(this, _LockedStoreOpener_group, "f"));
+    }
+}
+_LockedStoreOpener_group = new WeakMap();
+/**
+ * A `WebStoreOpener` whose stores persist to IndexedDB, one database per store
+ * family and identity. Inject `factory` and `keyRange` together outside a browser.
+ *
+ * Single-writer by default: the first store to open an identity (`base`, `name`, `temp`) takes a
+ * Web Locks lock, shared by every family the opener creates for it and released when the last of
+ * them closes. A second opener, tab or window on that identity is refused with
+ * `StoreLockHeldError`, and an engine without `navigator.locks` with `StoreLockUnsupportedError`;
+ * nothing runs unlocked unless `unsafeSkipStoreLock` says so.
+ */
+export function indexedDbOpener(options = {}) {
+    const persistenceFor = (family, identity) => new IndexedDbPersistence(family, identity, options.factory, options.keyRange);
+    return options.unsafeSkipStoreLock
+        ? new WebStoreOpener(persistenceFor)
+        : new LockedStoreOpener(persistenceFor, options.locks === undefined ? {} : { locks: options.locks });
+}